@jungjaehoon/mama-os 0.22.0 → 0.23.0

package/dist/cli/runtime/api-routes-init.js

@@ -56,11 +56,30 @@ const upload_handler_js_1 = require("../../api/upload-handler.js");
 const operator_tasks_handler_js_1 = require("../../api/operator-tasks-handler.js");
 const auth_middleware_js_1 = require("../../api/auth-middleware.js");
 const utilities_js_1 = require("./utilities.js");
+const code_audit_js_1 = require("../../observability/code-audit.js");
+const workorder_publishers_js_1 = require("../../operator/workorder-publishers.js");
+const security_monitor_js_1 = require("../../security/security-monitor.js");
 const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
 const { DebugLogger } = debugLogger;
 const routesLogger = new DebugLogger('api-routes');
 async function registerApiRoutes(params) {
-    const { config, apiServer, eventBus, oauthManager: _oauthManager, mamaApi: _mamaApi, messageRouter, agentLoop, toolExecutor, discordGateway, slackGateway, graphHandler, getAdapter, sessionsDb, } = params;
+    const { config, apiServer, eventBus, oauthManager: _oauthManager, mamaApi: _mamaApi, messageRouter, agentLoop, toolExecutor, discordGateway, slackGateway, graphHandler, getAdapter, sessionsDb, workOrderConsumer, } = params;
+    // ── Stage-2 publisher gate (plan S2-T2) ───────────────────────────────
+    // Throws at boot on a malformed flag value (no-fallback: a typo must not
+    // silently revert a believed-active migration to legacy).
+    const stage2Flag = (0, workorder_publishers_js_1.readStage2Flag)();
+    if (stage2Flag !== 'off') {
+        console.log(`[stage2] workorder publishers active (flag=${stage2Flag})`);
+    }
+    const enqueueWorkOrderOrThrow = (workKind, idempotencyKey, payload, priority) => {
+        const ledger = toolExecutor.getTaskLedger();
+        if (!ledger) {
+            throw new Error(`[stage2] TaskLedger unavailable - cannot enqueue ${workKind} workorder`);
+        }
+        (0, workorder_publishers_js_1.validateWorkOrderPayload)(workKind, payload);
+        const wo = ledger.enqueueWorkOrder({ workKind, idempotencyKey, input: payload, priority });
+        console.log(`[stage2] enqueued workorder ${workKind}#${wo.id} key=${idempotencyKey}`);
+    };
     // ── Validation Session Service ────────────────────────────────────────
     const validationService = sessionsDb ? new session_service_js_1.ValidationSessionService(sessionsDb) : null;
     /**
@@ -259,6 +278,22 @@ async function registerApiRoutes(params) {
     {
         const { createReportPublisher } = await import('../../api/report-handler.js');
         toolExecutor.setReportPublisher(createReportPublisher(apiServer.reportStore, apiServer.reportSseClients));
+        // S1-T4 artifact hub: the console READS the board it directs. Same store
+        // the publisher writes - the conductor's status answers cite these slots
+        // instead of re-deriving state from memory copies.
+        toolExecutor.setReportReader(() => {
+            const slots = apiServer.reportStore.getAll();
+            const projected = {};
+            for (const [name, slot] of Object.entries(slots)) {
+                projected[name] = {
+                    html: slot.html,
+                    updatedAt: Number.isFinite(slot.updatedAt)
+                        ? new Date(slot.updatedAt).toISOString()
+                        : null,
+                };
+            }
+            return projected;
+        });
     }
     if (dashboardAgentConfigured) {
         // ── Dashboard Agent ───────────────────────────────────────────────
@@ -284,6 +319,23 @@ This saves resources. Only publish when there is genuinely new information to re
         // request means "rebuild the board now", not "tell me nothing changed".
         const buildForcedDashboardPrompt = () => buildDashboardPrompt().replace(/3\. If NO substantive decisions[^\n]*\n/, '3. The owner explicitly requested a fresh board: do NOT reply NO_UPDATE. Rebuild and publish even if nothing changed since the last publish.\n');
         const doDashboardRun = async (opts) => {
+            // Stage-2 gate at the FUNCTION level: schedule, boot, manual REST all
+            // funnel here, so this single gate covers every entry path (plan F4).
