@jinn-network/client 0.1.8 → 0.1.9-canary.023faefb

package/dist/harnesses/auth-source.d.ts

@@ -0,0 +1,51 @@
+import type { Harness } from './types.js';
+/**
+ * Tilde-abbreviate an absolute path for operator display when it sits under the
+ * real home dir; otherwise return it unchanged. Used by harness `getAuthSource`
+ * implementations so the dashboard shows `~/.hermes/.env` rather than a full
+ * `/Users/...` path.
+ */
+export declare function displayPath(absolutePath: string): string;
+export type HarnessAuthSource = {
+    sourceKind: 'file';
+    sourcePath: string;
+    absolutePath: string;
+    envKey: string;
+    docAnchor: string;
+    /**
+     * When true the credential file is structured (e.g. codex `auth.json`)
+     * rather than a flat `KEY=value` dotenv. The resolver then reports
+     * `loaded` from file existence alone and masks the suffix to null — it
+     * never parses a key line out of the structured body.
+     */
+    credentialIsJson?: boolean;
+} | {
+    sourceKind: 'env';
+    envKey: string;
+    docAnchor: string;
+} | {
+    sourceKind: 'session';
+    docAnchor: string;
+};
+export interface HarnessAuthStatusEntry {
+    harnessName: string;
+    sourceKind: 'file' | 'env' | 'session' | 'none';
+    sourcePath?: string;
+    envKey?: string;
+    keySuffix: string | null;
+    lastModified: string | null;
+    state: 'loaded' | 'missing' | 'unknown';
+    docAnchor?: string;
+}
+export interface HarnessAuthStatusResponse {
+    harnesses: HarnessAuthStatusEntry[];
+}
+export interface ResolveOptions {
+    /** Env bag for env-kind sources. Defaults to process.env. */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Resolve one harness's safe auth status. Iteration-safe: any error collapses
+ * to a session-shaped `unknown` entry rather than throwing.
+ */
+export declare function resolveHarnessAuthStatus(harness: Harness, opts?: ResolveOptions): Promise<HarnessAuthStatusEntry>;

package/dist/harnesses/auth-source.js

@@ -0,0 +1,155 @@
+/**
+ * Shared resolver for the operator dashboard's "Harness auth status" panel (#564).
+ *
+ * A harness declares WHERE its credential lives via `getAuthSource()`. This
+ * helper owns the unsafe part: stat the file for mtime, read the credential,
+ * keep ONLY the last-4 suffix, discard the full value. It NEVER returns full
+ * key bytes. See docs/runbooks/rotating-harness-keys.md.
+ */
+import { stat, readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+/**
+ * Tilde-abbreviate an absolute path for operator display when it sits under the
+ * real home dir; otherwise return it unchanged. Used by harness `getAuthSource`
+ * implementations so the dashboard shows `~/.hermes/.env` rather than a full
+ * `/Users/...` path.
+ */
+export function displayPath(absolutePath) {
+    const home = homedir();
+    return absolutePath.startsWith(home) ? absolutePath.replace(home, '~') : absolutePath;
+}
+const MIN_SUFFIX_LEN = 8;
+/** Last-4 suffix, or null when the value is too short / empty to safely show. */
+function safeSuffix(value) {
+    if (value.length < MIN_SUFFIX_LEN)
+        return null;
+    return value.slice(-4);
+}
+/**
+ * Extract the value of a single `KEY=value` line from a dotenv-style file body.
+ * Matches the named key at the start of a line only — a value that merely
+ * mentions the key name elsewhere is ignored. Strips surrounding quotes.
+ */
+function readEnvValueFromFile(body, envKey) {
+    for (const rawLine of body.split(/\r?\n/)) {
+        const line = rawLine.trimStart();
+        if (!line.startsWith(`${envKey}=`))
+            continue;
+        let value = line.slice(envKey.length + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        return value;
+    }
+    return undefined;
+}
+/**
+ * Resolve one harness's safe auth status. Iteration-safe: any error collapses
+ * to a session-shaped `unknown` entry rather than throwing.
