@indigoai-us/hq-cli 5.239.0 → 5.241.0

package/dist/lib/lanes/store.js

@@ -543,6 +543,91 @@ export function parseLaneRecord(raw, filePath) {
         raw.worker_policy_delivery !== "prompt") {
         throw new LaneSchemaError(`Unknown worker policy delivery mode ${JSON.stringify(raw.worker_policy_delivery)}`, { path: filePath, field: "worker_policy_delivery", value: raw.worker_policy_delivery });
     }
+    if (raw.registry_worker !== undefined) {
+        const worker = raw.registry_worker;
+        if (!isPlainObject(worker) || Object.keys(worker).some((key) => !["id", "path", "worker_yaml_sha256", "approval_required", "human_checkpoints"].includes(key))) {
+            throw new LaneSchemaError("registry_worker must be a pinned registry worker record", {
+                path: filePath,
+                field: "registry_worker",
+            });
+        }
+        for (const key of ["id", "path"]) {
+            if (typeof worker[key] !== "string" || worker[key].trim().length === 0) {
+                throw new LaneSchemaError(`registry_worker.${key} must be a non-empty string`, {
+                    path: filePath,
+                    field: `registry_worker.${key}`,
+                });
+            }
+        }
+        const registryPath = worker.path.replaceAll("\\", "/");
+        if (path.posix.isAbsolute(registryPath) || registryPath.split("/").some((part) => part === ".." || part === ".")) {
+            throw new LaneSchemaError("registry_worker.path must stay within HQ_ROOT", {
+                path: filePath,
+                field: "registry_worker.path",
+            });
+        }
+        if (typeof worker.worker_yaml_sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(worker.worker_yaml_sha256)) {
+            throw new LaneSchemaError("registry_worker.worker_yaml_sha256 must be a SHA-256 hash", {
+                path: filePath,
+                field: "registry_worker.worker_yaml_sha256",
+            });
+        }
+        if (typeof worker.approval_required !== "boolean") {
+            throw new LaneSchemaError("registry_worker.approval_required must be a boolean", {
+                path: filePath,
+                field: "registry_worker.approval_required",
+            });
+        }
+        if (!Array.isArray(worker.human_checkpoints) || worker.human_checkpoints.some((checkpoint) => typeof checkpoint !== "string" || checkpoint.trim().length === 0) ||
+            new Set(worker.human_checkpoints).size !== worker.human_checkpoints.length) {
+            throw new LaneSchemaError("registry_worker.human_checkpoints must be unique non-empty strings", {
+                path: filePath,
+                field: "registry_worker.human_checkpoints",
+            });
+        }
+    }
+    if (raw.registry_worker_approval_history !== undefined) {
+        if (!Array.isArray(raw.registry_worker_approval_history)) {
+            throw new LaneSchemaError("registry_worker_approval_history must be an array when present", {
+                path: filePath,
+                field: "registry_worker_approval_history",
+            });
+        }
+        for (const [index, entry] of raw.registry_worker_approval_history.entries()) {
+            const field = `registry_worker_approval_history[${index}]`;
+            if (!isPlainObject(entry)) {
+                throw new LaneSchemaError(`${field} must be an approval audit event`, { path: filePath, field });
+            }
+            const expected = entry.event === "approved"
+                ? ["event", "approval_id", "checkpoint", "registry_worker_id", "worker_yaml_sha256", "reason", "actor", "at"]
+                : entry.event === "consumed"
+                    ? ["event", "approval_id", "envelope_ref", "at"]
+                    : [];
+            if (expected.length === 0 || Object.keys(entry).some((key) => !expected.includes(key))) {
+                throw new LaneSchemaError(`${field} has an unknown event or field`, { path: filePath, field });
+            }
+            for (const key of ["approval_id", ...(entry.event === "approved" ? ["checkpoint", "reason", "actor"] : ["envelope_ref"])]) {
+                if (typeof entry[key] !== "string" || entry[key].trim().length === 0) {
+                    throw new LaneSchemaError(`${field}.${key} must be a non-empty string`, { path: filePath, field });
+                }
+            }
+            if (entry.event === "approved" && entry.worker_yaml_sha256 !== undefined &&
+                (typeof entry.worker_yaml_sha256 !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry.worker_yaml_sha256))) {
+                throw new LaneSchemaError(`${field}.worker_yaml_sha256 must be a SHA-256 hash`, {
+                    path: filePath,
+                    field: `${field}.worker_yaml_sha256`,
+                });
+            }
+            if (entry.event === "approved" && entry.registry_worker_id !== undefined &&
+                (typeof entry.registry_worker_id !== "string" || entry.registry_worker_id.trim().length === 0)) {
+                throw new LaneSchemaError(`${field}.registry_worker_id must be a non-empty string`, {
+                    path: filePath,
+                    field: `${field}.registry_worker_id`,
+                });
+            }
+            requireTimestamp(entry.at, `${field}.at`, filePath);
+        }
+    }
     parseLaneStories(raw, filePath);
     if (raw.last_envelope !== undefined) {
         if (!isPlainObject(raw.last_envelope) || typeof raw.last_envelope.ref !== "string" ||
@@ -920,6 +1005,11 @@ export function mergeLaneRecords(live, sidecars) {
                 worker_profile_repin_history: unionHistory(all.map((record) => record.worker_profile_repin_history ?? []), entryIdentity, base.worker_profile_repin_history ?? []),
             }
             : {}),
+        ...(all.some((record) => record.registry_worker_approval_history !== undefined)
+            ? {
+                registry_worker_approval_history: unionHistory(all.map((record) => record.registry_worker_approval_history ?? []), entryIdentity, base.registry_worker_approval_history ?? []),
+            }
+            : {}),
         ...(all.some((record) => record.failed_resume_history !== undefined)
             ? {
                 failed_resume_history: unionHistory(all.map((record) => record.failed_resume_history ?? []), entryIdentity, base.failed_resume_history ?? []),

