@intutic/sync-daemon 1.10.0 → 2.0.0

package/dist/configReader.d.ts

@@ -9,7 +9,21 @@
  *
  * @module
  */
-import type { HarnessType, CapturedConfigFile } from '@intutic/shared-types';
+import type { HarnessType, CapturedConfigFile, GovernanceCoverageInputs } from '@intutic/shared-types';
+/**
+ * The four enforcement inputs `POST /api/v1/governance-coverage/snapshot`
+ * expects. Re-exported from `@intutic/shared-types` (TD-443) — previously
+ * declared locally here as a hand-kept duplicate of
+ * `harnessGradeSweep.ts`'s `deriveEnforcementInputs` return shape on the
+ * control-plane side, which drifted (this module's `syncLoop.ts` consumer
+ * was missing an `Array.isArray` guard the control-plane side had). Both
+ * sides now derive from `packages/shared-types/src/governanceCoverage.ts`'s
+ * single mapping — safe for this module to depend on since it is a leaf
+ * package, not `services/control-plane` itself, so the publicly-mirrored
+ * `services/sync-daemon` still never imports from the enterprise-only
+ * service.
+ */
+export type { GovernanceCoverageInputs } from '@intutic/shared-types';
 /**
  * Determine whether config capture should run on this iteration.
  * Captures every Nth iteration to avoid flooding the control plane.
@@ -38,9 +52,32 @@ export declare function readHarnessConfigs(workspaceRoot: string, harnesses: Har
  * @returns Number of files actually uploaded (after dedup).
  */
 export declare function uploadConfigCapture(controlPlaneUrl: string, apiKey: string, workspaceId: string, harnessType: HarnessType, configs: CapturedConfigFile[]): Promise<number>;
+/**
+ * Trigger an immediate governance-coverage grade snapshot for one harness
+ * (`POST /api/v1/governance-coverage/snapshot` — see that route's own doc
+ * comment: "Called by the sync-daemon after detecting harness config
+ * changes," which nothing actually did until this wiring). Best-effort and
+ * non-fatal by design, matching `uploadConfigCapture`'s own network-failure
+ * handling above: the hourly control-plane sweep (`harnessGradeSweep.ts`)
+ * re-grades every harness regardless, so a failed request here only costs
+ * the up-to-the-minute freshness this call exists to provide, never
+ * correctness.
+ */
+export declare function reportGovernanceCoverageSnapshot(controlPlaneUrl: string, apiKey: string, workspaceId: string, harnessType: HarnessType, inputs: GovernanceCoverageInputs): Promise<void>;
 /**
  * Full config capture cycle: read + upload.
  * Groups by harness type for proper capture payloads.
+ *
+ * @param governanceInputs - This cycle's per-harness enforcement signals
+ *   (from `runSyncIteration`'s agent-facets collection), used to fire a
+ *   governance-coverage snapshot immediately after a harness's rules file is
+ *   actually found to have changed — never on every sync tick, only on the
+ *   iterations where `uploadConfigCapture`'s content-hash dedup lets a file
+ *   through. Falls back to `hasRulesFile: true` / everything else `false`
+ *   when the caller has no facets for a harness yet (first cycle before the
+ *   agent-report step has run) — conservative in the same direction
+ *   `harnessGradeSweep.ts`'s own doc comment argues for: "a wrong mapping
+ *   overstates enforcement, which is worse than an empty grid."
  */
-export declare function captureAndUpload(controlPlaneUrl: string, apiKey: string, workspaceId: string, workspaceRoot: string, harnesses: HarnessType[]): Promise<void>;
+export declare function captureAndUpload(controlPlaneUrl: string, apiKey: string, workspaceId: string, workspaceRoot: string, harnesses: HarnessType[], governanceInputs?: Partial<Record<HarnessType, GovernanceCoverageInputs>>): Promise<void>;
 //# sourceMappingURL=configReader.d.ts.map

package/dist/configReader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configReader.d.ts","sourceRoot":"","sources":["../src/configReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAA6B,MAAM,uBAAuB,CAAA;AAkBvG;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAG1E;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW,EAAE,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,kBAAkB,EAAE,GAC5B,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW,EAAE,GACvB,OAAO,CAAC,IAAI,CAAC,CAgBf"}
+{"version":3,"file":"configReader.d.ts","sourceRoot":"","sources":["../src/configReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAElB,wBAAwB,EACzB,MAAM,uBAAuB,CAAA;AAkB9B;;;;;;;;;;;;GAYG;AACH,YAAY,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAErE;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAG1E;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW,EAAE,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,kBAAkB,EAAE,GAC5B,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gCAAgC,CACpD,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,WAAW,EAAE,EACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,GACxE,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/configReader.js

@@ -21,7 +21,6 @@ const MAX_FILE_SIZE_BYTES = 512 * 1024; // 512 KB
 // ─── Local hash cache ────────────────────────────────────────────────
 /** Cache of last-uploaded content hashes per file path. Avoids redundant uploads. */
 const lastUploadedHashes = new Map();
-// ─── Public API ──────────────────────────────────────────────────────
 /**
  * Determine whether config capture should run on this iteration.
  * Captures every Nth iteration to avoid flooding the control plane.
@@ -115,17 +114,72 @@ export async function uploadConfigCapture(controlPlaneUrl, apiKey, workspaceId,
     }
     return changed.length;
 }
+/**
+ * Trigger an immediate governance-coverage grade snapshot for one harness
+ * (`POST /api/v1/governance-coverage/snapshot` — see that route's own doc
+ * comment: "Called by the sync-daemon after detecting harness config
+ * changes," which nothing actually did until this wiring). Best-effort and
+ * non-fatal by design, matching `uploadConfigCapture`'s own network-failure
+ * handling above: the hourly control-plane sweep (`harnessGradeSweep.ts`)
+ * re-grades every harness regardless, so a failed request here only costs
+ * the up-to-the-minute freshness this call exists to provide, never
+ * correctness.
+ */
+export async function reportGovernanceCoverageSnapshot(controlPlaneUrl, apiKey, workspaceId, harnessType, inputs) {
+    try {
+        const res = await fetch(`${controlPlaneUrl}/api/v1/governance-coverage/snapshot`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({
+                workspaceId,
+                harnessType,
+                mcpProxyActive: inputs.mcpProxyActive,
+                nativeHookActive: inputs.nativeHookActive,
+                llmProxyActive: inputs.llmProxyActive,
+                hasRulesFile: inputs.hasRulesFile,
+            }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            console.warn(`[config-reader] Governance coverage snapshot failed (${res.status}): ${body}`);
+        }
+    }
+    catch (err) {
+        console.warn('[config-reader] Governance coverage snapshot request failed:', err);
+    }
+}
 /**
  * Full config capture cycle: read + upload.
  * Groups by harness type for proper capture payloads.
+ *
+ * @param governanceInputs - This cycle's per-harness enforcement signals
+ *   (from `runSyncIteration`'s agent-facets collection), used to fire a
+ *   governance-coverage snapshot immediately after a harness's rules file is
+ *   actually found to have changed — never on every sync tick, only on the
+ *   iterations where `uploadConfigCapture`'s content-hash dedup lets a file
+ *   through. Falls back to `hasRulesFile: true` / everything else `false`
+ *   when the caller has no facets for a harness yet (first cycle before the
+ *   agent-report step has run) — conservative in the same direction
+ *   `harnessGradeSweep.ts`'s own doc comment argues for: "a wrong mapping
+ *   overstates enforcement, which is worse than an empty grid."
  */
-export async function captureAndUpload(controlPlaneUrl, apiKey, workspaceId, workspaceRoot, harnesses) {
+export async function captureAndUpload(controlPlaneUrl, apiKey, workspaceId, workspaceRoot, harnesses, governanceInputs) {
     for (const harness of harnesses) {
         const configs = await readHarnessConfigs(workspaceRoot, [harness]);
         if (configs.length > 0) {
             const uploaded = await uploadConfigCapture(controlPlaneUrl, apiKey, workspaceId, harness, configs);
             if (uploaded > 0) {
                 console.log(`[config-reader] Captured ${uploaded} ${harness} config file(s)`);
+                await reportGovernanceCoverageSnapshot(controlPlaneUrl, apiKey, workspaceId, harness, governanceInputs?.[harness] ?? {
+                    mcpProxyActive: false,
+                    nativeHookActive: false,
+                    llmProxyActive: false,
+                    hasRulesFile: true,
+                });
             }
         }
     }