+ */
+export async function resolveHarnessAuthStatus(harness, opts = {}) {
+    if (!harness.getAuthSource) {
+        return {
+            harnessName: harness.name,
+            sourceKind: 'none',
+            keySuffix: null,
+            lastModified: null,
+            state: 'unknown',
+        };
+    }
+    let source;
+    try {
+        source = await harness.getAuthSource();
+    }
+    catch {
+        return {
+            harnessName: harness.name,
+            sourceKind: 'session',
+            keySuffix: null,
+            lastModified: null,
+            state: 'unknown',
+        };
+    }
+    if (source.sourceKind === 'session') {
+        return {
+            harnessName: harness.name,
+            sourceKind: 'session',
+            keySuffix: null,
+            lastModified: null,
+            state: 'unknown',
+            docAnchor: source.docAnchor,
+        };
+    }
+    if (source.sourceKind === 'env') {
+        const env = opts.env ?? process.env;
+        const value = env[source.envKey]?.trim() ?? '';
+        return {
+            harnessName: harness.name,
+            sourceKind: 'env',
+            envKey: source.envKey,
+            keySuffix: safeSuffix(value),
+            lastModified: null,
+            state: value.length > 0 ? 'loaded' : 'missing',
+            docAnchor: source.docAnchor,
+        };
+    }
+    // file-kind
+    let mtime = null;
+    let body;
+    try {
+        const st = await stat(source.absolutePath);
+        mtime = st.mtime.toISOString();
+        body = await readFile(source.absolutePath, 'utf8');
+    }
+    catch {
+        return {
+            harnessName: harness.name,
+            sourceKind: 'file',
+            sourcePath: source.sourcePath,
+            envKey: source.envKey,
+            keySuffix: null,
+            lastModified: null,
+            state: 'missing',
+            docAnchor: source.docAnchor,
+        };
+    }
+    // Structured credential files (e.g. codex auth.json): report `loaded` from
+    // existence + mtime, but never parse a key out — suffix stays masked.
+    if (source.credentialIsJson) {
+        return {
+            harnessName: harness.name,
+            sourceKind: 'file',
+            sourcePath: source.sourcePath,
+            envKey: source.envKey,
+            keySuffix: null,
+            lastModified: mtime,
+            state: 'loaded',
+            docAnchor: source.docAnchor,
+        };
+    }
+    const value = readEnvValueFromFile(body, source.envKey)?.trim() ?? '';
+    if (value.length === 0) {
+        return {
+            harnessName: harness.name,
+            sourceKind: 'file',
+            sourcePath: source.sourcePath,
+            envKey: source.envKey,
+            keySuffix: null,
+            lastModified: null,
+            state: 'missing',
+            docAnchor: source.docAnchor,
+        };
+    }
+    return {
+        harnessName: harness.name,
+        sourceKind: 'file',
+        sourcePath: source.sourcePath,
+        envKey: source.envKey,
+        keySuffix: safeSuffix(value),
+        lastModified: mtime,
+        state: 'loaded',
+        docAnchor: source.docAnchor,
+    };
+}
+//# sourceMappingURL=auth-source.js.map

package/dist/harnesses/auth-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-source.js","sourceRoot":"","sources":["../../src/harnesses/auth-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AACxF,CAAC;AA0CD,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,iFAAiF;AACjF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAc;IACxD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,OAAuB,EAAE;IAEzB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,SAAS;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;YAC5B,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC9C,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,YAAY;IACZ,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,KAAK;YACnB,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,UAAU,EAAE,MAAM;QAClB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;QAC5B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/harnesses/engine/canonical-json.js

@@ -22,9 +22,11 @@
  * Used for manifest signing: produce a deterministic byte string that two
  * independent parties can reproduce from the same object graph.
  */
-import { createRequire } from 'node:module';
-const require = createRequire(import.meta.url);
-const canonicalize = require('canonicalize');
+// canonicalize v3 is ESM-only (no CJS entry); the client is `"type": "module"`
+// so a native ESM default import is the correct interop (replaces the v2-era
+// createRequire shim). v3 is packaging-only vs v2 — its RFC 8785 output is
+// byte-identical, so existing content hashes / manifest signatures are stable.