package/dist/lib/lanes/types.d.ts

@@ -295,6 +295,31 @@ export interface WorkerProfileRepinHistoryEntry {
     at: string;
     reason: string;
 }
+/** The registry worker identity and approval contract pinned at lane creation. */
+export interface RegistryWorkerRecord {
+    id: string;
+    path: string;
+    worker_yaml_sha256: string;
+    approval_required: boolean;
+    human_checkpoints: string[];
+}
+/** Append-only approval and consumption events for registry worker checkpoints. */
+export type RegistryWorkerApprovalHistoryEntry = {
+    event: "approved";
+    approval_id: string;
+    checkpoint: string;
+    /** Pins this approval to the registry worker version that received it. */
+    registry_worker_id?: string;
+    worker_yaml_sha256?: string;
+    reason: string;
+    actor: string;
+    at: string;
+} | {
+    event: "consumed";
+    approval_id: string;
+    envelope_ref: string;
+    at: string;
+};
 export interface AttributionHistoryEntry {
     project_id: string;
     story_id: string;
@@ -390,6 +415,10 @@ export interface LaneRecord {
     hire_grant?: number;
     /** Content hash of the profile last applied to this lane. */
     worker_profile_hash?: string;
+    /** Registry persona selected by the profile, pinned at lane creation. */
+    registry_worker?: RegistryWorkerRecord;
+    /** Append-only approvals and one-envelope consumption records. */
+    registry_worker_approval_history?: RegistryWorkerApprovalHistoryEntry[];
     /** Bounded audit history of authorized Outpost profile hash re-pins. */
     worker_profile_repin_history?: WorkerProfileRepinHistoryEntry[];
     /** Profile fields intentionally unsupported by the selected provider. */

package/dist/lib/lanes/types.js

@@ -223,7 +223,7 @@ export const LANE_FIELD_WRITERS = {
     state: ["creator", "command", "watcher", "reconcile", "spawn"], queued_reason: ["creator", "command", "spawn", "watcher", "reconcile"], queued_at: ["creator", "command", "spawn", "watcher", "reconcile"], admission_reserved_at: ["creator", "command", "reconcile", "spawn", "watcher"],
     pickup_validation_pending: ["creator", "command", "spawn", "reconcile"],
     pickup_validation_pending_since: ["creator", "command", "spawn", "reconcile"],
-    priority: ["command"], worker: ["creator", "command"], worker_path: ["creator", "command"], worker_pack: ["creator", "command"], worker_profile: ["creator", "command"], worker_profile_hash: ["creator", "command", "spawn"], worker_profile_repin_history: ["command"], worker_profile_ignored: ["creator", "command", "spawn"], worker_policy_delivery: ["command", "spawn"],
+    priority: ["command"], worker: ["creator", "command"], worker_path: ["creator", "command"], worker_pack: ["creator", "command"], worker_profile: ["creator", "command"], worker_profile_hash: ["creator", "command", "spawn"], registry_worker: ["creator", "command", "spawn"], registry_worker_approval_history: ["command", "watcher", "reconcile"], worker_profile_repin_history: ["command"], worker_profile_ignored: ["creator", "command", "spawn"], worker_policy_delivery: ["command", "spawn"],
     keep_alive: ["creator", "command"], keep_alive_standing: ["command"], keep_alive_opted_in_at: ["creator", "command"], keep_alive_blocked_reason: ["command", "reconcile"], keep_alive_resume_count: ["command", "reconcile"], keep_alive_last_resume_at: ["command", "reconcile"], keep_alive_next_eligible_at: ["command", "reconcile"], keep_alive_exhausted_at: ["command", "reconcile"],
     provider: ["creator"], account: ["creator", "spawn", "command", "watcher", "reconcile"], account_selection: ["creator", "command"], admission_accounts: ["creator", "command"], account_history: ["command", "spawn", "watcher", "reconcile"], failed_resume_history: ["command"], pending_resume: ["command", "spawn", "watcher", "reconcile"], placement_default: ["creator"], host: ["creator", "command"], origin_host: ["creator"], origin_host_source: ["creator"],
     version: ["creator"], created_at: ["creator"], updated_at: ["creator"], attribution_history: ["command"],

