@iowarp/clio-coder 0.3.9 → 0.4.1

package/src/cli/evidence-inventory.ts

@@ -0,0 +1,183 @@
+/**
+ * Fixed machine-readable projection of recent evidence artifacts.
+ *
+ * `evidence list` is an operator table and `evidence inspect <id>` needs an id,
+ * so neither is a transport a GUI host can invoke blind. This command accepts
+ * no identifier, path, or limit, selects a bounded newest-first window itself,
+ * and emits provenance, tags, totals, and a trust verdict.
+ *
+ * An overview carries the working directories the runs executed in, the task
+ * text the operator typed, and the file names inside the bundle. None of that
+ * appears here. What does is the shape of the artifact and how far it can be
+ * trusted, which is what an operator picks a bundle by.
+ */
+
+import { clioDataDir } from "../core/xdg.js";
+import {
+	EVIDENCE_TAGS,
+	type EvidenceOverview,
+	type EvidenceTag,
+	listEvidenceOverviews,
+	loadEvidenceTrustStatus,
+	type TrustVerdict,
+	trustVerdict,
+} from "../domains/evidence/index.js";
+import { sanitizeCallTargetText } from "../domains/safety/call-target.js";
+import { truncateToWidth } from "../engine/tui-primitives.js";
+
+export const EVIDENCE_INVENTORY_MAX_ARTIFACTS = 12;
+export const EVIDENCE_INVENTORY_MAX_IDS = 8;
+
+const IDENTITY_WIDTH = 128;
+
+/**
+ * Worst verdict first.
+ *
+ * An artifact covering several runs is only as trustworthy as its weakest run,
+ * so the fold takes the worst rather than the newest or the most common. A
+ * `compromised` run inside an otherwise clean bundle is the fact the operator
+ * needs, and averaging it away would be the one summary worth not printing.
+ */
+const VERDICT_SEVERITY: ReadonlyArray<TrustVerdict> = ["compromised", "unverified", "unknown", "grounded", "reviewed"];
+
+export interface EvidenceInventoryArtifact {
+	readonly evidenceId: string;
+	readonly sourceKind: "run" | "session" | "eval";
+	readonly generatedAt: string;
+	readonly startedAt: string | null;
+	readonly endedAt: string | null;
+	readonly runIds: readonly string[];
+	readonly runIdsTruncated: boolean;
+	readonly agentIds: readonly string[];
+	readonly statuses: readonly string[];
+	readonly tags: readonly EvidenceTag[];
+	readonly totals: Readonly<{
+		runs: number;
+		receipts: number;
+		toolCalls: number;
+		toolErrors: number;
+		blockedToolCalls: number;
+		protectedArtifacts: number;
+		tokens: number;
+		costUsd: number;
+		wallTimeMs: number;
+	}>;
+	/** Secret-shaped values the builder replaced across the bundle's exports. */
+	readonly redactionCount: number;
+	readonly trust: Readonly<{
+		verdict: TrustVerdict;
+		/** Runs whose canonical trust status the bundle actually recorded. */
+		runsCovered: number;
+		/** True when the bundle predates the canonical trust projection. */
+		historical: boolean;
+	}>;
+}
+
+export interface EvidenceInventorySnapshot {
+	readonly version: 1;
+	readonly generatedAt: string;
+	readonly artifacts: readonly EvidenceInventoryArtifact[];
+	readonly truncated: boolean;
+}
+
+function bounded(value: string, width: number): string {
+	const sanitized = sanitizeCallTargetText(value);
+	if (sanitized.length === 0) return "unavailable";
+	return sanitizeCallTargetText(truncateToWidth(sanitized, width, "…", false));
+}
+
+/** Distinct, sanitized, bounded, in first-seen order. */
+function identities(values: ReadonlyArray<string>): string[] {
+	const seen: string[] = [];
+	for (const value of values) {
+		const text = bounded(value, IDENTITY_WIDTH);
