@integrity-labs/agt-cli 0.28.669 → 0.28.671

package/dist/mcp/direct-chat-channel.js

@@ -35912,29 +35912,40 @@ var FLAG_REGISTRY = [
     // write path, not a host's local environment file. One more reason not to
     // canary with it.
     envVar: "AGT_MEMORY_TOMBSTONES_ENABLED",
-    // Deliberately unreachable placeholder: the reader is not published yet.
+    // Pinned to the first PUBLISHED agt-cli whose manager carries a WORKING
+    // reader, verified against the tarball rather than inferred from the merge.
+    // ENG-9229 + ENG-9257 merged as 91a67cb08, but auto-publish patch-bumps
+    // from whatever is on main, so the merge does not name a version: a second
+    // CLI-touching merge landed eight minutes later, and `latest` was already
+    // past our cut by the time anyone looked. What settles it is
+    // `npm pack @integrity-labs/agt-cli@<v>` + grep of
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). 0.28.666 carries NONE of
+    // `_memory-retirement`, `memory-file-tombstones`, `applyMemoryTombstones`,
+    // `memory-retirement-report`; 0.28.667 carries all four.
     //
-    // It must be PARSEABLE and unreachable, not omitted and not garbage.
-    // classifyHostReach (packages/core/src/feature-flags/reach.ts) maps an
-    // empty `since` to `honors` for EVERY host including ones with no reader at
-    // all, and maps an unparseable one to `unknown` — which collides with the
-    // "host reports no agt_version" class, so an operator cannot tell "not
-    // shipped yet" from "these hosts are unreadable". '99.99.99' classifies
-    // every host `stale`, which is the honest pre-publication answer.
+    // ALL FOUR, because this has to name the first build where flipping the
+    // flag does what the flag SAYS, not merely the first build with a reader:
+    // the write-time manifest gate, the tombstone pass sitting above the
+    // download short-circuit, the response hash covering the tombstone list,
+    // and the report-back. Ship a build missing any of those and reach reports
+    // `honors` for hosts that silently never act. Here they shipped in one
+    // merge so they could not be split across versions - that is a property of
+    // this cut, not a guarantee about the next one.
     //
-    // Note '0.29.0' is used elsewhere for the same purpose but is weaker: it is
-    // unreachable only by accident of auto-publish patch-bumping 0.28.x, so one
-    // deliberate minor bump would silently reclassify the whole fleet `honors`.
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, to the first version carrying the CHANGED behaviour, and verify
+    // that one against the tarball too (apps/cli/package.json is not the
+    // published number). See `tool-call-audit` above, where the pin was NOT
+    // moved at such a merge and went stale for a day.
     //
-    // REPLACE IT AT THE **CLI** MERGE, not the API merge — `since` describes
-    // what the HOST can act on — with the published tarball's version (verify
-    // via `npm pack`; apps/cli/package.json is not the published number). And
-    // it must name the first build where flipping the flag does what this flag
-    // SAYS, not merely the first build with a reader: that means the manifest
-    // gate, the tombstone pass sitting above the download short-circuit, and
-    // the response hash covering the tombstone list. Ship a build missing any
-    // of those and reach reports `honors` for hosts that silently never act.
-    since: "99.99.99"
+    // WHY THIS FIELD IS NEVER OMITTED, whatever it is set to. classifyHostReach
+    // (packages/core/src/feature-flags/reach.ts) maps an empty `since` to
+    // `honors` for EVERY host including ones with no reader at all, and maps an
+    // unparseable one to `unknown` - which collides with the "host reports no
+    // agt_version" class, so an operator cannot tell "not shipped yet" from
+    // "these hosts are unreadable". Both outlive this particular version.
+    since: "0.28.667"
   },
   {
     key: "conversation-eval-backend",
@@ -36588,6 +36599,27 @@ var FLAG_REGISTRY = [
     // never auto-attach an integration nobody asked for, and both ENG-8332
     // prerequisites above are still open.