+            const boardAction = (0, workorder_publishers_js_1.resolvePublishAction)(stage2Flag, 'board');
+            if (boardAction !== 'legacy') {
+                try {
+                    const now = Date.now();
+                    enqueueWorkOrderOrThrow('board', opts?.force ? (0, workorder_publishers_js_1.boardManualKey)(now) : (0, workorder_publishers_js_1.boardFullKey)(now), { mode: 'full', ...(opts?.force ? { force: true } : {}) }, opts?.force ? 'high' : undefined);
+                }
+                catch (err) {
+                    routesLogger.error('[stage2] board enqueue failed:', err instanceof Error ? err.message : err);
+                }
+                // 'enqueue' (on): legacy stops - an enqueue failure must NOT silently
+                // fall back to a legacy run; the next occurrence retries.
+                // 'both' (shadow): legacy keeps publishing live below.
+                if (boardAction === 'enqueue')
+                    return;
+            }
             const pm = toolExecutor.getAgentProcessManager();
             if (!pm) {
                 routesLogger.warn('[Dashboard Agent] AgentProcessManager not available yet');
@@ -362,52 +414,130 @@ This saves resources. Only publish when there is genuinely new information to re
                     return row.n;
                 },
             };
+            // Stage-2 board completion hook (plan D1/E3/G1): the consumer wraps
+            // reconcile workorders with the SAME bracket the legacy closure owns,
+            // but trace rows from worker runs carry the worker's identity, not
+            // agent_id='dashboard-agent' - the re-key goes through details JSON
+            // (agent_activity has NO channel_id column; json_extract is the only
+            // schema-supported key; agent_id re-keying is a green-test trap).
+            if (workOrderConsumer) {
+                const { buildWorkerTraceQueries } = await import('../../operator/workorder-hooks.js');
+                const workerVerifierDeps = {
+                    ...verifierDeps,
+                    ...buildWorkerTraceQueries(sessionsDb, 'worker:board'),
+                };
+                workOrderConsumer.registerHook('board', {
+                    before: (wo) => {
+                        if (wo.payload.mode !== 'reconcile')
+                            return null;
+                        return captureSnapshot(workerVerifierDeps, `reconcile:${String(wo.payload.channelKey)}`);
+                    },
+                    after: (wo, response, beforeState) => {
+                        if (wo.payload.mode !== 'reconcile' || !beforeState) {
+                            // FULL runs are not bracket-verified (plan: reconcile mode only).
+                            if (response.includes('NO_UPDATE')) {
+                                console.log('[stage2] board worker: no changes detected, publish skipped');
+                            }
+                            return;
+                        }
+                        const scope = `reconcile:${String(wo.payload.channelKey)}`;
+                        const verdict = verifyAfterRun(workerVerifierDeps, beforeState, scope);
+                        const outcome = verdict.verified ? 'reconcile_verified' : 'reconcile_unverified';
+                        console.log(`[stage2] ${outcome} channel=${String(wo.payload.channelKey)}${verdict.effects.length > 0 ? ` (${verdict.effects.join('; ')})` : ''}`);
+                        try {
+                            if (sessionsDb) {
+                                (0, agent_store_js_1.logActivity)(sessionsDb, {
+                                    agent_id: 'workorder-board',
+                                    agent_version: 0,
+                                    type: outcome,
+                                    input_summary: `reconcile ${String(wo.payload.channelKey)}`,
+                                    output_summary: verdict.effects.join('; '),
+                                    execution_status: 'completed',
+                                    trigger_reason: 'workorder',
+                                });
+                            }
+                        }
+                        catch {
+                            /* telemetry only */
+                        }
+                        if (!verdict.verified) {
+                            eventBus.emit({
+                                type: 'agent:action',
+                                agent: 'Dashboard Agent',
+                                action: 'reconcile_unverified',
+                                target: String(wo.payload.channelKey),
+                            });
+                        }
+                    },
+                });
+            }
             const reconcileScheduler = new ReconcileScheduler({
                 debounceMs: Number(process.env.MAMA_RECONCILE_DEBOUNCE_MS) || undefined,
                 maxWaitMs: Number(process.env.MAMA_RECONCILE_MAX_WAIT_MS) || undefined,
                 globalMaxPerHour: Number(process.env.MAMA_RECONCILE_MAX_PER_HOUR) || undefined,
                 log: (line) => console.log(line),
-                run: (channelKey, deltaLines) => boardWriterQueue.push(async () => {
-                    const scope = `reconcile:${channelKey}`;
-                    const before = captureSnapshot(verifierDeps, scope);
-                    const prompt = buildReconcilePrompt({
-                        channelKey,
-                        deltaLines,
-                        todayIso: new Date().toISOString().slice(0, 10),
-                        kagemushaContext,
-                    });
-                    await executeValidatedRun('dashboard-agent', prompt, {
-                        requestTimeout: 300_000,
-                    });
-                    const verdict = verifyAfterRun(verifierDeps, before, scope);
-                    const outcome = verdict.verified ? 'reconcile_verified' : 'reconcile_unverified';
-                    console.log(`[reconcile] ${outcome} channel=${channelKey}${verdict.effects.length > 0 ? ` (${verdict.effects.join('; ')})` : ''}`);
-                    try {
-                        if (sessionsDb) {
-                            (0, agent_store_js_1.logActivity)(sessionsDb, {
-                                agent_id: 'dashboard-agent',
-                                agent_version: 0,
-                                type: outcome,
-                                input_summary: `reconcile ${channelKey}`,
-                                output_summary: verdict.effects.join('; '),
-                                execution_status: 'completed',
-                                trigger_reason: 'reconcile',
+                run: (channelKey, deltaLines) => {
+                    // Stage-2: at 'on' the reconcile leg becomes a board workorder (its
+                    // bracket verification moves to the consumer's completion hook);
+                    // shadow/off keep the legacy bracket-verified path (plan C1).
+                    if ((0, workorder_publishers_js_1.resolveReconcileAction)(stage2Flag) === 'enqueue') {
+                        try {
+                            enqueueWorkOrderOrThrow('board', (0, workorder_publishers_js_1.boardReconcileKey)(channelKey, Date.now()), {
+                                mode: 'reconcile',
+                                channelKey,
+                                deltaLines,
                             });
                         }
+                        catch (err) {
+                            routesLogger.error('[stage2] reconcile enqueue failed:', err instanceof Error ? err.message : err);
+                            // REJECT so ReconcileScheduler restores pendingLines - a
+                            // resolved failure silently drops this delta (PR bot round).
+                            return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+                        }
+                        return Promise.resolve();
                     }
-                    catch {
-                        /* telemetry only */
-                    }
-                    if (!verdict.verified) {
-                        // Loud, never blocking (observability over restriction).
-                        eventBus.emit({
-                            type: 'agent:action',
-                            agent: 'Dashboard Agent',
-                            action: 'reconcile_unverified',
-                            target: channelKey,
+                    return boardWriterQueue.push(async () => {
+                        const scope = `reconcile:${channelKey}`;
+                        const before = captureSnapshot(verifierDeps, scope);
+                        const prompt = buildReconcilePrompt({
+                            channelKey,
+                            deltaLines,
+                            todayIso: new Date().toISOString().slice(0, 10),
+                            kagemushaContext,
                         });
-                    }
-                }),
+                        await executeValidatedRun('dashboard-agent', prompt, {
+                            requestTimeout: 300_000,
+                        });
+                        const verdict = verifyAfterRun(verifierDeps, before, scope);
+                        const outcome = verdict.verified ? 'reconcile_verified' : 'reconcile_unverified';
+                        console.log(`[reconcile] ${outcome} channel=${channelKey}${verdict.effects.length > 0 ? ` (${verdict.effects.join('; ')})` : ''}`);
+                        try {
+                            if (sessionsDb) {
+                                (0, agent_store_js_1.logActivity)(sessionsDb, {
+                                    agent_id: 'dashboard-agent',
+                                    agent_version: 0,
+                                    type: outcome,
+                                    input_summary: `reconcile ${channelKey}`,
+                                    output_summary: verdict.effects.join('; '),
+                                    execution_status: 'completed',
+                                    trigger_reason: 'reconcile',
+                                });
+                            }
+                        }
+                        catch {
+                            /* telemetry only */
+                        }
+                        if (!verdict.verified) {
+                            // Loud, never blocking (observability over restriction).
+                            eventBus.emit({
+                                type: 'agent:action',
+                                agent: 'Dashboard Agent',
+                                action: 'reconcile_unverified',
+                                target: channelKey,
+                            });
+                        }
+                    });
+                },
             });
             eventBus.on('operator:channel-delta', (event) => {
                 if (event.type === 'operator:channel-delta') {
@@ -482,7 +612,20 @@ This saves resources. Only publish when there is genuinely new information to re
             });
         });
         // Wiki trigger via executeValidatedRun
-        const doWikiRun = async () => {
+        const doWikiRun = async (trigger) => {
+            // Stage-2 gate (function level, plan F4). Wiki never enters shadow
+            // (resolvePublishAction returns 'legacy' there) - its Obsidian writes
+            // have no capture seam.
+            if ((0, workorder_publishers_js_1.resolvePublishAction)(stage2Flag, 'wiki') === 'enqueue') {
+                try {
+                    const now = Date.now();
+                    enqueueWorkOrderOrThrow('wiki', (0, workorder_publishers_js_1.wikiBatchKey)(trigger, now), { batchId: `${now}-${trigger}`, events: [trigger] }, trigger === 'manual' ? 'high' : undefined);
+                }
+                catch (err) {
+                    routesLogger.error('[stage2] wiki enqueue failed:', err instanceof Error ? err.message : err);
+                }
+                return;
+            }
             if (!toolExecutor.getAgentProcessManager()) {
                 routesLogger.warn('[Wiki Agent] AgentProcessManager not available yet');
                 return;
@@ -517,21 +660,29 @@ This saves resources. Only compile when there is genuinely new information to do
                 routesLogger.error('[Wiki Agent] Error:', err instanceof Error ? err.message : err);
             }
         };
+        // Stage-2 wiki completion hook (plan E4): outcome reading only - the
+        // wiki:compiled events flow through the wikiPublisher independently.
+        if (workOrderConsumer) {
+            const { buildWikiAfterHook } = await import('../../operator/workorder-hooks.js');
+            workOrderConsumer.registerHook('wiki', {
+                after: buildWikiAfterHook((line) => routesLogger.debug(line)),
+            });
+        }
         // Serialize ALL wiki runs (boot, event-driven, manual) on one chain -- the
         // shared agent process rejects concurrent requests, so the boot run and a
         // manual trigger raced into 'Process is busy' (same pattern as the
         // dashboard agent's runDashboardAgent chain above).
         let wikiRunChain = Promise.resolve();
-        const runWikiAgent = () => {
-            wikiRunChain = wikiRunChain.then(doWikiRun).catch(() => { });
+        const runWikiAgent = (trigger) => {
+            wikiRunChain = wikiRunChain.then(() => doWikiRun(trigger)).catch(() => { });
             return wikiRunChain;
         };
         // Event-driven: compile when extraction completes. Trailing-edge debounce so
         // bursts of extraction:completed events coalesce into one wiki compile run.
-        eventBus.onDebounced('extraction:completed', () => runWikiAgent(), 30_000);
+        eventBus.onDebounced('extraction:completed', () => runWikiAgent('extraction:completed'), 30_000);
         // Promotion feeds the wiki: freshly promoted decisions are exactly the
         // material daily notes and lessons compile from.
-        eventBus.onDebounced('memory:promoted', () => runWikiAgent(), 30_000);
+        eventBus.onDebounced('memory:promoted', () => runWikiAgent('memory:promoted'), 30_000);
         // Emit agent:action notices when wiki pages are compiled
         eventBus.on('wiki:compiled', (event) => {
             if (event.type === 'wiki:compiled') {
@@ -547,11 +698,11 @@ This saves resources. Only compile when there is genuinely new information to do
         });
         // Manual trigger API
         apiServer.app.post('/api/wiki/compile', auth_middleware_js_1.requireAuth, async (_req, res) => {
-            runWikiAgent().catch(() => { });
+            runWikiAgent('manual').catch(() => { });
             res.json({ ok: true, message: 'Wiki compilation triggered' });
         });
         // First run after 15s (let connectors and dashboard agent go first)
-        setTimeout(runWikiAgent, 15_000);
+        setTimeout(() => runWikiAgent('boot'), 15_000);
         routesLogger.info('[Wiki Agent] Ready — triggers: extraction:completed event, POST /api/wiki/compile');
     }
     // -- Memory Promotion: scheduled observation->decision curation --
@@ -577,7 +728,19 @@ This saves resources. Only compile when there is genuinely new information to do
             'rules, recurring risk patterns; NEVER task lifecycle states, greetings, or logistics). ' +
             'Include scopes (the source channel, and the project when identifiable) and event_date.\n' +
             '5. Finish with exactly PROMOTED <n> or NO_UPDATE.';
-        const doPromotionRun = async () => {
+        const doPromotionRun = async (opts) => {
+            // Stage-2 gate (function level, plan F4). Promotion never enters shadow
+            // - its mama_save writes have no capture seam.
+            if ((0, workorder_publishers_js_1.resolvePublishAction)(stage2Flag, 'memory-curation') === 'enqueue') {
+                try {
+                    const now = Date.now();
+                    enqueueWorkOrderOrThrow('memory-curation', opts?.manual ? (0, workorder_publishers_js_1.promotionManualKey)(now) : (0, workorder_publishers_js_1.promotionKey)(now), { scheduledAt: new Date(now).toISOString() }, opts?.manual ? 'high' : undefined);
+                }
+                catch (err) {
+                    routesLogger.error('[stage2] promotion enqueue failed:', err instanceof Error ? err.message : err);
+                }
+                return;
+            }
             if (!toolExecutor.getAgentProcessManager()) {
                 routesLogger.warn('[Memory Promotion] AgentProcessManager not available yet');
                 return;
@@ -604,179 +767,113 @@ This saves resources. Only compile when there is genuinely new information to do
                 routesLogger.error('[Memory Promotion] Error:', err instanceof Error ? err.message : err);
             }
         };
+        // Stage-2 promotion completion hook (plan E4): the PROMOTED <n> parse and
+        // its event emissions are the wiki ingress chain's second link - losing
+        // them in the workorder conversion would silently sever memory:promoted.
+        if (workOrderConsumer) {
+            const { buildPromotionAfterHook } = await import('../../operator/workorder-hooks.js');
+            workOrderConsumer.registerHook('memory-curation', {
+                after: buildPromotionAfterHook({
+                    emitAgentAction: (action, target) => eventBus.emit({ type: 'agent:action', agent: 'Memory Agent', action, target }),
+                    emitMemoryPromoted: (saved) => eventBus.emit({ type: 'memory:promoted', saved }),
+                    log: (line) => console.log(line),
+                }),
+            });
+        }
         // Serialize all promotion runs on one chain (same 'Process is busy' class
         // as the dashboard and wiki agents).
         let promotionRunChain = Promise.resolve();
-        const runMemoryPromotion = () => {
-            promotionRunChain = promotionRunChain.then(doPromotionRun).catch(() => { });
+        const runMemoryPromotion = (opts) => {
+            promotionRunChain = promotionRunChain.then(() => doPromotionRun(opts)).catch(() => { });
             return promotionRunChain;
         };
-        setTimeout(runMemoryPromotion, PROMOTION_INITIAL_DELAY_MS);
-        setInterval(runMemoryPromotion, PROMOTION_INTERVAL_MS);
+        setTimeout(() => runMemoryPromotion(), PROMOTION_INITIAL_DELAY_MS);
+        setInterval(() => runMemoryPromotion(), PROMOTION_INTERVAL_MS);
         apiServer.app.post('/api/memory/promote', auth_middleware_js_1.requireAuth, (_req, res) => {
-            runMemoryPromotion().catch(() => { });
+            runMemoryPromotion({ manual: true }).catch(() => { });
             res.json({ ok: true, message: 'Memory promotion run triggered' });
         });
         console.log(`[Memory Promotion] Ready: every ${PROMOTION_INTERVAL_MS / 3_600_000}h, POST /api/memory/promote`);
     }
-    // ── Conductor Audit — hourly system health check ──────────────────────
+    // -- System Audit: hourly deterministic code checks ---------------------
+    // Owner decision 2026-04-22 (mama_conductor_audit_code_based_read_only),
+    // landed 2026-07-17: the audit is fact collection and recording executed by
+    // CODE - no LLM invocation, no auto-fix, no broad filesystem access. The
+    // prior hourly LLM audit violated that decision and the 2026-05-14
+    // no-shell-autofix rule, and lost its tools entirely to the persona
+    // lockdown (--tools ""). The 24h alert-dedup contract (owner verdict
+    // 2026-07-11) is preserved inside runCodeAudit; MAJOR findings flow through
+    // dispatchSecurityAlertDirect to the configured security alert sender.
     const AUDIT_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
     const AUDIT_INITIAL_DELAY_MS = 5 * 60 * 1000; // 5 min after startup
-    // Owner verdict 2026-07-11: the hourly audit re-sent the same MAJOR alert every
-    // run because each audit was stateless. agent_notices does not carry audit
-    // findings (review feedback on #134), so dedup state lives in a JSON file the
-    // conductor reads/writes itself, and the current time is interpolated per run
-    // so the 24h comparison is grounded.
-    const buildAuditPrompt = (nowIso) => 'Perform a system audit. Read ~/.mama/skills/audit-checklist.md and execute each step. ' +
-        'Classify findings as MINOR or MAJOR. ' +
-        'For MINOR items: execute the auto-fix command immediately (Bash curl). Do NOT just report — fix it. ' +
-        'For MAJOR items: report to human via channel alert, subject to the dedup rule below. ' +
-        `Alert dedup (MANDATORY): the current time is ${nowIso}. Read ~/.mama/state/audit-findings.json ` +
-        '(it may not exist on the first run). Re-alert a MAJOR finding only if it is NEW (no entry ' +
-        'with the same id), has ESCALATED, or its last_alerted_at is older than 24 hours compared to ' +
-        'the current time; otherwise stay silent about it. Never alert MINOR findings to the owner. ' +
-        'After the audit, Write ~/.mama/state/audit-findings.json with an array of every current ' +
-        'finding: {id (stable kebab-case slug), severity, first_seen, last_seen, last_alerted_at}. ' +
-        'Carry forward first_seen and last_alerted_at from the previous file; set last_alerted_at to ' +
-        'the current time only for findings you actually alerted this run. ' +
-        // Owner verdict 2026-07-10: hourly-audit self-notes are memory noise -- the two
-        // "durable policy" saves it produced were unscoped near-duplicates polluting
-        // global recall. The audit record lives in validation sessions + agent_activity;
-        // MAJOR findings reach the owner via the channel alert. No memory writes here.
-        'Do NOT call mama_save under any circumstances: the validation session and agent_activity ' +
-        'are the durable audit record, and repeated audits must not accumulate policy notes in memory.';
-    const runConductorAudit = async () => {
-        let auditSession = null;
-        let auditVersion = 0;
-        const auditStart = Date.now();
+    const doSystemAudit = async () => {
         try {
-            routesLogger.debug('[Conductor Audit] Starting hourly audit...');
-            try {
-                const ver = sessionsDb ? (0, agent_store_js_1.getLatestVersion)(sessionsDb, 'conductor') : null;
-                auditVersion = ver?.version ?? 0;
-                auditSession =
-                    validationService?.startSession('conductor', auditVersion, 'audit', {
-                        goal: 'hourly system audit',
-                    }) ?? null;
-            }
-            catch (bootstrapErr) {
-                routesLogger.warn('[Conductor Audit] Failed to initialize audit telemetry:', bootstrapErr);
-                auditVersion = 0;
-                auditSession = null;
-            }
-            if (sessionsDb) {
-                try {
-                    const startRow = (0, agent_store_js_1.logActivity)(sessionsDb, {
-                        agent_id: 'conductor',
-                        agent_version: auditVersion,
-                        type: 'audit_start',
-                        input_summary: 'Hourly system audit',
-                        run_id: auditSession?.id,
-                        execution_status: 'started',
-                        trigger_reason: 'audit',
+            const report = await (0, code_audit_js_1.runCodeAudit)({
+                config: {
+                    telegram: config.telegram,
+                    multi_agent: config.multi_agent,
+                    roles: config.roles,
+                },
+                // Evaluated at audit time: gateway-wiring registers the sender only
+                // for ACTIVE gateways, so a configured target on a dead gateway must
+                // not report a false PASS.
+                securityAlertConfigured: (0, security_monitor_js_1.hasSecurityAlertSender)(),
+                // Direct dispatch, NOT recordSecurityEvent: audit findings are
+                // self-generated and must not fabricate incident/denylist/RDAP
+                // artifacts for a pseudo client. dispatchSecurityAlertDirect awaits
+                // delivery and throws on failure, so runCodeAudit keeps
+                // last_alerted_at null and retries on the next run (fail loud).
+                alert: async (finding, reason) => {
+                    await (0, security_monitor_js_1.dispatchSecurityAlertDirect)({
+                        type: 'system_audit_finding',
+                        severity: 'critical',
+                        message: `[Audit/${reason}] ${finding.summary}`,
+                        // path carries the finding id so the alert-cooldown fingerprint
+                        // distinguishes findings instead of collapsing them all into one.
+                        path: finding.id,
+                        details: { findingId: finding.id, detail: finding.detail ?? null },
                     });
-                    if (auditSession) {
-                        try {
-                            validationService?.recordRun(auditSession.id, { activityId: startRow.id });
-                        }
-                        catch (telemetryErr) {
-                            routesLogger.warn('[Conductor Audit] Failed to link startup activity to validation session:', telemetryErr);
-                        }
-                    }
-                }
-                catch (telemetryErr) {
-                    routesLogger.warn('[Conductor Audit] Failed to write startup telemetry:', telemetryErr);
-                }
-            }
-            const auditChannelId = `conductor-audit-${Date.now()}`;
-            await messageRouter.process({
-                source: 'system',
-                channelId: auditChannelId,
-                userId: 'system',
-                text: buildAuditPrompt(new Date().toISOString()),
+                },
             });
-            const auditDuration = Date.now() - auditStart;
-            try {
-                if (sessionsDb) {
-                    const activityRow = (0, agent_store_js_1.logActivity)(sessionsDb, {
-                        agent_id: 'conductor',
-                        agent_version: auditVersion,
-                        type: 'audit_complete',
-                        input_summary: 'Hourly system audit',
-                        duration_ms: auditDuration,
-                        run_id: auditSession?.id,
-                        execution_status: 'completed',
-                        trigger_reason: 'audit',
-                    });
-                    if (auditSession) {
-                        validationService?.recordRun(auditSession.id, { activityId: activityRow.id });
-                    }
-                }
-            }