+		if (!seen.includes(text)) seen.push(text);
+		if (seen.length >= EVIDENCE_INVENTORY_MAX_IDS) break;
+	}
+	return seen;
+}
+
+function tally(value: number | undefined): number {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.trunc(value) : 0;
+}
+
+function amount(value: number | undefined): number {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+}
+
+/** Newest generation first. An unparseable stamp sorts oldest rather than throwing. */
+function byNewest(a: EvidenceOverview, b: EvidenceOverview): number {
+	return (Date.parse(b.generatedAt) || 0) - (Date.parse(a.generatedAt) || 0);
+}
+
+async function evidenceInventorySnapshot(
+	now: () => number = Date.now,
+	dataDir: string = clioDataDir(),
+): Promise<EvidenceInventorySnapshot> {
+	const all = (await listEvidenceOverviews(dataDir)).sort(byNewest);
+	const window = all.slice(0, EVIDENCE_INVENTORY_MAX_ARTIFACTS);
+	const artifacts: EvidenceInventoryArtifact[] = [];
+	for (const overview of window) {
+		// One unreadable trust file costs that artifact its verdict, never the
+		// whole inventory: the bundle itself is still the thing being listed.
+		let verdict: TrustVerdict = "unknown";
+		let runsCovered = 0;
+		let historical = true;
+		try {
+			const status = await loadEvidenceTrustStatus(dataDir, overview.evidenceId);
+			historical = status.projection !== "canonical";
+			runsCovered = status.runs.length;
+			const verdicts = status.runs.map((run) => trustVerdict(run.status));
+			verdict = VERDICT_SEVERITY.find((candidate) => verdicts.includes(candidate)) ?? "unknown";
+		} catch {
+			verdict = "unknown";
+		}
+		artifacts.push({
+			evidenceId: bounded(overview.evidenceId, IDENTITY_WIDTH),
+			sourceKind: overview.source.kind,
+			generatedAt: overview.generatedAt,
+			startedAt: overview.startedAt,
+			endedAt: overview.endedAt,
+			runIds: identities(overview.runIds),
+			runIdsTruncated: overview.runIds.length > EVIDENCE_INVENTORY_MAX_IDS,
+			agentIds: identities(overview.agentIds),
+			statuses: identities(overview.statuses),
+			tags: overview.tags.filter((tag) => EVIDENCE_TAGS.includes(tag)),
+			totals: {
+				runs: tally(overview.totals.runs),
+				receipts: tally(overview.totals.receipts),
+				toolCalls: tally(overview.totals.toolCalls),
+				toolErrors: tally(overview.totals.toolErrors),
+				blockedToolCalls: tally(overview.totals.blockedToolCalls),
+				protectedArtifacts: tally(overview.totals.protectedArtifacts),
+				tokens: tally(overview.totals.tokens),
+				costUsd: amount(overview.totals.costUsd),
+				wallTimeMs: tally(overview.totals.wallTimeMs),
+			},
+			redactionCount: tally(overview.redactionCount),
+			trust: { verdict, runsCovered, historical },
+		});
+	}
+	return {
+		version: 1,
+		generatedAt: new Date(now()).toISOString(),
+		artifacts,
+		truncated: all.length > window.length,
+	};
+}
+
+/**
+ * `clio-coder evidence inventory --json`, and nothing else.
+ *
+ * `fixed` is false as soon as the caller supplied an id or any other argument.
+ * A GUI host invokes this knowing the process it started cannot be steered into
+ * reading a different bundle or a wider window.
+ */
+export async function runEvidenceInventory(fixed: boolean): Promise<number> {
+	if (!fixed) {
+		process.stderr.write("clio-coder evidence inventory: usage: clio-coder evidence inventory --json\n");
+		return 2;
+	}
+	process.stdout.write(`${JSON.stringify(await evidenceInventorySnapshot(), null, 2)}\n`);
+	return 0;
+}

