@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/assets/scaffold/core/scripts/hq-job-run.sh

@@ -0,0 +1,1025 @@
+#!/usr/bin/env bash
+# hq-core: public
+# hq-job-run.sh — serialized Outpost scheduled-job executor (US-004 + US-006).
+#
+# Invoked by systemd user units (hq-job-{id}.service) or on demand:
+#   core/scripts/hq-job-run.sh --job-id <id>
+#   core/scripts/hq-job-run.sh <job.yaml>
+#
+# Behavior:
+#   - Global file lock (~/.hq/jobs/run.lock) — serialized-only (US-001)
+#   - Enforces job timeout_seconds (default 600; schema 60–14400)
+#   - Credentials only via `hq secrets exec` (requirements.secrets[]) or
+#     the box's cached CLI auth — never env vars / unit-file secrets
+#   - Trust model (7A): injects ONLY requirements.secrets[] — no static prompt scan
+#   - Appends stdout/stderr + exit to ~/.hq/jobs/logs/{id}/
+#   - Emits a compute-meter attribution marker (scheduled vs interactive)
+#   - Classifies failures (auth|secrets|timeout|agent_error|infra), writes
+#     failure_class to hq-pro jobs status (kind=run), bounded self-remediate,
+#     then dm-notify via hq-job-notify.sh (collapse 1/24h; never create-thread)
+#   - Missing runtime CLI auth: classify auth, notify re-login, exit 0 (unit OK)
+#
+# Runtime dispatch (US-001 spike flags):
+#   claude → claude -p … --output-format text --permission-mode bypassPermissions
+#   codex  → codex exec -s workspace-write --skip-git-repo-check …
+#
+# Env / overrides (tests):
+#   HQ_ROOT, HOME, HQ_JOB_LOCK, HQ_JOB_LOG_DIR, HQ_JOB_METER_DIR
+#   HQ_JOB_TIMEOUT_BIN, HQ_JOB_FLOCK_BIN, HQ_JOB_NOW
+#   HQ_JOB_PROBE_CLAUDE_CRED, HQ_JOB_PROBE_CODEX_AUTH (auth paths; shared with probe)
+#   HQ_JOB_RUN_SKIP_EXEC=1  — acquire lock + write marker/logs without calling CLI
+#   HQ_JOB_NOTIFY_BIN, HQ_JOB_REMEDIATE_BIN, HQ_JOB_RUN_NO_NOTIFY=1, HQ_JOB_RUN_NO_INGEST=1
+#   HQ_JOB_RUN_CURL, HQ_PRO_API_URL, OUTPOST_USER_ID, OUTPOST_INSTANCE_TOKEN
+#
+# Exit: 0 success or intentional auth/cwd skip; 1 agent/job failure; 2 usage/config;
+#       124 timeout (GNU timeout convention when available).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/hook-lib.sh"
+NOTIFY_BIN="${HQ_JOB_NOTIFY_BIN:-$SCRIPT_DIR/hq-job-notify.sh}"
+REMEDIATE_BIN="${HQ_JOB_REMEDIATE_BIN:-$SCRIPT_DIR/hq-job-remediate.sh}"
+AUTH_HEADER_FILE=""
+
+cleanup_auth_header_file() {
+  if [ -n "${AUTH_HEADER_FILE:-}" ]; then
+    rm -f -- "$AUTH_HEADER_FILE" 2>/dev/null || true
+    AUTH_HEADER_FILE=""
+  fi
+}
+trap cleanup_auth_header_file EXIT
+
+JOB_TARGET=""
+JOB_ID_ARG=""
+
+usage() {
+  sed -n '3,40p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+}
+
+die() {
+  echo "hq-job-run: $*" >&2
+  exit 2
+}
+
+log() {
+  echo "hq-job-run: $*" >&2
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --hq-root)
+      HQ_ROOT="${2:-}"
+      [ -n "$HQ_ROOT" ] || die "--hq-root requires a directory"
+      shift 2
+      ;;
+    --job-id)
+      JOB_ID_ARG="${2:-}"
+      [ -n "$JOB_ID_ARG" ] || die "--job-id requires a value"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    --)
+      shift
+      break
+      ;;
+    -*)
+      die "unknown option: $1"
+      ;;
+    *)
+      if [ -n "$JOB_TARGET" ]; then
+        die "unexpected argument: $1"
+      fi
+      JOB_TARGET="$1"
+      shift
+      ;;
+  esac
+done
+
+command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
+command -v jq >/dev/null 2>&1 || die "jq is required"
+
+iso_now() {
+  if [ -n "${HQ_JOB_NOW:-}" ]; then
+    printf '%s' "$HQ_JOB_NOW"
+    return
+  fi
+  date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
+    || date -u +"%Y-%m-%dT%H:%M:%S+00:00"
+}
+
+epoch_now() {
+  date -u +%s 2>/dev/null || date +%s
+}
+
+claude_cred_path() {
+  printf '%s' "${HQ_JOB_PROBE_CLAUDE_CRED:-${HOME}/.claude/.credentials.json}"
+}
+
+codex_auth_path() {
+  printf '%s' "${HQ_JOB_PROBE_CODEX_AUTH:-${HOME}/.codex/auth.json}"
+}
+
+find_job_file_by_id() {
+  local id="$1" f found=""
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    if [ "$(yq -r '.id // ""' "$f" 2>/dev/null)" = "$id" ]; then
+      if [ -n "$found" ]; then
+        die "duplicate job id '$id' in registry: $found and $f"
+      fi
+      found="$f"
+    fi
+  done < <(
+    {
+      find "$HQ_ROOT/personal/jobs" -maxdepth 1 \( -name '*.yaml' -o -name '*.yml' \) -type f 2>/dev/null || true
+      find "$HQ_ROOT/companies" -path '*/jobs/*' -maxdepth 3 \( -name '*.yaml' -o -name '*.yml' \) -type f 2>/dev/null || true
+    } | grep -Ev '\.conflict-|/\.conflicts/' | sort
+  )
+  [ -n "$found" ] || return 1
+  printf '%s' "$found"
+}
+
+resolve_job_file() {
+  if [ -n "$JOB_ID_ARG" ]; then
+    find_job_file_by_id "$JOB_ID_ARG" || die "job id not found: $JOB_ID_ARG"