package/dist/lib/lanes/watcher.d.ts

@@ -164,6 +164,8 @@ export declare function applyTerminalToLane(hqRoot: string, laneId: string, clas
 export declare function applyTerminalToLaneWithResult(hqRoot: string, laneId: string, classification: TerminalClassification, opts?: ApplyTerminalOpts): {
     record: LaneRecord;
     changed: boolean;
+    envelope?: LaneEnvelope;
+    classification: TerminalClassification;
 };
 export declare function isPidAlive(pid: number): boolean;
 export interface LatestEnvelope {

package/dist/lib/lanes/watcher.js

@@ -37,7 +37,8 @@ import { LanesError } from "./errors.js";
 import { questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { isTerminalLaneState, ENVELOPE_INVALID_REASON, parseLaneEnvelope, STORY_STATUSES, } from "./types.js";
 import { laneStories, storyStatusForEnvelope } from "./stories.js";
-import { readLane, retryUpdateLane, withLaneHireLocks } from "./store.js";
+import { appendCappedHistory, readLane, retryUpdateLane, withLaneHireLocks } from "./store.js";
+import { enforceRegistryApprovalGate } from "./approval-gate.js";
 import { readWorkerRunResult } from "./delivery.js";
 import { applyDefaultQuotaHold, quotaSignalFromFields, readQuotaSignal, recordAccountQuota, } from "./quota.js";
 import { PROVIDER_REJECTED_REASON, QUOTA_STATUS, isProviderLoginFailure, providerRejectionDetails, readProviderRejection, } from "./provider-rejection.js";
@@ -311,6 +312,7 @@ export function applyTerminalToLane(hqRoot, laneId, classification, opts = {}) {
 /** Terminal write outcome for emitters: only the CAS winner may publish mesh effects. */
 export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, opts = {}) {
     const at = opts.at ?? new Date().toISOString();
+    const envelopeRef = opts.envelopeRef ?? "envelopes/unknown.json";
     const existing = readLane(hqRoot, laneId);
     let questionRefusalCode = null;
     if (!isTerminalLaneState(existing.state) &&
@@ -334,7 +336,16 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
             reason: `question_record_refused:${questionRefusalCode}`,
         };
     let changed = false;
+    let effectiveEnvelope = opts.envelope ?? undefined;
+    let effectiveClassification = terminalClassification;
     const updated = retryUpdateLane(hqRoot, laneId, "watcher", (current) => {
+        const approvalGate = opts.envelope !== undefined && opts.envelope !== null
+            ? enforceRegistryApprovalGate(current, opts.envelope)
+            : undefined;
+        effectiveEnvelope = approvalGate?.envelope ?? opts.envelope ?? undefined;
+        effectiveClassification = approvalGate?.violation
+            ? { state: "blocked", reason: "approval_gate_violated" }
+            : terminalClassification;
         const terminal = current.state === "done" ||
             current.state === "failed" ||
             current.state === "interrupted" ||
@@ -343,24 +354,24 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
         if (terminal)
             return current;
         if (current.state === "awaiting_input" || current.state === "blocked") {
-            if (current.state === classification.state)
+            if (current.state === effectiveClassification.state)
                 return current;
         }
         const next = {
             ...current,
             ...runResultFields(hqRoot, current),
-            state: terminalClassification.state,
+            state: effectiveClassification.state,
             queued_reason: undefined,
             stalled: undefined,
             stalled_at: undefined,
             stalled_reason: undefined,
-            interrupted_at: classification.state === "interrupted" ? at : undefined,
+            interrupted_at: effectiveClassification.state === "interrupted" ? at : undefined,
             envelope_validation_errors: opts.envelopeValidationErrors,
         };
         changed = true;
-        if (terminalClassification.reason) {
+        if (effectiveClassification.reason) {
             next.terminal_reason =
-                terminalClassification.reason;
+                effectiveClassification.reason;
         }
         if (opts.quota?.quota_reset_at) {
             next.quota_reset_at = opts.quota.quota_reset_at;
@@ -371,10 +382,18 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
         if (opts.providerRejection) {
             next.terminal_details = providerRejectionDetails(opts.providerRejection, current);