package/src/cli/evidence.ts

@@ -12,21 +12,25 @@ import {
 	loadEvidenceRunProvenance,
 	provenanceTranscriptLines,
 } from "../domains/evidence/index.js";
+import { runEvidenceDetail } from "./evidence-detail.js";
+import { runEvidenceInventory } from "./evidence-inventory.js";
 import { printError, printNote, printOk } from "./shared.js";
 
 const HELP = `clio-coder evidence build --run <runId>
 clio-coder evidence build --session <sessionId>
 clio-coder evidence build --eval <evalId>
-clio-coder evidence inspect <evidenceId>
+clio-coder evidence inspect <evidenceId> [--json]
 clio-coder evidence list
+clio-coder evidence inventory --json
 
 Build or inspect deterministic Clio evidence artifacts.
 `;
 
-type EvidenceCommand = "build" | "inspect" | "list";
+type EvidenceCommand = "build" | "inspect" | "list" | "inventory";
 
 interface ParsedEvidenceArgs {
 	command?: EvidenceCommand;
+	json: boolean;
 	runId?: string;
 	sessionId?: string;
 	evalId?: string;
@@ -35,7 +39,7 @@ interface ParsedEvidenceArgs {
 }
 
 function parseEvidenceArgs(args: ReadonlyArray<string>): ParsedEvidenceArgs {
-	const parsed: ParsedEvidenceArgs = { help: false };
+	const parsed: ParsedEvidenceArgs = { help: false, json: false };
 	for (let index = 0; index < args.length; index += 1) {
 		const arg = args[index];
 		if (arg === undefined) continue;
@@ -44,12 +48,22 @@ function parseEvidenceArgs(args: ReadonlyArray<string>): ParsedEvidenceArgs {
 			continue;
 		}
 		if (parsed.command === undefined) {
-			if (arg === "build" || arg === "inspect" || arg === "list") {
+			if (arg === "build" || arg === "inspect" || arg === "list" || arg === "inventory") {
 				parsed.command = arg;
 				continue;
 			}
 			throw new Error(`unknown evidence command: ${arg}`);
 		}
+		// `inventory` is the fixed read a GUI host may invoke. Its argv is not a
+		// surface, so anything past the one required flag is a usage error rather
+		// than something to ignore.
+		if (parsed.command === "inventory") {
+			if (arg === "--json" && !parsed.json) {
+				parsed.json = true;
+				continue;
+			}
+			throw new Error("inventory accepts only --json");
+		}
 		if (parsed.command === "build") {
 			if (arg === "--run") {
 				const value = args[index + 1];
@@ -74,6 +88,10 @@ function parseEvidenceArgs(args: ReadonlyArray<string>): ParsedEvidenceArgs {
 			}
 			throw new Error(`unknown evidence build argument: ${arg}`);
 		}
+		if (parsed.command === "inspect" && arg === "--json" && !parsed.json) {
+			parsed.json = true;
+			continue;
+		}
 		if (parsed.command === "inspect" && parsed.evidenceId === undefined) {
 			if (arg.startsWith("-")) throw new Error("inspect requires an evidence id");
 			parsed.evidenceId = arg;
@@ -103,6 +121,11 @@ function parseEvidenceArgs(args: ReadonlyArray<string>): ParsedEvidenceArgs {
 	) {
 		throw new Error("list does not accept extra arguments");
 	}
+	// The GUI read is only fixed if `--json` is required rather than defaulted:
+	// a bare `evidence inventory` must not quietly print something else.
+	if (parsed.command === "inventory" && !parsed.json) {
+		throw new Error("inventory requires --json");
+	}
 	return parsed;
 }
 
@@ -159,6 +182,7 @@ export async function runEvidenceCommand(args: ReadonlyArray<string>): Promise<n
 				printError("inspect requires an evidence id");
 				return 2;
 			}
+			if (parsed.json) return runEvidenceDetail(evidenceId);
 			const inspected = await inspectEvidence(dataDir, evidenceId);
 			const provenance = await loadEvidenceRunProvenance(dataDir, evidenceId);
 			renderEvidence(inspected, provenance);
@@ -168,7 +192,8 @@ export async function runEvidenceCommand(args: ReadonlyArray<string>): Promise<n
 			renderEvidenceList(await listEvidenceOverviews(dataDir));
 			return 0;
 		}
-		printError("evidence requires build, inspect, or list");
+		if (parsed.command === "inventory") return runEvidenceInventory(parsed.json);
+		printError("evidence requires build, inspect, list, or inventory");
 		return 2;
 	} catch (error) {
 		printError(error instanceof Error ? error.message : String(error));

package/src/cli/fleet-decisions.ts

@@ -0,0 +1,69 @@
+/**
+ * Fixed machine-readable projection of durable coordinator gate decisions.
+ *
+ * A review or compete gate seals an integrity-covered artifact linking the
+ * decider receipt to every subject receipt, and nothing in the operator surface
+ * reads them: `fleet view` shows a run, not the verdict a gate reached about
+ * it. This command accepts no identifier, group, or limit, selects a bounded
+ * newest-first window itself, and emits the shape of each decision.
+ *
+ * It is a separate command from `fleet inspect --json` rather than another
+ * field on it, on the same reasoning the trace read used. The decisions live in
+ * their own directory with their own failure mode, and an installation that has
+ * never run a gate has no directory at all, so folding the read in would turn a
+ * missing directory into a failure of the run journal.
+ */
+
+import {
+	GATE_TOPOLOGY_MAX_DECISIONS,
+	GATE_TOPOLOGY_MAX_SUBJECTS,
+	type GateDecisionReason,
+	type GateTopologyDecision,
+	gateTopology,
+} from "../domains/dispatch/gate-topology.js";
+
+export {
+	GATE_TOPOLOGY_MAX_DECISIONS as FLEET_DECISIONS_MAX,
+	GATE_TOPOLOGY_MAX_SUBJECTS as FLEET_DECISIONS_MAX_SUBJECTS,
+};
+
+export interface FleetDecisionsSnapshot {
+	readonly version: 1;
+	readonly generatedAt: string;
+	readonly available: boolean;
+	readonly decisions: readonly GateTopologyDecision[];
+	readonly truncated: boolean;
+	readonly unverifiable: number;
+}
+
+export type { GateDecisionReason, GateTopologyDecision };
+
+/**
+ * Pure command payload builder, exported so the fixed CLI contract is testable
+ * without subprocess output capture.
+ *
+ * `available` separates an installation that has never run a gate from one
+ * whose gates all aged out of the scan. Both report no decisions and they are
+ * different operator states, so the flag is reported rather than inferred from
+ * an empty list.
+ */
+function fleetDecisionsSnapshot(now: () => number = Date.now): FleetDecisionsSnapshot {
+	const topology = gateTopology();
+	return {
+		version: 1,
+		generatedAt: new Date(now()).toISOString(),
+		available: topology.present,
+		decisions: topology.decisions,
+		truncated: topology.truncated,
+		unverifiable: topology.unverifiable,
+	};
+}
+
+export function runFleetDecisions(args: ReadonlyArray<string>): number {
+	if (args.length !== 1 || args[0] !== "--json") {
+		process.stderr.write("clio-coder fleet decisions: usage: clio-coder fleet decisions --json\n");
+		return 2;
+	}
+	process.stdout.write(`${JSON.stringify(fleetDecisionsSnapshot(), null, 2)}\n`);
+	return 0;
+}

package/src/cli/fleet-inspect.ts

@@ -0,0 +1,334 @@
+/**
+ * Fixed machine-readable projection of recent durable dispatch runs.
+ *
+ * `fleet view` is an operator-directed terminal surface: it accepts a run id,
+ * prints native evidence paths, and can follow one alternate-screen view. The
+ * GUI cannot safely reuse that transport. This command accepts no identifier
+ * or path, selects a bounded newest-first window itself, and emits only the
+ * already-sanitized view model fields a typed host adapter can further narrow.
+ */
+
+import {
+	COUNCIL_TOPOLOGY_MAX_COUNCILS,
+	COUNCIL_TOPOLOGY_MAX_MEMBERS,
+	COUNCIL_TOPOLOGY_MAX_SCAN,
+	COUNCIL_TOPOLOGY_MAX_TURNS,
+	type CouncilApproval,
+	type CouncilOrigin,
+	type CouncilSynthesisKind,
+	councilTopologies,
+} from "../domains/dispatch/council-topology.js";
+import type { ExecutionRole } from "../domains/dispatch/execution-role.js";
+import { listFleetRuns, openLedger } from "../domains/dispatch/state.js";
+import type { RunOutcome, RunStatus } from "../domains/dispatch/types.js";
+import { sanitizeCallTargetText } from "../domains/safety/call-target.js";
+import { truncateToWidth } from "../engine/tui-primitives.js";
+import { loadFleetRunViewModel, loadRunViewModel } from "./fleet-view.js";
+
+export const FLEET_INSPECT_MAX_RUNS = 8;
+export const FLEET_INSPECT_MAX_EVENTS = 32;
+export const FLEET_INSPECT_MAX_ROOTS = 4;
+export const FLEET_INSPECT_MAX_STEPS = 24;
+export const FLEET_INSPECT_MAX_COUNCILS = COUNCIL_TOPOLOGY_MAX_COUNCILS;
+export const FLEET_INSPECT_MAX_COUNCIL_MEMBERS = COUNCIL_TOPOLOGY_MAX_MEMBERS;
+export const FLEET_INSPECT_MAX_COUNCIL_TURNS = COUNCIL_TOPOLOGY_MAX_TURNS;
+
+const IDENTITY_WIDTH = 128;
+const TASK_WIDTH = 400;
+const EVENT_LABEL_WIDTH = 96;
+const EVENT_DETAIL_WIDTH = 240;
+const OUTCOME_WIDTH = 160;
+const STEP_ID_WIDTH = 96;
+
+export type FleetInspectEvidenceState = "pending" | "verified" | "failed" | "unavailable";
+
+export interface FleetInspectEvent {
+	readonly at: string;
+	readonly label: string;
+	readonly detail: string | null;
+}
+
+export interface FleetInspectRun {
+	readonly runId: string;
+	readonly agentId: string;
+	readonly model: string;
+	readonly target: string;
+	readonly node: string;
+	readonly phase: string;
+	readonly startedAt: string;
+	readonly elapsedMs: number;
+	readonly task: string | null;
+	readonly journal: "available" | "missing";
+	readonly events: readonly FleetInspectEvent[];
+	readonly eventsTruncated: boolean;
+	readonly evidence: Readonly<{
+		state: FleetInspectEvidenceState;
+		summary: string;
+	}>;
+	readonly outcome: string | null;
+	readonly outcomeDetail: string | null;
+	readonly terminal: boolean;
+}
+
+export interface FleetInspectRootStep {
+	readonly stepId: string;
+	/** The run the step terminated on, or null when the step never ran. */
+	readonly runId: string | null;
+	readonly agentId: string | null;
+	readonly outcome: string;
+	readonly detail: string | null;
+}
+
+/**
+ * One fleet root's step index.
+ *
+ * A root is not a run: it has no ledger row, receipt, or journal, so nothing
+ * here is a transcript. What it answers is the question the run window alone
+ * cannot, which is which planned steps a fleet had and which run each one
+ * terminated on. That turns the flat recent-run list into something an operator
+ * can trace back to the fleet that dispatched it.
