@jtf19/vibecoding-kit 0.1.0

package/tools/vibe-runtime/runtime-scheduler-risk-artifacts.mjs

@@ -0,0 +1,775 @@
+import { createRuntimeSchedulerStateLifecycleModel } from './runtime-scheduler-state-lifecycle-model.mjs';
+import { buildControlledLongRunningAutomationContract } from './runtime-controlled-long-running-automation-contract.mjs';
+
+export function createRuntimeSchedulerRiskArtifacts(deps) {
+  const {
+    fs, path, process, jsonSchemaVersion, stateDirectoryName, schedulerPlansDirectoryName, schedulerHookPlansDirectoryName,
+    schedulerRunsDirectoryName, schedulerLeasesDirectoryName, stage11RuntimeActionName, stage11AllowedExecutionSkills,
+    schedulerPolicyProfiles, schedulerRuntimeBudget,
+  } = deps;
+  const {
+    ensureRoot, workflowPath, writeJsonEnvelope, printList,
+    readJsonArtifact, writeStateArtifact, fileDigest, digestObject, validateCommonArtifactSafety, schedulerPlansDirectory,
+    schedulerHookPlansDirectory, schedulerPlanFilePath, schedulerHookPlanFilePath, hookIntentFilePath,
+    validateHookIntentArtifact, listSchedulerPlanFiles, listSchedulerHookPlanFiles, queueScanEnvelope, recoveryClassificationEnvelope,
+    executionPolicySnapshot, runtimeActionCatalogDigest, listDispatchEvents, listDispatchClaims, claimSummary, listExecutionFiles,
+    readExecutionFile, executionsDirectory, executionSummary, validateExecutionEnvelope, dispatchesDirectory, readDispatchEventFile,
+    verifyDispatchEvent, daemonSafety, activeSchedulerLease, writeSchedulerLease, completeSchedulerLease, controlledAutoRunEnvelope,
+    writeRunningThenCompleteExecution, recoveryPolicySnapshot, recoveryActionCatalogSnapshot, validateRecoveryClassificationArtifact,
+    writeRecoveryClassification, selectRecoveryFinding, recoveryApplyEnvelopeFromClassification, writeRecoveryApply,
+  } = deps;
+
+  function schedulerPolicySnapshot(profileName = 'single-local-auto-run') {
+    const profile = schedulerPolicyProfiles[profileName];
+    if (!profile) throw new Error(`Unknown scheduler policy profile: ${profileName}`);
+    const snapshot = {
+      name: 'stage-22-scheduler-policy',
+      version: 1,
+      stage: 'Stage 22',
+      profile: profile.profile,
+      mode: profile.mode,
+      default_enabled: profile.default_enabled,
+      allowed_scheduler_actions: [...profile.allowed_scheduler_actions].sort(),
+      allowed_runtime_actions: [...profile.allowed_runtime_actions].sort(),
+      auto_run_allowed: profile.auto_run_allowed,
+      recovery_apply_allowed: profile.recovery_apply_allowed,
+      retry_allowed: profile.retry_allowed,
+      source: 'builtin-data-only',
+      dynamic_code: false,
+      remote_config: false,
+    };
+    return { ...snapshot, scheduler_policy_digest: digestObject(snapshot) };
+  }
+
+  function runtimeBudgetSnapshot() {
+    const snapshot = { ...schedulerRuntimeBudget, source: 'builtin-data-only', dynamic_code: false, remote_config: false };
+    return { ...snapshot, runtime_budget_digest: digestObject(snapshot) };
+  }
+
+  function validateSchedulerPolicySnapshot(policy) {
+    const failures = [];
+    if (!policy || typeof policy !== 'object') return ['scheduler policy snapshot is required'];
+    if (policy.name !== 'stage-22-scheduler-policy') failures.push('scheduler policy.name must be stage-22-scheduler-policy');
+    if (policy.version !== 1) failures.push('scheduler policy.version must be 1');
+    if (policy.stage !== 'Stage 22') failures.push('scheduler policy.stage must be Stage 22');
+    if (!Object.hasOwn(schedulerPolicyProfiles, policy.profile || '')) failures.push('scheduler policy.profile must be known');
+    if (policy.default_enabled !== false) failures.push('scheduler policy.default_enabled must be false');
+    if (policy.dynamic_code !== false) failures.push('scheduler policy.dynamic_code must be false');
+    if (policy.remote_config !== false) failures.push('scheduler policy.remote_config must be false');
+    for (const key of ['allowed_scheduler_actions', 'allowed_runtime_actions']) {
+      if (!Array.isArray(policy[key])) failures.push(`scheduler policy.${key} must be an array`);
+    }
+    const { scheduler_policy_digest: _digest, ...unsigned } = policy;
+    if (!policy.scheduler_policy_digest) failures.push('scheduler policy digest is required');
+    else if (digestObject(unsigned) !== policy.scheduler_policy_digest) failures.push('scheduler policy digest mismatch');
+    const current = Object.hasOwn(schedulerPolicyProfiles, policy.profile || '') ? schedulerPolicySnapshot(policy.profile) : null;
+    if (current && policy.scheduler_policy_digest && policy.scheduler_policy_digest !== current.scheduler_policy_digest) failures.push('scheduler policy digest must match current builtin profile');
+    return failures;
+  }
+
+  function validateRuntimeBudgetSnapshot(budget) {
+    const failures = [];
+    if (!budget || typeof budget !== 'object') return ['runtime budget snapshot is required'];
+    if (budget.stage !== 'Stage 22') failures.push('runtime budget.stage must be Stage 22');
+    if (budget.kill_switch !== false) failures.push('runtime budget.kill_switch must be false');
+    if (budget.retry_allowed !== false) failures.push('runtime budget.retry_allowed must be false');
+    if (budget.recovery_apply_allowed !== false) failures.push('runtime budget.recovery_apply_allowed must be false');
+    if (budget.max_runs_per_invocation !== 1) failures.push('runtime budget.max_runs_per_invocation must be 1');
+    for (const key of ['max_active_scheduler_runs', 'max_retry_attempts', 'max_consecutive_failures', 'max_lock_age_ms']) {
+      if (typeof budget[key] !== 'number') failures.push(`runtime budget.${key} must be a number`);
+    }
+    const { runtime_budget_digest: _digest, ...unsigned } = budget;
+    if (!budget.runtime_budget_digest) failures.push('runtime budget digest is required');
+    else if (digestObject(unsigned) !== budget.runtime_budget_digest) failures.push('runtime budget digest mismatch');
+    const current = runtimeBudgetSnapshot();
+    if (budget.runtime_budget_digest && budget.runtime_budget_digest !== current.runtime_budget_digest) failures.push('runtime budget digest must match current builtin budget');
+    return failures;
+  }
+
+  function schedulerSafety({ writes = false, once = false } = {}) {
+    return {
+      stage: once ? 'Stage 23' : 'Stage 21',
+      writes: Boolean(writes),
+      scheduler_plan_artifact: Boolean(writes && !once),
+      scheduler_run_artifact: Boolean(writes && once),
+      scheduler_lease_artifact: Boolean(writes && once),
+      single_shot: Boolean(once),
+      loop: false,
+      watcher: false,
+      daemon: false,
+      auto_recovery: false,
+      auto_retry: false,
+      auto_reply: false,
+      platform_api: false,
+      skill_execution: false,
+      business_source_write: false,
+      subagent: false,
+      mcp: false,
+      git: false,
+      worktree: false,
+      dispatch_event_modified: false,
+      claim_modified: false,
+    };
+  }
+
+  function controlledLongRunningAutomationForEnvelope(envelope, phase) {
+    const schedulerDetail = envelope.scheduler || envelope.scheduler_hook_plan || envelope.scheduler_run || {};
+    const policy = envelope.policy || envelope.plan?.policy || {};
+    const runtimeBudget = envelope.runtime_budget || envelope.plan?.runtime_budget || {};
+    const lockEvidence = schedulerDetail.lock || schedulerDetail.lease || schedulerDetail.scheduler_lease_file || '';
+    return buildControlledLongRunningAutomationContract({
+      phase,
+      artifactSummary: envelope.summary || {
+        mode: envelope.mode || '',
+        state_present: envelope.state_present === true,