+    return
+  fi
+  if [ -z "$JOB_TARGET" ]; then
+    die "usage: hq-job-run.sh --job-id <id> | <job.yaml>"
+  fi
+  if [ -f "$JOB_TARGET" ]; then
+    printf '%s' "$JOB_TARGET"
+    return
+  fi
+  if [ -f "$HQ_ROOT/$JOB_TARGET" ]; then
+    printf '%s' "$HQ_ROOT/$JOB_TARGET"
+    return
+  fi
+  find_job_file_by_id "$JOB_TARGET" || die "job not found: $JOB_TARGET"
+}
+
+check_runtime_auth() {
+  local runtime="$1"
+  case "$runtime" in
+    claude)
+      if ! command -v claude >/dev/null 2>&1; then
+        printf 'no_cli'
+        return 1
+      fi
+      if [ -s "$(claude_cred_path)" ]; then
+        printf 'ok'
+        return 0
+      fi
+      printf 'missing'
+      return 1
+      ;;
+    codex)
+      if ! command -v codex >/dev/null 2>&1; then
+        printf 'no_cli'
+        return 1
+      fi
+      if [ -s "$(codex_auth_path)" ]; then
+        printf 'ok'
+        return 0
+      fi
+      printf 'missing'
+      return 1
+      ;;
+    *)
+      printf 'unknown_runtime'
+      return 1
+      ;;
+  esac
+}
+
+build_prompt() {
+  local job_file="$1"
+  local prompt skill
+  prompt="$(yq -r '.exec.prompt // ""' "$job_file")"
+  skill="$(yq -r '.exec.skill // ""' "$job_file")"
+  if [ -n "$prompt" ] && [ "$prompt" != "null" ]; then
+    printf '%s' "$prompt"
+    return
+  fi
+  if [ -n "$skill" ] && [ "$skill" != "null" ]; then
+    local args_json
+    args_json="$(yq -o=json -I=0 '.exec.args // {}' "$job_file" 2>/dev/null || echo '{}')"
+    printf 'Execute the HQ skill "%s" unattended with these args (JSON): %s. Follow the skill instructions exactly and produce a concise completion summary.' \
+      "$skill" "$args_json"
+    return
+  fi
+  die "job missing exec.prompt and exec.skill: $job_file"
+}
+
+append_meter_marker() {
+  local job_id="$1" runtime="$2" started="$3" ended="$4" exit_status="$5" duration="$6" skip_reason="${7:-}"
+  local dir="${HQ_JOB_METER_DIR:-${HOME}/.hq/jobs/meters}"
+  mkdir -p "$dir"
+  local line
+  line="$(jq -nc \
+    --arg schema "hq.outpost.job-run/v1" \
+    --arg kind "scheduled-job-run" \
+    --arg job_id "$job_id" \
+    --arg runtime "$runtime" \
+    --arg started_at "$started" \
+    --arg ended_at "$ended" \
+    --argjson exit_status "$exit_status" \
+    --argjson duration_seconds "$duration" \
+    --arg outpost_id "${OUTPOST_ID:-}" \
+    --arg skip_reason "$skip_reason" \
+    '{
+      schema: $schema,
+      kind: $kind,
+      job_id: $job_id,
+      runtime: $runtime,
+      started_at: $started_at,
+      ended_at: $ended_at,
+      exit_status: $exit_status,
+      duration_seconds: $duration_seconds
+    }
+    + (if $outpost_id != "" then {outpost_id: $outpost_id} else {} end)
+    + (if $skip_reason != "" then {skip_reason: $skip_reason} else {} end)')"
+  printf '%s\n' "$line" >>"$dir/runs.jsonl"
+  chmod 600 "$dir/runs.jsonl" 2>/dev/null || true
+}
+
+api_base() {
+  local base
+  base="${HQ_PRO_API_URL:-${HQ_API_URL:-${HQ_VAULT_API_URL:-https://hqapi.hq.computer}}}"
+  base="${base%/}"
+  printf '%s' "$base"
+}
+
+resolve_box_identity() {
+  local xtrace_was_set=0
+  case "$-" in
+    *x*) xtrace_was_set=1; set +x ;;
+  esac
+
+  if [ -n "${OUTPOST_USER_ID:-}" ] && [ -n "${OUTPOST_INSTANCE_TOKEN:-}" ]; then
+    [ "$xtrace_was_set" -eq 0 ] || set -x
+    return 0
+  fi
+  local envf="/etc/outpost/codex-identity.env"
+  if [ -f "$envf" ]; then
+    # shellcheck disable=SC1090
+    . "$envf" 2>/dev/null || true
+    if [ -n "${OUTPOST_USER_ID:-}" ] && [ -n "${OUTPOST_INSTANCE_TOKEN:-}" ]; then
+      [ "$xtrace_was_set" -eq 0 ] || set -x
+      return 0
+    fi
+  fi
+  local runner="${HQ_JOB_PROBE_RUNNER:-/usr/local/bin/outpost-runner.sh}"
+  if [ -f "$runner" ]; then
+    OUTPOST_USER_ID="${OUTPOST_USER_ID:-$(sed -n 's/^USER_ID="\(.*\)"$/\1/p' "$runner" 2>/dev/null | head -1)}"
+    OUTPOST_INSTANCE_TOKEN="${OUTPOST_INSTANCE_TOKEN:-$(sed -n 's/^INSTANCE_TOKEN="\(.*\)"$/\1/p' "$runner" 2>/dev/null | head -1)}"
+    OUTPOST_ID="${OUTPOST_ID:-$(sed -n 's/^OUTPOST_ID="\(.*\)"$/\1/p' "$runner" 2>/dev/null | head -1)}"
+  fi
+  if [ -n "${OUTPOST_USER_ID:-}" ] && [ -n "${OUTPOST_INSTANCE_TOKEN:-}" ]; then
+    [ "$xtrace_was_set" -eq 0 ] || set -x
+    return 0
+  fi
+  [ "$xtrace_was_set" -eq 0 ] || set -x
+  return 1
+}
+
+create_auth_header_file() {
+  local xtrace_was_set=0 write_rc=0
+  AUTH_HEADER_FILE="$(mktemp "${TMPDIR:-/tmp}/hq-job-run-auth-header.XXXXXX")"
+  chmod 600 "$AUTH_HEADER_FILE"
+  case "$-" in
+    *x*) xtrace_was_set=1; set +x ;;
+  esac
+  if printf 'x-outpost-instance-token: %s\n' "$OUTPOST_INSTANCE_TOKEN" >"$AUTH_HEADER_FILE"; then
+    write_rc=0
+  else
+    write_rc=$?