package/dist/configReader.js.map

@@ -1 +1 @@
-{"version":3,"file":"configReader.js","sourceRoot":"","sources":["../src/configReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,wEAAwE;AAExE,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAElC,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAA,CAAE,SAAS;AAEjD,wEAAwE;AAExE,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAEpD,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAA;IACpG,OAAO,cAAc,GAAG,CAAC,IAAI,cAAc,GAAG,QAAQ,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,SAAwB;IAExB,MAAM,OAAO,GAAyB,EAAE,CAAA;IAExC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAQ;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,4BAA4B,QAAQ,KAAK,IAAI,CAAC,IAAI,kBAAkB,mBAAmB,QAAQ,CAAC,CAAA;gBAC7G,SAAQ;YACV,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAE7E,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,mDAAmD;YACnD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,kCAAkC,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,WAAwB,EACxB,OAA6B;IAE7B,+DAA+D;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,QAAQ,KAAK,CAAC,CAAC,WAAW,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAElC,MAAM,OAAO,GAA8B;QACzC,WAAW;QACX,WAAW;QACX,KAAK,EAAE,OAAO;KACf,CAAA;IAED,MAAM,GAAG,GAAG,GAAG,eAAe,wBAAwB,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,MAAM,EAAE;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7C,OAAO,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACtE,OAAO,CAAC,CAAA;IACV,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,aAAqB,EACrB,SAAwB;IAExB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,eAAe,EACf,MAAM,EACN,WAAW,EACX,OAAO,EACP,OAAO,CACR,CAAA;YACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,IAAI,OAAO,iBAAiB,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"configReader.js","sourceRoot":"","sources":["../src/configReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAOrC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,wEAAwE;AAExE,oFAAoF;AACpF,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAElC,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAA,CAAE,SAAS;AAEjD,wEAAwE;AAExE,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAmBpD;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAA;IACpG,OAAO,cAAc,GAAG,CAAC,IAAI,cAAc,GAAG,QAAQ,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,SAAwB;IAExB,MAAM,OAAO,GAAyB,EAAE,CAAA;IAExC,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAQ;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpC,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,4BAA4B,QAAQ,KAAK,IAAI,CAAC,IAAI,kBAAkB,mBAAmB,QAAQ,CAAC,CAAA;gBAC7G,SAAQ;YACV,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAE7E,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,mDAAmD;YACnD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,kCAAkC,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAA;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,WAAwB,EACxB,OAA6B;IAE7B,+DAA+D;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,QAAQ,KAAK,CAAC,CAAC,WAAW,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAElC,MAAM,OAAO,GAA8B;QACzC,WAAW;QACX,WAAW;QACX,KAAK,EAAE,OAAO;KACf,CAAA;IAED,MAAM,GAAG,GAAG,GAAG,eAAe,wBAAwB,CAAA;IACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,MAAM,EAAE;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IAEF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7C,OAAO,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACtE,OAAO,CAAC,CAAA;IACV,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,WAAwB,EACxB,MAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,sCAAsC,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW;gBACX,WAAW;gBACX,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7C,OAAO,CAAC,IAAI,CAAC,wDAAwD,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8DAA8D,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,aAAqB,EACrB,SAAwB,EACxB,gBAAyE;IAEzE,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,eAAe,EACf,MAAM,EACN,WAAW,EACX,OAAO,EACP,OAAO,CACR,CAAA;YACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,4BAA4B,QAAQ,IAAI,OAAO,iBAAiB,CAAC,CAAA;gBAE7E,MAAM,gCAAgC,CACpC,eAAe,EACf,MAAM,EACN,WAAW,EACX,OAAO,EACP,gBAAgB,EAAE,CAAC,OAAO,CAAC,IAAI;oBAC7B,cAAc,EAAE,KAAK;oBACrB,gBAAgB,EAAE,KAAK;oBACvB,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;iBACnB,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/configWriter.d.ts