         }
-        const envelope = opts.envelope;
-        if (envelope && opts.envelopeRef) {
+        const envelope = effectiveEnvelope;
+        if (approvalGate && !approvalGate.violation && approvalGate.approvedIdsToConsume.length > 0) {
+            next.registry_worker_approval_history = approvalGate.approvedIdsToConsume.reduce((history, approvalId) => appendCappedHistory(history, {
+                event: "consumed",
+                approval_id: approvalId,
+                envelope_ref: envelopeRef,
+                at,
+            }), current.registry_worker_approval_history ?? []);
+        }
+        if (envelope) {
             next.last_envelope = {
-                ref: opts.envelopeRef,
+                ref: envelopeRef,
                 decision: envelope.decision,
                 at,
                 artifacts: envelope.artifacts,
@@ -411,7 +430,12 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
         provider: updated.provider,
         account: updated.account,
     });
-    return { record: updated, changed };
+    return {
+        record: updated,
+        changed,
+        ...(effectiveEnvelope !== undefined ? { envelope: effectiveEnvelope } : {}),
+        classification: effectiveClassification,
+    };
 }
 export function isPidAlive(pid) {
     try {
@@ -1145,6 +1169,8 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                     providerRejection,
                 });
                 const updated = terminalWrite.record;
+                const effectiveEnvelope = terminalWrite.envelope ?? envelope;
+                const effectiveClassification = terminalWrite.classification;
                 logDecision({
                     event: "terminal_write",
                     at: tick.emit.at,
@@ -1155,11 +1181,16 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                 // lane_blocked; ask → lane_ask with the queue ids. After the state
                 // write, so a mesh failure can never leave the lane unclassified.
                 if (mesh && terminalWrite.changed) {
-                    if (envelope && latest && updated.state === classification.state) {
-                        const questionIds = envelope.decision === "ask"
-                            ? envelopeQuestionIds(laneId, latest.ref, envelope, questionIndexes)
+                    const envelopeState = effectiveEnvelope?.decision === "ask"
+                        ? "awaiting_input"
+                        : effectiveEnvelope?.decision === "blocked"
+                            ? "blocked"
+                            : "done";
+                    if (effectiveEnvelope && latest && updated.state === envelopeState) {
+                        const questionIds = effectiveEnvelope.decision === "ask"
+                            ? envelopeQuestionIds(laneId, latest.ref, effectiveEnvelope, questionIndexes)
                             : undefined;
-                        await emitMeshSoft(`lane_${envelope.decision}`, logDecision, tick.emit.at, (signal) => emitLaneDecisionEvents(mesh, updated, envelope, {
+                        await emitMeshSoft(`lane_${effectiveEnvelope.decision}`, logDecision, tick.emit.at, (signal) => emitLaneDecisionEvents(mesh, updated, effectiveEnvelope, {
                             questionIds,
                             signal,
                             storyStatusSuppressions,
@@ -1167,7 +1198,7 @@ async function runWatcherLoopOwned(hqRoot, laneId, deps) {
                     }
                     else if (updated.state === "failed" || updated.state === "interrupted" ||
                         updated.state === "cancelled" || updated.state === "killed") {
-                        await emitMeshSoft(`lane_${updated.state}`, logDecision, tick.emit.at, (signal) => emitLaneTerminalStateEvent(mesh, updated, updated.state, updated.terminal_reason ?? classification.reason, signal), meshRequestTimeoutMs);
+                        await emitMeshSoft(`lane_${updated.state}`, logDecision, tick.emit.at, (signal) => emitLaneTerminalStateEvent(mesh, updated, updated.state, updated.terminal_reason ?? effectiveClassification.reason, signal), meshRequestTimeoutMs);
                     }
                 }
                 if (terminalWrite.changed && deps.recoverQueuedMessages) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.239.0",
+  "version": "5.241.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {