@intentic/sandbox-contract 1.312.0 → 1.314.0

package/src/schemas/workspace/mainline.ts

@@ -14,6 +14,20 @@ export const MainlineLandSchema = z.object({
 });
 export type MainlineLand = z.infer<typeof MainlineLandSchema>;
 
+// A land a red is laid at, as a reader names it.
+export const MainlineLandRefSchema = z.object({
+    conversationId: z.string().describe("The conversation whose work landed."),
+    title: z.string().optional().describe("Its title when it landed."),
+});
+export type MainlineLandRef = z.infer<typeof MainlineLandRefSchema>;
+
+// One failure a run named, split the way a reader scans it.
+export const MainlineFailureSchema = z.object({
+    name: z.string().describe("What failed: a test by its own name, anything else (a type error, a whole task) as the check printed it."),
+    path: z.string().optional().describe("The repository path it failed in, when it names one."),
+});
+export type MainlineFailure = z.infer<typeof MainlineFailureSchema>;
+
 // What happened to a red verdict's failures, decided once the lands behind it had their own check.
 export const MainlineRoutingKindSchema = z.enum([
     // More work landed while this ran; the check that measures it decides, so nobody is sent after a failure it may fix.
@@ -30,6 +44,8 @@ export const MainlineRoutingKindSchema = z.enum([
     "resolved",
     // The sends and fresh attempts a red streak allows are used up; it waits for a person.
     "spent",
+    // A person set findings aside as not to be fixed (`findings` names which); what a push left is the owner's to dismiss.
+    "dismissed",
 ]);
 export type MainlineRoutingKind = z.infer<typeof MainlineRoutingKindSchema>;
 
@@ -41,6 +57,10 @@ export const MainlineRoutingSchema = z.object({
         .describe("The conversation working on them (the original or a fresh one), or the one still working that the repair waits for."),
     at: z.number().describe("When that was decided, in milliseconds."),
     detail: z.string().optional().describe("One sentence on why, in the sandbox's words."),
+    findings: z
+        .array(z.string())
+        .optional()
+        .describe("The findings it was about, by id, when it was about some of a red's findings rather than the whole red."),
 });
 export type MainlineRouting = z.infer<typeof MainlineRoutingSchema>;
 
@@ -61,6 +81,16 @@ export const MainlineRunSchema = z.object({
         .array(z.string())
         .optional()
         .describe("The conversations whose lands these failures were laid at, when any could be named."),
+    named: z
+        .boolean()
+        .optional()
+        .describe(
+            "Whether the failures were laid at the suspects by the paths they changed. False when nobody could be told apart (every land the run covered is a suspect) or nothing new failed in it (none is). Absent on green, and from a daemon that did not say.",
+        ),
+    units: z
+        .array(MainlineFailureSchema)
+        .optional()
+        .describe("The same first failures, split into a name and the path they failed in. Absent from a daemon that does not split them."),
     routing: MainlineRoutingSchema.optional().describe("What became of a red run's failures. Absent on green, and until it is decided."),
 });
 export type MainlineRun = z.infer<typeof MainlineRunSchema>;
@@ -76,53 +106,82 @@ export const MainlineProjectSchema = z.object({
         })
         .optional()
         .describe("The check running on it now, if any."),
+    session: z
+        .string()
+        .optional()
+        .describe("The terminal session its check runs in, running or last, to attach to for the whole log. Absent from a daemon that does not say."),
     queued: z.array(MainlineLandSchema).describe("Lands waiting for the next check, which will measure them together."),
     last: MainlineRunSchema.optional().describe("Its most recent settled check."),
     redSince: z.number().optional().describe("When its checks went red and stayed so, in milliseconds. Absent while green."),
+    red: z
+        .object({
+            since: z.number().describe("When its checks went red and stayed so, in milliseconds."),
+            cause: z
+                .array(MainlineLandRefSchema)
+                .describe("The work this red is laid at, oldest first: the lands its failures were laid at on the latest run of the streak that could name any. Empty when none could be."),
+            named: z.boolean().describe("Whether `cause` was narrowed by the paths the lands changed; false when it is every land the run covered."),
+            fixer: MainlineRoutingSchema.optional().describe("The latest decision about who has it. Absent until one is made."),
+        })
+        .optional()
+        .describe("The red streak it is in, as the sandbox laid it. Absent while green, and from a daemon that does not lay it."),
 });
 export type MainlineProject = z.infer<typeof MainlineProjectSchema>;
 