     defaultValue: false
+  },
+  {
+    key: "host-right-sizing",
+    description: 'ADR-0072. Gates the HostRightSizer cron, which evaluates every managed EC2 host against 7 days of memory and CPU and (at enforce) resizes it one rung inside the host\'s own maintenance window. off = the cron returns immediately: nothing is read, nothing is written. shadow = evaluate, persist a verdict row per host, and post the weekly summary \u2014 NO resize, and no actor code runs. enforce = as shadow, plus enqueue resizes. AS OF PHASE 1 (ENG-9324) THERE IS NO ACTOR, SO `enforce` BEHAVES EXACTLY LIKE `shadow`: selecting it records the mode on each verdict row and changes nothing else, and no host is resized. This note comes out when the Phase 3 actor lands; until then treat enforce as shadow-with-a-label, not as an armed fleet. Ships dark: this mechanism ends in a stop/start of a customer production host, so an unreachable flag store must resolve to NOT acting. TWO BOUNDS WORTH KNOWING BEFORE FLIPPING. (1) off is not a stop button for in-flight work \u2014 HostResizeDispatcher reads only ec2_pending_instance_type and knows nothing about this flag, so flipping to off stops new enqueues and lets every already-enqueued host complete its stop/modify/start; combined with the ~5-minute eval cache the true blast unit is one tick of open windows. A real kill switch has to live inside the dispatcher. (2) BYO hosts (ADR-0028) are EXCLUDED in Phase 1, not merely clamped to shadow: their instances live in the customer AWS account while the cron authenticates only with the platform provisioner role, so their metrics read as empty and every evaluation would land as unknown. ADR-0072 \xA79 intends them to be shadow-only ("we recommend; they resize") and making that real needs the per-host cross_account_role_arn resolved - its own slice. Pool hosts (ADR-0042) are excluded too, while host_kind is unset in prod. Both are eligibility predicates applied by the cron, documented here so the admin page showing enforce for such an org is not read as behaviour.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark at `off`, NOT `shadow`. Diverging deliberately from
+    // slack-scheduled-channel-guard, whose shadow is a free local log line:
+    // THIS shadow spends a fleet-wide CloudWatch GetMetricData sweep per tick
+    // and writes a row per host, so defaulting to shadow would newly bill and
+    // newly write for every org that never opted in. shadow is the per-canary
+    // opt-in; enforce is the audited flip after the Phase 2 review.
+    defaultValue: "off",
+    // Evaluated centrally, in the API cron — there is no host-side reader, so
+    // no `since` and no dependence on fleet agt-cli convergence.
+    // NOTE: deliberately NO envVar. ADR-0072 §9 wants this gate scoped per
+    // org/host, and an envVar would be highest-precedence (ADR-0022) — a
+    // literal in sst.config.ts would pin every stage and make the admin page a
+    // control that does nothing, which is the ENG-8303 class exactly.
+    // enforce arms automated downtime on a customer's production host.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/index.js

@@ -42851,29 +42851,40 @@ var FLAG_REGISTRY = [
     // write path, not a host's local environment file. One more reason not to
     // canary with it.
     envVar: "AGT_MEMORY_TOMBSTONES_ENABLED",
-    // Deliberately unreachable placeholder: the reader is not published yet.
+    // Pinned to the first PUBLISHED agt-cli whose manager carries a WORKING
+    // reader, verified against the tarball rather than inferred from the merge.
+    // ENG-9229 + ENG-9257 merged as 91a67cb08, but auto-publish patch-bumps
+    // from whatever is on main, so the merge does not name a version: a second
+    // CLI-touching merge landed eight minutes later, and `latest` was already
+    // past our cut by the time anyone looked. What settles it is
+    // `npm pack @integrity-labs/agt-cli@<v>` + grep of
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). 0.28.666 carries NONE of
+    // `_memory-retirement`, `memory-file-tombstones`, `applyMemoryTombstones`,
+    // `memory-retirement-report`; 0.28.667 carries all four.
     //
-    // It must be PARSEABLE and unreachable, not omitted and not garbage.
-    // classifyHostReach (packages/core/src/feature-flags/reach.ts) maps an
-    // empty `since` to `honors` for EVERY host including ones with no reader at
-    // all, and maps an unparseable one to `unknown` — which collides with the
-    // "host reports no agt_version" class, so an operator cannot tell "not
-    // shipped yet" from "these hosts are unreadable". '99.99.99' classifies
-    // every host `stale`, which is the honest pre-publication answer.
+    // ALL FOUR, because this has to name the first build where flipping the
+    // flag does what the flag SAYS, not merely the first build with a reader:
+    // the write-time manifest gate, the tombstone pass sitting above the
+    // download short-circuit, the response hash covering the tombstone list,
+    // and the report-back. Ship a build missing any of those and reach reports
+    // `honors` for hosts that silently never act. Here they shipped in one
+    // merge so they could not be split across versions - that is a property of
+    // this cut, not a guarantee about the next one.
     //
-    // Note '0.29.0' is used elsewhere for the same purpose but is weaker: it is
-    // unreachable only by accident of auto-publish patch-bumping 0.28.x, so one
-    // deliberate minor bump would silently reclassify the whole fleet `honors`.