+ */
+export interface FleetInspectRoot {
+	readonly rootId: string;
+	readonly fleet: string;
+	readonly startedAt: string;
+	readonly elapsedMs: number;
+	readonly running: boolean;
+	readonly resumedFrom: string | null;
+	readonly plannedSteps: number;
+	readonly recordedSteps: number;
+	readonly steps: readonly FleetInspectRootStep[];
+	readonly stepsTruncated: boolean;
+}
+
+export interface FleetInspectCouncilTurn {
+	readonly round: number;
+	readonly runId: string;
+	readonly status: RunStatus;
+	readonly outcome: RunOutcome | null;
+	readonly terminal: boolean;
+}
+
+export interface FleetInspectCouncilMember {
+	readonly label: string;
+	readonly agentId: string;
+	readonly target: string;
+	readonly model: string;
+	readonly executionRole: ExecutionRole;
+	readonly turns: readonly FleetInspectCouncilTurn[];
+	readonly turnsTruncated: boolean;
+}
+
+export interface FleetInspectCouncilJudge {
+	readonly runId: string;
+	readonly agentId: string;
+	readonly target: string;
+	readonly model: string;
+	readonly status: RunStatus;
+	readonly outcome: RunOutcome | null;
+}
+
+/**
+ * One council's topology, reconstructed from the same ledger the run window
+ * reads.
+ *
+ * A council is not a fleet root and owns no record of its own: it is a set of
+ * ordinary runs sharing a group stamp. What this carries is the shape of that
+ * set. The members' answers, the judge's synthesis prose, and the vote tally are
+ * free model text inside receipt output and stay on the host permanently, so a
+ * council row says who was seated, where each voice ran, how many rounds it
+ * took, and whether a synthesis was reached, and nothing about what was said.
+ */
+export interface FleetInspectCouncil {
+	readonly group: string;
+	readonly startedAt: string;
+	readonly endedAt: string | null;
+	readonly running: boolean;
+	readonly roundsPlanned: number | null;
+	readonly roundsObserved: number;
+	readonly origin: CouncilOrigin | null;
+	readonly approval: CouncilApproval | null;
+	readonly members: readonly FleetInspectCouncilMember[];
+	readonly membersTruncated: boolean;
+	readonly membersRejected: number;
+	readonly synthesis: Readonly<{
+		kind: CouncilSynthesisKind | null;
+		sealedRunId: string | null;
+		judge: FleetInspectCouncilJudge | null;
+	}>;
+}
+
+export interface FleetInspectSnapshot {
+	readonly version: 1;
+	readonly generatedAt: string;
+	readonly runs: readonly FleetInspectRun[];
+	readonly truncated: boolean;
+	readonly roots: readonly FleetInspectRoot[];
+	readonly rootsTruncated: boolean;
+	readonly councils: readonly FleetInspectCouncil[];
+	readonly councilsTruncated: boolean;
+}
+
+function bounded(value: string, width: number): string {
+	const sanitized = sanitizeCallTargetText(value);
+	if (sanitized.length === 0) return "unavailable";
+	return sanitizeCallTargetText(truncateToWidth(sanitized, width, "…", false));
+}
+
+function evidenceProjection(text: string): FleetInspectRun["evidence"] {
+	if (text.startsWith("receipt pending;")) {
+		return {
+			state: "pending",
+			summary: "Receipt pending; this run has not finalized.",
+		};
+	}
+	if (text.startsWith("RECEIPT INTEGRITY FAILED:")) {
+		return {
+			state: "failed",
+			summary: "Clio Coder rejected the stored receipt's integrity.",
+		};
+	}
+	if (text.startsWith("receipt unavailable:")) {
+		return {
+			state: "unavailable",
+			summary: "The durable receipt is unavailable.",
+		};
+	}
+	if (text.startsWith("trust v")) {
+		return { state: "verified", summary: bounded(text, EVENT_DETAIL_WIDTH) };
+	}
+	return {
+		state: "unavailable",
+		summary: "Receipt trust could not be classified.",
+	};
+}
+
+/** Pure command payload builder, exported so the fixed CLI contract is testable without subprocess output capture. */
+function fleetInspectSnapshot(now: () => number = Date.now): FleetInspectSnapshot {
+	const ledgerRows = openLedger().list();
+	const selected = ledgerRows.slice(0, FLEET_INSPECT_MAX_RUNS);
+	// The council window is deliberately wider than the run window. A single
+	// council is up to five members over three rounds plus a judge and its sealed
+	// report, so a council that finished an hour ago holds no row in the eight
+	// newest runs. Selecting it from the same already-open ledger costs nothing
+	// but the scan; a second child process reading the same file would not.
+	const topology = councilTopologies(ledgerRows.slice(0, COUNCIL_TOPOLOGY_MAX_SCAN));
+	const runs: FleetInspectRun[] = [];
+	for (const row of selected) {
+		const model = loadRunViewModel(row.id, { now });
+		if (model === null) continue;
+		const visibleEvents = model.transcript.slice(-FLEET_INSPECT_MAX_EVENTS);
+		runs.push({
+			runId: bounded(model.runId, IDENTITY_WIDTH),
+			agentId: bounded(model.agentId, IDENTITY_WIDTH),
+			model: bounded(model.model, IDENTITY_WIDTH),
+			target: bounded(model.target, IDENTITY_WIDTH),
+			node: bounded(model.node, IDENTITY_WIDTH),
+			phase: bounded(model.phase, IDENTITY_WIDTH),
+			startedAt: model.startedAt,
+			elapsedMs: model.elapsedMs,
+			task: model.task === undefined ? null : bounded(model.task, TASK_WIDTH),
+			journal: model.journalPresent ? "available" : "missing",
+			events: visibleEvents.map((event) => ({
+				at: event.at,
+				label: bounded(event.label, EVENT_LABEL_WIDTH),
+				detail: event.detail === undefined ? null : bounded(event.detail, EVENT_DETAIL_WIDTH),
+			})),
+			eventsTruncated: model.transcriptTruncated || model.transcript.length > visibleEvents.length,
+			evidence: evidenceProjection(model.evidence),
+			outcome: model.outcome === null ? null : bounded(model.outcome, OUTCOME_WIDTH),
+			outcomeDetail: model.outcomeDetail === null ? null : bounded(model.outcomeDetail, OUTCOME_WIDTH),
+			terminal: model.terminal,
+		});
+	}
+	const rootRecords = listFleetRuns();
+	const selectedRoots = rootRecords.slice(0, FLEET_INSPECT_MAX_ROOTS);
+	const roots: FleetInspectRoot[] = [];
+	for (const record of selectedRoots) {
+		const model = loadFleetRunViewModel(record.id, { now });
+		if (model === null) continue;
+		// The planned order is the order the operator wrote the fleet in, so the
+		// index keeps its head rather than its tail: an operator reading a step
+		// index is looking for where the fleet got to, not where it ended.
+		const visibleSteps = model.steps.slice(0, FLEET_INSPECT_MAX_STEPS);
+		roots.push({
+			rootId: bounded(model.rootId, IDENTITY_WIDTH),
+			fleet: bounded(model.fleet, IDENTITY_WIDTH),
+			startedAt: model.startedAt,
+			elapsedMs: model.elapsedMs,
+			running: model.running,
+			resumedFrom: model.resumedFrom === null ? null : bounded(model.resumedFrom, IDENTITY_WIDTH),
+			plannedSteps: model.plannedSteps,
+			recordedSteps: model.recordedSteps,
+			steps: visibleSteps.map((step) => ({
+				stepId: bounded(step.stepId, STEP_ID_WIDTH),
+				runId: step.runId === null ? null : bounded(step.runId, IDENTITY_WIDTH),
+				agentId: step.agentId === null ? null : bounded(step.agentId, IDENTITY_WIDTH),
+				outcome: bounded(step.outcome, OUTCOME_WIDTH),
+				detail: step.detail === undefined ? null : bounded(step.detail, OUTCOME_WIDTH),
+			})),
+			stepsTruncated: model.steps.length > visibleSteps.length,
+		});
+	}
+	const councils: FleetInspectCouncil[] = topology.councils.map((council) => ({
+		group: bounded(council.group, IDENTITY_WIDTH),
+		startedAt: council.startedAt,
+		endedAt: council.endedAt,
+		running: council.running,
+		roundsPlanned: council.roundsPlanned,
+		roundsObserved: council.roundsObserved,
+		origin: council.origin,
+		approval: council.approval,
+		members: council.members.map((member) => ({
+			label: bounded(member.label, IDENTITY_WIDTH),
+			agentId: bounded(member.agentId, IDENTITY_WIDTH),
+			target: bounded(member.targetId, IDENTITY_WIDTH),
+			model: bounded(member.wireModelId, IDENTITY_WIDTH),
+			executionRole: member.executionRole,
+			turns: member.turns.map((turn) => ({
+				round: turn.round,
+				runId: bounded(turn.runId, IDENTITY_WIDTH),
+				status: turn.status,
+				outcome: turn.outcome,
+				terminal: turn.terminal,
+			})),
+			turnsTruncated: member.turnsTruncated,
+		})),
+		membersTruncated: council.membersTruncated,
+		membersRejected: council.membersRejected,
+		synthesis: {
+			kind: council.synthesis.kind,
+			sealedRunId: council.synthesis.sealedRunId === null ? null : bounded(council.synthesis.sealedRunId, IDENTITY_WIDTH),
+			judge:
+				council.synthesis.judge === null
+					? null
+					: {
+							runId: bounded(council.synthesis.judge.runId, IDENTITY_WIDTH),
+							agentId: bounded(council.synthesis.judge.agentId, IDENTITY_WIDTH),
+							target: bounded(council.synthesis.judge.targetId, IDENTITY_WIDTH),
+							model: bounded(council.synthesis.judge.wireModelId, IDENTITY_WIDTH),
+							status: council.synthesis.judge.status,
+							outcome: council.synthesis.judge.outcome,
+						},
+		},
+	}));
+	return {
+		version: 1,
+		generatedAt: new Date(now()).toISOString(),
+		runs,
+		truncated: ledgerRows.length > selected.length || runs.length !== selected.length,
+		roots,
+		rootsTruncated: rootRecords.length > selectedRoots.length || roots.length !== selectedRoots.length,
+		councils,
+		councilsTruncated: topology.truncated || ledgerRows.length > COUNCIL_TOPOLOGY_MAX_SCAN,
+	};
+}
+
+export function runFleetInspect(args: ReadonlyArray<string>): number {
+	if (args.length !== 1 || args[0] !== "--json") {
+		process.stderr.write("clio-coder fleet inspect: usage: clio-coder fleet inspect --json\n");
+		return 2;
+	}
+	process.stdout.write(`${JSON.stringify(fleetInspectSnapshot(), null, 2)}\n`);
+	return 0;
+}

package/src/cli/fleet-preflight.ts

@@ -33,7 +33,7 @@ export function inspectFleet(name: string, vars?: Readonly<Record<string, string
 	const resolved = new Set<string>();
 	const settings = readSettings();
 	const targetIds = new Set(settings.targets.map((target) => target.id));
-	const profileIds = new Set(Object.keys(settings.workers?.profiles ?? {}));
+	const profileIds = new Set(Object.keys(settings.fleet?.profiles ?? {}));
 	for (const step of contract.steps) {
 		const positions =
 			step.kind === "loop"