@@ -25,6 +25,14 @@ export interface WriteResult {
     /** Paths where the harness was skipped (not detected or deferred). */
     filesSkipped: string[];
 }
+/**
+ * The workspace's local SOPs (`.intutic/sops/<dir>/*.md`, narrowed by
+ * `session-context.json`'s `activeLocalSops` when present). Shared by the
+ * config writer and by the gate-cache refresh, which compiles their
+ * `review_before:` tokens into hold rules (TD-474 item 4). A missing
+ * directory is an empty list.
+ */
+export declare function loadLocalSopEntries(workspaceRoot: string, harnesses: HarnessType[]): Promise<SyncSopEntry[]>;
 /**
  * Write SOP content to all targeted harness config files.
  *
@@ -41,13 +49,55 @@ export interface WriteResult {
 export declare function writeConfigFiles(workspaceRoot: string, sops: SyncSopEntry[], proxyUrl: string, harnesses: HarnessType[], workspaceId?: string, 
 /** WS-5 Q3: 'rewrite' (default) | 'immutable' | 'alert-only' */
 bypassEnforcementTier?: string): Promise<WriteResult>;
+/** Outcome of a single ADD/DELETE/REPLACE operation within one suggestion's edit set. */
+export interface ConfigEditOperationOutcome {
+    /** Index into the suggestion's `edits` array. */
+    index: number;
+    operation: string;
+    /** Whether this operation's effect actually landed in the on-disk file. */
+    applied: boolean;
+    /** Present when `applied` is false — why it didn't land. */
+    reason?: string;
+}
+/**
+ * Per-suggestion result of `applyConfigEdits` — what the daemon reports back
+ * to control-plane via `POST /api/v1/skillopt/:suggestionId/apply-result`
+ * (TD-349).
+ */
+export interface ConfigEditApplyOutcome {
+    suggestionId: string;
+    /** True only when every operation for this suggestion landed. */
+    ok: boolean;
+    perOperation: ConfigEditOperationOutcome[];
+}
 /**
  * Apply a list of custom config edits (ADD, DELETE, REPLACE) to a workspace rule file.
+ *
+ * Returns one `ConfigEditApplyOutcome` per input suggestion (TD-349) instead
+ * of `void` — every operation's real fate (fuzzy-match miss on DELETE/
+ * REPLACE, an unresolvable target file, or the final `atomicWrite` itself
+ * failing) is recorded here rather than only `console.warn`'d, so the caller
+ * (syncLoop.ts) can ack the daemon's actual outcome back to control-plane
+ * instead of the daemon-side write being invisible to it.
  */
 export declare function applyConfigEdits(workspaceRoot: string, appliedEdits: Array<{
     suggestionId: string;
     harnessType: string;
     filePath: string;
     edits: string | ConfigEdit[];
-}>, bypassEnforcementTier?: string): Promise<void>;
+}>, bypassEnforcementTier?: string): Promise<ConfigEditApplyOutcome[]>;
+/**
+ * Write content to a file atomically.
+ *
+ * Writes to a `.tmp` sibling first, then renames to the target path.
+ * This prevents partial/corrupt files if the process is interrupted mid-write.
+ *
+ * If bypassEnforcementTier === 'immutable', clears the macOS user-immutable
+ * flag before writing and re-sets it after (WS-5 Q3).
+ *
+ * Exported for reuse by other full-regenerate writers in this daemon (e.g.
+ * `lib/decisionsDigest.ts`) that want the same write-tmp-then-rename
+ * atomicity without duplicating it.
+ */
+export declare function atomicWrite(filePath: string, content: string, bypassEnforcementTier?: string): Promise<void>;
 //# sourceMappingURL=configWriter.d.ts.map

package/dist/configWriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configWriter.d.ts","sourceRoot":"","sources":["../src/configWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAwClF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAmBrD,CAAA;AAID,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,sEAAsE;IACtE,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,EAAE,EACxB,WAAW,SAAK;AAChB,gEAAgE;AAChE,qBAAqB,CAAC,EAAE,MAAM,GAC7B,OAAO,CAAC,WAAW,CAAC,CAwJtB;AAkCD;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,KAAK,CAAC;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAAA;CAC7B,CAAC,EACF,qBAAqB,CAAC,EAAE,MAAM,GAC7B,OAAO,CAAC,IAAI,CAAC,CA2Df"}
+{"version":3,"file":"configWriter.d.ts","sourceRoot":"","sources":["../src/configWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AA0ClF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAwGrD,CAAA;AAID,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,sEAAsE;IACtE,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA0ClH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,YAAY,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,EAAE,EACxB,WAAW,SAAK;AAChB,gEAAgE;AAChE,qBAAqB,CAAC,EAAE,MAAM,GAC7B,OAAO,CAAC,WAAW,CAAC,CA0JtB;AAkCD,yFAAyF;AACzF,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAA;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,iEAAiE;IACjE,EAAE,EAAE,OAAO,CAAA;IACX,YAAY,EAAE,0BAA0B,EAAE,CAAA;CAC3C;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,KAAK,CAAC;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAAA;CAC7B,CAAC,EACF,qBAAqB,CAAC,EAAE,MAAM,GAC7B,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAqHnC;AA8YD;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,MAAM,GAC7B,OAAO,CAAC,IAAI,CAAC,CAiBf"}