+        writes: envelope.safety?.writes === true,
+        selected: schedulerDetail.selected_candidate || schedulerDetail.selected?.candidate_file || '',
+        queue_state: schedulerDetail.queue || schedulerDetail.queue_state || '',
+      },
+      policyBound: Boolean(policy.scheduler_policy_digest),
+      loopPolicyBound: envelope.safety?.loop === false || envelope.safety?.single_shot === true,
+      lockAuditBound: Boolean(lockEvidence),
+      heartbeatPolicyBound: Boolean(schedulerDetail.lock?.heartbeat_required || schedulerDetail.heartbeat_required),
+      stopFilePolicyBound: false,
+      iterationBudgetBound: Boolean(runtimeBudget.runtime_budget_digest || runtimeBudget.max_runs_per_invocation),
+      killSwitchBound: Object.hasOwn(runtimeBudget, 'kill_switch'),
+      blockedReasons: envelope.quality || schedulerDetail.blocked_reasons || [],
+      nextManualAction: 'Review scheduler policy, runtime budget, lock, heartbeat, and queue evidence before any separate human-approved foreground action.',
+    });
+  }
+
+  function withControlledLongRunningAutomation(envelope, phase) {
+    return {
+      ...envelope,
+      controlled_long_running_automation: controlledLongRunningAutomationForEnvelope(envelope, phase),
+    };
+  }
+
+  const schedulerStateLifecycle = createRuntimeSchedulerStateLifecycleModel(deps);
+  const schedulerPlanSnapshotPath = schedulerStateLifecycle.schedulerPlanSnapshotPath;
+  const schedulerHookPlanSnapshotPath = schedulerStateLifecycle.schedulerHookPlanSnapshotPath;
+  const schedulerRunPath = schedulerStateLifecycle.schedulerRunPath;
+  const writeSchedulerPlan = schedulerStateLifecycle.writeSchedulerPlan;
+  const writeSchedulerRun = schedulerStateLifecycle.writeSchedulerRun;
+
+  function schedulerPlanEnvelope(root, { persist = false, profile = 'single-local-auto-run' } = {}) {
+    const queue = queueScanEnvelope(root, { persist: false });
+    const recovery = recoveryClassificationEnvelope(root, { persist: false });
+    const schedulerPolicy = schedulerPolicySnapshot(profile);
+    const runtimeBudget = runtimeBudgetSnapshot();
+    const executionPolicy = executionPolicySnapshot();
+    const selected = queue.queue.promotion_preview[0] || null;
+    const blocked = queue.queue.blocked.map((item) => ({ ...item, scheduler_blocked_reasons: item.blocked_reasons }));
+    const planCore = {
+      created_at: new Date().toISOString(),
+      queue_digest: digestObject({ items: queue.queue.items, ready: queue.queue.ready, blocked: queue.queue.blocked }),
+      execution_policy_digest: executionPolicy.policy_digest,
+      scheduler_policy_digest: schedulerPolicy.scheduler_policy_digest,
+      runtime_budget_digest: runtimeBudget.runtime_budget_digest,
+      action_catalog_digest: runtimeActionCatalogDigest(),
+      recovery_classification_digest: recovery.recovery_classification.classification_digest,
+      recovery_hints: {
+        classification_digest: recovery.recovery_classification.classification_digest,
+        eligible_count: recovery.recovery_classification.eligible_count,
+        blocked_count: recovery.recovery_classification.blocked_count,
+        top_finding: recovery.recovery_classification.findings.find((finding) => finding.eligible) || recovery.recovery_classification.findings[0] || null,
+      },
+      eligible: queue.queue.ready.slice(0, runtimeBudget.max_runs_per_invocation),
+      blocked,
+      selected,
+      planned_writes: selected ? [path.join(stateDirectoryName, schedulerRunsDirectoryName, '<timestamp>.scheduler-run.json').replace(/\\/g, '/'), path.join(stateDirectoryName, schedulerLeasesDirectoryName, '<plan-hash>.scheduler-lease.json').replace(/\\/g, '/')] : [],
+      next_scan_after_ms: 60 * 1000,
+    };
+    const planId = digestObject(planCore).slice(0, 16);
+    const envelope = {
+      mode: 'scheduler-plan',
+      ok: true,
+      state_present: fs.existsSync(workflowPath(root)),
+      scheduler: {
+        default_enabled: false,
+        worker: false,
+        watcher: false,
+        loop: false,
+        writes: Boolean(persist),
+        plan_id: planId,
+        ...planCore,
+      },
+      policy: schedulerPolicy,
+      runtime_budget: runtimeBudget,
+      execution_policy: executionPolicy,
+      queue: {
+        items: queue.queue.items.length,
+        ready: queue.queue.ready.length,
+        blocked: queue.queue.blocked.length,
+      },
+      safety: schedulerSafety({ writes: persist, once: false }),
+      quality: [...queue.quality, ...recovery.quality],
+      action: persist
+        ? 'scheduler plan artifact was written. No auto-run, loop, daemon, recovery, retry, platform API, subagent, MCP, git, worktree, or business source write occurred.'
+        : 'scheduler plan was previewed read-only. No files were written and no runtime action occurred.',
+    };
+    return withControlledLongRunningAutomation(envelope, 'scheduler-plan');
+  }
+
+  function validateSchedulerPlanArtifact(plan) {
+    const failures = [];
+    if (plan.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+    if (plan.command !== 'scheduler') failures.push('command must be scheduler');
+    if (plan.mode !== 'scheduler-plan') failures.push('mode must be scheduler-plan');
+    if (!plan.scheduler?.plan_id) failures.push('scheduler.plan_id is required');
+    if (!Array.isArray(plan.scheduler?.eligible)) failures.push('scheduler.eligible must be an array');
+    if (!Array.isArray(plan.scheduler?.blocked)) failures.push('scheduler.blocked must be an array');
+    if (typeof plan.scheduler?.queue_digest !== 'string' || !plan.scheduler.queue_digest) failures.push('scheduler.queue_digest is required');
+    if (typeof plan.scheduler?.recovery_classification_digest !== 'string' || !plan.scheduler.recovery_classification_digest) failures.push('scheduler.recovery_classification_digest is required');
+    if (!plan.scheduler?.recovery_hints || typeof plan.scheduler.recovery_hints !== 'object') failures.push('scheduler.recovery_hints is required');
+    if (plan.scheduler?.action_catalog_digest !== runtimeActionCatalogDigest()) failures.push('scheduler action catalog digest mismatch');
+    if (plan.scheduler?.execution_policy_digest !== executionPolicySnapshot().policy_digest) failures.push('scheduler execution policy digest mismatch');
+    if (plan.scheduler?.scheduler_policy_digest !== schedulerPolicySnapshot(plan.policy?.profile || 'single-local-auto-run').scheduler_policy_digest) failures.push('scheduler policy digest mismatch');
+    if (plan.scheduler?.runtime_budget_digest !== runtimeBudgetSnapshot().runtime_budget_digest) failures.push('runtime budget digest mismatch');
+    failures.push(...validateSchedulerPolicySnapshot(plan.policy));
+    failures.push(...validateRuntimeBudgetSnapshot(plan.runtime_budget));
+    if (plan.safety?.stage !== 'Stage 21') failures.push('safety.stage must be Stage 21');
+    if (plan.safety?.scheduler_plan_artifact !== true) failures.push('safety.scheduler_plan_artifact must be true');
+    for (const key of ['loop', 'watcher', 'daemon', 'auto_recovery', 'auto_retry', 'auto_reply', 'platform_api', 'skill_execution', 'business_source_write', 'subagent', 'mcp', 'git', 'worktree']) {
+      if (plan.safety?.[key] !== false) failures.push(`safety.${key} must be false`);
+    }
+    return { ok: failures.length === 0, failures };
+  }
+
+  function schedulerHookPlanEnvelope(root, hookIntentFile, { persist = false } = {}) {
+    const hookIntentPath = hookIntentFilePath(root, hookIntentFile);
+    const hookIntent = readJsonArtifact(hookIntentPath, 'Hook intent');
+    const hookVerification = validateHookIntentArtifact(root, hookIntent);
+    if (!hookVerification.ok) throw new Error(`hook intent verification failed: ${hookVerification.failures.join('; ')}`);
+    const schedulerPreview = schedulerPlanEnvelope(root, { persist: false, profile: 'scheduler-dry-run' });
+    const hookIntentDigest = fileDigest(hookIntentPath);
+    const queueState = schedulerPreview.queue.ready > 0 ? 'ready' : schedulerPreview.queue.items > 0 ? 'blocked' : 'deferred';
+    const blockedReasons = [...schedulerPreview.quality];
+    if (schedulerPreview.queue.items === 0) blockedReasons.push('queue is empty');
+    if (schedulerPreview.queue.ready === 0 && schedulerPreview.queue.items > 0) blockedReasons.push('no ready queue item');
+    const planCore = {
+      version: 1,
+      stage: 'Stage 34',
+      created_at: new Date().toISOString(),
+      writes: Boolean(persist),
+      hook_intent_file: path.basename(hookIntentPath),
+      hook_intent_digest: hookIntentDigest,
+      hook_source: hookIntent.hook_intent?.hook_source || '',
+      allowed_followup: hookIntent.hook_intent?.allowed_followup || [],
+      scheduler_profile: 'scheduler-dry-run',
+      scheduler_plan_id: schedulerPreview.scheduler.plan_id,
+      scheduler_plan_digest: digestObject(schedulerPreview.scheduler),
+      queue_state: queueState,
+      queue_summary: schedulerPreview.queue,
+      selected: schedulerPreview.scheduler.selected,
+      eligible: schedulerPreview.scheduler.eligible,
+      blocked: schedulerPreview.scheduler.blocked,
+      blocked_reasons: blockedReasons,
+      budget: {
+        lease_required: true,
+        approval_required: true,
+        max_runs_per_invocation: 0,
+        runtime_action_allowed: false,
+        subagent_dispatch_allowed: false,
+      },
+      required_approvals: ['scheduler-hook-plan-review'],
+      planned_writes: persist ? [path.join(stateDirectoryName, schedulerHookPlansDirectoryName, '<timestamp>.scheduler-hook-plan.json').replace(/\\/g, '/')] : [],
+      no_execution: true,
+      no_scheduler_run: true,
+      no_subagent_dispatch: true,
+      no_session_create: true,
+      no_platform_api: true,
+    };
+    const envelope = {
+      mode: 'scheduler-hook-plan',
+      ok: hookVerification.ok,
+      state_present: fs.existsSync(workflowPath(root)),
+      scheduler_hook_plan: { ...planCore, plan_digest: digestObject(planCore) },
+      hook_intent: {
+        file: path.basename(hookIntentPath),
+        digest: hookIntentDigest,
+        verification: hookVerification,
+      },
+      scheduler_plan: schedulerPreview,
+      safety: {
+        stage: 'Stage 34',
+        writes: Boolean(persist),
+        scheduler_hook_plan_artifact: Boolean(persist),
+        hook_triggered: false,
+        scheduler_selected: false,
+        scheduler_plan: true,
+        scheduler_run: false,
+        session_create: false,
+        subagent_dispatch: false,
+        external_api: false,
+        external_delivery: false,
+        model_invocation: false,
+        runtime_action: false,
+        auto_execution: false,
+        controlled_auto_execution: false,
+        platform_api: false,
+        skill_execution: false,
+        business_source_write: false,
+        subagent: false,
+        mcp: false,
+        daemon: false,
+        git: false,
+        worktree: false,
+        dispatch_event_modified: false,
+        claim_modified: false,
+      },
+      quality: blockedReasons,
+      action: persist
+        ? 'scheduler hook plan artifact was written. No scheduler run, subagent dispatch, session creation, platform API, git, worktree, or business source write occurred.'
+        : 'scheduler hook plan was previewed read-only. No files were written and no scheduler run or subagent dispatch occurred.',
+    };
+    return withControlledLongRunningAutomation(envelope, 'scheduler-hook-plan');
+  }
+
+  function validateSchedulerHookPlanArtifact(root, artifact) {
+    const failures = [];
+    if (artifact.schema_version !== jsonSchemaVersion) failures.push('schema_version must be 1');
+    if (artifact.command !== 'scheduler') failures.push('command must be scheduler');
+    if (artifact.mode !== 'scheduler-hook-plan') failures.push('mode must be scheduler-hook-plan');
+    const plan = artifact.scheduler_hook_plan || {};
+    if (plan.stage !== 'Stage 34') failures.push('scheduler_hook_plan.stage must be Stage 34');
+    if (!plan.hook_intent_file || !String(plan.hook_intent_file).endsWith('.hook-intent.json')) failures.push('scheduler_hook_plan.hook_intent_file must be a hook intent artifact');
+    if (plan.hook_source !== 'session_start') failures.push('scheduler_hook_plan.hook_source must be session_start');
+    if (!Array.isArray(plan.allowed_followup) || digestObject(plan.allowed_followup) !== digestObject(['scheduler-plan-only'])) failures.push('scheduler_hook_plan.allowed_followup must equal scheduler-plan-only');
+    if (plan.scheduler_profile !== 'scheduler-dry-run') failures.push('scheduler_hook_plan.scheduler_profile must be scheduler-dry-run');
+    const embeddedPolicy = artifact.scheduler_plan?.policy || null;
+    const embeddedBudget = artifact.scheduler_plan?.runtime_budget || null;
+    const embeddedSchedulerPlan = artifact.scheduler_plan?.scheduler || null;
+    if (!embeddedPolicy) failures.push('scheduler_hook_plan embedded scheduler policy is required');
+    else {
+      failures.push(...validateSchedulerPolicySnapshot(embeddedPolicy));
+      if (embeddedPolicy.profile !== 'scheduler-dry-run') failures.push('scheduler_hook_plan policy.profile must be scheduler-dry-run');
+      if (embeddedPolicy.mode !== 'plan-only') failures.push('scheduler_hook_plan policy.mode must be plan-only');
+      if (digestObject(embeddedPolicy.allowed_scheduler_actions || []) !== digestObject(['plan'])) failures.push('scheduler_hook_plan policy.allowed_scheduler_actions must equal plan');
+      if (digestObject(embeddedPolicy.allowed_runtime_actions || []) !== digestObject([])) failures.push('scheduler_hook_plan policy.allowed_runtime_actions must be empty');
+      for (const key of ['default_enabled', 'auto_run_allowed', 'recovery_apply_allowed', 'retry_allowed', 'dynamic_code', 'remote_config']) {
+        if (embeddedPolicy[key] !== false) failures.push(`scheduler_hook_plan policy.${key} must be false`);
+      }
+    }
+    if (!embeddedBudget) failures.push('scheduler_hook_plan embedded runtime budget is required');
+    else {
+      failures.push(...validateRuntimeBudgetSnapshot(embeddedBudget));
+      if (embeddedBudget.max_runs_per_invocation !== 1) failures.push('scheduler_hook_plan embedded runtime budget max_runs_per_invocation must be 1');
+      for (const key of ['kill_switch', 'retry_allowed', 'recovery_apply_allowed', 'dynamic_code', 'remote_config']) {
+        if (embeddedBudget[key] !== false) failures.push(`scheduler_hook_plan embedded runtime budget.${key} must be false`);
+      }
+    }
+    const embeddedSafety = artifact.scheduler_plan?.safety || null;
+    if (!embeddedSafety) failures.push('scheduler_hook_plan embedded scheduler safety is required');
+    else {
+      if (embeddedSafety.stage !== 'Stage 21') failures.push('scheduler_hook_plan embedded scheduler safety.stage must be Stage 21');
+      if (embeddedSafety.scheduler_plan_artifact !== false) failures.push('scheduler_hook_plan embedded scheduler safety.scheduler_plan_artifact must be false');
+      for (const key of ['writes', 'scheduler_run_artifact', 'scheduler_lease_artifact', 'single_shot', 'loop', 'watcher', 'daemon', 'auto_recovery', 'auto_retry', 'auto_reply', 'platform_api', 'skill_execution', 'business_source_write', 'subagent', 'mcp', 'git', 'worktree', 'dispatch_event_modified', 'claim_modified']) {
+        if (embeddedSafety[key] !== false) failures.push(`scheduler_hook_plan embedded scheduler safety.${key} must be false`);
+      }
+    }
+    if (!embeddedSchedulerPlan) failures.push('scheduler_hook_plan embedded scheduler plan is required');
+    else {
+      if (plan.scheduler_plan_id !== embeddedSchedulerPlan.plan_id) failures.push('scheduler_hook_plan scheduler_plan_id mismatch');
+      if (plan.scheduler_plan_digest !== digestObject(embeddedSchedulerPlan)) failures.push('scheduler_hook_plan scheduler_plan_digest mismatch');
+      if (digestObject(plan.queue_summary || {}) !== digestObject(artifact.scheduler_plan?.queue || {})) failures.push('scheduler_hook_plan queue_summary mismatch');
+      if (digestObject(plan.selected || null) !== digestObject(embeddedSchedulerPlan.selected || null)) failures.push('scheduler_hook_plan selected mismatch');
+      if (digestObject(plan.eligible || []) !== digestObject(embeddedSchedulerPlan.eligible || [])) failures.push('scheduler_hook_plan eligible mismatch');
+      if (digestObject(plan.blocked || []) !== digestObject(embeddedSchedulerPlan.blocked || [])) failures.push('scheduler_hook_plan blocked mismatch');
+    }
+    if (plan.no_execution !== true) failures.push('scheduler_hook_plan.no_execution must be true');
+    if (plan.no_scheduler_run !== true) failures.push('scheduler_hook_plan.no_scheduler_run must be true');
+    if (plan.no_subagent_dispatch !== true) failures.push('scheduler_hook_plan.no_subagent_dispatch must be true');
+    if (plan.no_session_create !== true) failures.push('scheduler_hook_plan.no_session_create must be true');
+    if (plan.no_platform_api !== true) failures.push('scheduler_hook_plan.no_platform_api must be true');
+    if (!Array.isArray(plan.required_approvals) || digestObject(plan.required_approvals) !== digestObject(['scheduler-hook-plan-review'])) failures.push('scheduler_hook_plan.required_approvals must equal scheduler-hook-plan-review');
+    if (!Array.isArray(plan.planned_writes)) failures.push('scheduler_hook_plan.planned_writes must be an array');
+    else if (plan.writes === false && plan.planned_writes.length !== 0) failures.push('scheduler_hook_plan.planned_writes must be empty for preview');
+    else if (plan.writes === true && digestObject(plan.planned_writes) !== digestObject([path.join(stateDirectoryName, schedulerHookPlansDirectoryName, '<timestamp>.scheduler-hook-plan.json').replace(/\\/g, '/')])) failures.push('scheduler_hook_plan.planned_writes must only contain scheduler hook plan artifact');
+    if (plan.writes !== false && plan.writes !== true) failures.push('scheduler_hook_plan.writes must be boolean');
+    if (!['ready', 'blocked', 'deferred'].includes(plan.queue_state || '')) failures.push('scheduler_hook_plan.queue_state must be ready, blocked, or deferred');
+    if (!plan.budget || plan.budget.runtime_action_allowed !== false || plan.budget.subagent_dispatch_allowed !== false) failures.push('scheduler_hook_plan budget must disable runtime action and subagent dispatch');
+    if (plan.budget?.lease_required !== true) failures.push('scheduler_hook_plan budget.lease_required must be true');
+    if (plan.budget?.approval_required !== true) failures.push('scheduler_hook_plan budget.approval_required must be true');
+    if (plan.budget?.max_runs_per_invocation !== 0) failures.push('scheduler_hook_plan budget.max_runs_per_invocation must be 0');
+    const digestPayload = { ...plan };
+    delete digestPayload.plan_digest;
+    if (plan.plan_digest !== digestObject(digestPayload)) failures.push('scheduler_hook_plan digest mismatch');
+    if (root && plan.hook_intent_file && plan.hook_intent_digest) {
+      try {
+        const hookPath = hookIntentFilePath(root, plan.hook_intent_file);
+        if (fileDigest(hookPath) !== plan.hook_intent_digest) failures.push('scheduler_hook_plan hook intent digest mismatch');
+        const hookIntent = readJsonArtifact(hookPath, 'Hook intent');
+        const hookVerification = validateHookIntentArtifact(root, hookIntent);
+        failures.push(...hookVerification.failures.map((failure) => `hook intent: ${failure}`));
+      } catch (error) {
+        failures.push(error.message);
+      }
+    }
+    failures.push(...validateCommonArtifactSafety(artifact.safety, 'Stage 34'));
+    for (const key of ['hook_triggered', 'scheduler_selected', 'scheduler_run', 'session_create', 'subagent_dispatch', 'external_api', 'external_delivery', 'model_invocation', 'runtime_action', 'auto_execution', 'platform_api', 'skill_execution', 'business_source_write', 'subagent', 'mcp', 'daemon', 'git', 'worktree']) {
+      if (artifact.safety?.[key] !== false) failures.push(`safety.${key} must be false`);
+    }
+    if (artifact.safety?.scheduler_plan !== true) failures.push('safety.scheduler_plan must be true');
+    return { ok: failures.length === 0, failures };
+  }
+
+  function writeSchedulerHookPlan(root, envelope) {
+    const file = schedulerHookPlanSnapshotPath(root);
+    const payload = { schema_version: jsonSchemaVersion, command: 'scheduler', ...envelope, safety: { ...envelope.safety, scheduler_hook_plan_artifact: true } };
+    const verification = validateSchedulerHookPlanArtifact(root, payload);
+    if (!verification.ok) throw new Error(`scheduler hook plan verification failed: ${verification.failures.join('; ')}`);
+    return writeStateArtifact(path.dirname(file), path.basename(file), payload);
+  }
+
+  function schedulerHookPlanAuditEnvelope(root, mode, planFile = '') {
+    if (mode === 'list') {
+      const plans = listSchedulerHookPlanFiles(root).map((fileName) => {
+        try {
+          const plan = readJsonArtifact(path.join(schedulerHookPlansDirectory(root), fileName), 'Scheduler hook plan');
+          const verification = validateSchedulerHookPlanArtifact(root, plan);
+          return { file: fileName, hook_intent_file: plan.scheduler_hook_plan?.hook_intent_file || '', queue_state: plan.scheduler_hook_plan?.queue_state || '', verification_ok: verification.ok, verification_failures: verification.failures };
+        } catch (error) {
+          return { file: fileName, hook_intent_file: '', queue_state: '', verification_ok: false, verification_failures: [error.message] };
+        }
+      });
+      return { mode: 'scheduler-hook-plan-list', ok: true, plans, summary: { count: plans.length, failed_count: plans.filter((plan) => !plan.verification_ok).length }, quality: [], action: 'read-only scheduler hook plan audit listed hook-derived plans. No scheduler execution occurred.' };
+    }
+    const file = schedulerHookPlanFilePath(root, planFile);
+    const plan = readJsonArtifact(file, 'Scheduler hook plan');
+    const verification = validateSchedulerHookPlanArtifact(root, plan);
+    if (mode === 'verify' && !verification.ok) throw new Error(`scheduler hook plan verification failed: ${verification.failures.join('; ')}`);
+    return { mode: mode === 'verify' ? 'scheduler-hook-plan-verify' : 'scheduler-hook-plan-show', ok: verification.ok, summary: { file: path.basename(file), hook_intent_file: plan.scheduler_hook_plan?.hook_intent_file || '', queue_state: plan.scheduler_hook_plan?.queue_state || '' }, verification, plan, quality: verification.failures, action: 'read-only scheduler hook plan audit inspected one hook-derived plan. No scheduler execution occurred.' };
+  }
+
+  function printSchedulerHookPlan(envelope, file = '') {
+    console.log('Vibecoding Runtime Scheduler Hook Plan');
+    console.log(`Mode: ${envelope.mode === 'scheduler-hook-plan' ? 'from-hook-plan' : envelope.mode}`);
+    console.log(`Hook intent: ${envelope.scheduler_hook_plan.hook_intent_file}`);
+    console.log(`Queue state: ${envelope.scheduler_hook_plan.queue_state}`);
+    console.log(`Scheduler plan id: ${envelope.scheduler_hook_plan.scheduler_plan_id}`);
+    if (file) console.log(`Scheduler hook plan: ${path.relative(process.cwd(), file)}`);
+    if (envelope.quality.length > 0) printList('Blocked reasons', envelope.quality);
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function printSchedulerHookPlanAudit(envelope) {
+    console.log('Vibecoding Runtime Scheduler Hook Plan Audit');
+    console.log(`Mode: ${envelope.mode.replace('scheduler-hook-plan-', '')}`);
+    if (envelope.mode === 'scheduler-hook-plan-list') {
+      console.log(`Hook plans: ${envelope.summary.count}; Failed: ${envelope.summary.failed_count}`);
+      for (const plan of envelope.plans) console.log(`- ${plan.file}: hook=${plan.hook_intent_file || 'none'}; queue=${plan.queue_state || 'unknown'}; verification=${plan.verification_ok ? 'passed' : 'failed'}`);
+    } else {
+      console.log(`File: ${envelope.summary.file}`);
+      console.log(`Hook intent: ${envelope.summary.hook_intent_file}`);
+      console.log(`Queue state: ${envelope.summary.queue_state}`);
+      console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+      if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+    }
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function schedulerPlanAuditEnvelope(root, mode, planFile = '') {
+    if (mode === 'list') {
+      const plans = [
+        ...listSchedulerPlanFiles(root).map((fileName) => {
+          try {
+            const plan = readJsonArtifact(path.join(schedulerPlansDirectory(root), fileName), 'Scheduler plan');
+            const verification = validateSchedulerPlanArtifact(plan);
+            return { file: fileName, kind: 'scheduler-plan', plan_id: plan.scheduler?.plan_id || '', selected_candidate: plan.scheduler?.selected?.candidate_file || '', verification_ok: verification.ok, verification_failures: verification.failures };
+          } catch (error) {
+            return { file: fileName, kind: 'scheduler-plan', plan_id: '', selected_candidate: '', verification_ok: false, verification_failures: [error.message] };
+          }
+        }),
+        ...listSchedulerHookPlanFiles(root).map((fileName) => {
+          try {
+            const plan = readJsonArtifact(path.join(schedulerHookPlansDirectory(root), fileName), 'Scheduler hook plan');
+            const verification = validateSchedulerHookPlanArtifact(root, plan);
+            return { file: fileName, kind: 'scheduler-hook-plan', plan_id: plan.scheduler_hook_plan?.scheduler_plan_id || '', selected_candidate: plan.scheduler_hook_plan?.selected?.candidate_file || '', verification_ok: verification.ok, verification_failures: verification.failures };
+          } catch (error) {
+            return { file: fileName, kind: 'scheduler-hook-plan', plan_id: '', selected_candidate: '', verification_ok: false, verification_failures: [error.message] };
+          }
+        }),
+      ].sort((left, right) => left.file.localeCompare(right.file));
+      return { mode: 'scheduler-plan-list', ok: true, plans, summary: { count: plans.length, failed_count: plans.filter((plan) => !plan.verification_ok).length }, quality: [], action: 'read-only scheduler plan audit listed plan artifacts. No scheduler execution occurred.' };
+    }
+    const file = schedulerPlanFilePath(root, planFile);
+    const plan = readJsonArtifact(file, 'Scheduler plan');
+    const verification = validateSchedulerPlanArtifact(plan);
+    if (mode === 'verify' && !verification.ok) throw new Error(`scheduler plan verification failed: ${verification.failures.join('; ')}`);
+    return { mode: mode === 'verify' ? 'scheduler-plan-verify' : 'scheduler-plan-show', ok: verification.ok, summary: { file: path.basename(file), plan_id: plan.scheduler?.plan_id || '', selected_candidate: plan.scheduler?.selected?.candidate_file || '', eligible_count: plan.scheduler?.eligible?.length || 0, blocked_count: plan.scheduler?.blocked?.length || 0 }, verification, plan, quality: verification.failures, action: 'read-only scheduler plan audit inspected a plan artifact. No scheduler execution occurred.' };
+  }
+
+  function printSchedulerPlan(envelope, file = '') {
+    console.log('Vibecoding Runtime Scheduler Plan');
+    console.log('Mode: plan');
+    console.log(`Plan id: ${envelope.scheduler.plan_id}`);
+    console.log(`Ready: ${envelope.queue.ready}; Blocked: ${envelope.queue.blocked}`);
+    console.log(`Selected: ${envelope.scheduler.selected?.candidate_file || 'none'}`);
+    if (file) console.log(`Scheduler plan: ${path.relative(process.cwd(), file)}`);
+    if (envelope.quality.length > 0) printList('Blocked reasons', envelope.quality);
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function printSchedulerPlanAudit(envelope) {
+    console.log('Vibecoding Runtime Scheduler Plan Audit');
+    console.log(`Mode: ${envelope.mode.replace('scheduler-plan-', '')}`);
+    if (envelope.mode === 'scheduler-plan-list') {
+      console.log(`Plans: ${envelope.summary.count}; Failed: ${envelope.summary.failed_count}`);
+      for (const plan of envelope.plans) console.log(`- ${plan.file}: ${plan.plan_id || 'unknown'} [selected=${plan.selected_candidate || 'none'}; verification=${plan.verification_ok ? 'passed' : 'failed'}]`);
+    } else {
+      console.log(`File: ${envelope.summary.file}`);
+      console.log(`Plan id: ${envelope.summary.plan_id}`);
+      console.log(`Selected: ${envelope.summary.selected_candidate || 'none'}`);
+      console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+      if (envelope.verification.failures.length > 0) printList('Verification failures', envelope.verification.failures);
+    }
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function schedulerPolicyAuditEnvelope(mode, profileName = '') {
+    if (mode === 'list') {
+      const policies = Object.keys(schedulerPolicyProfiles).sort().map((profile) => schedulerPolicySnapshot(profile));
+      const envelope = { mode: 'scheduler-policy-list', ok: true, policies: policies.map((policy) => ({ profile: policy.profile, mode: policy.mode, default_enabled: policy.default_enabled, scheduler_policy_digest: policy.scheduler_policy_digest })), runtime_budget: runtimeBudgetSnapshot(), quality: [], action: 'read-only scheduler policy audit listed builtin scheduler policy profiles. No scheduler execution occurred.' };
+      return withControlledLongRunningAutomation(envelope, 'scheduler-policy-list');
+    }
+    const policy = schedulerPolicySnapshot(profileName);
+    const budget = runtimeBudgetSnapshot();
+    const failures = [...validateSchedulerPolicySnapshot(policy), ...validateRuntimeBudgetSnapshot(budget)];
+    const envelope = { mode: 'scheduler-policy-show', ok: failures.length === 0, policy, runtime_budget: budget, verification: { ok: failures.length === 0, failures }, quality: failures, action: 'read-only scheduler policy audit inspected builtin scheduler policy and runtime budget. No scheduler execution occurred.' };
+    return withControlledLongRunningAutomation(envelope, 'scheduler-policy-show');
+  }
+
+  function printSchedulerPolicyAudit(envelope) {
+    console.log('Vibecoding Runtime Scheduler Policy Audit');
+    console.log(`Mode: ${envelope.mode === 'scheduler-policy-list' ? 'list' : 'show'}`);
+    if (envelope.mode === 'scheduler-policy-list') {
+      console.log(`Policies: ${envelope.policies.length}`);
+      for (const policy of envelope.policies) console.log(`- ${policy.profile}: ${policy.mode} [default_enabled=${policy.default_enabled ? 'true' : 'false'}; digest=${policy.scheduler_policy_digest}]`);
+    } else {
+      console.log(`Profile: ${envelope.policy.profile}`);
+      console.log(`Default enabled: ${envelope.policy.default_enabled ? 'true' : 'false'}`);
+      console.log(`Max runs per invocation: ${envelope.runtime_budget.max_runs_per_invocation}`);
+      console.log(`Verification: ${envelope.verification.ok ? 'passed' : 'failed'}`);
+    }
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function schedulerScanEnvelope(root) {
+    const dispatchFiles = listDispatchEvents(root);
+    const claims = listDispatchClaims(root).map((claim) => claimSummary(claim, root));
+    const executionFiles = listExecutionFiles(root);
+    const executions = executionFiles.map((fileName) => {
+      try {
+        const execution = readExecutionFile(path.join(executionsDirectory(root), fileName));
+        return executionSummary(fileName, execution, validateExecutionEnvelope(execution));
+      } catch (error) {
+        return { file: fileName, status: 'invalid', verification_ok: false, verification_failures: [error.message] };
+      }
+    });
+    const claimByEvent = new Map(claims.map((claim) => [claim.event_file, claim]));
+    const candidates = dispatchFiles.map((fileName) => {
+      const claim = claimByEvent.get(fileName);
+      let event = null;
+      let verification = { ok: false, failures: ['dispatch event not readable'] };
+      try {
+        event = readDispatchEventFile(path.join(dispatchesDirectory(root), fileName));
+        verification = verifyDispatchEvent(event);
+      } catch (error) {
+        verification = { ok: false, failures: [error.message] };
+      }
+      const targetSkill = event?.dispatch?.target_skill || '';
+      const ready = Boolean(verification.ok && claim?.status === 'picked' && stage11AllowedExecutionSkills.has(targetSkill));
+      const reasons = [];
+      if (!verification.ok) reasons.push('dispatch-invalid');
+      if (!claim) reasons.push('claim-missing');
+      else if (claim.status !== 'picked') reasons.push(`claim-${claim.status || 'unknown'}`);
+      if (!stage11AllowedExecutionSkills.has(targetSkill)) reasons.push('target-not-allowlisted');
+      return {
+        event_file: fileName,
+        target_skill: targetSkill,
+        claim_status: claim?.status || 'not_claimed',
+        ready_for_execution: ready,
+        blocked_reasons: reasons,
+        retry: {
+          retry_allowed: false,
+          reason: 'automatic retry is disabled in this stage',
+        },
+      };
+    });
+    const staleClaims = claims.filter((claim) => claim.audit?.stale || (claim.audit && !claim.audit.event_digest_matches));
+    const staleRunningExecutions = executions.filter((execution) => execution.status === 'running');
+    const retryPreview = executions
+      .filter((execution) => ['failed', 'timed_out'].includes(execution.status))
+      .map((execution) => ({ file: execution.file, status: execution.status, retry_allowed: false, reason: 'automatic retry is disabled in this stage' }));
+    const envelope = {
+      mode: 'daemon-scan-dry-run',
+      ok: true,
+      state_present: fs.existsSync(workflowPath(root)),
+      scheduler: {
+        queue: 'manual-only',
+        scan: true,
+        candidates,
+        blocked: candidates.filter((candidate) => !candidate.ready_for_execution),
+        stale_claims: staleClaims,
+        stale_running_executions: staleRunningExecutions,
+        retry_preview: retryPreview,
+        lock: {
+          lock_required: true,
+          lock_acquired: false,
+          lease_required: true,
+          heartbeat_required: true,
+        },
+        watcher: {
+          enabled: false,
+          long_running: false,
+        },
+        worker: false,
+      },
+      safety: daemonSafety({ dryRun: true, writes: false }),
+      quality: [],
+      action: 'scheduler scan dry-run audited dispatch, claim, and execution state. No daemon run envelope, background worker, pickup, execute, retry, skill execution, platform API, subagent, MCP, git, worktree, or business source write occurred.',
+    };
+    return withControlledLongRunningAutomation(envelope, 'daemon-scan-dry-run');
+  }
+
+  function printSchedulerScan(envelope) {
+    console.log('Vibecoding Runtime Scheduler Audit');
+    console.log('Mode: scan-dry-run');
+    console.log(`Queue: ${envelope.scheduler.queue}`);
+    console.log(`Candidates: ${envelope.scheduler.candidates.length}`);
+    console.log(`Blocked: ${envelope.scheduler.blocked.length}`);
+    console.log(`Stale claims: ${envelope.scheduler.stale_claims.length}`);
+    console.log(`Stale running executions: ${envelope.scheduler.stale_running_executions.length}`);
+    console.log(`Retry preview: ${envelope.scheduler.retry_preview.length}; retry_allowed=false`);
+    console.log(`Lock: required=${envelope.scheduler.lock.lock_required ? 'true' : 'false'}; acquired=${envelope.scheduler.lock.lock_acquired ? 'true' : 'false'}; lease_required=${envelope.scheduler.lock.lease_required ? 'true' : 'false'}; heartbeat_required=${envelope.scheduler.lock.heartbeat_required ? 'true' : 'false'}`);
+    console.log(`Watcher: enabled=${envelope.scheduler.watcher.enabled ? 'true' : 'false'}; long_running=${envelope.scheduler.watcher.long_running ? 'true' : 'false'}`);
+    console.log('Safety: scan=true; dry_run=true; writes=false; auto_execution=false; platform_api=false; skill_execution=false; worker=false; watcher=false; git=false; worktree=false.');
+    console.log(`Action: ${envelope.action}`);
+  }
+
+  function schedulerOncePreviewEnvelope(root) {
+    const plan = schedulerPlanEnvelope(root, { persist: false, profile: 'single-local-auto-run' });
+    const planPayload = { schema_version: jsonSchemaVersion, command: 'scheduler', ...plan, safety: { ...plan.safety, scheduler_plan_artifact: true } };
+    const planVerification = validateSchedulerPlanArtifact(planPayload);
+    if (!planVerification.ok) throw new Error(`scheduler plan verification failed: ${planVerification.failures.join('; ')}`);
+    const selected = plan.scheduler.selected;
+    const schedulerRun = { writes: false, plan_id: plan.scheduler.plan_id, selected_candidate: selected?.candidate_file || '', selected_approval: selected?.approval_file || '', selected_event: selected?.event_file || '', idempotency_key: selected?.idempotency_key || '', planned_execution: Boolean(selected), scheduler_policy_digest: plan.policy.scheduler_policy_digest, runtime_budget_digest: plan.runtime_budget.runtime_budget_digest, execution_policy_digest: plan.execution_policy.policy_digest, action_catalog_digest: runtimeActionCatalogDigest(), scheduler_lease_file: '', scheduler_lease_digest: '', execution_file: '', execution_status: '', retry_allowed: false, recovery_apply_allowed: false, loop: false, daemon: false };
+    const envelope = { mode: 'scheduler-once-preview', ok: true, state_present: fs.existsSync(workflowPath(root)), scheduler_run: schedulerRun, plan, safety: schedulerSafety({ writes: false, once: true }), quality: selected ? [] : ['scheduler once found no ready queue item'], action: 'scheduler once was previewed read-only. No scheduler run, lease, execution, recovery, retry, platform API, subagent, MCP, git, worktree, or business source write occurred.' };
+    return withControlledLongRunningAutomation(envelope, 'scheduler-once-preview');
+  }
+
+  function schedulerOnceEnvelope(root) {
+    const plan = schedulerPlanEnvelope(root, { persist: false, profile: 'single-local-auto-run' });
+    const planPayload = { schema_version: jsonSchemaVersion, command: 'scheduler', ...plan, safety: { ...plan.safety, scheduler_plan_artifact: true } };
+    const planVerification = validateSchedulerPlanArtifact(planPayload);
+    if (!planVerification.ok) throw new Error(`scheduler plan verification failed: ${planVerification.failures.join('; ')}`);
+    const selected = plan.scheduler.selected;
+    if (!selected) throw new Error('scheduler once found no ready queue item');
+    if (!plan.policy.allowed_scheduler_actions.includes('once') || !plan.policy.auto_run_allowed) throw new Error('scheduler policy does not allow once auto-run');
+    if (plan.runtime_budget.kill_switch) throw new Error('scheduler runtime budget kill switch is enabled');
+    if (plan.runtime_budget.max_runs_per_invocation !== 1) throw new Error('scheduler runtime budget must allow exactly one run per invocation');
+    if (activeSchedulerLease(root)) throw new Error('active scheduler lease already exists');
+    const leaseFile = writeSchedulerLease(root, plan);
+    let executionFile = '', executionEnvelopeResult = null;
+    try {
+      const result = writeRunningThenCompleteExecution(root, selected.event_file, controlledAutoRunEnvelope(root, selected.event_file, selected.actor, selected.approval_file));
+      executionFile = result.file; executionEnvelopeResult = result.envelope;
+      completeSchedulerLease(leaseFile, executionEnvelopeResult.execution?.status === 'succeeded' ? 'completed' : 'failed');
+    } catch (error) { completeSchedulerLease(leaseFile, 'failed'); throw error; }
+    const leaseDigest = fileDigest(leaseFile);
+    const schedulerRun = { plan_id: plan.scheduler.plan_id, selected_candidate: selected.candidate_file, selected_approval: selected.approval_file, selected_event: selected.event_file, idempotency_key: selected.idempotency_key, execution_file: path.basename(executionFile), execution_status: executionEnvelopeResult.execution?.status || '', scheduler_policy_digest: plan.policy.scheduler_policy_digest, runtime_budget_digest: plan.runtime_budget.runtime_budget_digest, execution_policy_digest: plan.execution_policy.policy_digest, action_catalog_digest: runtimeActionCatalogDigest(), scheduler_lease_file: path.basename(leaseFile), scheduler_lease_digest: leaseDigest, retry_allowed: false, recovery_apply_allowed: false, loop: false, daemon: false };
+    return { mode: 'scheduler-once-run', ok: true, state_present: fs.existsSync(workflowPath(root)), scheduler_run: schedulerRun, plan, execution: { file: path.basename(executionFile), digest: fileDigest(executionFile), status: executionEnvelopeResult.execution?.status || '' }, safety: schedulerSafety({ writes: true, once: true }), quality: [], action: 'single-shot scheduler executed one ready item through controlled auto-run. No loop, daemon, recovery, retry, auto reply, platform API, subagent, MCP, git, worktree, or business source write occurred.' };
+  }
+
+  function schedulerOnceRecoveryPreviewEnvelope(root) {
+    const plan = schedulerPlanEnvelope(root, { persist: false, profile: 'scheduler-recovery-once' });
+    const policy = schedulerPolicySnapshot('scheduler-recovery-once');
+    if (!policy.allowed_scheduler_actions.includes('recover-once')) throw new Error('scheduler policy does not allow recover-once');
+    if (plan.runtime_budget.kill_switch) throw new Error('scheduler runtime budget kill switch is enabled');
+    if (plan.runtime_budget.max_runs_per_invocation !== 1) throw new Error('scheduler runtime budget must allow exactly one run per invocation');
+    if (activeSchedulerLease(root)) throw new Error('active scheduler lease already exists');
+    const classificationEnvelope = recoveryClassificationEnvelope(root, { persist: false });
+    const selected = selectRecoveryFinding({ recovery_classification: classificationEnvelope.recovery_classification });
+    const schedulerRun = { writes: false, plan_id: plan.scheduler.plan_id, recovery_mode: true, selected_candidate: '', selected_recovery_finding: selected?.source_file || '', selected_recovery_category: selected?.category || '', recovery_action: selected?.recovery_action || '', idempotency_key: '', scheduler_policy_digest: policy.scheduler_policy_digest, runtime_budget_digest: plan.runtime_budget.runtime_budget_digest, recovery_policy_digest: recoveryPolicySnapshot().recovery_policy_digest, recovery_action_catalog_digest: recoveryActionCatalogSnapshot().recovery_action_catalog_digest, recovery_classification_file: '', recovery_classification_digest: classificationEnvelope.recovery_classification.classification_digest, recovery_run_file: '', retry_package_file: '', scheduler_lease_file: '', scheduler_lease_digest: '', retry_allowed: false, recovery_apply_allowed: Boolean(selected), loop: false, daemon: false };
+    const envelope = { mode: 'scheduler-recovery-once-preview', ok: true, state_present: fs.existsSync(workflowPath(root)), scheduler_run: schedulerRun, plan, recovery_classification: classificationEnvelope.recovery_classification, safety: { ...schedulerSafety({ writes: false, once: true }), stage: 'Stage 26', recovery_apply: false, auto_recovery: false, auto_retry: false }, quality: selected ? [] : ['scheduler recovery once found no eligible recovery finding'], action: 'scheduler recovery once was previewed read-only. No scheduler run, lease, classification artifact, recovery run, retry package, normal queue execution, automatic retry, platform API, subagent, MCP, git, worktree, or business source write occurred.' };
+    return withControlledLongRunningAutomation(envelope, 'scheduler-recovery-once-preview');
+  }
+
+  function schedulerOnceRecoveryEnvelope(root) {
+    const plan = schedulerPlanEnvelope(root, { persist: false, profile: 'scheduler-recovery-once' });
+    const policy = schedulerPolicySnapshot('scheduler-recovery-once');
+    if (!policy.allowed_scheduler_actions.includes('recover-once')) throw new Error('scheduler policy does not allow recover-once');
+    if (plan.runtime_budget.kill_switch) throw new Error('scheduler runtime budget kill switch is enabled');
+    if (plan.runtime_budget.max_runs_per_invocation !== 1) throw new Error('scheduler runtime budget must allow exactly one run per invocation');
+    if (activeSchedulerLease(root)) throw new Error('active scheduler lease already exists');
+    const classificationEnvelope = recoveryClassificationEnvelope(root, { persist: true });
+    const classificationPayload = { schema_version: jsonSchemaVersion, command: 'recovery', ...classificationEnvelope, safety: { ...classificationEnvelope.safety, recovery_classification_artifact: true } };
+    const classificationVerification = validateRecoveryClassificationArtifact(classificationPayload, root);
+    if (!classificationVerification.ok) throw new Error(`recovery classification verification failed: ${classificationVerification.failures.join('; ')}`);
+    const recoveryEnvelopeResult = recoveryApplyEnvelopeFromClassification(root, classificationPayload, '', { persist: true, allowActiveSchedulerLease: true });
+    const classificationFile = writeRecoveryClassification(root, classificationEnvelope);
+    recoveryEnvelopeResult.recovery_run.classification_file = path.basename(classificationFile);
+    const leaseFile = writeSchedulerLease(root, plan);
+    let recoveryResult = null;
+    try { const writeResult = writeRecoveryApply(root, recoveryEnvelopeResult); recoveryResult = { envelope: recoveryEnvelopeResult, ...writeResult }; completeSchedulerLease(leaseFile, 'completed'); }
+    catch (error) { completeSchedulerLease(leaseFile, 'failed'); throw error; }
+    const leaseDigest = fileDigest(leaseFile), run = recoveryResult.envelope.recovery_run;
