@indigoai-us/hq-cli 5.156.0 → 5.158.0

package/dist/lib/lanes/host-capacity.d.ts

@@ -0,0 +1,46 @@
+import type { LaneHost, LaneProvider, LaneRecord, LanesConfig } from "./types.js";
+export interface HostCapacityAccount {
+    enabled: boolean;
+    logged_in: boolean | null;
+    max_running: number;
+    running: number;
+    queued: number;
+}
+export interface HostCapacityProvider {
+    max_running: number;
+    max_queued: number;
+    running: number;
+    queued: number;
+    accounts: Record<string, HostCapacityAccount>;
+}
+export interface HostCapacitySnapshot {
+    schema_version: "hq-lanes-host-capacity.v1";
+    host: LaneHost;
+    sampled_at: string;
+    providers: Record<LaneProvider, HostCapacityProvider>;
+}
+export interface HostPlacementChoice {
+    host: LaneHost;
+    account: string;
+    queued: boolean;
+}
+/** Snapshot the same per-host running-slot predicate used by lane admission. */
+export declare function buildHostCapacitySnapshot(input: {
+    host: LaneHost;
+    lanes: readonly LaneRecord[];
+    config: LanesConfig;
+    existsSync: (path: string) => boolean;
+    now: Date;
+}): HostCapacitySnapshot;
+/** Reject malformed remote snapshots before they can influence host selection. */
+export declare function parseHostCapacitySnapshot(raw: unknown): HostCapacitySnapshot;
+/**
+ * Choose the least-loaded eligible host/account from advisory snapshots. The
+ * selected host still runs the shared admission check under its own lock.
+ */
+export declare function chooseHostForLane(snapshots: readonly HostCapacitySnapshot[], request: {
+    provider: LaneProvider;
+    account?: string;
+    allowedAccounts?: readonly string[];
+}): HostPlacementChoice;
+//# sourceMappingURL=host-capacity.d.ts.map