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, to the first version carrying the CHANGED behaviour, and verify
+    // that one against the tarball too (apps/cli/package.json is not the
+    // published number). See `tool-call-audit` above, where the pin was NOT
+    // moved at such a merge and went stale for a day.
     //
-    // REPLACE IT AT THE **CLI** MERGE, not the API merge — `since` describes
-    // what the HOST can act on — with the published tarball's version (verify
-    // via `npm pack`; apps/cli/package.json is not the published number). And
-    // it must name the first build where flipping the flag does what this flag
-    // SAYS, not merely the first build with a reader: that means the manifest
-    // gate, the tombstone pass sitting above the download short-circuit, and
-    // the response hash covering the tombstone list. Ship a build missing any
-    // of those and reach reports `honors` for hosts that silently never act.
-    since: "99.99.99"
+    // WHY THIS FIELD IS NEVER OMITTED, whatever it is set to. classifyHostReach
+    // (packages/core/src/feature-flags/reach.ts) maps an empty `since` to
+    // `honors` for EVERY host including ones with no reader at all, and maps an
+    // unparseable one to `unknown` - which collides with the "host reports no
+    // agt_version" class, so an operator cannot tell "not shipped yet" from
+    // "these hosts are unreadable". Both outlive this particular version.
+    since: "0.28.667"
   },
   {
     key: "conversation-eval-backend",
@@ -43527,6 +43538,27 @@ var FLAG_REGISTRY = [
     // never auto-attach an integration nobody asked for, and both ENG-8332
     // prerequisites above are still open.
     defaultValue: false
+  },
+  {
+    key: "host-right-sizing",
+    description: 'ADR-0072. Gates the HostRightSizer cron, which evaluates every managed EC2 host against 7 days of memory and CPU and (at enforce) resizes it one rung inside the host\'s own maintenance window. off = the cron returns immediately: nothing is read, nothing is written. shadow = evaluate, persist a verdict row per host, and post the weekly summary \u2014 NO resize, and no actor code runs. enforce = as shadow, plus enqueue resizes. AS OF PHASE 1 (ENG-9324) THERE IS NO ACTOR, SO `enforce` BEHAVES EXACTLY LIKE `shadow`: selecting it records the mode on each verdict row and changes nothing else, and no host is resized. This note comes out when the Phase 3 actor lands; until then treat enforce as shadow-with-a-label, not as an armed fleet. Ships dark: this mechanism ends in a stop/start of a customer production host, so an unreachable flag store must resolve to NOT acting. TWO BOUNDS WORTH KNOWING BEFORE FLIPPING. (1) off is not a stop button for in-flight work \u2014 HostResizeDispatcher reads only ec2_pending_instance_type and knows nothing about this flag, so flipping to off stops new enqueues and lets every already-enqueued host complete its stop/modify/start; combined with the ~5-minute eval cache the true blast unit is one tick of open windows. A real kill switch has to live inside the dispatcher. (2) BYO hosts (ADR-0028) are EXCLUDED in Phase 1, not merely clamped to shadow: their instances live in the customer AWS account while the cron authenticates only with the platform provisioner role, so their metrics read as empty and every evaluation would land as unknown. ADR-0072 \xA79 intends them to be shadow-only ("we recommend; they resize") and making that real needs the per-host cross_account_role_arn resolved - its own slice. Pool hosts (ADR-0042) are excluded too, while host_kind is unset in prod. Both are eligibility predicates applied by the cron, documented here so the admin page showing enforce for such an org is not read as behaviour.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark at `off`, NOT `shadow`. Diverging deliberately from
+    // slack-scheduled-channel-guard, whose shadow is a free local log line:
+    // THIS shadow spends a fleet-wide CloudWatch GetMetricData sweep per tick
+    // and writes a row per host, so defaulting to shadow would newly bill and
+    // newly write for every org that never opted in. shadow is the per-canary
+    // opt-in; enforce is the audited flip after the Phase 2 review.
+    defaultValue: "off",
+    // Evaluated centrally, in the API cron — there is no host-side reader, so
+    // no `since` and no dependence on fleet agt-cli convergence.
+    // NOTE: deliberately NO envVar. ADR-0072 §9 wants this gate scoped per
+    // org/host, and an envVar would be highest-precedence (ADR-0022) — a
+    // literal in sst.config.ts would pin every stage and make the admin page a
+    // control that does nothing, which is the ENG-8303 class exactly.