+    const schedulerRun = { plan_id: plan.scheduler.plan_id, recovery_mode: true, selected_candidate: '', selected_recovery_finding: run.selected_finding.source_file, selected_recovery_category: run.selected_finding.category, recovery_run_file: path.basename(recoveryResult.file), retry_package_file: recoveryResult.retryFile ? path.basename(recoveryResult.retryFile) : '', recovery_action: run.recovery_action, idempotency_key: run.idempotency_key, scheduler_policy_digest: policy.scheduler_policy_digest, runtime_budget_digest: plan.runtime_budget.runtime_budget_digest, recovery_policy_digest: run.recovery_policy_digest, recovery_action_catalog_digest: run.recovery_action_catalog_digest, recovery_classification_file: path.basename(classificationFile), recovery_classification_digest: fileDigest(classificationFile), scheduler_lease_file: path.basename(leaseFile), scheduler_lease_digest: leaseDigest, retry_allowed: false, recovery_apply_allowed: true, loop: false, daemon: false };
+    return { mode: 'scheduler-recovery-once-run', ok: true, state_present: fs.existsSync(workflowPath(root)), scheduler_run: schedulerRun, plan, recovery: { file: path.basename(recoveryResult.file), digest: fileDigest(recoveryResult.file), retry_package_file: recoveryResult.retryFile ? path.basename(recoveryResult.retryFile) : '' }, safety: { ...schedulerSafety({ writes: true, once: true }), stage: 'Stage 26', recovery_apply: true, auto_recovery: false, auto_retry: false }, quality: [], action: 'single-shot scheduler applied one recovery finding through confirmed recovery path. No loop, daemon, normal queue execution, automatic retry, auto reply, platform API, subagent, MCP, git, worktree, or business source write occurred.' };
+  }
+
+  function printSchedulerRecoveryOnce(envelope, file = '') {
+    for (const line of ['Vibecoding Runtime Scheduler Recovery Once', `Mode: ${envelope.mode === 'scheduler-recovery-once-preview' ? 'recover-once-preview' : 'recover-once-confirm'}`, `Plan id: ${envelope.scheduler_run.plan_id}`, `Selected recovery: ${envelope.scheduler_run.selected_recovery_finding || 'none'} [${envelope.scheduler_run.selected_recovery_category || 'none'}]`, `Recovery run: ${envelope.scheduler_run.recovery_run_file || 'none'}`, ...(file ? [`Scheduler run: ${path.relative(process.cwd(), file)}`] : []), `Action: ${envelope.action}`]) console.log(line);
+  }
+
+  function printSchedulerOnce(envelope, file = '') {
+    for (const line of ['Vibecoding Runtime Scheduler Once', `Mode: ${envelope.mode === 'scheduler-once-preview' ? 'once-preview' : 'once-confirm'}`, `Plan id: ${envelope.scheduler_run.plan_id}`, `Selected candidate: ${envelope.scheduler_run.selected_candidate || 'none'}`, `Execution: ${envelope.scheduler_run.execution_file || 'none'} [${envelope.scheduler_run.execution_status || 'not-started'}]`, ...(file ? [`Scheduler run: ${path.relative(process.cwd(), file)}`] : []), `Action: ${envelope.action}`]) console.log(line);
+  }
+
+  function runSchedulerPolicies(options) {
+    if (options.write || options.dryRun || options.confirm || options.scan || options.once || options.fromDispatch || options.actor || options.approval || options.run || options.autoRun) throw new Error('scheduler-policies supports read-only audit only');
+    const modes = [options.schedulerPolicyList, options.schedulerPolicyShow].filter(Boolean);
+    if (modes.length !== 1) throw new Error('scheduler-policies requires exactly one of --list or --show <profile>');
+    ensureRoot(options.root);
+    const envelope = options.schedulerPolicyList ? schedulerPolicyAuditEnvelope('list') : schedulerPolicyAuditEnvelope('show', options.profile);
+    if (options.json) writeJsonEnvelope('scheduler-policies', envelope); else printSchedulerPolicyAudit(envelope);
+  }
+
+  function runScheduler(options) {
+    if (options.write || options.dryRun || options.scan || options.fromDispatch || options.actor || options.approval || options.run || options.autoRun) throw new Error('scheduler supports plan, hook-derived plan, plan audit, single-shot once, and confirmed recovery once only');
+    const wantsHookPlan = Boolean(options.schedulerFromHook && options.schedulerPlan);
+    const modes = [wantsHookPlan, options.schedulerPlan && !options.schedulerFromHook, options.once, options.schedulerListPlans, options.schedulerShowPlan, options.schedulerVerifyPlan].filter(Boolean);
+    if (modes.length !== 1) throw new Error('scheduler requires exactly one of --plan, --from-hook <hook-intent> --plan, --once, --list, --show, or --verify');
+    ensureRoot(options.root);
+    if (options.schedulerRecover && !options.once) throw new Error('scheduler --recover is only supported with --once');
+    const emit = (envelope, print, file = '', key = '') => options.json ? writeJsonEnvelope('scheduler', key ? { ...envelope, [key]: path.basename(file) } : envelope) : print(envelope, file);
+    if (options.schedulerFromHook) {
+      if (!options.schedulerPlan) throw new Error('scheduler --from-hook requires --plan');
+      if (options.schedulerRecover || options.once) throw new Error('scheduler --from-hook cannot be combined with --once or --recover');
+      const envelope = schedulerHookPlanEnvelope(options.root, options.schedulerHookFile, { persist: options.confirm });
+      return emit(envelope, printSchedulerHookPlan, options.confirm ? writeSchedulerHookPlan(options.root, envelope) : '', options.confirm ? 'scheduler_hook_plan_file' : '');
+    }
+    if (options.schedulerPlan) {
+      const envelope = schedulerPlanEnvelope(options.root, { persist: options.confirm });
+      return emit(envelope, printSchedulerPlan, options.confirm ? writeSchedulerPlan(options.root, envelope) : '', options.confirm ? 'scheduler_plan_file' : '');
+    }
+    if (options.once) {
+      const envelope = !options.confirm ? (options.schedulerRecover ? schedulerOnceRecoveryPreviewEnvelope(options.root) : schedulerOncePreviewEnvelope(options.root)) : (options.schedulerRecover ? schedulerOnceRecoveryEnvelope(options.root) : schedulerOnceEnvelope(options.root));
+      return emit(envelope, options.schedulerRecover ? printSchedulerRecoveryOnce : printSchedulerOnce, options.confirm ? writeSchedulerRun(options.root, envelope) : '', options.confirm ? 'scheduler_run_file' : '');
+    }
+    if (options.schedulerRecover) throw new Error('scheduler --recover is only supported with --once');
+    if (options.confirm) throw new Error('scheduler --confirm is only supported with --plan or --once');
+    const mode = options.schedulerListPlans ? 'list' : options.schedulerVerifyPlan ? 'verify' : 'show';
+    if (options.schedulerPlanFile && String(options.schedulerPlanFile).endsWith('.scheduler-hook-plan.json')) return emit(schedulerHookPlanAuditEnvelope(options.root, mode, options.schedulerPlanFile), printSchedulerHookPlanAudit);
+    return emit(schedulerPlanAuditEnvelope(options.root, mode, options.schedulerPlanFile), printSchedulerPlanAudit);
+  }
+
+  return {
+    schedulerPolicySnapshot, runtimeBudgetSnapshot, validateSchedulerPolicySnapshot, validateRuntimeBudgetSnapshot, schedulerSafety,
+    schedulerPlanSnapshotPath, schedulerHookPlanSnapshotPath, schedulerRunPath, schedulerPlanEnvelope, validateSchedulerPlanArtifact, writeSchedulerPlan,
+    schedulerHookPlanEnvelope, validateSchedulerHookPlanArtifact, writeSchedulerHookPlan, schedulerHookPlanAuditEnvelope, printSchedulerHookPlan, printSchedulerHookPlanAudit,
+    schedulerPlanAuditEnvelope, printSchedulerPlan, printSchedulerPlanAudit, schedulerPolicyAuditEnvelope, printSchedulerPolicyAudit, schedulerScanEnvelope, printSchedulerScan,
+    writeSchedulerRun, schedulerOncePreviewEnvelope, schedulerOnceEnvelope, schedulerOnceRecoveryPreviewEnvelope, schedulerOnceRecoveryEnvelope, printSchedulerRecoveryOnce, printSchedulerOnce, runSchedulerPolicies, runScheduler,
+  };
+}