package/dist/lib/lanes/host-capacity.js

@@ -0,0 +1,173 @@
+import { accountStatus } from "./accounts.js";
+import { accountMaxRunning } from "./config.js";
+import { laneOccupiesRunningSlot, laneRunsOnHost, } from "./admission.js";
+import { LanesError } from "./errors.js";
+function admissionHost(host) {
+    return host.kind === "outpost"
+        ? { hostname: "", outpostId: host.id }
+        : { hostname: host.id, outpostId: null };
+}
+/** Snapshot the same per-host running-slot predicate used by lane admission. */
+export function buildHostCapacitySnapshot(input) {
+    const at = input.now.getTime();
+    const onHost = input.lanes.filter((lane) => laneRunsOnHost(lane, admissionHost(input.host)));
+    const providers = {};
+    for (const provider of ["claude", "codex", "grok"]) {
+        const providerConfig = input.config.providers[provider];
+        const providerLanes = onHost.filter((lane) => lane.provider === provider);
+        const running = providerLanes.filter((lane) => laneOccupiesRunningSlot(lane, at));
+        const queued = providerLanes.filter((lane) => lane.state === "queued");
+        const accounts = {};
+        for (const [id, account] of Object.entries(providerConfig.accounts)) {
+            const status = accountStatus(provider, id, input.config, {
+                existsSync: input.existsSync,
+            });
+            accounts[id] = {
+                enabled: account.enabled,
+                logged_in: status.logged_in,
+                max_running: accountMaxRunning(providerConfig, id),
+                running: running.filter((lane) => lane.account === id).length,
+                queued: queued.filter((lane) => lane.account === id).length,
+            };
+        }
+        providers[provider] = {
+            max_running: providerConfig.max_running,
+            max_queued: providerConfig.max_queued,
+            running: running.length,
+            queued: queued.length,
+            accounts,
+        };
+    }
+    return {
+        schema_version: "hq-lanes-host-capacity.v1",
+        host: input.host,
+        sampled_at: input.now.toISOString(),
+        providers,
+    };
+}
+function objectValue(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function requireCount(value, field, positive = false) {
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < (positive ? 1 : 0)) {
+        throw new LanesError("host_capacity_invalid", `Invalid host capacity field ${field}`, {
+            field,
+            value: value ?? null,
+        });
+    }
+    return value;
+}
+/** Reject malformed remote snapshots before they can influence host selection. */
+export function parseHostCapacitySnapshot(raw) {
+    const root = objectValue(raw);
+    const hostRaw = objectValue(root?.host);
+    const providersRaw = objectValue(root?.providers);
+    if (root?.schema_version !== "hq-lanes-host-capacity.v1" ||
+        typeof root.sampled_at !== "string" ||
+        !Number.isFinite(Date.parse(root.sampled_at)) ||
+        (hostRaw?.kind !== "local" && hostRaw?.kind !== "outpost") ||
+        typeof hostRaw.id !== "string" ||
+        hostRaw.id.trim() === "" ||
+        providersRaw === undefined) {
+        throw new LanesError("host_capacity_invalid", "Malformed host capacity snapshot", {});
+    }
+    const providers = {};
+    for (const provider of ["claude", "codex", "grok"]) {
+        const row = objectValue(providersRaw[provider]);
+        const accountsRaw = objectValue(row?.accounts);
+        if (row === undefined || accountsRaw === undefined) {
+            throw new LanesError("host_capacity_invalid", `Missing capacity for ${provider}`, {
+                provider,
+            });
+        }
+        const accounts = {};
+        for (const [id, accountValue] of Object.entries(accountsRaw)) {
+            const account = objectValue(accountValue);
+            if (id.trim() === "" || account === undefined ||
+                typeof account.enabled !== "boolean" ||
+                !(account.logged_in === null || typeof account.logged_in === "boolean")) {
+                throw new LanesError("host_capacity_invalid", `Malformed ${provider} account capacity`, {
+                    provider,
+                    account: id,
+                });
+            }
+            accounts[id] = {
+                enabled: account.enabled,
+                logged_in: account.logged_in,
+                max_running: requireCount(account.max_running, `${provider}.${id}.max_running`, true),
+                running: requireCount(account.running, `${provider}.${id}.running`),
+                queued: requireCount(account.queued, `${provider}.${id}.queued`),
+            };
+        }
+        providers[provider] = {
+            max_running: requireCount(row.max_running, `${provider}.max_running`, true),
+            max_queued: requireCount(row.max_queued, `${provider}.max_queued`, true),
+            running: requireCount(row.running, `${provider}.running`),
+            queued: requireCount(row.queued, `${provider}.queued`),
+            accounts,
+        };
+    }
+    return {
+        schema_version: "hq-lanes-host-capacity.v1",
+        host: { kind: hostRaw.kind, id: hostRaw.id },
+        sampled_at: root.sampled_at,
+        providers,
+    };
+}
+/**
+ * Choose the least-loaded eligible host/account from advisory snapshots. The
+ * selected host still runs the shared admission check under its own lock.
+ */
+export function chooseHostForLane(snapshots, request) {
+    const candidates = [];
+    const allowed = request.account === undefined
+        ? request.allowedAccounts
+        : request.allowedAccounts === undefined
+            ? [request.account]
+            : request.allowedAccounts.filter((account) => account === request.account);
+    for (const snapshot of snapshots) {
+        const provider = snapshot.providers[request.provider];
+        if (!provider)
+            continue;
+        const accounts = Object.entries(provider.accounts)
+            .filter(([id, account]) => (allowed === undefined || allowed.includes(id)) &&
+            account.enabled &&
+            account.logged_in === true);
+        for (const [accountId, account] of accounts) {
+            const hasRunningSlot = provider.running < provider.max_running &&
+                account.running < account.max_running;
+            const hasQueueSlot = provider.queued < provider.max_queued;
+            if (!hasRunningSlot && !hasQueueSlot)
+                continue;
+            candidates.push({
+                host: snapshot.host,
+                account: accountId,
+                queued: !hasRunningSlot,
+                score: provider.running / provider.max_running +
+                    provider.queued / provider.max_queued +
+                    account.running / account.max_running,
+            });
+        }
+    }
+    candidates.sort((a, b) => Number(a.queued) - Number(b.queued) ||
+        a.score - b.score ||
+        `${a.host.kind}:${a.host.id}`.localeCompare(`${b.host.kind}:${b.host.id}`) ||
+        a.account.localeCompare(b.account));
+    const selected = candidates[0];
+    if (!selected) {
+        throw new LanesError("lane_placement_no_capacity", `No host has logged-in account capacity for ${request.provider}${request.account ? ` account ${request.account}` : ""}`, {
+            provider: request.provider,
+            ...(request.account !== undefined ? { account: request.account } : {}),
+            hosts: snapshots.map((snapshot) => ({
+                kind: snapshot.host.kind,
+                id: snapshot.host.id,
+            })),
+        });
+    }
+    return { host: selected.host, account: selected.account, queued: selected.queued };
+}
+//# sourceMappingURL=host-capacity.js.map