 
 // WHAT A PUSH LEFT BEHIND. The pre-push hook never refuses (verify-push.mjs, `--advisory`): it measures, reports, and the
 // push goes. What it found used to vanish with the terminal it printed to. It now leaves a report in the repository's
-// git dir, the daemon files it here once the push has actually reached the remote, and each finding waits until a later
-// measurement no longer prints it or somebody dismisses it. Nobody is sent after one: acting on it is the owner's call.
-
-// What measured a finding: one of the repository's checks (by id), the linter, the assertion ratchet, the
-// manifest/lockfile lockstep, or rustfmt. Only a check's or the linter's finding can be measured again; the other three
-// are about the pushed commits themselves, so they end only when dismissed.
-export const PushFindingKindSchema = z.enum(["check", "lint", "ratchet", "lockstep", "rustfmt"]);
-export type PushFindingKind = z.infer<typeof PushFindingKindSchema>;
-
-export const PushFindingStateSchema = z.enum([
-    // Still printed at the last measurement, and nobody has dismissed it.
-    "open",
-    // A later push, recheck or land check measured it and it was gone.
-    "resolved",
-    // Somebody decided it will not be fixed.
-    "dismissed",
-]);
-export type PushFindingState = z.infer<typeof PushFindingStateSchema>;
+// git dir, the daemon files it once the push has actually reached the remote, and what it found is owed, as the
+// project's push Red, until a later measurement no longer prints it or somebody dismisses it. Nobody is sent after it:
+// acting on it is the owner's call (RED_POLICY).
 
-export const PushFindingSchema = z.object({
-    id: z.string().describe("Stable across pushes: the same problem found again is the same id."),
-    kind: PushFindingKindSchema.describe("What measured it."),
-    check: z.string().optional().describe("The check's own id, for a check's finding."),
+// ONE FINDING, whatever measured it: a check run's line as the repository's own tooling printed it, named by what
+// printed it (`source`, the repository's word: a check's id, `lint`, a hook), with the command that shows it again and
+// whether a later measurement can say it is gone. A push's findings are these; a land check's failures and a CI run's
+// failed jobs become them too.
+export const FindingSchema = z.object({
+    id: z.string().describe("Stable across measurements: the same problem found again is the same id."),
+    source: z.string().describe("What measured it, in the repository's own words: a check's id, `lint`, a hook."),
+    text: z.string().describe("The finding as it was printed."),
+    path: z.string().optional().describe("The repository path it is about, when it names one."),
+    command: z.string().optional().describe("The command that shows it again."),
+    recheckable: z
+        .boolean()
+        .describe("Whether a later measurement can find it gone. False for one about commits already made, which ends only when dismissed."),
     gate: z
         .enum(["code", "tidy"])
         .optional()
-        .describe("For a check's finding: `code` means the tree fails the check whoever caused it; `tidy` means the push added this line."),
-    text: z.string().describe("The finding as the check printed it."),
-    command: z.string().optional().describe("The command that shows it again."),
+        .describe("For a check's finding: `code` means the tree fails the check whoever caused it; `tidy` means the change measured added this line."),
     commit: z
         .object({ sha: z.string(), subject: z.string() })
         .optional()
-        .describe("The newest pushed commit that touched the path the finding names, when it names one."),
-    state: PushFindingStateSchema,
-    settledAt: z.number().optional().describe("When it was resolved or dismissed, in milliseconds."),
+        .describe("The newest commit of the change measured that touched the path it names, when it names one."),
 });
-export type PushFinding = z.infer<typeof PushFindingSchema>;
+export type Finding = z.infer<typeof FindingSchema>;
+
+// ONE RED, whatever went red: a land check's project, what a push left in a project, main's CI on a branch. What it owes
+// (its findings), who it was laid at and whether that was narrowed, and every decision about it, oldest first. Each
+// source answers its own red by its own policy (RED_POLICY); the record is the same.
+export const RedSourceSchema = z.enum(["land", "push", "ci"]);
+export type RedSource = z.infer<typeof RedSourceSchema>;
 