+import canonicalize from 'canonicalize';
 /**
  * Recursively replace NaN / ±Infinity with null so that canonicalize does not
  * throw — matching the JSON.stringify behaviour that the rest of the codebase

package/dist/harnesses/engine/canonical-json.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/harnesses/engine/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAA2C,CAAC;AAEvF;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,WAAW;QACX,MAAM,MAAM,GAAI,KAAoC,CAAC,MAAM,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/harnesses/engine/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,OAAO,YAAY,MAAM,cAAc,CAAC;AAExC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,WAAW;QACX,MAAM,MAAM,GAAI,KAAoC,CAAC,MAAM,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/harnesses/engine/engine.d.ts

@@ -16,6 +16,7 @@ import type { Harness, HarnessContext, RuntimePlugin } from '../types.js';
 import type { IdentityPublisher, ReputationRegistryClient, ResolvedAgent } from '../../erc8004/index.js';
 import type { Task } from '../../types/task.js';
 import { TrajectoryCollector } from '../../trajectory/index.js';
+import type { ScrubPipeline } from '../../trajectory/scrub/pipeline.js';
 import type { SolverNetManifestV1 } from '../../vendor/@jinn-network/sdk/dist/solvernets/index.js';
 import { type FreezeViolation } from '../../daemon/freeze-fence.js';
 export declare class NotImplementedError extends Error {
@@ -70,6 +71,10 @@ export interface JoinedSolverNetsView {
     } | undefined;
     /** Enumerate all joined manifest CIDs (used for digest-based filtering). */
     manifestCids(): string[];
+    /** Add/replace one joined entry live (used by the hot-apply join applier, #1037). */
+    set(manifestCid: string, entry: {
+        roles: Array<'solver' | 'evaluator'>;
+    }): void;
 }
 /**
  * Build a `JoinedSolverNetsView` from the raw operator-config block.
@@ -82,6 +87,17 @@ export declare function joinedSolverNetsViewFromConfig(joined: Record<string, {
     manifestCid: string;
     roles: Array<'solver' | 'evaluator'>;
 }> | undefined): JoinedSolverNetsView | undefined;
+/**
+ * Mutable `JoinedSolverNetsView` for the running daemon. Unlike
+ * `joinedSolverNetsViewFromConfig` (boot snapshot), the applier
+ * (`daemon/join-applier.ts`, #1037) keeps a handle and calls `set()` when a
+ * join is hot-applied, so the engine's per-task eligibility check sees the new
+ * cid on its next call without a restart.
+ */
+export declare function createMutableJoinedSolverNetsView(initial: Record<string, {
+    manifestCid: string;
+    roles: Array<'solver' | 'evaluator'>;
+}> | undefined): JoinedSolverNetsView;
 /**
  * Resolves a launched SolverNet manifest by IPFS CID.
  *
@@ -140,6 +156,12 @@ export interface TaskEngineOptions {
      */
     implRegistry?: ImplRegistry;
     solverNetRegistry?: SolverNetRegistryLike;
+    /**
+     * Seller-side scrub pipeline applied to trajectory spans at emit time. When
+     * absent, the engine builds the default (openredaction + secretlint); supply
+     * one to add the ML PII detector.
+     */
+    scrubPipeline?: ScrubPipeline;
     /**
      * Per-launch operator eligibility filter (Task 28 of
      * `spec/2026-05-05-solvernet-creation-and-launch.md`).
@@ -287,6 +309,7 @@ export declare class TaskEngine {
     protected readonly deliveryDeps: TaskEngineOptions['deliveryDeps'];
     protected readonly implRegistry: TaskEngineOptions['implRegistry'];
     protected readonly solverNetRegistry: TaskEngineOptions['solverNetRegistry'];
+    protected readonly scrubPipeline: ScrubPipeline;
     protected readonly joinedSolverNets: TaskEngineOptions['joinedSolverNets'];
     protected readonly manifestResolver: TaskEngineOptions['manifestResolver'];
     protected readonly identityPublisher: TaskEngineOptions['identityPublisher'];
@@ -362,7 +385,8 @@ export declare class TaskEngine {
     }>;
     /**
      * Recover all in-flight tasks from persisted state.
-     * Called at daemon startup before beginning normal event processing.
+     * Started at daemon startup; runs concurrently with the daemon loops
+     * (#1422 — startup must not block on a recovered impl re-execution).
      * Returns a per-task report for each task attempted.
      */
     recoverInFlight(): Promise<RecoveryReport[]>;
@@ -576,6 +600,15 @@ export declare class TaskEngine {
      *   TCAttemptAlreadyFinalized, …). We mark the row RACE_LOST and emit a
      *   `kind=race_lost` activity event so operators can audit prunes
      *   without inflating the FAILED counter (#896).
+     * - A transport-transient error (e.g. `AllRpcsFailedError` — every provider
+     *   in the L2 fallback chain failed at once) on a task whose delivery window
+     *   is still open: leave the row in its current in-flight state so the next
+     *   tick re-drives it once the RPCs recover, and emit a `tick_error` (warn)
+     *   event instead of inflating the FAILED counter. Without this the daemon
+     *   stamped the row FAILED, dropping it from `getInFlight()` permanently, so
+     *   L2 work went silent until a manual restart (#912). Past-window transient
+     *   errors still terminalize to avoid churning on work that can no longer
+     *   settle.
      * - Everything else: existing markFailed behaviour. When invoked from
      *   recovery, `contextLabel === 'recovery'` so the failure_reason
      *   carries the `recovery:` prefix the original code path used.

package/dist/harnesses/engine/engine.js

@@ -18,14 +18,17 @@ import { assembleAndSignEnvelope, } from './envelope-assembly.js';
 import { deliverAndClaim, } from './delivery.js';
 import { SafeInnerRevertError, isNonRecoverableInnerRevert, formatDecodedRevert, } from '../../adapters/mech/safe-revert.js';
 import { emitEvent } from '../../observability/emit-event.js';
+import { isRecoverableTransactionError } from '../../tx-retry.js';
 import { SkippableError } from '../types.js';
 import { submitEvaluatorFeedback, codeDigestSha256ToBytes32, encodeExecutionPayload, encodeExecutionPayloadV2, modeStringToFlag, } from '../../erc8004/index.js';
 import { TrajectoryCollector, emitTrajectory } from '../../trajectory/index.js';
+import { buildScrubPipeline } from '../../trajectory/scrub/build.js';
 import { uploadToIpfs } from '../../adapters/mech/ipfs.js';
 import { VerdictCode } from '../../adapters/mech/verdict-code.js';
 import { buildInfo } from '../../build-info.js';
 import { getSolverNetContract } from '../../vendor/@jinn-network/sdk/dist/solvernets/index.js';
 import { runHarnessWithFreezeFence, } from '../../daemon/freeze-fence.js';
+import { recordLoopTick } from '../../daemon/loop-heartbeat.js';
 import { harnessStateDirName } from '../names.js';
 import { recordTaskCost } from '../../spend/record.js';
 // ── Sentinel error ────────────────────────────────────────────────────────────
@@ -61,6 +64,25 @@ export function joinedSolverNetsViewFromConfig(joined) {
     return {
         get: (cid) => map.get(cid),
         manifestCids: () => [...map.keys()],
+        set: (cid, entry) => { map.set(cid, entry); },
+    };
+}
+/**
+ * Mutable `JoinedSolverNetsView` for the running daemon. Unlike
+ * `joinedSolverNetsViewFromConfig` (boot snapshot), the applier
+ * (`daemon/join-applier.ts`, #1037) keeps a handle and calls `set()` when a
+ * join is hot-applied, so the engine's per-task eligibility check sees the new
+ * cid on its next call without a restart.
+ */
+export function createMutableJoinedSolverNetsView(initial) {
+    const map = new Map();
+    for (const [key, entry] of Object.entries(initial ?? {})) {
+        map.set(entry.manifestCid ?? key, { roles: entry.roles });
+    }
+    return {
+        get: (cid) => map.get(cid),
+        manifestCids: () => [...map.keys()],
+        set: (cid, entry) => { map.set(cid, entry); },
     };
 }
 // ── TaskEngine ─────────────────────────────────────────────────────────
@@ -72,6 +94,7 @@ export class TaskEngine {
     deliveryDeps;
     implRegistry;
     solverNetRegistry;
+    scrubPipeline;
     joinedSolverNets;
     manifestResolver;
     identityPublisher;
@@ -124,6 +147,7 @@ export class TaskEngine {
         this.deliveryDeps = opts.deliveryDeps;
         this.implRegistry = opts.implRegistry;
         this.solverNetRegistry = opts.solverNetRegistry;
+        this.scrubPipeline = opts.scrubPipeline ?? buildScrubPipeline();
         this.joinedSolverNets = opts.joinedSolverNets;
         this.manifestResolver = opts.manifestResolver;
         this.identityPublisher = opts.identityPublisher;
@@ -180,12 +204,25 @@ export class TaskEngine {
     }
     /**
      * Recover all in-flight tasks from persisted state.
-     * Called at daemon startup before beginning normal event processing.
+     * Started at daemon startup; runs concurrently with the daemon loops
+     * (#1422 — startup must not block on a recovered impl re-execution).
      * Returns a per-task report for each task attempted.
      */
     async recoverInFlight() {
         const inflight = this.persistence.getInFlight();
-        const results = await Promise.allSettled(inflight.map((task) => this._recoverOne(task)));
+        const results = await Promise.allSettled(
+        // #1422: recovery runs concurrently with the tick/watcher loops, so
+        // each task must hold the same in-flight guard `scheduleProcess` uses —
+        // otherwise a tick fired mid-recovery double-drives the task's impl.
+        inflight.map((task) => {
+            if (this.processingRequestIds.has(task.requestId)) {
+                return Promise.resolve();
+            }
+            this.processingRequestIds.add(task.requestId);
+            return this._recoverOne(task).finally(() => {
+                this.processingRequestIds.delete(task.requestId);
+            });
+        }));
         const reports = results.map((result, i) => {
             const requestId = inflight[i].requestId;
             if (result.status === 'fulfilled') {
@@ -281,6 +318,7 @@ export class TaskEngine {
             catch (err) {
                 console.error('[harness-engine] tick loop error (continuing):', err instanceof Error ? err.message : err);
             }
+            recordLoopTick(this.store, 'engine-tick'); // #1043 loop watchdog
             if (this.stopped)
                 break;
             await Promise.race([
@@ -761,7 +799,17 @@ export class TaskEngine {
             throw new NotImplementedError('runImpl');
         }
         const runtimePlugins = solverNet?.runtimePlugins ?? [];
-        this.runtimePluginsByRequest.set(task.requestId, runtimePlugins);
+        // #1035: merge harness self-attributed plugins (e.g. claude-code-learner)
+        // into the envelope carrier so they appear in executor.plugins. This is a
+        // SEPARATE array from `runtimePlugins`: the latter still feeds
+        // ctx.runtimePlugins / ctx.solverPluginRoots (which the harness uses to
+        // LOAD solver plugins), and the learner plugin is already loaded by the
+        // harness itself via its own plugin root — adding it there would double-load.
+        const attributedPlugins = [
+            ...runtimePlugins,
+            ...(impl.attributionPlugins?.() ?? []),
+        ];
+        this.runtimePluginsByRequest.set(task.requestId, attributedPlugins);
         const workingDir = task.workingDir ?? join(this.paths.workingDirRoot, task.requestId);
         const kindSeg = solverType.replace(/[.:]/g, '_');
         const implStateDir = task.implStateDir ?? (kindSeg
@@ -846,7 +894,7 @@ export class TaskEngine {
                         informationalClaim: skippedOutput.informational ?? null,
                         solutionOutputsJson: JSON.stringify(skippedOutput),
                         implName: impl.name,
-                        runtimePluginsJson: JSON.stringify(runtimePlugins),
+                        runtimePluginsJson: JSON.stringify(attributedPlugins),
                     });
                     console.log(`[harness-engine] ${task.requestId} RUNNING → POST_SNAPSHOT via impl=${impl.name} (skipped)`);
                     return;
@@ -890,7 +938,7 @@ export class TaskEngine {
                 informationalClaim: output.informational ?? null,
                 solutionOutputsJson: JSON.stringify(output),
                 implName: impl.name,
-                runtimePluginsJson: JSON.stringify(runtimePlugins),
+                runtimePluginsJson: JSON.stringify(attributedPlugins),
             });
         }
         finally {
@@ -981,6 +1029,7 @@ export class TaskEngine {
                     signerAddress: account.address,
                     ipfsRegistryUrl: this.envelopeDeps.ipfsRegistryUrl,
                     scrub: packagingDepsWithReq.donation?.scrub,
+                    scrubPipeline: this.scrubPipeline,
                 });
                 const sources = [];
                 if (packagingDepsWithReq.donation?.enabled) {
@@ -1488,10 +1537,7 @@ export class TaskEngine {
             case 'UNRESOLVED':
                 return VerdictCode.Unresolved;
             default:
-                // gatingClaim is null, verdict is absent, or the string is unrecognized.
-                // Return Invalid(3) — not Pass(1). Pass must come from an explicit PASS/SCORED verdict.
-                console.warn(`[harness-engine] verdictCodeForTask: unrecognized gatingClaim.verdict (got=${String(raw)}); defaulting to Invalid(3) — should never happen, indicates the evaluator harness didn't set gatingClaim.verdict before submission`);
-                return VerdictCode.Invalid;
+                throw new Error(`[harness-engine] verdictCodeForTask: missing or unrecognized gatingClaim.verdict (got=${String(raw)}); refusing to claim Invalid(3) on-chain without an explicit evaluator verdict`);
         }
     }
     async _maybePostEvaluatorFeedback(task) {
@@ -1630,6 +1676,15 @@ export class TaskEngine {
      *   TCAttemptAlreadyFinalized, …). We mark the row RACE_LOST and emit a
      *   `kind=race_lost` activity event so operators can audit prunes
      *   without inflating the FAILED counter (#896).
+     * - A transport-transient error (e.g. `AllRpcsFailedError` — every provider
+     *   in the L2 fallback chain failed at once) on a task whose delivery window
+     *   is still open: leave the row in its current in-flight state so the next
+     *   tick re-drives it once the RPCs recover, and emit a `tick_error` (warn)
+     *   event instead of inflating the FAILED counter. Without this the daemon
+     *   stamped the row FAILED, dropping it from `getInFlight()` permanently, so
+     *   L2 work went silent until a manual restart (#912). Past-window transient
+     *   errors still terminalize to avoid churning on work that can no longer
+     *   settle.
      * - Everything else: existing markFailed behaviour. When invoked from
      *   recovery, `contextLabel === 'recovery'` so the failure_reason
      *   carries the `recovery:` prefix the original code path used.
@@ -1652,6 +1707,24 @@ export class TaskEngine {
             return 'race_lost';
         }
         const reason = err instanceof Error ? err.message : String(err);
+        // A transport-transient failure (all RPC providers in the fallback chain
+        // blipped at once, 429s, timeouts, …) is not the task's fault and is not
+        // permanent. Leave the row in its in-flight state — do NOT call
+        // markFailed, which would drop it from getInFlight() forever (#912) — so
+        // the engine-tick loop re-drives it once the RPCs recover. The tick loop
+        // IS the retry; there is no per-task attempt counter. Skip this only once
+        // the delivery window has closed, so we never churn on work that can no
+        // longer settle on-chain.
+        if (task.windowEndTs > Date.now() && isRecoverableTransactionError(err)) {
+            emitEvent(this.store, {
+                kind: 'tick_error',
+                requestId: task.requestId,
+                solverType: task.solverType ?? undefined,
+                outcome: 'warn',
+                detail: `transient RPC failure in ${contextLabel}; left ${task.state} for retry: ${reason}`,
+            }, 'harness-engine');
+            return 'transient';
+        }
         const stamped = contextLabel === 'recovery' ? `recovery: ${reason}` : reason;
         this.persistence.markFailed(task.requestId, stamped);
         return 'failed';
@@ -1695,8 +1768,15 @@ export class TaskEngine {
             if (current && current.state === task.state) {
                 const classification = this._classifyAndMarkTerminal(task, err, 'recovery');
                 const reason = err instanceof Error ? err.message : String(err);
-                const log = classification === 'race_lost' ? console.log : console.error;
-                const verb = classification === 'race_lost' ? 'pruned' : 'failed';
+                // 'transient' leaves the row in-flight (not terminal); the next tick
+                // re-drives it once the RPCs recover (#912). Log it at warn so the
+                // stall is visible without firing the error-level alerting that a
+                // genuine failure does.
+                const { log, verb } = {
+                    race_lost: { log: console.log, verb: 'pruned' },
+                    transient: { log: console.warn, verb: 'deferred (transient RPC)' },
+                    failed: { log: console.error, verb: 'failed' },
+                }[classification];
                 log(`[harness-engine] resume ${verb} for ${task.requestId}: ${reason}`);
             }
             throw err;