package/dist/lib/lanes/index.d.ts

@@ -3,10 +3,12 @@
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
 export { MAX_LANE_DEPTH } from "./constants.js";
-export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
+export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneOccupiesRunningSlot, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
 export type { AdmissionCapReason, AdmissionHost } from "./admission.js";
+export { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "./host-capacity.js";
+export type { HostCapacityAccount, HostCapacityProvider, HostCapacitySnapshot, HostPlacementChoice, } from "./host-capacity.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STORY_STATUSES, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
-export type { AccountConfig, AttributionHistoryEntry, EnvelopeDecision, EnvelopeQuestion, HostKind, LaneCompanyRef, LaneEnvelope, LaneHost, LaneProvider, LaneRecord, LaneStory, LaneStoryStatus, PendingResume, AccountHistoryEntry, LaneState, LanesConfig, LastEnvelopeRef, LivenessState, LivenessWindows, ProviderConfig, QuestionAnswer, QuestionBodyRef, QuestionRecord, QuestionStatus, QueuedReason, RaisedVia, RoutingHistoryEntry, RoutingReason, SeniorHistoryEntry, SeniorKind, SeniorRef, StoryStatus, TerminalLaneState, ThrottleConfig, } from "./types.js";
+export type { AccountConfig, AttributionHistoryEntry, EnvelopeDecision, EnvelopeQuestion, HostKind, LaneCompanyRef, LaneEnvelope, LaneHost, LaneProvider, LanePlacementPolicy, LaneRecord, LaneStory, LaneStoryStatus, PendingResume, AccountHistoryEntry, LaneState, LanesConfig, LastEnvelopeRef, LivenessState, LivenessWindows, ProviderConfig, QuestionAnswer, QuestionBodyRef, QuestionRecord, QuestionStatus, QueuedReason, RaisedVia, RoutingHistoryEntry, RoutingReason, SeniorHistoryEntry, SeniorKind, SeniorRef, StoryStatus, TerminalLaneState, ThrottleConfig, } from "./types.js";
 export { ACTIVE_LANE_STORY_STATUSES, activeLaneStories, laneStories, laneStory, storyKey, storyStatusForEnvelope, storyWarning, withCurrentStory, withLaneStories, } from "./stories.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_AUTO_COMPACT_TOKENS, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerAutoCompactTokens, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";
 export type { ConfigLoadDeps, ConfigWriteDeps } from "./config.js";