-            catch (telemetryErr) {
-                routesLogger.warn('[Conductor Audit] Failed to write completion telemetry:', telemetryErr);
-            }
-            try {
-                if (auditSession && validationService) {
-                    validationService.finalizeSession(auditSession.id, {
-                        execution_status: 'completed',
-                        metrics: { duration_ms: auditDuration },
-                    });
-                }
-            }
-            catch (telemetryErr) {
-                routesLogger.warn('[Conductor Audit] Failed to finalize validation session:', telemetryErr);
-            }
-            routesLogger.debug('[Conductor Audit] Audit complete');
+            const majors = report.findings.filter((f) => f.severity === 'MAJOR').length;
+            const minors = report.findings.filter((f) => f.severity === 'MINOR').length;
+            routesLogger.info(`[System Audit] ${report.pass_items.length} pass, ${majors} MAJOR, ${minors} MINOR, ` +
+                `alerted=[${report.alerted.join(',')}] in ${report.duration_ms}ms`);
+            if (report.alert_delivery_failures.length > 0) {
+                routesLogger.error('[System Audit] Alert delivery failures:', report.alert_delivery_failures.join('; '));
+            }
+            return report;
         }
         catch (err) {
-            const auditDuration = Date.now() - auditStart;
-            try {
-                if (sessionsDb) {
-                    const failRow = (0, agent_store_js_1.logActivity)(sessionsDb, {
-                        agent_id: 'conductor',
-                        agent_version: auditVersion,
-                        type: 'audit_failed',
-                        input_summary: 'Hourly system audit failed',
-                        error_message: err instanceof Error ? err.message : String(err),
-                        duration_ms: auditDuration,
-                        run_id: auditSession?.id,
-                        execution_status: 'failed',
-                        trigger_reason: 'audit',
-                    });
-                    if (auditSession) {
-                        validationService?.recordRun(auditSession.id, { activityId: failRow.id });
-                    }
-                }
-            }
-            catch (telemetryErr) {
-                routesLogger.warn('[Conductor Audit] Failed to write failure telemetry:', telemetryErr);
-            }
-            try {
-                if (auditSession && validationService) {
-                    validationService.finalizeSession(auditSession.id, {
-                        execution_status: 'failed',
-                        error_message: err instanceof Error ? err.message : String(err),
-                        metrics: { duration_ms: auditDuration },
-                    });
-                }
-            }
-            catch (telemetryErr) {
-                routesLogger.warn('[Conductor Audit] Failed to finalize failed session:', telemetryErr);
-            }
-            routesLogger.error('[Conductor Audit] Failed:', err instanceof Error ? err.message : String(err));
+            routesLogger.error('[System Audit] Failed:', err instanceof Error ? err.message : String(err));
+            return null;
         }
     };
+    // Serialize scheduled and manual runs (same pattern as the memory-promotion
+    // chain above): overlapping audits would read the same prior state, alert
+    // twice, and race the audit-findings.json write. doSystemAudit never
+    // rejects, so chaining on the previous run is sufficient.
+    let auditRunChain = Promise.resolve(null);
+    const runSystemAudit = () => {
+        const next = auditRunChain.then(doSystemAudit);
+        auditRunChain = next;
+        return next;
+    };
     setTimeout(() => {
-        runConductorAudit();
-        setInterval(runConductorAudit, AUDIT_INTERVAL_MS);
+        void runSystemAudit();
+        setInterval(() => void runSystemAudit(), AUDIT_INTERVAL_MS);
     }, AUDIT_INITIAL_DELAY_MS);
-    // Manual trigger
+    // Manual trigger returns the full report (read-only, no LLM, fast)
     apiServer.app.post('/api/conductor/audit', auth_middleware_js_1.requireAuth, async (_req, res) => {
-        runConductorAudit().catch(() => { });
-        res.json({ ok: true, message: 'Conductor audit triggered' });
+        const report = await runSystemAudit();
+        if (report) {
+            res.json({ ok: true, mode: 'code', report });
+        }
+        else {
+            res.status(500).json({ ok: false, error: 'audit failed - see daemon.log' });
+        }
     });
-    routesLogger.info('[Conductor Audit] Ready — runs every 60 min, POST /api/conductor/audit for manual trigger');
+    routesLogger.info('[System Audit] Ready - deterministic code checks every 60 min, POST /api/conductor/audit for manual run');
     // ── Memory Agent stats API ────────────────────────────────────────────
     apiServer.app.get('/api/memory-agent/stats', auth_middleware_js_1.requireAuth, (_req, res) => {
         const stats = messageRouter.getMemoryAgentStats();