+    // enforce arms automated downtime on a customer's production host.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/origami.js

@@ -41662,29 +41662,40 @@ var FLAG_REGISTRY = [
     // write path, not a host's local environment file. One more reason not to
     // canary with it.
     envVar: "AGT_MEMORY_TOMBSTONES_ENABLED",
-    // Deliberately unreachable placeholder: the reader is not published yet.
+    // Pinned to the first PUBLISHED agt-cli whose manager carries a WORKING
+    // reader, verified against the tarball rather than inferred from the merge.
+    // ENG-9229 + ENG-9257 merged as 91a67cb08, but auto-publish patch-bumps
+    // from whatever is on main, so the merge does not name a version: a second
+    // CLI-touching merge landed eight minutes later, and `latest` was already
+    // past our cut by the time anyone looked. What settles it is
+    // `npm pack @integrity-labs/agt-cli@<v>` + grep of
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). 0.28.666 carries NONE of
+    // `_memory-retirement`, `memory-file-tombstones`, `applyMemoryTombstones`,
+    // `memory-retirement-report`; 0.28.667 carries all four.
     //
-    // It must be PARSEABLE and unreachable, not omitted and not garbage.
-    // classifyHostReach (packages/core/src/feature-flags/reach.ts) maps an
-    // empty `since` to `honors` for EVERY host including ones with no reader at
-    // all, and maps an unparseable one to `unknown` — which collides with the
-    // "host reports no agt_version" class, so an operator cannot tell "not
-    // shipped yet" from "these hosts are unreadable". '99.99.99' classifies
-    // every host `stale`, which is the honest pre-publication answer.
+    // ALL FOUR, because this has to name the first build where flipping the
+    // flag does what the flag SAYS, not merely the first build with a reader:
+    // the write-time manifest gate, the tombstone pass sitting above the
+    // download short-circuit, the response hash covering the tombstone list,
+    // and the report-back. Ship a build missing any of those and reach reports
+    // `honors` for hosts that silently never act. Here they shipped in one
+    // merge so they could not be split across versions - that is a property of
+    // this cut, not a guarantee about the next one.
     //
-    // Note '0.29.0' is used elsewhere for the same purpose but is weaker: it is
-    // unreachable only by accident of auto-publish patch-bumping 0.28.x, so one
-    // deliberate minor bump would silently reclassify the whole fleet `honors`.
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, to the first version carrying the CHANGED behaviour, and verify
+    // that one against the tarball too (apps/cli/package.json is not the
+    // published number). See `tool-call-audit` above, where the pin was NOT
+    // moved at such a merge and went stale for a day.
     //
-    // REPLACE IT AT THE **CLI** MERGE, not the API merge — `since` describes
-    // what the HOST can act on — with the published tarball's version (verify
-    // via `npm pack`; apps/cli/package.json is not the published number). And
-    // it must name the first build where flipping the flag does what this flag
-    // SAYS, not merely the first build with a reader: that means the manifest
-    // gate, the tombstone pass sitting above the download short-circuit, and
-    // the response hash covering the tombstone list. Ship a build missing any
-    // of those and reach reports `honors` for hosts that silently never act.
-    since: "99.99.99"
+    // WHY THIS FIELD IS NEVER OMITTED, whatever it is set to. classifyHostReach
+    // (packages/core/src/feature-flags/reach.ts) maps an empty `since` to
+    // `honors` for EVERY host including ones with no reader at all, and maps an
+    // unparseable one to `unknown` - which collides with the "host reports no
+    // agt_version" class, so an operator cannot tell "not shipped yet" from
+    // "these hosts are unreadable". Both outlive this particular version.
+    since: "0.28.667"
   },
   {
     key: "conversation-eval-backend",
@@ -42338,6 +42349,27 @@ var FLAG_REGISTRY = [
     // never auto-attach an integration nobody asked for, and both ENG-8332
     // prerequisites above are still open.