package/dist/lib/lanes/index.js

@@ -3,7 +3,8 @@
  */
 export { AccountResolutionError, LaneNotFoundError, LaneSchemaError, LaneVersionConflict, LanesConfigError, LanesError, WorkerResolutionError, isLaneVersionConflict, isLanesError, } from "./errors.js";
 export { MAX_LANE_DEPTH } from "./constants.js";
-export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
+export { compareLaneQueueOrder, hasActiveAdmissionReservation, hasActivePendingResume, hasEarlierEligibleQueuedLane, laneOccupiesRunningSlot, laneAdmissionCapReason, laneRunsOnHost, withAllLaneAdmissionLocks, withLaneAdmissionLock, } from "./admission.js";
+export { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "./host-capacity.js";
 export { CONFIG_SCHEMA_VERSION, ENVELOPE_DECISIONS, ENVELOPE_SCHEMA_VERSION, HISTORY_CAP, HOST_KINDS, LANE_PROVIDERS, LANE_SCHEMA_VERSION, LANE_STORY_STATUSES, LANE_STATES, LIVENESS_STATES, QUESTION_BODY_STORES, QUESTION_SCHEMA_VERSION, QUESTION_STATUSES, QUEUED_REASONS, RAISED_VIA, ROUTING_REASONS, SENIOR_KINDS, STORY_STATUSES, TERMINAL_LANE_STATES, isEnvelopeDecision, isHostKind, isLaneProvider, isLaneState, isLivenessState, isQuestionStatus, isSeniorKind, isTerminalLaneState, parseLaneEnvelope, parseLaneProvider, parseLaneState, parseLivenessState, parseMajorSchema, parseQuestionStatus, parseSeniorKind, } from "./types.js";
 export { ACTIVE_LANE_STORY_STATUSES, activeLaneStories, laneStories, laneStory, storyKey, storyStatusForEnvelope, storyWarning, withCurrentStory, withLaneStories, } from "./stories.js";
 export { DEFAULT_ACCOUNT_HOMES, DEFAULT_AUTO_COMPACT_TOKENS, DEFAULT_COMPACT_AFTER_MS, DEFAULT_CPU_BUSY_PAUSE, DEFAULT_CPU_BUSY_RESUME, DEFAULT_LIVE_WITHIN_MS, DEFAULT_LIVENESS_WINDOWS, DEFAULT_MAX_QUEUED, DEFAULT_MIN_AVAILABLE_MEM_MB, DEFAULT_PROVIDER_MAX_RUNNING, DEFAULT_SILENT_LOST_MS, DEFAULT_TURN_START_LOST_MS, LANES_CONFIG_REL, accountMaxRunning, canonicalizeHome, documentedDefaultConfig, expandHome, lanesConfigPath, loadLanesConfig, parseLanesConfig, providerCompactAfterMs, providerAutoCompactTokens, providerQuotaDefaultHoldMs, DEFAULT_QUOTA_HOLD_MS, writeLanesConfig, } from "./config.js";

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -7,7 +7,7 @@
  * `outpost_dispatch_failed`, never a queued lane nobody will pick up.
  */
 import { OutpostsClient } from "@indigoai-us/hq-cloud/outposts";
-import type { LaneRecord } from "./types.js";
+import type { LaneHost, LaneRecord } from "./types.js";
 export declare const PICKUP_EXEC_TIMEOUT_SECONDS = 120;
 export declare const PICKUP_WAIT_MS: number;
 export interface OutpostPickupPayload {
@@ -57,6 +57,16 @@ export interface OutpostExecPort {
 export declare function parseOutpostPickupPayload(raw: unknown): OutpostPickupPayload;
 /** Same wrapping `hq outposts exec` applies: run from the box's HQ folder. */
 export declare function buildOutpostPickupCommand(payloadUrl: string): string;
+/** Bounded, read-only capacity query executed by the target Outpost CLI. */
+export declare function buildOutpostCapacityCommand(): string;
+/** Commit a queued lane move on the host that currently owns its state. */
+export declare function buildOutpostMoveTargetCommand(input: {
+    laneId: string;
+    host: LaneHost;
+    account: string;
+}): string;
+/** Idempotently backfill the marker on the selected Outpost. */
+export declare function buildOutpostIdentityBackfillCommand(expectedId: string): string;
 /** Build the same `hq outposts exec` remote command used by lane pickup. */
 export declare function buildOutpostLaneCommand(input: OutpostLaneCommand): string;
 export declare function stageOutpostPayload(port: Pick<OutpostExecPort, "stageExecInput">, outpostId: string, bytes: Uint8Array, put?: typeof fetch): Promise<{