+// Who answers a red: `route` sends it itself (the land check's router, conversations/land/land-breakage.ts), `owner`
+// waits for a person's press (what a push left, conversations/fix/push-fix.ts), `fix-agent` starts the source's own fix
+// agent once the red is main's standing word (CI, ci/repair-gate.ts).
+export const RED_POLICY = { land: "route", push: "owner", ci: "fix-agent" } as const satisfies Record<RedSource, "route" | "owner" | "fix-agent">;
+
+export const RedSchema = z.object({
+    source: RedSourceSchema.describe("What went red."),
+    scope: z.string().describe("Where: a project's folder, or a repository and branch."),
+    since: z.number().describe("When the red streak began (state/red-streak.ts)."),
+    findings: z.array(FindingSchema).default([]).describe("What it owes, as the red's own measurement named it."),
+    suspects: z.array(z.string()).default([]).describe("The conversations it was laid at."),
+    named: z.boolean().default(false).describe("Whether the paths they changed narrowed it to them."),
+    decisions: z.array(MainlineRoutingSchema).default([]).describe("What was decided about it, oldest first."),
+});
+export type Red = z.infer<typeof RedSchema>;
+
+// ONE PUSH THE HOOK MEASURED, as the record lists it: where it went and what it found that it brought in. What of that is
+// still owed is the project's push Red's to say (`findings`), never the push's.
 export const MainlinePushSchema = z.object({
     project: z.string().describe("Which project, by folder relative to the workspace. Empty is the workspace root."),
     id: z.string().describe("The report's own id."),
@@ -132,18 +191,29 @@ export const MainlinePushSchema = z.object({
     base: z.string().optional().describe("The commit the pushed range starts from; absent when the remote had nothing to compare with."),
     head: z.string().describe("The commit that was pushed."),
     commits: z.number().describe("How many commits the push carried."),
-    findings: z.array(PushFindingSchema).describe("What it found that this push brought in, open or not. Empty for a clean push."),
-    measuredAt: z.number().optional().describe("When its findings were last measured again, in milliseconds."),
+    findings: z
+        .array(FindingSchema)
+        .describe("What it found that this push brought in, less what an earlier push had already left open. Empty for a clean push."),
+    refused: z
+        .boolean()
+        .optional()
+        .describe("True when the repository's own pre-push hook refused it, so nothing reached the remote and its one finding is what the hook said."),
 });
 export type MainlinePush = z.infer<typeof MainlinePushSchema>;
 
 export const MainlineStatusSchema = z.object({
     projects: z.array(MainlineProjectSchema).describe("Every project a land has been checked in, or is waiting to be."),
     recent: z.array(MainlineRunSchema).describe("The latest settled checks across every project, newest first."),
-    pushes: z
+    pushed: z
         .array(MainlinePushSchema)
         .optional()
-        .describe("The latest push checks across every project, newest first, with what each left behind. Absent from a daemon that records none."),
+        .describe("The latest pushes the hook measured across every project, newest first, with what each brought in. Absent from a daemon that records none."),
+    reds: z
+        .array(RedSchema)
+        .optional()
+        .describe(
+            "Every red the main line holds, one record whatever went red: each red project's land check and what pushes left in each project, with what each owes and every decision about it. Absent from a daemon that keeps none.",
+        ),
 });
 export type MainlineStatus = z.infer<typeof MainlineStatusSchema>;
 
@@ -187,15 +257,12 @@ export const MainlinePushFixResultSchema = z.object({
     conversationId: z.string().describe("The conversation holding the findings. Open it to watch."),
 });
 
-// The oldest push in `project` that still has an open finding: what a hand-over is keyed by, so pressing again while
-// any of its findings stand continues the same attempt, and a backlog that starts after everything was handled starts
-// a fresh one.
-export const oldestOpenPush = (pushes: readonly MainlinePush[], project: string): MainlinePush | undefined =>
-    pushes.findLast((push) => push.project === project && push.findings.some((finding) => finding.state === "open"));
+// What pushes left in `project`, as the reds name it; undefined while nothing is owed.
+export const pushRedOf = (reds: readonly Red[] | undefined, project: string): Red | undefined =>
+    reds?.find((red) => red.source === "push" && red.scope === project);
 
-// The conversation id a hand-over of `project`'s open push findings wears (attempt 1), derived so the editor and the
-// daemon agree on whether an agent is already on them; undefined when nothing is open.
-export const pushFindingsFixBase = (pushes: readonly MainlinePush[], project: string): string | undefined => {
-    const oldest = oldestOpenPush(pushes, project);
-    return oldest === undefined ? undefined : pushFixConversationId(project === "" ? "workspace" : project, `left:${oldest.head}`);
-};
+// The conversation id a hand-over of a push red wears (attempt 1), derived from when the red began, so the editor and the
+// daemon agree on whether an agent is already on it: pressing again while anything is owed continues the same attempt,
+// and a red that begins after everything was handled starts a fresh one. Undefined when nothing is owed.
+export const pushFixBase = (red: Pick<Red, "scope" | "since"> | undefined): string | undefined =>
+    red === undefined ? undefined : pushFixConversationId(red.scope === "" ? "workspace" : red.scope, `red:${red.since}`);

package/src/state/contract-lock.test.ts

@@ -1,20 +1,81 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { shrunkSurfaces } from "@intentic/constants/contract-shrink";
 import { packageRoot } from "@intentic/constants/node";
-import { currentLock } from "./contract-lock.js";
+import { RAW_ROUTE_LIST } from "../protocol/raw-routes.js";
+import type { RouteMeta } from "../protocol/route-meta.js";
+import { accessChanges, currentLock, serializeLock } from "./contract-lock.js";
+
+const committedText = (): string => readFileSync(join(packageRoot(import.meta.url), "contract.lock.json"), "utf8");
+
+const ACCESS_MOVED =
+    "a route's access moved — run `pnpm --filter @intentic/sandbox-contract lock` and commit contract.lock.json with this change. " +
+    "Any change to an existing route's reach (a lower floor, a guest, agent, panel or sync grant, a wider control rung, or a " +
+    "tighter one that locks callers out) lands as a `type!:` commit with a `Breaking-Note:` trailer saying who can now reach " +
+    "what, or who no longer can.";
 
 // contract.lock.json must match the exported schemas; the git-aware half of this check lives in contract-shrink.mjs.
 // Needs 30s: serializing ~500 schemas can run past the unit hang detector under load.
 test(
     "contract.lock.json matches the schemas this package exports",
     () => {
-        const committed = JSON.parse(readFileSync(join(packageRoot(import.meta.url), "contract.lock.json"), "utf8")) as Record<string, unknown>;
+        const committed = committedText();
+        const current = currentLock();
+        // Named first, so a reach change says which route before the whole-lock diff does.
+        expect(accessChanges(committed, serializeLock(current)), ACCESS_MOVED).toEqual([]);
         expect(
-            currentLock(),
+            current,
             "the wire contract moved — run `pnpm --filter @intentic/sandbox-contract lock` and commit contract.lock.json with this change. " +
                 "If a schema or field was removed or changed (not added), land it as a `type!:` commit with a `Breaking-Note:` trailer " +
                 "saying, in the user's words, what stops working and what to do instead.",
-        ).toEqual(committed);
+        ).toEqual(JSON.parse(committed));
     },
     { timeout: 30_000 },
 );
+
+// The wire outside oRPC is pinned the same way: a changed tunnel path, a gone control message or a renamed verdict is a
+// shrink the push gate and the landing draft both flag, where before nothing could see it.
+test("the lock flags a change to the wire no oRPC route carries", () => {
+    const base = currentLock() as Record<string, Record<string, unknown>>;
+    const moved = structuredClone(base);
+    (moved["wire:tunnel"] as { path: string }).path = "/tunnel/v3";
+    delete (moved["wire:browser-wire"] as { webTransport?: unknown }).webTransport;
+    expect(shrunkSurfaces(base, moved)).toEqual(["wire:browser-wire.webTransport", "wire:tunnel.path"]);
+    expect(shrunkSurfaces(moved, base)).toEqual(["wire:tunnel.path"]);
+});
+
+// The lock as it would be with one raw route declared otherwise: the declaration is swapped in place, and back.
+const lockWith = (name: string, change: (declared: RouteMeta) => RouteMeta): Record<string, unknown> => {
+    const route = RAW_ROUTE_LIST.find((candidate) => candidate.name === name);
+    if (route === undefined) {
+        throw new Error(`${name} is gone; pick another raw route with a maintainer floor and no grants`);
+    }
+    const declared = route.meta;
+    Reflect.set(route, "meta", change(declared));
+    try {
+        return currentLock();
+    } finally {
+        Reflect.set(route, "meta", declared);
+    }
+};
+
+const ROUTE = "POST /system/sync/report";
+
+// A lowered floor on any route, not only the ones route-reach.test.ts pins: the lock check names it, and the push gate and
+// the landing draft read it as a shrink that needs a declared break.
+test("lowering one route's floor fails the lock check, naming the route", () => {
+    const committed = currentLock();
+    const lowered = lockWith(ROUTE, (declared) => ({ ...declared, floor: "viewer" }));
+    expect(accessChanges(serializeLock(committed), serializeLock(lowered))).toEqual([`${ROUTE}: floor "maintainer" → "viewer"`]);
+    expect(shrunkSurfaces(committed, lowered)).toEqual([`access:${ROUTE}.floor`]);
+});
+
+// A grant a route never declared still has a value in the lock, so granting it is a changed value, not growth that
+// passes; taking one away reads the same way, since it locks out a caller that relied on it.
+test("granting guest or agent reach reads as a shrink, and so does taking it back", () => {
+    const committed = currentLock();
+    const granted = lockWith(ROUTE, (declared) => ({ ...declared, guest: true, agent: true }));
+    expect(accessChanges(serializeLock(committed), serializeLock(granted))).toEqual([`${ROUTE}: agent false → true, guest false → true`]);
+    expect(shrunkSurfaces(committed, granted)).toEqual([`access:${ROUTE}.agent`, `access:${ROUTE}.guest`]);
+    expect(shrunkSurfaces(granted, committed)).toEqual([`access:${ROUTE}.agent`, `access:${ROUTE}.guest`]);
+});

package/src/state/contract-lock.ts

@@ -1,7 +1,19 @@
 // contract.lock.json is every exported schema serialized to canonical JSON Schema, so git can flag a wire-contract
 // change. contract-shrink demands a `!` commit with a Breaking-Note when a schema, field or type shrinks; additions
-// pass freely. Derived from the package's exports, not a hand-kept list.
+// pass freely. Derived from the package's exports, not a hand-kept list, plus the wire no oRPC route carries: the
+// manifests the Rust crates that define it write beside their TypeScript (the tunnel, what a browser sees of the front
+// and the edge, and the front's control socket with Node), under `wire:` names no export can take.
+//
+// And who reaches each route: every raw route's and every procedure's RouteMeta, each reach field with its default
+// resolved (route-meta.ts `routeAccess`), under `access:METHOD /path`. Resolved, so every field is a value on every
+// route: a lowered floor, a `guest`, `agent` or `panel` granted, a control rung widened are each a changed value, which
+// contract-shrink reads as a shrink, the same `!` and Breaking-Note a removed field needs. A field left absent could
+// instead be added unseen, since growth passes freely. route-reach.test.ts in the daemon proves the gates honour
+// exactly these declarations; this pins the declarations themselves.
 
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { packageRoot } from "@intentic/constants/node";
 import { z } from "zod";
 import * as contract from "../index.js";
 
@@ -21,6 +33,57 @@ const sorted = (value: unknown): unknown => {
     return value;
 };
 
+const ACCESS_PREFIX = "access:";
+
+// The access half of the lock, one entry per route with its fields in key order; a procedure also names itself, so a
+// route moving between procedures is seen.
+const accessEntries = (): Record<string, Readonly<Record<string, string | boolean>>> => {
+    const entries = new Map<string, Readonly<Record<string, string | boolean>>>();
+    for (const route of [...contract.RAW_ROUTE_LIST, ...contract.SANDBOX_ROUTES]) {
+        const key = `${ACCESS_PREFIX}${route.method} ${route.path}`;
+        if (entries.has(key)) {
+            throw new Error(`two routes declare ${route.method} ${route.path}; the lock can record only one reach for it`);
+        }
+        const access = contract.routeAccess(route.method, route.meta);
+        const fields = route.name === `${route.method} ${route.path}` ? access : { ...access, procedure: route.name };
+        entries.set(key, Object.fromEntries(Object.entries(fields).toSorted(([a], [b]) => a.localeCompare(b))));
+    }
+    return Object.fromEntries([...entries].toSorted(([a], [b]) => a.localeCompare(b)));
+};
+
+// A lock text's access half: route key to its fields. Entries under other names are not its business.
+const accessHalf = (text: string): Record<string, Readonly<Record<string, string | boolean>>> => {
+    const lock = z.record(z.string(), z.unknown()).parse(JSON.parse(text));
+    return z
+        .record(z.string(), z.record(z.string(), z.union([z.string(), z.boolean()])))
+        .parse(Object.fromEntries(Object.entries(lock).filter(([key]) => key.startsWith(ACCESS_PREFIX))));
+};
+
+// Each route whose recorded reach differs between two locks, one line naming the route and every field that moved, so a
+// failing lock check says which route's access changed rather than leaving it to a diff of hundreds of entries. Takes
+// the two lock texts, as serializeLock writes them.
+export const accessChanges = (baseText: string, headText: string): string[] => {
+    const base = accessHalf(baseText);
+    const head = accessHalf(headText);
+    const keys = new Set([...Object.keys(base), ...Object.keys(head)]);
+    return [...keys].toSorted().flatMap((key) => {
+        const route = key.slice(ACCESS_PREFIX.length);
+        const was = base[key];
+        const now = head[key];
+        if (was === undefined || now === undefined) {
+            return [`${route}: ${was === undefined ? "new route" : "no longer declared"}`];
+        }
+        const moved = [...new Set([...Object.keys(was), ...Object.keys(now)])]
+            .toSorted()
+            .filter((field) => was[field] !== now[field])
+            .map((field) => `${field} ${JSON.stringify(was[field]) ?? "absent"} → ${JSON.stringify(now[field]) ?? "absent"}`);
+        return moved.length === 0 ? [] : [`${route}: ${moved.join(", ")}`];
+    });
+};
+
+// Each written by its crate's own test: `tunnel`, `browser-wire` and `front-wire` under _sandbox/front/crates.
+const WIRE_MANIFESTS = ["browser-wire", "front-wire", "tunnel"] as const;
+
 export const currentLock = (): Record<string, unknown> => {
     const lock: Record<string, unknown> = {};
     for (const name of Object.keys(contract).sort()) {
@@ -38,7 +101,12 @@ export const currentLock = (): Record<string, unknown> => {
             lock[name] = "<unserializable>";
         }
     }
-    return lock;
+    for (const manifest of WIRE_MANIFESTS) {
+        // Read from src/ whether this runs from src/ or dist/: the manifests are data `cargo test` writes, never compiled.
+        const text = readFileSync(join(packageRoot(import.meta.url), "src", "front", "generated", `${manifest}.json`), "utf8");
+        lock[`wire:${manifest}`] = sorted(JSON.parse(text));
+    }
+    return { ...lock, ...accessEntries() };
 };
 