+  fi
+  [ "$xtrace_was_set" -eq 0 ] || set -x
+  return "$write_rc"
+}
+
+# Classify exit + log tail → auth|secrets|timeout|agent_error|infra
+classify_failure() {
+  local exit_code="$1" log_file="$2" auth_hint="${3:-}"
+  if [ -n "$auth_hint" ] && [ "$auth_hint" != "ok" ]; then
+    printf 'auth'
+    return
+  fi
+  if [ "$exit_code" -eq 124 ] || [ "$exit_code" -eq 137 ]; then
+    printf 'timeout'
+    return
+  fi
+  local tail_txt=""
+  if [ -n "$log_file" ] && [ -f "$log_file" ]; then
+    tail_txt="$(tail -n 80 "$log_file" 2>/dev/null || true)"
+  fi
+  local lower
+  lower="$(printf '%s' "$tail_txt" | tr '[:upper:]' '[:lower:]')"
+
+  if printf '%s' "$lower" | grep -Eq \
+    'not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required'; then
+    printf 'auth'
+    return
+  fi
+  if printf '%s' "$lower" | grep -Eq \
+    'secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret'; then
+    printf 'secrets'
+    return
+  fi
+  # Avoid matching job metadata like timeout_seconds=N in the log header.
+  if printf '%s' "$lower" | grep -Eq \
+    '(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][[:space:]]*124\b'; then
+    printf 'timeout'
+    return
+  fi
+  if printf '%s' "$lower" | grep -Eq \
+    'connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable'; then
+    printf 'infra'
+    return
+  fi
+  if [ "$exit_code" -eq 0 ]; then
+    printf ''
+    return
+  fi
+  printf 'agent_error'
+}
+
+next_action_for_class() {
+  local fc="$1" runtime="${2:-}"
+  case "$fc" in
+    auth)
+      printf 're-login on Outpost (device code) for %s' "${runtime:-the runtime CLI}"
+      ;;
+    secrets)
+      printf 'share the missing secret to this Outpost (hq secrets share KEY) then re-probe'
+      ;;
+    timeout)
+      printf 'raise timeout_seconds or split the job work'
+      ;;
+    infra)
+      printf 'check Outpost disk/network; job will self-retry once on transient infra'
+      ;;
+    agent_error)
+      printf 'inspect the job log and fix the prompt/skill'
+      ;;
+    *)
+      printf ''
+      ;;
+  esac
+}
+
+# POST kind=run ingest. Never fails the job run.
+ingest_run_status() {
+  local job_id="$1" run_at="$2" run_id="$3" last_exit="$4" failure_class="$5" next_actions_json="$6"
+  if [ "${HQ_JOB_RUN_NO_INGEST:-}" = "1" ]; then
+    log "ingest skipped (HQ_JOB_RUN_NO_INGEST=1)"
+    return 0
+  fi
+  if ! resolve_box_identity; then
+    log "run status ingest skipped — missing Outpost identity"
+    return 0
+  fi
+  local payload fc_json
+  if [ -z "$failure_class" ] || [ "$failure_class" = "null" ]; then
+    fc_json='null'
+  else
+    fc_json="$(jq -nc --arg f "$failure_class" '$f')"
+  fi
+  payload="$(jq -nc \
+    --arg userId "$OUTPOST_USER_ID" \
+    --arg jobId "$job_id" \
+    --arg run_at "$run_at" \
+    --arg event_id "$run_id" \
+    --arg run_id "$run_id" \
+    --argjson last_exit "$last_exit" \
+    --argjson failure_class "$fc_json" \
+    --argjson next_actions "$next_actions_json" \
+    --arg outpostId "${OUTPOST_ID:-}" \
+    '{
+      userId: $userId,
+      jobId: $jobId,
+      kind: "run",
+      run_at: $run_at,
+      event_id: $event_id,
+      run_id: $run_id,
+      last_exit: $last_exit,
+      failure_class: $failure_class,
+      next_actions: $next_actions
+    } + (if $outpostId != "" then {outpostId: $outpostId} else {} end)')"
+
+  local curl_bin="${HQ_JOB_RUN_CURL:-curl}"
+  local url tmp_body tmp_hdr http=0
+  url="$(api_base)/outpost/internal/jobs-status"
+  if ! command -v "$curl_bin" >/dev/null 2>&1; then
+    log "run status ingest skipped — curl not found"
+    return 0
+  fi
+  tmp_body="$(mktemp "${TMPDIR:-/tmp}/hq-job-run-ingest-body.XXXXXX")"
+  tmp_hdr="$(mktemp "${TMPDIR:-/tmp}/hq-job-run-ingest-hdr.XXXXXX")"
+  create_auth_header_file
+  set +e
+  "$curl_bin" -sS -m 20 -X POST "$url" \
+    -H "content-type: application/json" \
+    -H "@${AUTH_HEADER_FILE}" \
+    --data "$payload" \
+    -D "$tmp_hdr" \
+    -o "$tmp_body"
+  local curl_rc=$?
+  set -e
+  if [ "$curl_rc" -eq 0 ]; then
+    http="$(awk 'BEGIN{c=0} /^HTTP\//{c=$2} END{print c+0}' "$tmp_hdr" 2>/dev/null || echo 0)"
+  fi
+  rm -f "$tmp_body" "$tmp_hdr" "$AUTH_HEADER_FILE"
+  AUTH_HEADER_FILE=""
+  if [ "$http" -ge 200 ] && [ "$http" -lt 300 ]; then
+    log "run status ingested job=$job_id failure_class=${failure_class:-null} http=$http"
+  else
+    log "run status ingest failed job=$job_id http=$http (logged; not failing run)"
+  fi
+  return 0
+}
+
+call_notify() {
+  local job_id="$1" job_name="$2" outcome="$3" summary="$4" duration="$5" log_path="$6"
+  local failure_class="${7:-}" next_action="${8:-}" owner="${9:-}" notify_mode="${10:-profile}"
+  if [ "${HQ_JOB_RUN_NO_NOTIFY:-}" = "1" ]; then
+    log "notify skipped (HQ_JOB_RUN_NO_NOTIFY=1)"
+    return 0
+  fi
+  if [ ! -x "$NOTIFY_BIN" ] && [ -f "$NOTIFY_BIN" ]; then
+    chmod +x "$NOTIFY_BIN" 2>/dev/null || true
+  fi
+  if [ ! -f "$NOTIFY_BIN" ]; then
+    log "notify skipped — missing $NOTIFY_BIN"
+    return 0
+  fi
+  set +e
+  bash "$NOTIFY_BIN" \
+    --hq-root "$HQ_ROOT" \
+    --job-id "$job_id" \
+    --job-name "$job_name" \
+    --outcome "$outcome" \
+    --summary "$summary" \
+    --duration "$duration" \
+    --log-path "$log_path" \
+    --failure-class "$failure_class" \
+    --next-action "$next_action" \
+    --owner "$owner" \
+    --notify "$notify_mode" \
+    >>"$log_path" 2>&1
+  local nrc=$?
+  set -e
+  if [ "$nrc" -ne 0 ]; then
+    log "notify helper exited $nrc (ignored)"
+  fi
+  return 0
+}
+
+call_remediate() {
+  local failure_class="$1" job_id="$2" company="$3"
+  if [ ! -x "$REMEDIATE_BIN" ] && [ -f "$REMEDIATE_BIN" ]; then
+    chmod +x "$REMEDIATE_BIN" 2>/dev/null || true
+  fi
+  if [ ! -f "$REMEDIATE_BIN" ]; then
+    echo '{"retry_recommended":false,"attempted":false,"notes":"remediate missing"}'
+    return 0
+  fi
+  local out
+  set +e
+  out="$(
+    HQ_JOB_REMEDIATE_LOG="${LOG_FILE:-/dev/null}" \
+      bash "$REMEDIATE_BIN" \
+        --hq-root "$HQ_ROOT" \
+        --failure-class "$failure_class" \
+        --job-id "$job_id" \
+        --company "$company" 2>>"${LOG_FILE:-/dev/null}"
+  )"
+  local rrc=$?
+  set -e
+  if [ "$rrc" -ne 0 ] || [ -z "$out" ]; then
+    echo '{"retry_recommended":false,"attempted":false,"notes":"remediate failed"}'
+    return 0
+  fi
+  printf '%s' "$out"
+}
+
+# --- resolve job ---
+JOB_FILE="$(resolve_job_file)"
+[ -f "$JOB_FILE" ] || die "job file missing: $JOB_FILE"
+
+JOB_ID="$(yq -r '.id // ""' "$JOB_FILE")"
+JOB_NAME="$(yq -r '.name // .id // ""' "$JOB_FILE")"
+RUNTIME="$(yq -r '.runtime // ""' "$JOB_FILE")"
+TIMEOUT_SEC="$(yq -r '.timeout_seconds // 600' "$JOB_FILE")"
+CWD_REL="$(yq -r '.cwd // .requirements.cwd // ""' "$JOB_FILE")"
+COMPANY="$(yq -r '.requirements.company // ""' "$JOB_FILE")"
+OWNER="$(yq -r '.owner // ""' "$JOB_FILE")"
+NOTIFY_MODE="$(yq -r '.notify // "profile"' "$JOB_FILE")"
+ENABLED="$(yq -o=json '.' "$JOB_FILE" | jq -r 'if has("enabled") then (.enabled|tostring) else "true" end')"
+# exec.surface overrides profile execution_surface; default headless.
+SURFACE="$(yq -r '.exec.surface // ""' "$JOB_FILE")"
+if [ -z "$SURFACE" ] || [ "$SURFACE" = "null" ]; then
+  ALERTS_FILE="${HQ_JOB_ALERTS_FILE:-${HQ_ROOT}/personal/settings/schedule-alerts.yaml}"
+  if [ -f "$ALERTS_FILE" ]; then
+    SURFACE="$(yq -r '.execution_surface // ""' "$ALERTS_FILE" 2>/dev/null || true)"
+  fi
+fi
+case "$SURFACE" in
+  remote) SURFACE="remote" ;;
+  *) SURFACE="headless" ;;
+esac
+# hq dm accepts personUid recipients; do not replace a job owner with this Outpost's identity.
+
+[ -n "$JOB_ID" ] && [ "$JOB_ID" != "null" ] || die "job missing id: $JOB_FILE"
+[ -n "$RUNTIME" ] && [ "$RUNTIME" != "null" ] || die "job missing runtime: $JOB_FILE"
+[ -n "$JOB_NAME" ] || JOB_NAME="$JOB_ID"
+[ -n "$NOTIFY_MODE" ] && [ "$NOTIFY_MODE" != "null" ] || NOTIFY_MODE="profile"
+case "$TIMEOUT_SEC" in
+  ''|*[!0-9]*) TIMEOUT_SEC=600 ;;
+esac
+if [ "$TIMEOUT_SEC" -lt 60 ]; then TIMEOUT_SEC=60; fi
+if [ "$TIMEOUT_SEC" -gt 14400 ]; then TIMEOUT_SEC=14400; fi
+
+if [ "$ENABLED" = "false" ] || [ "$ENABLED" = "False" ] || [ "$ENABLED" = "0" ]; then
+  log "skip job $JOB_ID — enabled=false"
+  exit 0
+fi
+
+LOG_BASE="${HQ_JOB_LOG_DIR:-${HOME}/.hq/jobs/logs}"
+LOG_DIR="$LOG_BASE/$JOB_ID"
+mkdir -p "$LOG_DIR"
+LOCK_PATH="${HQ_JOB_LOCK:-${HOME}/.hq/jobs/run.lock}"
+mkdir -p "$(dirname "$LOCK_PATH")"
+
+FLOCK_BIN="${HQ_JOB_FLOCK_BIN:-}"
+if [ -z "$FLOCK_BIN" ]; then
+  command -v flock >/dev/null 2>&1 || die "Outpost/Linux requires util-linux flock(1) for serialized job runs"
+  FLOCK_BIN="$(command -v flock)"
+fi
+TIMEOUT_BIN="${HQ_JOB_TIMEOUT_BIN:-}"
+if [ -z "$TIMEOUT_BIN" ]; then
+  if command -v timeout >/dev/null 2>&1; then
+    TIMEOUT_BIN="timeout"
+  elif command -v gtimeout >/dev/null 2>&1; then
+    TIMEOUT_BIN="gtimeout"
+  else
+    TIMEOUT_BIN=""
+  fi
+fi
+
+RUN_STAMP="$(date -u +%Y%m%dT%H%M%SZ 2>/dev/null || date +%Y%m%d%H%M%S)"
+LOG_FILE="$LOG_DIR/${RUN_STAMP}.log"
+STATUS_FILE="$LOG_DIR/${RUN_STAMP}.status"
+
+# Serialize all scheduled runs on this box.
+exec 9>"$LOCK_PATH"
+if ! "$FLOCK_BIN" -x 9; then
+  die "failed to acquire global run lock: $LOCK_PATH"
+fi
+
+STARTED_AT="$(iso_now)"
+STARTED_EPOCH="$(epoch_now)"
+SKIP_REASON=""
+EXIT_CODE=0
+
+{
+  echo "=== hq-job-run $JOB_ID ==="
+  echo "started_at=$STARTED_AT"
+  echo "runtime=$RUNTIME"
+  echo "timeout_seconds=$TIMEOUT_SEC"
+  echo "surface=$SURFACE"
+  echo "job_file=$JOB_FILE"
+  echo "hq_root=$HQ_ROOT"
+} >>"$LOG_FILE"
+
+AUTH_STATUS="$(check_runtime_auth "$RUNTIME" || true)"
+if [ "$AUTH_STATUS" != "ok" ]; then
+  case "$AUTH_STATUS" in
+    no_cli)
+      SKIP_REASON="runtime CLI '$RUNTIME' not installed on PATH — skip (re-login/install on Outpost)"
+      ;;
+    missing)
+      SKIP_REASON="runtime CLI '$RUNTIME' not authenticated on Outpost (cached credentials missing) — skip"
+      ;;
+    *)
+      SKIP_REASON="unsupported or unknown runtime '$RUNTIME' — skip"
+      ;;
+  esac
+  {
+    echo "skip_reason=$SKIP_REASON"
+    echo "auth_status=$AUTH_STATUS"
+    echo "failure_class=auth"
+  } >>"$LOG_FILE"
+  log "$SKIP_REASON"
+  ENDED_AT="$(iso_now)"
+  ENDED_EPOCH="$(epoch_now)"
+  DUR=$((ENDED_EPOCH - STARTED_EPOCH))
+  [ "$DUR" -ge 0 ] || DUR=0
+  printf 'exit=0\nskip_reason=%s\nfailure_class=auth\nstarted_at=%s\nended_at=%s\n' \
+    "$SKIP_REASON" "$STARTED_AT" "$ENDED_AT" >"$STATUS_FILE"
+  append_meter_marker "$JOB_ID" "$RUNTIME" "$STARTED_AT" "$ENDED_AT" 0 "$DUR" "$SKIP_REASON"
+
+  # Bounded remediate: Cognito refresh only — never device-login loop.
+  REM_OUT="$(call_remediate auth "$JOB_ID" "$COMPANY")"
+  echo "remediate=$REM_OUT" >>"$LOG_FILE"
+  NEXT_ACT="$(printf '%s' "$REM_OUT" | jq -r '.next_action // empty')"
+  [ -n "$NEXT_ACT" ] || NEXT_ACT="$(next_action_for_class auth "$RUNTIME")"
+  NA_JSON="$(jq -nc --arg a "$NEXT_ACT" 'if $a == "" then [] else [$a] end')"
+  RUN_ID="run-${JOB_ID}-${RUN_STAMP}-authskip"
+  ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" 1 "auth" "$NA_JSON"
+  call_notify "$JOB_ID" "$JOB_NAME" "failed" "$SKIP_REASON" "$DUR" "$LOG_FILE" \
+    "auth" "$NEXT_ACT" "$OWNER" "$NOTIFY_MODE"
+  exit 0
+fi
+
+# Working directory — must resolve under HQ_ROOT (no absolute / no .. escape)
+RUN_CWD="$HQ_ROOT"
+if [ -n "$CWD_REL" ] && [ "$CWD_REL" != "null" ]; then
+  case "$CWD_REL" in
+    /*)
+      SKIP_REASON="cwd absolute not allowed: $CWD_REL — skip"
+      log "$SKIP_REASON"
+      {
+        echo "skip_reason=$SKIP_REASON"
+        echo "failure_class=infra"
+      } >>"$LOG_FILE"
+      ENDED_AT="$(iso_now)"
+      ENDED_EPOCH="$(epoch_now)"
+      DUR=$((ENDED_EPOCH - STARTED_EPOCH))
+      [ "$DUR" -ge 0 ] || DUR=0
+      printf 'exit=0\nskip_reason=%s\nfailure_class=infra\nstarted_at=%s\nended_at=%s\n' \
+        "$SKIP_REASON" "$STARTED_AT" "$ENDED_AT" >"$STATUS_FILE"
+      append_meter_marker "$JOB_ID" "$RUNTIME" "$STARTED_AT" "$ENDED_AT" 0 "$DUR" "$SKIP_REASON"
+      NEXT_ACT="fix job cwd to an HQ-root-relative path (no absolute, no '..')"
+      NA_JSON="$(jq -nc --arg a "$NEXT_ACT" '[$a]')"
+      RUN_ID="run-${JOB_ID}-${RUN_STAMP}-cwd"
+      ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" 1 "infra" "$NA_JSON"
+      call_notify "$JOB_ID" "$JOB_NAME" "blocked" "$SKIP_REASON" "$DUR" "$LOG_FILE" \
+        "infra" "$NEXT_ACT" "$OWNER" "$NOTIFY_MODE"
+      exit 0
+      ;;
+  esac
+  _cwd_part=""
+  _old_ifs="$IFS"
+  IFS='/'
+  # shellcheck disable=SC2086
+  for _cwd_part in $CWD_REL; do
+    if [ "$_cwd_part" = ".." ]; then
+      IFS="$_old_ifs"
+      SKIP_REASON="cwd contains '..': $CWD_REL — skip"
+      log "$SKIP_REASON"
+      {
+        echo "skip_reason=$SKIP_REASON"
+        echo "failure_class=infra"
+      } >>"$LOG_FILE"
+      ENDED_AT="$(iso_now)"
+      ENDED_EPOCH="$(epoch_now)"
+      DUR=$((ENDED_EPOCH - STARTED_EPOCH))
+      [ "$DUR" -ge 0 ] || DUR=0
+      printf 'exit=0\nskip_reason=%s\nfailure_class=infra\nstarted_at=%s\nended_at=%s\n' \
+        "$SKIP_REASON" "$STARTED_AT" "$ENDED_AT" >"$STATUS_FILE"
+      append_meter_marker "$JOB_ID" "$RUNTIME" "$STARTED_AT" "$ENDED_AT" 0 "$DUR" "$SKIP_REASON"
+      NEXT_ACT="fix job cwd to an HQ-root-relative path without '..'"
+      NA_JSON="$(jq -nc --arg a "$NEXT_ACT" '[$a]')"
+      RUN_ID="run-${JOB_ID}-${RUN_STAMP}-cwd"
+      ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" 1 "infra" "$NA_JSON"
+      call_notify "$JOB_ID" "$JOB_NAME" "blocked" "$SKIP_REASON" "$DUR" "$LOG_FILE" \
+        "infra" "$NEXT_ACT" "$OWNER" "$NOTIFY_MODE"
+      exit 0
+    fi
+  done
+  IFS="$_old_ifs"
+  HQ_CANON="$(realpath -m "$HQ_ROOT" 2>/dev/null || realpath "$HQ_ROOT" 2>/dev/null || true)"
+  RUN_CWD="$(realpath -m "$HQ_ROOT/$CWD_REL" 2>/dev/null || true)"
+  if [ -z "$RUN_CWD" ] && [ -d "$HQ_ROOT/$CWD_REL" ]; then
+    RUN_CWD="$(realpath "$HQ_ROOT/$CWD_REL" 2>/dev/null || true)"
+  fi
+  if [ -z "$HQ_CANON" ] || [ -z "$RUN_CWD" ]; then
+    HQ_CANON="$(hq_normpath "$HQ_ROOT")"
+    RUN_CWD="$(hq_normpath "$HQ_ROOT/$CWD_REL")"
+  fi
+  case "$RUN_CWD" in
+    "$HQ_CANON"|"$HQ_CANON"/*) ;;
+    *)
+      SKIP_REASON="cwd escapes HQ_ROOT: $CWD_REL → $RUN_CWD — skip"
+      log "$SKIP_REASON"
+      {
+        echo "skip_reason=$SKIP_REASON"
+        echo "failure_class=infra"
+      } >>"$LOG_FILE"
+      ENDED_AT="$(iso_now)"
+      ENDED_EPOCH="$(epoch_now)"
+      DUR=$((ENDED_EPOCH - STARTED_EPOCH))
+      [ "$DUR" -ge 0 ] || DUR=0
+      printf 'exit=0\nskip_reason=%s\nfailure_class=infra\nstarted_at=%s\nended_at=%s\n' \
+        "$SKIP_REASON" "$STARTED_AT" "$ENDED_AT" >"$STATUS_FILE"
+      append_meter_marker "$JOB_ID" "$RUNTIME" "$STARTED_AT" "$ENDED_AT" 0 "$DUR" "$SKIP_REASON"
+      NEXT_ACT="fix job cwd to stay under HQ root"
+      NA_JSON="$(jq -nc --arg a "$NEXT_ACT" '[$a]')"
+      RUN_ID="run-${JOB_ID}-${RUN_STAMP}-cwd"
+      ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" 1 "infra" "$NA_JSON"
+      call_notify "$JOB_ID" "$JOB_NAME" "blocked" "$SKIP_REASON" "$DUR" "$LOG_FILE" \
+        "infra" "$NEXT_ACT" "$OWNER" "$NOTIFY_MODE"
+      exit 0
+      ;;
+  esac
+fi
+if [ ! -d "$RUN_CWD" ]; then
+  SKIP_REASON="cwd missing: $RUN_CWD — skip"
+  log "$SKIP_REASON"
+  {
+    echo "skip_reason=$SKIP_REASON"
+    echo "failure_class=infra"
+  } >>"$LOG_FILE"
+  ENDED_AT="$(iso_now)"
+  ENDED_EPOCH="$(epoch_now)"
+  DUR=$((ENDED_EPOCH - STARTED_EPOCH))
+  [ "$DUR" -ge 0 ] || DUR=0
+  printf 'exit=0\nskip_reason=%s\nfailure_class=infra\nstarted_at=%s\nended_at=%s\n' \
+    "$SKIP_REASON" "$STARTED_AT" "$ENDED_AT" >"$STATUS_FILE"
+  append_meter_marker "$JOB_ID" "$RUNTIME" "$STARTED_AT" "$ENDED_AT" 0 "$DUR" "$SKIP_REASON"
+  NEXT_ACT="create missing cwd on Outpost: $RUN_CWD"
+  NA_JSON="$(jq -nc --arg a "$NEXT_ACT" '[$a]')"
+  RUN_ID="run-${JOB_ID}-${RUN_STAMP}-cwd"
+  ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" 1 "infra" "$NA_JSON"
+  call_notify "$JOB_ID" "$JOB_NAME" "blocked" "$SKIP_REASON" "$DUR" "$LOG_FILE" \
+    "infra" "$NEXT_ACT" "$OWNER" "$NOTIFY_MODE"
+  exit 0
+fi
+
+PROMPT_TEXT="$(build_prompt "$JOB_FILE")"
+
+# Build secret name list for hq secrets exec allowlist injection.
+SECRET_NAMES=()
+SECRET_COUNT="$(yq -r '.requirements.secrets // [] | length' "$JOB_FILE")"
+if [ "$SECRET_COUNT" != "null" ] && [ "${SECRET_COUNT:-0}" -gt 0 ] 2>/dev/null; then
+  i=0
+  while [ "$i" -lt "$SECRET_COUNT" ]; do
+    sn="$(yq -r ".requirements.secrets[$i]" "$JOB_FILE")"
+    i=$((i + 1))
+    [ -n "$sn" ] && [ "$sn" != "null" ] || continue
+    SECRET_NAMES+=("$sn")
+  done
+fi
+
+# Claude remote surface: TTY + --remote-control so the run appears in Desktop.
+# Auto-dismisses known startup dialogs; copies pane output into LOG_FILE.
+# Launcher is a temp script (not nested shell quoting) to keep prompts/safe.
+run_claude_remote() {
+  local cmd_rc=0
+  if ! command -v tmux >/dev/null 2>&1; then
+    echo "remote surface requested but tmux missing — falling back to headless" >>"$LOG_FILE"
+    SURFACE="headless"
+    return 99
+  fi
+  local sess="hq-job-${JOB_ID}-${RUN_STAMP}"
+  local rc_name="schedule/${JOB_ID}"
+  local deadline=$((TIMEOUT_SEC + 30))
+  local i=0
+  local pane=""
+  local exit_file="$LOG_DIR/${RUN_STAMP}.remote-exit"
+  local done_file="$LOG_DIR/${RUN_STAMP}.remote-done"
+  local launcher="$LOG_DIR/${RUN_STAMP}.remote-launch.sh"
+  # Completion is a sentinel file — not pane text (prompt instructions also
+  # contain marker words and caused false early teardown).
+  rm -f "$done_file"
+  local remote_prompt
+  remote_prompt="${PROMPT_TEXT}
+
+When ALL work above is fully finished (success or failure), create this exact empty file with a shell tool (and do not create it earlier):
+  touch $(printf %q "$done_file")
+Then stop."
+  echo "surface=remote remote_name=$rc_name tmux_session=$sess done_file=$done_file" >>"$LOG_FILE"
+  {
+    echo '#!/usr/bin/env bash'
+    echo 'set -uo pipefail'
+    printf 'cd %q\n' "$RUN_CWD"
+    printf 'claude --remote-control %q --permission-mode bypassPermissions --dangerously-skip-permissions %q\n' "$rc_name" "$remote_prompt"
+    echo 'rc=$?'
+    printf 'echo EXIT=$rc > %q\n' "$exit_file"
+    echo 'sleep 15'
+    echo 'exit "$rc"'
+  } >"$launcher"
+  chmod 700 "$launcher"
+  tmux kill-session -t "$sess" 2>/dev/null || true
+  tmux new-session -d -s "$sess" -x 120 -y 40 "$launcher"
+  while [ "$i" -lt "$deadline" ]; do
+    sleep 2
+    i=$((i + 2))
+    pane="$(tmux capture-pane -t "$sess" -p -S -120 2>/dev/null || true)"
+    # Startup / tool-permission dialogs (remote TTY can still prompt)
+    if printf '%s\n' "$pane" | grep -q 'Yes, I accept'; then
+      tmux send-keys -t "$sess" "2" Enter
+      continue
+    fi
+    if printf '%s\n' "$pane" | grep -q 'Try the new fullscreen renderer'; then
+      tmux send-keys -t "$sess" "2" Enter
+      continue
+    fi
+    if printf '%s\n' "$pane" | grep -q 'Do you want to proceed'; then
+      # "2" = Yes, and don't ask again for similar commands
+      tmux send-keys -t "$sess" "2" Enter
+      echo "auto-accepted tool permission prompt" >>"$LOG_FILE"
+      continue
+    fi
+    if [ -f "$done_file" ]; then
+      echo "remote done sentinel present" >>"$LOG_FILE"
+      sleep 2
+      pane="$(tmux capture-pane -t "$sess" -p -S -300 2>/dev/null || true)"
+      cmd_rc=0
+      break
+    fi
+    if [ -f "$exit_file" ]; then
+      cmd_rc="$(tr -dc '0-9' <"$exit_file" | head -c 3)"
+      [ -n "$cmd_rc" ] || cmd_rc=0
+      break
+    fi
+  done
+  if [ "$i" -ge "$deadline" ]; then
+    echo "remote surface timed out after ${TIMEOUT_SEC}s" >>"$LOG_FILE"
+    cmd_rc=124
+  fi
+  {
+    echo "=== remote pane capture ==="
+    tmux capture-pane -t "$sess" -p -S -300 2>/dev/null || true
+  } >>"$LOG_FILE"
+  # End the Remote Control process so Desktop moves schedule/<job-id> to Archived.
+  echo "tearing down remote session ${rc_name} (review under Desktop Archived)" >>"$LOG_FILE"
+  tmux kill-session -t "$sess" 2>/dev/null || true
+  rm -f "$launcher"
+  return "$cmd_rc"
+}
+
+run_agent() {
+  local cmd_rc=0
+  if [ "${HQ_JOB_RUN_SKIP_EXEC:-}" = "1" ]; then
+    echo "(HQ_JOB_RUN_SKIP_EXEC=1 — not invoking runtime CLI)" >>"$LOG_FILE"
+    return 0
+  fi
+
+  if [ "$RUNTIME" = "claude" ] && [ "$SURFACE" = "remote" ]; then
+    set +e
+    run_claude_remote
+    cmd_rc=$?
+    set -e
+    if [ "$cmd_rc" -ne 99 ]; then
+      return "$cmd_rc"
+    fi
+    # 99 = fall through to headless
+  fi
+  if [ "$RUNTIME" = "codex" ] && [ "$SURFACE" = "remote" ]; then
+    echo "surface=remote ignored for codex — using headless" >>"$LOG_FILE"
+  fi
+
+  local -a agent_cmd
+  case "$RUNTIME" in
+    claude)
+      agent_cmd=(claude -p "$PROMPT_TEXT" --output-format text --permission-mode bypassPermissions)
+      ;;
+    codex)
+      # Spike-validated flags on codex-cli 0.147 (NOT --ask-for-approval never).
+      agent_cmd=(codex exec -s workspace-write --skip-git-repo-check -C "$RUN_CWD" "$PROMPT_TEXT")
+      ;;
+    *)
+      echo "unknown runtime: $RUNTIME" >>"$LOG_FILE"
+      return 2
+      ;;
+  esac
+
+  local -a wrap_cmd=()
+  if [ -n "$TIMEOUT_BIN" ]; then
+    wrap_cmd=("$TIMEOUT_BIN" --signal=TERM --kill-after=15s "${TIMEOUT_SEC}s")
+  fi
+
+  # Inject only confirmed requirements.secrets[] via hq secrets exec.
+  # CLI shape: hq secrets [--company S|--personal] exec --only K1,K2 -- <cmd>
+  if [ "${#SECRET_NAMES[@]}" -gt 0 ] && command -v hq >/dev/null 2>&1; then
+    local only_csv=""
+    local sn
+    for sn in "${SECRET_NAMES[@]}"; do
+      if [ -z "$only_csv" ]; then
+        only_csv="$sn"
+      else
+        only_csv="${only_csv},${sn}"
+      fi
+    done
+    local -a secrets_cmd=(hq secrets)
+    if [ -n "$COMPANY" ] && [ "$COMPANY" != "null" ]; then
+      secrets_cmd+=(--company "$COMPANY")
+    else
+      secrets_cmd+=(--personal)
+    fi
+    secrets_cmd+=(exec --only "$only_csv" --script "${BASH_SOURCE[0]}" --)
+    (
+      cd "$RUN_CWD"
+      if [ "${#wrap_cmd[@]}" -gt 0 ]; then
+        "${secrets_cmd[@]}" "${wrap_cmd[@]}" "${agent_cmd[@]}"
+      else
+        "${secrets_cmd[@]}" "${agent_cmd[@]}"
+      fi
+    ) >>"$LOG_FILE" 2>&1 || cmd_rc=$?
+  else
+    if [ "${#SECRET_NAMES[@]}" -gt 0 ]; then
+      echo "warning: requirements.secrets set but hq CLI missing — running without secrets exec" >>"$LOG_FILE"
+    fi
+    (
+      cd "$RUN_CWD"
+      if [ "${#wrap_cmd[@]}" -gt 0 ]; then
+        "${wrap_cmd[@]}" "${agent_cmd[@]}"
+      else
+        "${agent_cmd[@]}"
+      fi
+    ) >>"$LOG_FILE" 2>&1 || cmd_rc=$?
+  fi
+  return "$cmd_rc"
+}
+
+RETRIED=0
+FAILURE_CLASS=""
+NEXT_ACT=""
+
+set +e
+run_agent
+EXIT_CODE=$?
+set -e
+
+finalize_timestamps() {
+  ENDED_AT="$(iso_now)"
+  ENDED_EPOCH="$(epoch_now)"
+  DUR=$((ENDED_EPOCH - STARTED_EPOCH))
+  [ "$DUR" -ge 0 ] || DUR=0
+}
+
+if [ "$EXIT_CODE" -ne 0 ]; then
+  FAILURE_CLASS="$(classify_failure "$EXIT_CODE" "$LOG_FILE" "")"
+  echo "failure_class=$FAILURE_CLASS" >>"$LOG_FILE"
+  REM_OUT="$(call_remediate "$FAILURE_CLASS" "$JOB_ID" "$COMPANY")"
+  echo "remediate=$REM_OUT" >>"$LOG_FILE"
+  NEXT_ACT="$(printf '%s' "$REM_OUT" | jq -r '.next_action // empty')"
+  [ -n "$NEXT_ACT" ] || NEXT_ACT="$(next_action_for_class "$FAILURE_CLASS" "$RUNTIME")"
+  RETRY_REC="$(printf '%s' "$REM_OUT" | jq -r '.retry_recommended // false')"
+  if [ "$RETRY_REC" = "true" ] && [ "$RETRIED" -eq 0 ]; then
+    RETRIED=1
+    echo "remediate_retry=1" >>"$LOG_FILE"
+    log "self-remediate recommended retry for $FAILURE_CLASS — retrying once"
+    set +e
+    run_agent
+    EXIT_CODE=$?
+    set -e
+    if [ "$EXIT_CODE" -ne 0 ]; then
+      FAILURE_CLASS="$(classify_failure "$EXIT_CODE" "$LOG_FILE" "")"
+      echo "failure_class_after_retry=$FAILURE_CLASS" >>"$LOG_FILE"
+      NEXT_ACT="$(next_action_for_class "$FAILURE_CLASS" "$RUNTIME")"
+    else
+      FAILURE_CLASS=""
+      NEXT_ACT=""
+    fi
+  fi
+fi
+
+finalize_timestamps
+
+{
+  echo "ended_at=$ENDED_AT"
+  echo "exit=$EXIT_CODE"
+  echo "duration_seconds=$DUR"
+  echo "retried=$RETRIED"
+  [ -n "$FAILURE_CLASS" ] && echo "failure_class=$FAILURE_CLASS"
+} >>"$LOG_FILE"
+
+printf 'exit=%s\nstarted_at=%s\nended_at=%s\nduration_seconds=%s\nfailure_class=%s\nretried=%s\n' \
+  "$EXIT_CODE" "$STARTED_AT" "$ENDED_AT" "$DUR" "${FAILURE_CLASS:-}" "$RETRIED" >"$STATUS_FILE"
+
+append_meter_marker "$JOB_ID" "$RUNTIME" "$STARTED_AT" "$ENDED_AT" "$EXIT_CODE" "$DUR" ""
+
+RUN_ID="run-${JOB_ID}-${RUN_STAMP}"
+if [ "$EXIT_CODE" -eq 0 ]; then
+  NA_JSON='[]'
+  ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" 0 "null" "$NA_JSON"
+  SUMMARY="completed ok"
+  [ "$RETRIED" -eq 1 ] && SUMMARY="completed ok after self-remediation retry"
+  call_notify "$JOB_ID" "$JOB_NAME" "ok" "$SUMMARY" "$DUR" "$LOG_FILE" \
+    "" "" "$OWNER" "$NOTIFY_MODE"
+  log "job $JOB_ID completed ok (${DUR}s)"
+  exit 0
+fi
+
+NA_JSON="$(jq -nc --arg a "$NEXT_ACT" 'if $a == "" then [] else [$a] end')"
+# Cap last_exit to 0–255 for ingest; preserve real exit for process.
+INGEST_EXIT="$EXIT_CODE"
+if [ "$INGEST_EXIT" -lt 0 ]; then INGEST_EXIT=1; fi
+if [ "$INGEST_EXIT" -gt 255 ]; then INGEST_EXIT=255; fi
+ingest_run_status "$JOB_ID" "$ENDED_AT" "$RUN_ID" "$INGEST_EXIT" "$FAILURE_CLASS" "$NA_JSON"
+SUMMARY="exit=$EXIT_CODE class=$FAILURE_CLASS"
+call_notify "$JOB_ID" "$JOB_NAME" "failed" "$SUMMARY" "$DUR" "$LOG_FILE" \
+  "$FAILURE_CLASS" "$NEXT_ACT" "$OWNER" "$NOTIFY_MODE"
+
+log "job $JOB_ID failed exit=$EXIT_CODE class=$FAILURE_CLASS (${DUR}s) log=$LOG_FILE"
+exit "$EXIT_CODE"