package/dist/lib/lanes/outpost-dispatch.js

@@ -42,6 +42,35 @@ export function parseOutpostPickupPayload(raw) {
 export function buildOutpostPickupCommand(payloadUrl) {
     return withRemoteHqDir(joinCommandParts(["hq", "lanes", "pickup", "--payload-url", payloadUrl]));
 }
+/** Bounded, read-only capacity query executed by the target Outpost CLI. */
+export function buildOutpostCapacityCommand() {
+    return withRemoteHqDir(joinCommandParts(["hq", "lanes", "capacity", "--json"]));
+}
+/** Commit a queued lane move on the host that currently owns its state. */
+export function buildOutpostMoveTargetCommand(input) {
+    return withRemoteHqDir(joinCommandParts([
+        "hq",
+        "lanes",
+        "move-target",
+        input.laneId,
+        "--host-kind",
+        input.host.kind,
+        "--host-id",
+        input.host.id,
+        "--account",
+        input.account,
+    ]));
+}
+/** Idempotently backfill the marker on the selected Outpost. */
+export function buildOutpostIdentityBackfillCommand(expectedId) {
+    return withRemoteHqDir(joinCommandParts([
+        "hq",
+        "lanes",
+        "outpost-identity-backfill-target",
+        "--expected-id",
+        expectedId,
+    ]));
+}
 /** Build the same `hq outposts exec` remote command used by lane pickup. */
 export function buildOutpostLaneCommand(input) {
     const args = ["hq", "lanes", input.action, input.laneId];
@@ -88,10 +117,17 @@ export async function dispatchOutpostPickup(port, input) {
         };
     }
     catch (err) {
+        const outcomeDetails = {
+            outpost_id: input.outpostId,
+            command_id: submitted.commandId,
+            done: false,
+            outcome_unknown: true,
+        };
         if (ac.signal.aborted) {
-            throw new LanesError("outpost_dispatch_failed", `Timed out waiting for Outpost pickup (${waitMs}ms)`, { outpost_id: input.outpostId, command_id: submitted.commandId });
+            throw new LanesError("outpost_dispatch_failed", `Timed out waiting for Outpost pickup (${waitMs}ms)`, outcomeDetails);
         }
-        throw err;
+        const message = dispatchErrorMessage(err);
+        throw new LanesError("outpost_dispatch_failed", `Failed waiting for Outpost pickup: ${message}`, { ...outcomeDetails, message });
     }
     finally {
         clearTimeout(timer);

package/dist/lib/lanes/outpost-identity.d.ts

@@ -0,0 +1,33 @@
+export declare const OUTPOST_ID_MARKER_PATH = "/etc/outpost/outpost-id";
+export declare const OUTPOST_ID_MARKER_DIR = "/etc/outpost";
+export type OutpostIdentityValue = {
+    kind: "id";
+    id: string;
+} | {
+    kind: "unknown";
+} | {
+    kind: "not_outpost";
+};
+export interface OutpostIdentityMarkerStore {
+    read(): OutpostIdentityValue;
+    /** Return false if another writer already created the marker. */
+    createIfMissing(id: string): boolean;
+}
+export interface OutpostIdentityMarkerWriterOptions {
+    markerDir?: string;
+    markerPath?: string;
+    run?: (input: {
+        id: string;
+        markerDir: string;
+        markerPath: string;
+        script: string;
+    }) => {
+        status: number | null;
+        error?: Error;
+        stderr?: string;
+    };
+}
+export declare function validateOutpostIdentityId(id: string): void;
+export declare function backfillOutpostIdentityMarker(expectedId: string, store: OutpostIdentityMarkerStore): "created" | "unchanged";
+export declare function createOutpostIdentityMarkerIfMissing(id: string, options?: OutpostIdentityMarkerWriterOptions): boolean;
+//# sourceMappingURL=outpost-identity.d.ts.map