     defaultValue: false
+  },
+  {
+    key: "host-right-sizing",
+    description: 'ADR-0072. Gates the HostRightSizer cron, which evaluates every managed EC2 host against 7 days of memory and CPU and (at enforce) resizes it one rung inside the host\'s own maintenance window. off = the cron returns immediately: nothing is read, nothing is written. shadow = evaluate, persist a verdict row per host, and post the weekly summary \u2014 NO resize, and no actor code runs. enforce = as shadow, plus enqueue resizes. AS OF PHASE 1 (ENG-9324) THERE IS NO ACTOR, SO `enforce` BEHAVES EXACTLY LIKE `shadow`: selecting it records the mode on each verdict row and changes nothing else, and no host is resized. This note comes out when the Phase 3 actor lands; until then treat enforce as shadow-with-a-label, not as an armed fleet. Ships dark: this mechanism ends in a stop/start of a customer production host, so an unreachable flag store must resolve to NOT acting. TWO BOUNDS WORTH KNOWING BEFORE FLIPPING. (1) off is not a stop button for in-flight work \u2014 HostResizeDispatcher reads only ec2_pending_instance_type and knows nothing about this flag, so flipping to off stops new enqueues and lets every already-enqueued host complete its stop/modify/start; combined with the ~5-minute eval cache the true blast unit is one tick of open windows. A real kill switch has to live inside the dispatcher. (2) BYO hosts (ADR-0028) are EXCLUDED in Phase 1, not merely clamped to shadow: their instances live in the customer AWS account while the cron authenticates only with the platform provisioner role, so their metrics read as empty and every evaluation would land as unknown. ADR-0072 \xA79 intends them to be shadow-only ("we recommend; they resize") and making that real needs the per-host cross_account_role_arn resolved - its own slice. Pool hosts (ADR-0042) are excluded too, while host_kind is unset in prod. Both are eligibility predicates applied by the cron, documented here so the admin page showing enforce for such an org is not read as behaviour.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark at `off`, NOT `shadow`. Diverging deliberately from
+    // slack-scheduled-channel-guard, whose shadow is a free local log line:
+    // THIS shadow spends a fleet-wide CloudWatch GetMetricData sweep per tick
+    // and writes a row per host, so defaulting to shadow would newly bill and
+    // newly write for every org that never opted in. shadow is the per-canary
+    // opt-in; enforce is the audited flip after the Phase 2 review.
+    defaultValue: "off",
+    // Evaluated centrally, in the API cron — there is no host-side reader, so
+    // no `since` and no dependence on fleet agt-cli convergence.
+    // NOTE: deliberately NO envVar. ADR-0072 §9 wants this gate scoped per
+    // org/host, and an envVar would be highest-precedence (ADR-0022) — a
+    // literal in sst.config.ts would pin every stage and make the admin page a
+    // control that does nothing, which is the ENG-8303 class exactly.
+    // enforce arms automated downtime on a customer's production host.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/slack-channel.js

@@ -36145,29 +36145,40 @@ var FLAG_REGISTRY = [
     // write path, not a host's local environment file. One more reason not to
     // canary with it.
     envVar: "AGT_MEMORY_TOMBSTONES_ENABLED",
-    // Deliberately unreachable placeholder: the reader is not published yet.
+    // Pinned to the first PUBLISHED agt-cli whose manager carries a WORKING
+    // reader, verified against the tarball rather than inferred from the merge.
+    // ENG-9229 + ENG-9257 merged as 91a67cb08, but auto-publish patch-bumps
+    // from whatever is on main, so the merge does not name a version: a second
+    // CLI-touching merge landed eight minutes later, and `latest` was already
+    // past our cut by the time anyone looked. What settles it is
+    // `npm pack @integrity-labs/agt-cli@<v>` + grep of
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). 0.28.666 carries NONE of
+    // `_memory-retirement`, `memory-file-tombstones`, `applyMemoryTombstones`,
+    // `memory-retirement-report`; 0.28.667 carries all four.
     //
-    // It must be PARSEABLE and unreachable, not omitted and not garbage.
-    // classifyHostReach (packages/core/src/feature-flags/reach.ts) maps an
-    // empty `since` to `honors` for EVERY host including ones with no reader at
-    // all, and maps an unparseable one to `unknown` — which collides with the
-    // "host reports no agt_version" class, so an operator cannot tell "not
-    // shipped yet" from "these hosts are unreadable". '99.99.99' classifies
-    // every host `stale`, which is the honest pre-publication answer.
+    // ALL FOUR, because this has to name the first build where flipping the
+    // flag does what the flag SAYS, not merely the first build with a reader:
+    // the write-time manifest gate, the tombstone pass sitting above the
+    // download short-circuit, the response hash covering the tombstone list,
+    // and the report-back. Ship a build missing any of those and reach reports
+    // `honors` for hosts that silently never act. Here they shipped in one
+    // merge so they could not be split across versions - that is a property of
+    // this cut, not a guarantee about the next one.
     //
-    // Note '0.29.0' is used elsewhere for the same purpose but is weaker: it is
-    // unreachable only by accident of auto-publish patch-bumping 0.28.x, so one
-    // deliberate minor bump would silently reclassify the whole fleet `honors`.
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, to the first version carrying the CHANGED behaviour, and verify
+    // that one against the tarball too (apps/cli/package.json is not the
+    // published number). See `tool-call-audit` above, where the pin was NOT
+    // moved at such a merge and went stale for a day.
     //
-    // REPLACE IT AT THE **CLI** MERGE, not the API merge — `since` describes
-    // what the HOST can act on — with the published tarball's version (verify
-    // via `npm pack`; apps/cli/package.json is not the published number). And
-    // it must name the first build where flipping the flag does what this flag
-    // SAYS, not merely the first build with a reader: that means the manifest
-    // gate, the tombstone pass sitting above the download short-circuit, and
-    // the response hash covering the tombstone list. Ship a build missing any
-    // of those and reach reports `honors` for hosts that silently never act.
-    since: "99.99.99"
+    // WHY THIS FIELD IS NEVER OMITTED, whatever it is set to. classifyHostReach
+    // (packages/core/src/feature-flags/reach.ts) maps an empty `since` to
+    // `honors` for EVERY host including ones with no reader at all, and maps an
+    // unparseable one to `unknown` - which collides with the "host reports no
+    // agt_version" class, so an operator cannot tell "not shipped yet" from
+    // "these hosts are unreadable". Both outlive this particular version.
+    since: "0.28.667"
   },
   {
     key: "conversation-eval-backend",
@@ -36821,6 +36832,27 @@ var FLAG_REGISTRY = [
     // never auto-attach an integration nobody asked for, and both ENG-8332
     // prerequisites above are still open.
     defaultValue: false
+  },
+  {
+    key: "host-right-sizing",
+    description: 'ADR-0072. Gates the HostRightSizer cron, which evaluates every managed EC2 host against 7 days of memory and CPU and (at enforce) resizes it one rung inside the host\'s own maintenance window. off = the cron returns immediately: nothing is read, nothing is written. shadow = evaluate, persist a verdict row per host, and post the weekly summary \u2014 NO resize, and no actor code runs. enforce = as shadow, plus enqueue resizes. AS OF PHASE 1 (ENG-9324) THERE IS NO ACTOR, SO `enforce` BEHAVES EXACTLY LIKE `shadow`: selecting it records the mode on each verdict row and changes nothing else, and no host is resized. This note comes out when the Phase 3 actor lands; until then treat enforce as shadow-with-a-label, not as an armed fleet. Ships dark: this mechanism ends in a stop/start of a customer production host, so an unreachable flag store must resolve to NOT acting. TWO BOUNDS WORTH KNOWING BEFORE FLIPPING. (1) off is not a stop button for in-flight work \u2014 HostResizeDispatcher reads only ec2_pending_instance_type and knows nothing about this flag, so flipping to off stops new enqueues and lets every already-enqueued host complete its stop/modify/start; combined with the ~5-minute eval cache the true blast unit is one tick of open windows. A real kill switch has to live inside the dispatcher. (2) BYO hosts (ADR-0028) are EXCLUDED in Phase 1, not merely clamped to shadow: their instances live in the customer AWS account while the cron authenticates only with the platform provisioner role, so their metrics read as empty and every evaluation would land as unknown. ADR-0072 \xA79 intends them to be shadow-only ("we recommend; they resize") and making that real needs the per-host cross_account_role_arn resolved - its own slice. Pool hosts (ADR-0042) are excluded too, while host_kind is unset in prod. Both are eligibility predicates applied by the cron, documented here so the admin page showing enforce for such an org is not read as behaviour.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark at `off`, NOT `shadow`. Diverging deliberately from
+    // slack-scheduled-channel-guard, whose shadow is a free local log line:
+    // THIS shadow spends a fleet-wide CloudWatch GetMetricData sweep per tick
+    // and writes a row per host, so defaulting to shadow would newly bill and
+    // newly write for every org that never opted in. shadow is the per-canary
+    // opt-in; enforce is the audited flip after the Phase 2 review.
+    defaultValue: "off",
+    // Evaluated centrally, in the API cron — there is no host-side reader, so
+    // no `since` and no dependence on fleet agt-cli convergence.
+    // NOTE: deliberately NO envVar. ADR-0072 §9 wants this gate scoped per
+    // org/host, and an envVar would be highest-precedence (ADR-0022) — a
+    // literal in sst.config.ts would pin every stage and make the admin page a
+    // control that does nothing, which is the ENG-8303 class exactly.
+    // enforce arms automated downtime on a customer's production host.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/telegram-channel.js

@@ -36289,29 +36289,40 @@ var FLAG_REGISTRY = [
     // write path, not a host's local environment file. One more reason not to
     // canary with it.
     envVar: "AGT_MEMORY_TOMBSTONES_ENABLED",
-    // Deliberately unreachable placeholder: the reader is not published yet.
+    // Pinned to the first PUBLISHED agt-cli whose manager carries a WORKING
+    // reader, verified against the tarball rather than inferred from the merge.
+    // ENG-9229 + ENG-9257 merged as 91a67cb08, but auto-publish patch-bumps
+    // from whatever is on main, so the merge does not name a version: a second
+    // CLI-touching merge landed eight minutes later, and `latest` was already
+    // past our cut by the time anyone looked. What settles it is
+    // `npm pack @integrity-labs/agt-cli@<v>` + grep of
+    // package/dist/lib/manager-worker.js (the manager is the actual reader; the
+    // dist/mcp/* occurrences are bundling artifacts). 0.28.666 carries NONE of
+    // `_memory-retirement`, `memory-file-tombstones`, `applyMemoryTombstones`,
+    // `memory-retirement-report`; 0.28.667 carries all four.
     //
-    // It must be PARSEABLE and unreachable, not omitted and not garbage.
-    // classifyHostReach (packages/core/src/feature-flags/reach.ts) maps an
-    // empty `since` to `honors` for EVERY host including ones with no reader at
-    // all, and maps an unparseable one to `unknown` — which collides with the
-    // "host reports no agt_version" class, so an operator cannot tell "not
-    // shipped yet" from "these hosts are unreadable". '99.99.99' classifies
-    // every host `stale`, which is the honest pre-publication answer.
+    // ALL FOUR, because this has to name the first build where flipping the
+    // flag does what the flag SAYS, not merely the first build with a reader:
+    // the write-time manifest gate, the tombstone pass sitting above the
+    // download short-circuit, the response hash covering the tombstone list,
+    // and the report-back. Ship a build missing any of those and reach reports
+    // `honors` for hosts that silently never act. Here they shipped in one
+    // merge so they could not be split across versions - that is a property of
+    // this cut, not a guarantee about the next one.
     //
-    // Note '0.29.0' is used elsewhere for the same purpose but is weaker: it is
-    // unreachable only by accident of auto-publish patch-bumping 0.28.x, so one
-    // deliberate minor bump would silently reclassify the whole fleet `honors`.
+    // MOVE THIS PIN whenever a change alters what arming the flag DOES on a
+    // host, to the first version carrying the CHANGED behaviour, and verify
+    // that one against the tarball too (apps/cli/package.json is not the
+    // published number). See `tool-call-audit` above, where the pin was NOT
+    // moved at such a merge and went stale for a day.
     //
-    // REPLACE IT AT THE **CLI** MERGE, not the API merge — `since` describes
-    // what the HOST can act on — with the published tarball's version (verify
-    // via `npm pack`; apps/cli/package.json is not the published number). And
-    // it must name the first build where flipping the flag does what this flag
-    // SAYS, not merely the first build with a reader: that means the manifest
-    // gate, the tombstone pass sitting above the download short-circuit, and
-    // the response hash covering the tombstone list. Ship a build missing any
-    // of those and reach reports `honors` for hosts that silently never act.
-    since: "99.99.99"
+    // WHY THIS FIELD IS NEVER OMITTED, whatever it is set to. classifyHostReach
+    // (packages/core/src/feature-flags/reach.ts) maps an empty `since` to
+    // `honors` for EVERY host including ones with no reader at all, and maps an
+    // unparseable one to `unknown` - which collides with the "host reports no
+    // agt_version" class, so an operator cannot tell "not shipped yet" from
+    // "these hosts are unreadable". Both outlive this particular version.
+    since: "0.28.667"
   },
   {
     key: "conversation-eval-backend",
@@ -36965,6 +36976,27 @@ var FLAG_REGISTRY = [
     // never auto-attach an integration nobody asked for, and both ENG-8332
     // prerequisites above are still open.
     defaultValue: false
+  },
+  {
+    key: "host-right-sizing",
+    description: 'ADR-0072. Gates the HostRightSizer cron, which evaluates every managed EC2 host against 7 days of memory and CPU and (at enforce) resizes it one rung inside the host\'s own maintenance window. off = the cron returns immediately: nothing is read, nothing is written. shadow = evaluate, persist a verdict row per host, and post the weekly summary \u2014 NO resize, and no actor code runs. enforce = as shadow, plus enqueue resizes. AS OF PHASE 1 (ENG-9324) THERE IS NO ACTOR, SO `enforce` BEHAVES EXACTLY LIKE `shadow`: selecting it records the mode on each verdict row and changes nothing else, and no host is resized. This note comes out when the Phase 3 actor lands; until then treat enforce as shadow-with-a-label, not as an armed fleet. Ships dark: this mechanism ends in a stop/start of a customer production host, so an unreachable flag store must resolve to NOT acting. TWO BOUNDS WORTH KNOWING BEFORE FLIPPING. (1) off is not a stop button for in-flight work \u2014 HostResizeDispatcher reads only ec2_pending_instance_type and knows nothing about this flag, so flipping to off stops new enqueues and lets every already-enqueued host complete its stop/modify/start; combined with the ~5-minute eval cache the true blast unit is one tick of open windows. A real kill switch has to live inside the dispatcher. (2) BYO hosts (ADR-0028) are EXCLUDED in Phase 1, not merely clamped to shadow: their instances live in the customer AWS account while the cron authenticates only with the platform provisioner role, so their metrics read as empty and every evaluation would land as unknown. ADR-0072 \xA79 intends them to be shadow-only ("we recommend; they resize") and making that real needs the per-host cross_account_role_arn resolved - its own slice. Pool hosts (ADR-0042) are excluded too, while host_kind is unset in prod. Both are eligibility predicates applied by the cron, documented here so the admin page showing enforce for such an org is not read as behaviour.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark at `off`, NOT `shadow`. Diverging deliberately from
+    // slack-scheduled-channel-guard, whose shadow is a free local log line:
+    // THIS shadow spends a fleet-wide CloudWatch GetMetricData sweep per tick
+    // and writes a row per host, so defaulting to shadow would newly bill and
+    // newly write for every org that never opted in. shadow is the per-canary
+    // opt-in; enforce is the audited flip after the Phase 2 review.
+    defaultValue: "off",
+    // Evaluated centrally, in the API cron — there is no host-side reader, so
+    // no `since` and no dependence on fleet agt-cli convergence.
+    // NOTE: deliberately NO envVar. ADR-0072 §9 wants this gate scoped per
+    // org/host, and an envVar would be highest-precedence (ADR-0022) — a
+    // literal in sst.config.ts would pin every stage and make the admin page a
+    // control that does nothing, which is the ENG-8303 class exactly.
+    // enforce arms automated downtime on a customer's production host.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/{persistent-session-4LP3DQ5U.js → persistent-session-LTFB4M53.js}

@@ -43,8 +43,8 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-U5EI5SXJ.js";
-import "./chunk-4GA4K2BF.js";
+} from "./chunk-57XP5OG6.js";
+import "./chunk-DWFN5PMF.js";
 import "./chunk-XWVM4KPK.js";
 export {
   EGRESS_BASELINE_DOMAINS,
@@ -92,4 +92,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-4LP3DQ5U.js.map
+//# sourceMappingURL=persistent-session-LTFB4M53.js.map

package/dist/{responsiveness-probe-P3GHBH2Y.js → responsiveness-probe-P2S3UMRE.js}

@@ -1,7 +1,7 @@
 import {
   paneLogPath
-} from "./chunk-U5EI5SXJ.js";
-import "./chunk-4GA4K2BF.js";
+} from "./chunk-57XP5OG6.js";
+import "./chunk-DWFN5PMF.js";
 import "./chunk-XWVM4KPK.js";
 
 // src/lib/responsiveness-probe.ts
@@ -727,4 +727,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-P3GHBH2Y.js.map
+//# sourceMappingURL=responsiveness-probe-P2S3UMRE.js.map

package/dist/{session-auth-dead-3QN24ELV.js → session-auth-dead-YHSQBOB4.js}

@@ -1,6 +1,6 @@
 import {
   sessionTranscriptDir
-} from "./chunk-4GA4K2BF.js";
+} from "./chunk-DWFN5PMF.js";
 
 // src/lib/session-auth-dead.ts
 import { closeSync, openSync, readSync, readdirSync, statSync } from "fs";
@@ -203,4 +203,4 @@ export {
   decideSessionAuthState,
   probeSessionAuth
 };
-//# sourceMappingURL=session-auth-dead-3QN24ELV.js.map
+//# sourceMappingURL=session-auth-dead-YHSQBOB4.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/agt-cli",
-  "version": "0.28.669",
+  "version": "0.28.671",
   "description": "Augmented Team CLI — agent provisioning and management",
   "type": "module",
   "engines": {