 // One line per schema, not pretty-printed: keeps the lock short enough that a diff shows which surfaces moved.

package/src/state/fix-stance.test.ts

@@ -59,6 +59,14 @@ test.each([
     });
 });
 
+// The daemon's own reading decides, whatever the watch list says: a wake waiting in its queue keeps it working with no
+// watch at all, and a daemon that says nothing wakes it is not second-guessed from a list it still shows.
+test("an agent the daemon says awaits a wake is still working, and one it says does not is judged on what it holds", () => {
+    expect(fixStance(agent({ status: `idle`, awaitingWake: true })).kind).toBe(`working`);
+    const watches = [{ id: `watch-a1b2`, note: `CI on the pushed branch`, intervalSeconds: 60, deadlineAt: 9_000 }];
+    expect(fixStance(agent({ status: `idle`, awaitingWake: false, watches, diff: { files: 1, insertions: 1, deletions: 0 } })).kind).toBe(`ready`);
+});
+
 // Diff present doesn't change a failed status to ready; it only earns a mention in the hint.
 test("an agent that failed after writing files still reads as failed", () => {
     const stance = fixStance(agent({ status: `error`, diff: { files: 2, insertions: 34, deletions: 6 } }));

package/src/state/fix-stance.ts

@@ -1,5 +1,5 @@
 import { turnedAwayCode } from "../policy/turned-away.js";
-import type { AgentSummary } from "../schemas/agents.js";
+import { type AgentSummary, awaitsWake } from "../schemas/agents.js";
 
 /* WHAT BECAME OF THE AGENT A SURFACE SENT AFTER A FAILURE — a red pipeline row, a refused push. */
 
@@ -130,8 +130,8 @@ const RULES: readonly ((agent: AgentSummary) => FixStance | undefined)[] = [
             ? needsYou("Needs you", "The fix agent has stopped and is waiting on you.")
             : undefined,
     (agent) => (IN_FLIGHT.has(agent.status) ? WORKING : undefined),
-    // An armed watch wakes it again by itself, so neither what it holds nor holding nothing is its last word yet.
-    (agent) => ((agent.watches?.length ?? 0) > 0 ? WORKING : undefined),
+    // It runs again by itself (a watch, a waiting wake), so neither what it holds nor holding nothing is its last word yet.
+    (agent) => (awaitsWake(agent) ? WORKING : undefined),
     (agent) => (holdingWork(agent) ? READY : undefined),
     (agent) => (agent.status === "landed" ? LANDED : undefined),
 ];

package/src/state/history-state.ts

@@ -74,6 +74,10 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "backups/", portability: "derived" },
     // Bundles being taken in, mid-review; excluded as someone else's. Deleted on apply/abandon, swept after a crash.
     { path: "arrivals/", portability: "derived" },
+    // The agent engines this sandbox installed beside the image's own, each with its pointer file; reinstalled on demand.
+    { path: "engines/", portability: "derived" },
+    // An update the host downloaded and built for this sandbox (`ic sandbox prepare`); about this machine only.
+    { path: "update-staged.json", portability: "derived" },
 
     /* ---- credentials ---- */
 
@@ -132,7 +136,7 @@ export const HISTORY_STATE_FILES: readonly StateFile[] = [
     { path: "converting/", portability: "secret", note: "An update's undo record stays with the sandbox it happened on." },
     // Which conversion episodes are open or recently committed, and earlier addresses awaiting removal.
     { path: "state-journal.json", portability: "derived" },
-    // Every conversation the import of the pre-1.308 layout settled (the daemon's agents/registry/pre-1308-import.ts),
+    // Every conversation the import of the pre-1.308 layout settled (the daemon's conversations/registry/pre-1308-import.ts),
     // so one deleted after its import is not brought back from the old files still on disk. About this volume only.
     { path: "pre-1308-import.json", portability: "derived" },
 ];

package/src/state/landed-commit.test.ts

@@ -1,4 +1,4 @@
-import { declaredTestNote, landedCommitMessage } from "./landed-commit.js";
+import { declaredAllows, declaredTestNote, landedCommitMessage } from "./landed-commit.js";
 
 // The push gate reads a weakening's declaration off the commit (assertion-ratchet.mjs), so the trailer must survive
 // the trip from the conversation's last word into the message a land commits under.
@@ -15,3 +15,14 @@ test("a Test-Note is read only from a line that starts with one and says somethi
     expect(declaredTestNote("I kept a Test-Note: nowhere near the start")).toBeUndefined();
     expect(declaredTestNote("Test-Note:   \n")).toBeUndefined();
 });
+
+// An exception a conversation declared rides its land's commit, one trailer per line, for the checks that read them.
+test("an Allow line is read from each line that starts with one, and each commits as its own trailer", () => {
+    const said = "Done.\n\nAllow: layout — the fixtures folder is one suite's data\nAllow: paths — the test spells a root on purpose\nI would Allow: nothing here";
+    const allows = declaredAllows(said);
+    expect(allows).toEqual(["layout — the fixtures folder is one suite's data", "paths — the test spells a root on purpose"]);
+    expect(declaredAllows("Allow:   \n")).toEqual([]);
+    expect(landedCommitMessage({ subject: "fix: tabs", testNote: "Rows became a table.", allows })).toBe(
+        "fix: tabs\n\nTest-Note: Rows became a table.\nAllow: layout — the fixtures folder is one suite's data\nAllow: paths — the test spells a root on purpose",
+    );
+});

package/src/state/landed-commit.ts

@@ -7,6 +7,7 @@ export const landedCommitMessage = (landed: LandedMessage): string => {
         landed.note === undefined ? "" : `Release-Note: ${landed.note}`,
         landed.breaking === undefined ? "" : `Breaking-Note: ${landed.breaking}`,
         landed.testNote === undefined ? "" : `Test-Note: ${landed.testNote}`,
+        ...(landed.allows ?? []).map((allow) => `Allow: ${allow}`),
     ]
         .filter((line) => line !== "")
         .join("\n");
@@ -15,3 +16,7 @@ export const landedCommitMessage = (landed: LandedMessage): string => {
 
 // The `Test-Note:` line a conversation ended its last message with, when it declared a weakened test on purpose.
 export const declaredTestNote = (said: string): string | undefined => /^Test-Note:[ \t]*(\S.*)$/m.exec(said)?.[1]?.trim();
+
+// The `Allow: <check> — <reason>` lines a conversation ended its last message with, each an exception it declared for
+// its change on purpose; the check after the land and the push read them off the landed commit.
+export const declaredAllows = (said: string): string[] => [...said.matchAll(/^Allow:[ \t]*(\S.*)$/gm)].map((match) => match[1]!.trim());

package/src/state/red-streak.test.ts

@@ -0,0 +1,28 @@
+import { headStreak, nextStreak } from "./red-streak.js";
+
+// The five places that asked "is this still the same red" asked it five ways; these are the two answers they share.
+
+describe(`a streak followed one observation at a time`, () => {
+    test(`begins at the first red, keeps that start through every red after it, and ends at anything else`, () => {
+        const first = nextStreak(undefined, true, 10);
+        expect(first).toEqual({ since: 10, count: 1 });
+        const second = nextStreak(first, true, 20);
+        expect(second).toEqual({ since: 10, count: 2 });
+        expect(nextStreak(second, false, 30)).toBeUndefined();
+        expect(nextStreak(undefined, false, 30)).toBeUndefined();
+    });
+
+    test(`begins again when the red is a different failure`, () => {
+        expect(nextStreak({ since: 10, count: 3 }, true, 40, false)).toEqual({ since: 40, count: 1 });
+    });
+});
+
+describe(`a streak read off a history`, () => {
+    test(`is the unbroken run of red at the head, newest first`, () => {
+        const history = [`red-3`, `red-2`, `green-1`, `red-0`];
+        expect(headStreak(history, (item) => item.startsWith(`red`))).toEqual([`red-3`, `red-2`]);
+        expect(headStreak([`green`, `red`], (item) => item === `red`)).toEqual([]);
+        expect(headStreak([`red`, `red`], (item) => item === `red`)).toEqual([`red`, `red`]);
+        expect(headStreak([], () => true)).toEqual([]);
+    });
+});

package/src/state/red-streak.ts

@@ -0,0 +1,28 @@
+// ONE DEFINITION OF A RED STREAK, for every source that goes red: a land check's project (verify-store.ts), main's CI
+// (repair-gate.ts), a pipeline branch on the board (the pipelines extension's ciStreaks.ts) and the Main line's older
+// daemons (the editor's mainlineView.ts). A streak is the unbroken run of red at the head: a red extends it, anything
+// else ends it, and `since` is where it began, which is what names one failure across every red that continues it.
+
+export interface Streak {
+    // When (or at which run) the streak began: the first red of the unbroken run.
+    readonly since: number;
+    // How many reds in a row it holds.
+    readonly count: number;
+}
+
+/**
+ * One observation's effect on the streak before it. A red continues it, unless `continues` says this red is a different
+ * failure (CI: no failed job repeats), which begins one of its own; anything else ends it.
+ */
+export const nextStreak = (previous: Streak | undefined, red: boolean, at: number, continues = true): Streak | undefined => {
+    if (!red) {
+        return undefined;
+    }
+    return previous !== undefined && continues ? { since: previous.since, count: previous.count + 1 } : { since: at, count: 1 };
+};
+
+/** The streak a newest-first history stands on: its unbroken run of red at the head, newest first; empty when the head is not red. */
+export const headStreak = <T>(newestFirst: readonly T[], isRed: (item: T) => boolean): T[] => {
+    const end = newestFirst.findIndex((item) => !isRed(item));
+    return end === -1 ? [...newestFirst] : newestFirst.slice(0, end);
+};

package/src/state/workspace-state.test.ts

@@ -1,4 +1,4 @@
-import { STATE_DIR } from "@intentic/constants";
+import { HISTORY_ROOT, STATE_DIR } from "@intentic/constants";
 import type { FileContribution } from "@intentic/extension-manifest";
 import {
     BACKED_UP_STATE_PATHS,
@@ -129,6 +129,12 @@ describe(`isReportedManifest`, () => {
         // What `relative` gives the daemon for a manifest kept under /history.
         expect(isReportedManifest(`../../history/settings.json`)).toBe(false);
     });
+
+    it(`reports the conversation registry on the daemon's volume by its absolute path, and nothing else there`, () => {
+        expect(isReportedManifest(`${HISTORY_ROOT}/conversations.db`)).toBe(true);
+        expect(isReportedManifest(`${HISTORY_ROOT}/state-journal.json`)).toBe(false);
+        expect(isReportedManifest(`../history/conversations.db`)).toBe(false);
+    });
 });
 
 describe(`WORKSPACE_STATE_FILES`, () => {

package/src/state/workspace-state.ts

@@ -1,4 +1,4 @@
-import { STATE_DIR } from "@intentic/constants";
+import { HISTORY_ROOT, STATE_DIR } from "@intentic/constants";
 import type { FileContribution } from "@intentic/extension-manifest";
 import type { StateFile } from "./state-portability.js";
 
@@ -601,9 +601,17 @@ export const REPORTED_MANIFEST_PATHS: readonly string[] = WORKSPACE_STATE_FILES.
     (file) => file.path,
 );
 
+// Files on the daemon's own volume whose unreadable records are reported too, named by their absolute path there: the
+// conversation registry's rows, one of which this build could not read costs that conversation until a build that can
+// runs. Reported, never repaired from the card (no route edits them), and refreshed whenever the card is fetched.
+export const REPORTED_VOLUME_FILES: readonly string[] = [`${HISTORY_ROOT}/conversations.db`];
+
 // Accepts either separator; the daemon holds these as platform paths and normalizing at every call site is what
 // eventually gets forgotten.
-export const isReportedManifest = (relPath: string): boolean => REPORTED_MANIFEST_PATHS.includes(relPath.replaceAll("\\", "/"));
+export const isReportedManifest = (relPath: string): boolean => {
+    const path = relPath.replaceAll("\\", "/");
+    return REPORTED_MANIFEST_PATHS.includes(path) || REPORTED_VOLUME_FILES.includes(path);
+};
 
 // Entries directly under `.intentic/` the file API refuses to read, write, move or delete for anyone, owner
 // included (workspace/workspace-files.ts enforces it). Declared here so the browser can draw the same rule instead