package/dist/lib/lanes/outpost-identity.js

@@ -0,0 +1,59 @@
+import { spawnSync } from "node:child_process";
+import { LanesError } from "./errors.js";
+export const OUTPOST_ID_MARKER_PATH = "/etc/outpost/outpost-id";
+export const OUTPOST_ID_MARKER_DIR = "/etc/outpost";
+const SAFE_OUTPOST_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+export function validateOutpostIdentityId(id) {
+    if (id !== id.trim() || !SAFE_OUTPOST_ID.test(id)) {
+        throw new LanesError("outpost_identity_id_invalid", "Outpost identity must be a single-line id containing only letters, numbers, hyphens, or underscores", { value: id });
+    }
+}
+export function backfillOutpostIdentityMarker(expectedId, store) {
+    validateOutpostIdentityId(expectedId);
+    const current = store.read();
+    if (current.kind === "id") {
+        if (current.id !== expectedId) {
+            throw outpostIdentityMismatch(expectedId, current.id);
+        }
+        return "unchanged";
+    }
+    if (current.kind === "not_outpost") {
+        throw new LanesError("outpost_identity_not_host", `This host has no ${OUTPOST_ID_MARKER_DIR} directory; identity backfill only runs on an Outpost`, { expected_id: expectedId, marker_path: OUTPOST_ID_MARKER_PATH });
+    }
+    let created;
+    try {
+        created = store.createIfMissing(expectedId);
+    }
+    catch (err) {
+        const after = store.read();
+        if (after.kind === "id" && after.id === expectedId)
+            return "unchanged";
+        if (after.kind === "id")
+            throw outpostIdentityMismatch(expectedId, after.id);
+        throw new LanesError("outpost_identity_backfill_failed", `Could not write ${OUTPOST_ID_MARKER_PATH}: ${err instanceof Error ? err.message : String(err)}`, { expected_id: expectedId, marker_path: OUTPOST_ID_MARKER_PATH });
+    }
+    const after = store.read();
+    if (after.kind === "id") {
+        if (after.id !== expectedId)
+            throw outpostIdentityMismatch(expectedId, after.id);
+        return created ? "created" : "unchanged";
+    }
+    throw new LanesError("outpost_identity_backfill_failed", `Backfill did not create ${OUTPOST_ID_MARKER_PATH} with expected value ${expectedId}`, { expected_id: expectedId, marker_path: OUTPOST_ID_MARKER_PATH });
+}
+export function createOutpostIdentityMarkerIfMissing(id, options = {}) {
+    validateOutpostIdentityId(id);
+    const markerDir = options.markerDir ?? OUTPOST_ID_MARKER_DIR;
+    const markerPath = options.markerPath ?? OUTPOST_ID_MARKER_PATH;
+    const script = `umask 022; install -d -m 0755 "$2" && set -C && printf '%s\\n' "$1" > "$3"`;
+    const result = options.run?.({ id, markerDir, markerPath, script }) ?? spawnSync("sudo", ["-n", "sh", "-c", script, "hq-outpost-identity", id, markerDir, markerPath], { encoding: "utf8" });
+    if (result.error) {
+        throw new LanesError("outpost_identity_backfill_failed", `Could not run sudo to write ${OUTPOST_ID_MARKER_PATH}: ${result.error.message}`, { expected_id: id, marker_path: OUTPOST_ID_MARKER_PATH });
+    }
+    if (result.status === 0)
+        return true;
+    return false;
+}
+function outpostIdentityMismatch(expectedId, actualId) {
+    return new LanesError("outpost_identity_mismatch", `Refusing to replace ${OUTPOST_ID_MARKER_PATH}: it contains ${actualId}, expected ${expectedId}`, { expected_id: expectedId, actual_id: actualId, marker_path: OUTPOST_ID_MARKER_PATH });
+}
+//# sourceMappingURL=outpost-identity.js.map

package/dist/lib/lanes/spawn.js

@@ -1496,6 +1496,17 @@ export function spawnLaneWorker(hqRoot, lane, deps = {}, launch = {}) {
     const profile = existing.worker_profile
         ? loadWorkerProfile(hqRoot, existing.worker_profile)
         : undefined;
+    if (existing.host.kind === "outpost" &&
+        profile !== undefined &&
+        existing.worker_profile_hash !== profile.contentHash) {
+        throw new LanesError("worker_profile_hash_mismatch", `Worker profile ${JSON.stringify(existing.worker_profile)} on Outpost ${existing.host.id} changed after pickup validation`, {
+            lane_id: existing.lane_id,
+            worker: existing.worker_profile,
+            outpost: existing.host.id,
+            expected_hash: existing.worker_profile_hash ?? null,
+            actual_hash: profile.contentHash,
+        });
+    }
     const profileDefaultsApply = profile !== undefined && profile.meta.provider === existing.provider;
     const profileModel = profileDefaultsApply ? profile.meta.model : undefined;
     const profileEffort = profileDefaultsApply ? profile.meta.effort : undefined;

package/dist/lib/lanes/store.js

@@ -460,6 +460,18 @@ export function parseLaneRecord(raw, filePath) {
             path: filePath,
         });
     }
+    if (raw.placement_default !== undefined) {
+        const placement = raw.placement_default;
+        if (!isPlainObject(placement) ||
+            (placement.kind !== "local" && placement.kind !== "auto" && placement.kind !== "outpost") ||
+            (placement.kind === "outpost" && (typeof placement.id !== "string" || placement.id.trim() === "")) ||
+            (placement.kind !== "outpost" && "id" in placement)) {
+            throw new LaneSchemaError("placement_default must be local, auto, or a pinned Outpost", {
+                path: filePath,
+                field: "placement_default",
+            });
+        }
+    }
     if (!Array.isArray(raw.attribution_history)) {
         throw new LaneSchemaError("attribution_history must be an array", {
             path: filePath,

package/dist/lib/lanes/types.d.ts

@@ -314,6 +314,7 @@ export interface LaneRecord {
      * recorded session with this turn instead of starting fresh from the brief.
      */
     pending_resume?: PendingResume;
+    placement_default?: LanePlacementPolicy;
     host: LaneHost;
     /**
      * Creating machine's identity when `host.kind` is `outpost` (spec §5.2).
@@ -448,6 +449,15 @@ export interface PendingResume {
     compact?: boolean;
     at: string;
 }
+/** Where child lanes created by this manager should be placed by default. */
+export type LanePlacementPolicy = {
+    kind: "local";
+} | {
+    kind: "auto";
+} | {
+    kind: "outpost";
+    id: string;
+};
 export interface LaneResumeRecord {
     session_id: string;
     at: string;

package/dist/lib/lanes/types.js

@@ -220,7 +220,7 @@ export const LANE_FIELD_WRITERS = {
     pickup_validation_pending: ["creator", "command", "spawn", "reconcile"],
     pickup_validation_pending_since: ["creator", "command", "spawn", "reconcile"],
     priority: ["command"], worker: ["creator"], worker_path: ["creator"], worker_pack: ["creator"], worker_profile: ["creator"], worker_profile_hash: ["creator", "spawn"], worker_profile_ignored: ["creator", "spawn"],
-    provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], pending_resume: ["command", "spawn", "watcher", "reconcile"], host: ["creator"], origin_host: ["creator"], origin_host_source: ["creator"],
+    provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], pending_resume: ["command", "spawn", "watcher", "reconcile"], placement_default: ["creator"], host: ["creator", "command"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],
     last_envelope: ["watcher", "reconcile"], model: ["creator", "spawn", "command"], model_source: ["creator", "spawn", "command"], effort: ["creator", "spawn"], effort_source: ["creator", "spawn"], fast_mode: ["spawn"],
     last_message_at: ["command"], last_compaction: ["spawn"], story_complete: ["watcher", "reconcile"], story_complete_reason: ["watcher", "reconcile"], story_status: ["watcher", "reconcile"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.156.0",
+  "version": "5.158.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {