@jungjaehoon/mama-os 0.22.1 → 0.24.0

package/dist/operator/workorder-consumer.js

@@ -0,0 +1,253 @@
+"use strict";
+/**
+ * WorkOrderConsumer - the single host-code consumer of system workorders
+ * (Stage 2, plan S2-T3).
+ *
+ * A dedicated interval timer (60s default) claims pending workorders from the
+ * TaskLedger and runs each through workerRun on the operator lane. It runs
+ * UNCONDITIONALLY of MAMA_TRIGGER_LOOP (the publishers are unconditional, so
+ * coupling consumption to an opt-in loop would strand every workorder - plan
+ * A1 BLOCKER), gated only by MAMA_STAGE2_WORKORDERS=shadow|on.
+ *
+ * Serial consumption: one claim at a time, awaited to completion, with a tick
+ * re-entrancy guard (a 260s board run spans 4+ ticks - overlapping ticks skip,
+ * plan G4). Blocking bound = the runner's per-request timeout x maxTurns; no
+ * consumer-level watchdog (plan N2).
+ *
+ * Failure policy (plan G5/M4): failWorkOrder marks the row, then per-kind
+ * maxAttempts decides requeue (fresh row, attempts+1, same occurrence key)
+ * vs retries-exhausted (owner alarm, deduped per kind). Boot recovery routes
+ * stale in_progress claims (crash artifacts) through the SAME policy, with a
+ * separate stale-claim alarm.
+ *
+ * Completion hooks (plan E3/E4): per-kind before/after seams re-home the
+ * post-run host effects the legacy closures owned (board bracket
+ * verification, promotion event re-emission, wiki noUpdate reading). Hook
+ * errors are LOUD but never fail a completed run (observe, never block).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkOrderConsumer = exports.WORKORDER_MAX_ATTEMPTS = void 0;
+const worker_run_js_1 = require("./worker-run.js");
+/** Per-kind retry budget: attempts start at 1; board/promotion self-heal on
+ *  the next publish cycle, wiki events do not re-fire so it retries once. */
+exports.WORKORDER_MAX_ATTEMPTS = {
+    board: 1,
+    wiki: 2,
+    'memory-curation': 1,
+};
+const DEFAULT_TICK_MS = 60_000;
+const ALARM_DEDUP_MS = 6 * 60 * 60 * 1000;
+class WorkOrderConsumer {
+    deps;
+    hooks = new Map();
+    lastAlarmAt = new Map();
+    timer = null;
+    consuming = false;
+    activeTick = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    registerHook(kind, hook) {
+        if (this.hooks.has(kind)) {
+            throw new Error(`[workorder-consumer] hook for '${kind}' already registered`);
+        }
+        this.hooks.set(kind, hook);
+    }
+    /**
+     * Boot recovery (plan C4/M4): in_progress system rows are crash artifacts
+     * (single serial consumer). Each routes through the SAME failure policy
+     * (a crashed wiki batch requeues once; board/promotion do not), plus a
+     * separate stale-claim alarm.
+     */
+    bootRecover() {
+        for (const wo of this.deps.ledger.listStaleClaims()) {
+            this.log(`[workorder-consumer] stale claim recovered: ${wo.workKind}#${wo.id}`);
+            this.emitEvent({ type: 'stale-claim', workKind: wo.workKind, workOrderId: wo.id });
+            this.alarm(wo.workKind, `workorder ${wo.workKind}#${wo.id} stale claim (daemon crash?)`);
+            this.handleFailure(wo, 'stale-claim');
+        }
+    }
+    start() {
+        if (this.timer) {
+            throw new Error('[workorder-consumer] already started');
+        }
+        const tickMs = this.deps.tickMs ?? DEFAULT_TICK_MS;
+        this.timer = setInterval(() => {
+            // Only track a REAL tick: during a long run subsequent firings resolve
+            // 'skipped' instantly and would OVERWRITE activeTick - stop() would
+            // then await the skipped promise while the true tick still runs and
+            // the DB closes under it (round-2 review N1).
+            if (!this.consuming) {
+                this.activeTick = this.tick();
+            }
+        }, tickMs);
+        this.timer.unref?.();
+        this.log(`[workorder-consumer] started (tick every ${tickMs}ms)`);
+    }
+    isStarted() {
+        return this.timer !== null;
+    }
+    /** Graceful: awaits an in-flight tick so shutdown does not race the
+     *  operator-DB close into "database is not open" noise (review m4). */
+    async stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        if (this.activeTick) {
+            await this.activeTick.catch(() => { });
+            this.activeTick = null;
+        }
+    }
+    /**
+     * Drain pending workorders serially: claim -> await -> next claim. Returns
+     * 'skipped' when a previous tick is still consuming (re-entrancy guard,
+     * plan G4) - long runs span multiple tick firings.
+     */
+    async tick() {
+        if (this.consuming)
+            return 'skipped';
+        this.consuming = true;
+        try {
+            // Drain is BOUNDED by the pending count at tick start: a row requeued
+            // by this tick's failure policy waits for the NEXT tick (natural
+            // backoff - otherwise a failing order retries in a tight loop).
+            let remaining = this.deps.ledger.countPendingWorkOrders();
+            while (remaining > 0) {
+                const wo = this.deps.ledger.claimNextWorkOrder();
+                if (!wo)
+                    break;
+                await this.runOne(wo);
+                remaining--;
+            }
+            return 'drained';
+        }
+        finally {
+            this.consuming = false;
+        }
+    }
+    async runOne(wo) {
+        let brief;
+        try {
+            brief = this.deps.loadBrief(wo.workKind);
+        }
+        catch (err) {
+            // I/O errors (permissions etc.) must fail THIS order, not abort the
+            // whole tick with a stranded claim (PR bot round).
+            this.handleFailure(wo, `brief-load-failed: ${errMessage(err)}`);
+            return;
+        }
+        if (!brief || !brief.trim()) {
+            this.log(`[workorder-consumer] brief missing for '${wo.workKind}' - failing #${wo.id}`);
+            this.handleFailure(wo, 'brief-missing');
+            return;
+        }
+        const hook = this.hooks.get(wo.workKind);
+        let beforeState;
+        if (hook?.before) {
+            try {
+                beforeState = hook.before(wo);
+            }
+            catch (err) {
+                // A broken before-hook must not strand the claim: fail the order loudly.
+                this.handleFailure(wo, `before-hook: ${errMessage(err)}`);
+                return;
+            }
+        }
+        let response;
+        try {
+            // Inside the try: a runOptionsFor throw/reject (shadow capture publisher
+            // missing, envelope issuance failure) fails the order instead of running
+            // with the live publisher / without an envelope.
+            const runOptions = await this.deps.runOptionsFor?.(wo);
+            response = await (0, worker_run_js_1.workerRun)(this.deps.runner, {
+                kind: wo.workKind,
+                brief,
+                input: JSON.stringify(wo.payload),
+                runOptions,
+            });
+        }
+        catch (err) {
+            this.handleFailure(wo, errMessage(err));
+            return;
+        }
+        if (hook?.after) {
+            try {
+                hook.after(wo, response, beforeState);
+            }
+            catch (err) {
+                // Observe, never block: a verification/emission failure is loud but
+                // does not fail a run that completed.
+                this.log(`[workorder-consumer] after-hook error (${wo.workKind}#${wo.id}): ${errMessage(err)}`);
+            }
+        }
+        // Shadow-gate diagnostics (§8.2): the worker's actual output decides
+        // whether the tool path works - log a bounded head, never the full body.
+        this.log(`[workorder-consumer] ${wo.workKind}#${wo.id} response head: ${response.slice(0, 200).replace(/\n/g, ' | ')}`);
+        this.deps.ledger.completeWorkOrder(wo.id);
+        this.emitEvent({ type: 'complete', workKind: wo.workKind, workOrderId: wo.id });
+        this.log(`[workorder-consumer] completed ${wo.workKind}#${wo.id}`);
+    }
+    /**
+     * Failure policy layer (plan G5): mark failed, then requeue (attempts+1,
+     * fresh row, same occurrence key - the terminal row freed it) or declare
+     * retries-exhausted with an owner alarm.
+     */
+    handleFailure(wo, reason) {
+        const maxAttempts = exports.WORKORDER_MAX_ATTEMPTS[wo.workKind];
+        if (wo.payload.attempts < maxAttempts) {
+            // Atomic fail+requeue (PR bot round): a crash between separate fail and
+            // enqueue calls would silently lose the retry.
+            const requeued = this.deps.ledger.requeueWorkOrder(wo, reason);
+            this.emitEvent({ type: 'failed', workKind: wo.workKind, workOrderId: wo.id, reason });
+            this.emitEvent({ type: 'requeued', workKind: wo.workKind, workOrderId: requeued.id });
+            this.log(`[workorder-consumer] failed ${wo.workKind}#${wo.id} (${reason}) -> requeued #${requeued.id} (attempt ${wo.payload.attempts + 1}/${maxAttempts})`);
+            return;
+        }
+        this.deps.ledger.failWorkOrder(wo.id, reason);
+        this.emitEvent({ type: 'failed', workKind: wo.workKind, workOrderId: wo.id, reason });
+        this.log(`[workorder-consumer] failed ${wo.workKind}#${wo.id}: ${reason}`);
+        this.emitEvent({ type: 'exhausted', workKind: wo.workKind, workOrderId: wo.id, reason });
+        this.alarm(wo.workKind, `workorder ${wo.workKind}#${wo.id} retries exhausted (${wo.payload.attempts}/${maxAttempts}): ${reason}`);
+    }
+    /** Owner alarm: passive notice + active telegram, deduped per kind (6h). */
+    alarm(kind, message) {
+        const now = this.deps.now?.() ?? Date.now();
+        const last = this.lastAlarmAt.get(kind);
+        if (last !== undefined && now - last < ALARM_DEDUP_MS) {
+            this.log(`[workorder-consumer] alarm deduped (${kind}): ${message}`);
+            return;
+        }
+        this.lastAlarmAt.set(kind, now);
+        try {
+            this.deps.noticeOwner(message);
+        }
+        catch (err) {
+            this.log(`[workorder-consumer] notice enqueue failed: ${errMessage(err)}`);
+        }
+        if (this.deps.opsAlarm.configured) {
+            void this.deps.opsAlarm.send(`⚠️ ${message}`).catch((err) => {
+                this.log(`[workorder-consumer] active alarm send failed: ${errMessage(err)}`);
+            });
+        }
+        else {
+            this.log(`[workorder-consumer] active alarm unconfigured - log-only: ${message}`);
+        }
+    }
+    emitEvent(event) {
+        try {
+            this.deps.onEvent?.(event);
+        }
+        catch {
+            /* telemetry only */
+        }
+    }
+    log(line) {
+        (this.deps.log ?? console.log)(line);
+    }
+}
+exports.WorkOrderConsumer = WorkOrderConsumer;
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=workorder-consumer.js.map

package/dist/operator/workorder-consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder-consumer.js","sourceRoot":"","sources":["../../src/operator/workorder-consumer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAGH,mDAA+D;AA2D/D;6EAC6E;AAChE,QAAA,sBAAsB,GAAkC;IACnE,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,iBAAiB,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,MAAa,iBAAiB;IACX,IAAI,CAAwB;IAC5B,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IAChD,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IACxD,KAAK,GAA0B,IAAI,CAAC;IACpC,SAAS,GAAG,KAAK,CAAC;IAClB,UAAU,GAA4B,IAAI,CAAC;IAEnD,YAAY,IAA2B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,IAAmB,EAAE,IAAmB;QACnD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,sBAAsB,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,WAAW;QACT,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,+CAA+C,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,8BAA8B,CAAC,CAAC;YACzF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,8CAA8C;YAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,4CAA4C,MAAM,KAAK,CAAC,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED;2EACuE;IACvE,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,gEAAgE;YAChE,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAC1D,OAAO,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBACjD,IAAI,CAAC,EAAE;oBAAE,MAAM;gBACf,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtB,SAAS,EAAE,CAAC;YACd,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,EAAmB;QACtC,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,mDAAmD;YACnD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,sBAAsB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,2CAA2C,EAAE,CAAC,QAAQ,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,WAAoB,CAAC;QACzB,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,yEAAyE;gBACzE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,gBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,yEAAyE;YACzE,yEAAyE;YACzE,iDAAiD;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;YACvD,QAAQ,GAAG,MAAM,IAAA,yBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC3C,IAAI,EAAE,EAAE,CAAC,QAAQ;gBACjB,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC;gBACjC,UAAU;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,sCAAsC;gBACtC,IAAI,CAAC,GAAG,CACN,0CAA0C,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,CAAC,GAAG,CACN,wBAAwB,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,mBAAmB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAC9G,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,EAAmB,EAAE,MAAc;QACvD,MAAM,WAAW,GAAG,8BAAsB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,WAAW,EAAE,CAAC;YACtC,wEAAwE;YACxE,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,GAAG,CACN,+BAA+B,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,MAAM,kBAAkB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,WAAW,GAAG,CAClJ,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,+BAA+B,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,KAAK,CACR,EAAE,CAAC,QAAQ,EACX,aAAa,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,MAAM,MAAM,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,IAAmB,EAAE,OAAe;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,cAAc,EAAE,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,uCAAuC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,+CAA+C,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAClC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1D,IAAI,CAAC,GAAG,CAAC,kDAAkD,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,8DAA8D,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAA6B;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,IAAY;QACtB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;CACF;AAhOD,8CAgOC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/operator/workorder-hooks.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Extracted, testable pieces of the Stage-2 per-kind completion hooks
+ * (plan S2-T3; extraction demanded by implementation review round 1 - the
+ * hook bodies lived in registerApiRoutes closures where nothing could prove
+ * them, which is the green-test-trap class the plan bans).
+ *
+ * - buildWorkerTraceQueries: the G1 re-keyed verifier trace queries. Worker
+ *   runs log gateway_tool_call rows with the worker's identity, NOT
+ *   agent_id='dashboard-agent'; the ONLY schema-supported key is the details
+ *   JSON (agent_activity has no channel_id column) - hence json_extract.
+ * - buildPromotionAfterHook: the PROMOTED <n> parse + event re-emission that
+ *   keeps the memory:promoted -> wiki ingress chain alive (plan E4/R7).
+ * - buildWikiAfterHook: outcome reading only.
+ */
+import type { SQLiteDatabase } from '../sqlite.js';
+import type { WorkOrderRecord } from './task-ledger.js';
+export interface WorkerTraceQueries {
+    getTraceMaxId: () => number;
+    countObligatedTraceRowsSince: (maxId: number) => number;
+}
+export declare function buildWorkerTraceQueries(sessionsDb: SQLiteDatabase | undefined, workerChannelId: string): WorkerTraceQueries;
+export interface PromotionHookEvents {
+    emitAgentAction: (action: 'promoted' | 'no_update', target: string) => void;
+    emitMemoryPromoted: (saved: number) => void;
+    log?: (line: string) => void;
+}
+/** The wiki ingress chain's second link: losing this parse severs memory:promoted. */
+export declare function buildPromotionAfterHook(events: PromotionHookEvents): (wo: WorkOrderRecord, response: string) => void;
+export declare function buildWikiAfterHook(log: (line: string) => void): (wo: WorkOrderRecord, response: string) => void;
+//# sourceMappingURL=workorder-hooks.d.ts.map

package/dist/operator/workorder-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder-hooks.d.ts","sourceRoot":"","sources":["../../src/operator/workorder-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIxD,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,4BAA4B,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACzD;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,cAAc,GAAG,SAAS,EACtC,eAAe,EAAE,MAAM,GACtB,kBAAkB,CA0BpB;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5E,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,sFAAsF;AACtF,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,mBAAmB,GAC1B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAcjD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAQjD"}

package/dist/operator/workorder-hooks.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * Extracted, testable pieces of the Stage-2 per-kind completion hooks
+ * (plan S2-T3; extraction demanded by implementation review round 1 - the
+ * hook bodies lived in registerApiRoutes closures where nothing could prove
+ * them, which is the green-test-trap class the plan bans).
+ *
+ * - buildWorkerTraceQueries: the G1 re-keyed verifier trace queries. Worker
+ *   runs log gateway_tool_call rows with the worker's identity, NOT
+ *   agent_id='dashboard-agent'; the ONLY schema-supported key is the details
+ *   JSON (agent_activity has no channel_id column) - hence json_extract.
+ * - buildPromotionAfterHook: the PROMOTED <n> parse + event re-emission that
+ *   keeps the memory:promoted -> wiki ingress chain alive (plan E4/R7).
+ * - buildWikiAfterHook: outcome reading only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildWorkerTraceQueries = buildWorkerTraceQueries;
+exports.buildPromotionAfterHook = buildPromotionAfterHook;
+exports.buildWikiAfterHook = buildWikiAfterHook;
+const action_verifier_js_1 = require("./action-verifier.js");
+const TRACE_TOOL_LIST = action_verifier_js_1.OBLIGATED_TOOLS.map((t) => `'${t}'`).join(',');
+function buildWorkerTraceQueries(sessionsDb, workerChannelId) {
+    return {
+        getTraceMaxId: () => {
+            if (!sessionsDb)
+                return 0;
+            const row = sessionsDb
+                .prepare(`SELECT MAX(id) AS max_id FROM agent_activity
+           WHERE type = 'gateway_tool_call'
+             AND json_extract(details, '$.channel_id') = ?`)
+                .get(workerChannelId);
+            return row.max_id ?? 0;
+        },
+        countObligatedTraceRowsSince: (maxId) => {
+            if (!sessionsDb)
+                return 0;
+            const row = sessionsDb
+                .prepare(`SELECT COUNT(*) AS n FROM agent_activity
+           WHERE type = 'gateway_tool_call'
+             AND json_extract(details, '$.channel_id') = ?
+             AND id > ? AND (normalized_tool_name IN (${TRACE_TOOL_LIST}) OR input_summary IN (${TRACE_TOOL_LIST}))`)
+                .get(workerChannelId, maxId);
+            return row.n;
+        },
+    };
+}
+/** The wiki ingress chain's second link: losing this parse severs memory:promoted. */
+function buildPromotionAfterHook(events) {
+    return (_wo, response) => {
+        const promotedMatch = response.match(/PROMOTED\s+(\d+)/);
+        const saved = promotedMatch ? Number(promotedMatch[1]) : 0;
+        const noUpdate = response.includes('NO_UPDATE');
+        events.emitAgentAction(noUpdate || saved === 0 ? 'no_update' : 'promoted', `promotion run: ${saved} saved`);
+        if (saved > 0) {
+            events.emitMemoryPromoted(saved);
+            events.log?.(`[stage2] promotion worker: promoted ${saved} durable judgments`);
+        }
+    };
+}
+function buildWikiAfterHook(log) {
+    return (_wo, response) => {
+        if (response.includes('NO_UPDATE')) {
+            log('[stage2] wiki worker: no changes detected');
+        }
+        else {
+            log('[stage2] wiki worker: compilation complete');
+        }
+    };
+}
+//# sourceMappingURL=workorder-hooks.js.map

package/dist/operator/workorder-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder-hooks.js","sourceRoot":"","sources":["../../src/operator/workorder-hooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAaH,0DA6BC;AASD,0DAgBC;AAED,gDAUC;AA5ED,6DAAuD;AAGvD,MAAM,eAAe,GAAG,oCAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAOvE,SAAgB,uBAAuB,CACrC,UAAsC,EACtC,eAAuB;IAEvB,OAAO;QACL,aAAa,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,UAAU;iBACnB,OAAO,CACN;;2DAEiD,CAClD;iBACA,GAAG,CAAC,eAAe,CAA8B,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,4BAA4B,EAAE,CAAC,KAAa,EAAE,EAAE;YAC9C,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,UAAU;iBACnB,OAAO,CACN;;;wDAG8C,eAAe,0BAA0B,eAAe,IAAI,CAC3G;iBACA,GAAG,CAAC,eAAe,EAAE,KAAK,CAAkB,CAAC;YAChD,OAAO,GAAG,CAAC,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,sFAAsF;AACtF,SAAgB,uBAAuB,CACrC,MAA2B;IAE3B,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;QACvB,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,CAAC,eAAe,CACpB,QAAQ,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAClD,kBAAkB,KAAK,QAAQ,CAChC,CAAC;QACF,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,EAAE,CAAC,uCAAuC,KAAK,oBAAoB,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,GAA2B;IAE3B,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;QACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/operator/workorder-publishers.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Stage-2 publisher gate: pure decision + key/payload contracts for converting
+ * the three system-agent run paths (dashboard/wiki/promotion) and the
+ * reconcile leg into workorder enqueues.
+ *
+ * The gate decision is a PURE function (plan E5) so every flag x kind combo is
+ * unit-testable outside the api-routes-init closures. The wiring sites call
+ * resolvePublishAction and act on 'legacy' | 'enqueue' | 'both'.
+ *
+ * Flag: MAMA_STAGE2_WORKORDERS=off|shadow|on (tri-state; deliberate deviation
+ * from the repo's `=== '1'` convention - documented in configuration-options).
+ *   off    - legacy direct runs (current behavior)
+ *   shadow - board ONLY dual-runs: legacy keeps publishing live AND the same
+ *            occurrence is enqueued for the capture consumer. wiki/promotion
+ *            stay pure legacy - their side effects (Obsidian writes, mama_save)
+ *            have no capture seam and must never double-execute (plan B1/C2).
+ *   on     - all three kinds (and the reconcile leg) enqueue; legacy stops.
+ *
+ * Plan: docs/superpowers/plans/2026-07-18-stage2-workorder-ownership.md S2-T2
+ */
+import type { WorkOrderKind } from './task-ledger.js';
+export declare const STAGE2_FLAG_ENV = "MAMA_STAGE2_WORKORDERS";
+export declare const STAGE2_FLAGS: readonly ["off", "shadow", "on"];
+export type Stage2Flag = (typeof STAGE2_FLAGS)[number];
+export type PublishAction = 'legacy' | 'enqueue' | 'both';
+/**
+ * Parse the tri-state flag. Absent/empty -> 'off'. Any other value is a
+ * misconfiguration and throws at boot (no-fallback: a typo silently reverting
+ * to legacy would mask a believed-active migration).
+ */
+export declare function readStage2Flag(env?: NodeJS.ProcessEnv): Stage2Flag;
+/** Pure gate decision for the three scheduled/boot/manual run paths. */
+export declare function resolvePublishAction(flag: Stage2Flag, kind: WorkOrderKind): PublishAction;
+/**
+ * The reconcile leg converts at 'on' ONLY (plan: shadow/off keep the legacy
+ * bracket-verified path; its verification moves to the consumer hook at 'on').
+ */
+export declare function resolveReconcileAction(flag: Stage2Flag): 'legacy' | 'enqueue';
+export declare function boardFullKey(now: number): string;
+/** Manual/forced orders get their own key (plan M2): a forced refresh must
+ *  never dedup against a pending scheduled FULL that lacks force. */
+export declare function boardManualKey(now: number): string;
+export declare function boardReconcileKey(channelKey: string, now: number): string;
+export declare function wikiBatchKey(trigger: string, now: number): string;
+export declare function promotionKey(now: number): string;
+export declare function promotionManualKey(now: number): string;
+export interface BoardPayload {
+    mode: 'full' | 'reconcile';
+    /** Owner-forced refresh: brief must publish even on NO_UPDATE. */
+    force?: boolean;
+    channelKey?: string;
+    deltaLines?: string[];
+}
+export interface WikiPayload {
+    batchId: string;
+    /** Trigger provenance; the run does its own novelty check, events carry no content. */
+    events: string[];
+}
+export interface PromotionPayload {
+    scheduledAt: string;
+}
+/**
+ * Validate a payload at enqueue time. Unknown fields are rejected LOUDLY -
+ * a misspelled field silently dropped would surface as a wrong run later.
+ * (`attempts` is ledger-managed and allowed everywhere.)
+ */
+export declare function validateWorkOrderPayload(kind: WorkOrderKind, payload: Record<string, unknown>): void;
+//# sourceMappingURL=workorder-publishers.d.ts.map

package/dist/operator/workorder-publishers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder-publishers.d.ts","sourceRoot":"","sources":["../../src/operator/workorder-publishers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,eAAO,MAAM,YAAY,kCAAmC,CAAC;AAC7D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAS/E;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,CAKzF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAE7E;AAUD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;qEACqE;AACrE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAOzE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,IAAI,CA2CN"}

package/dist/operator/workorder-publishers.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * Stage-2 publisher gate: pure decision + key/payload contracts for converting
+ * the three system-agent run paths (dashboard/wiki/promotion) and the
+ * reconcile leg into workorder enqueues.
+ *
+ * The gate decision is a PURE function (plan E5) so every flag x kind combo is
+ * unit-testable outside the api-routes-init closures. The wiring sites call
+ * resolvePublishAction and act on 'legacy' | 'enqueue' | 'both'.
+ *
+ * Flag: MAMA_STAGE2_WORKORDERS=off|shadow|on (tri-state; deliberate deviation
+ * from the repo's `=== '1'` convention - documented in configuration-options).
+ *   off    - legacy direct runs (current behavior)
+ *   shadow - board ONLY dual-runs: legacy keeps publishing live AND the same
+ *            occurrence is enqueued for the capture consumer. wiki/promotion
+ *            stay pure legacy - their side effects (Obsidian writes, mama_save)
+ *            have no capture seam and must never double-execute (plan B1/C2).
+ *   on     - all three kinds (and the reconcile leg) enqueue; legacy stops.
+ *
+ * Plan: docs/superpowers/plans/2026-07-18-stage2-workorder-ownership.md S2-T2
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAGE2_FLAGS = exports.STAGE2_FLAG_ENV = void 0;
+exports.readStage2Flag = readStage2Flag;
+exports.resolvePublishAction = resolvePublishAction;
+exports.resolveReconcileAction = resolveReconcileAction;
+exports.boardFullKey = boardFullKey;
+exports.boardManualKey = boardManualKey;
+exports.boardReconcileKey = boardReconcileKey;
+exports.wikiBatchKey = wikiBatchKey;
+exports.promotionKey = promotionKey;
+exports.promotionManualKey = promotionManualKey;
+exports.validateWorkOrderPayload = validateWorkOrderPayload;
+exports.STAGE2_FLAG_ENV = 'MAMA_STAGE2_WORKORDERS';
+exports.STAGE2_FLAGS = ['off', 'shadow', 'on'];
+/**
+ * Parse the tri-state flag. Absent/empty -> 'off'. Any other value is a
+ * misconfiguration and throws at boot (no-fallback: a typo silently reverting
+ * to legacy would mask a believed-active migration).
+ */
+function readStage2Flag(env = process.env) {
+    const raw = (env[exports.STAGE2_FLAG_ENV] ?? '').trim();
+    if (raw === '') {
+        return 'off';
+    }
+    if (exports.STAGE2_FLAGS.includes(raw))
+        return raw;
+    throw new Error(`${exports.STAGE2_FLAG_ENV} must be one of ${exports.STAGE2_FLAGS.join('|')} (or unset), got: '${raw}'`);
+}
+/** Pure gate decision for the three scheduled/boot/manual run paths. */
+function resolvePublishAction(flag, kind) {
+    if (flag === 'off')
+        return 'legacy';
+    if (flag === 'on')
+        return 'enqueue';
+    // shadow: board dual-runs; wiki/promotion must not leak uncaptured writes.
+    return kind === 'board' ? 'both' : 'legacy';
+}
+/**
+ * The reconcile leg converts at 'on' ONLY (plan: shadow/off keep the legacy
+ * bracket-verified path; its verification moves to the consumer hook at 'on').
+ */
+function resolveReconcileAction(flag) {
+    return flag === 'on' ? 'enqueue' : 'legacy';
+}
+// ── Occurrence keys (plan D5/M2) ──────────────────────────────────────────
+// Keys identify one OCCURRENCE: same scheduled slot dedups against itself,
+// the next slot (or any manual request) mints a fresh key. Terminal rows free
+// their key (ledger index predicate), so retries insert fresh rows.
+const BOARD_SLOT_MS = 30 * 60 * 1000;
+const PROMOTION_SLOT_MS = 6 * 60 * 60 * 1000;
+function boardFullKey(now) {
+    return `board:full:${Math.floor(now / BOARD_SLOT_MS)}`;
+}
+/** Manual/forced orders get their own key (plan M2): a forced refresh must
+ *  never dedup against a pending scheduled FULL that lacks force. */
+function boardManualKey(now) {
+    return `board:manual:${now}`;
+}
+function boardReconcileKey(channelKey, now) {
+    // Timestamp, not slot (PR bot round): distinct reconciles for one channel
+    // can fire within a 30-min window carrying DIFFERENT deltas - a slot key
+    // would dedup the later one against the open earlier row and drop its
+    // delta. The ReconcileScheduler's debounce is the coalescing layer; each
+    // scheduler fire is its own occurrence.
+    return `board:reconcile:${channelKey}:${now}`;
+}
+function wikiBatchKey(trigger, now) {
+    return `wiki:${now}-${trigger}`;
+}
+function promotionKey(now) {
+    return `promotion:${Math.floor(now / PROMOTION_SLOT_MS)}`;
+}
+function promotionManualKey(now) {
+    return `promotion:manual:${now}`;
+}
+const PAYLOAD_KEYS = {
+    board: ['mode', 'force', 'channelKey', 'deltaLines'],
+    wiki: ['batchId', 'events'],
+    'memory-curation': ['scheduledAt'],
+};
+/**
+ * Validate a payload at enqueue time. Unknown fields are rejected LOUDLY -
+ * a misspelled field silently dropped would surface as a wrong run later.
+ * (`attempts` is ledger-managed and allowed everywhere.)
+ */
+function validateWorkOrderPayload(kind, payload) {
+    const allowed = PAYLOAD_KEYS[kind];
+    for (const key of Object.keys(payload)) {
+        if (key !== 'attempts' && !allowed.includes(key)) {
+            throw new Error(`workorder payload (${kind}): unknown field '${key}'`);
+        }
+    }
+    if (kind === 'board') {
+        const mode = payload.mode;
+        if (mode !== 'full' && mode !== 'reconcile') {
+            throw new Error(`workorder payload (board): mode must be 'full'|'reconcile', got: ${String(mode)}`);
+        }
+        if (payload.force !== undefined && typeof payload.force !== 'boolean') {
+            throw new Error(`workorder payload (board): force must be a boolean`);
+        }
+        if (mode === 'reconcile') {
+            if (typeof payload.channelKey !== 'string' || payload.channelKey === '') {
+                throw new Error(`workorder payload (board reconcile): channelKey required`);
+            }
+            if (!Array.isArray(payload.deltaLines) || payload.deltaLines.length === 0) {
+                throw new Error(`workorder payload (board reconcile): non-empty deltaLines[] required`);
+            }
+        }
+        else if (payload.channelKey !== undefined || payload.deltaLines !== undefined) {
+            // Reconcile-only fields on a full run signal a caller bug - loud.
+            throw new Error(`workorder payload (board full): channelKey/deltaLines are reconcile-only`);
+        }
+    }
+    else if (kind === 'wiki') {
+        if (typeof payload.batchId !== 'string' || payload.batchId === '') {
+            throw new Error(`workorder payload (wiki): batchId required`);
+        }
+        if (!Array.isArray(payload.events) ||
+            payload.events.some((entry) => typeof entry !== 'string')) {
+            throw new Error(`workorder payload (wiki): events[] of strings required`);
+        }
+    }
+    else {
+        if (typeof payload.scheduledAt !== 'string' || payload.scheduledAt === '') {
+            throw new Error(`workorder payload (memory-curation): scheduledAt required`);
+        }
+    }
+}
+//# sourceMappingURL=workorder-publishers.js.map

package/dist/operator/workorder-publishers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workorder-publishers.js","sourceRoot":"","sources":["../../src/operator/workorder-publishers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAgBH,wCASC;AAGD,oDAKC;AAMD,wDAEC;AAUD,oCAEC;AAID,wCAEC;AAED,8CAOC;AAED,oCAEC;AAED,oCAEC;AAED,gDAEC;AAiCD,4DA8CC;AA3JY,QAAA,eAAe,GAAG,wBAAwB,CAAC;AAE3C,QAAA,YAAY,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAK7D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,uBAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAK,oBAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAiB,CAAC;IAChF,MAAM,IAAI,KAAK,CACb,GAAG,uBAAe,mBAAmB,oBAAY,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,GAAG,CACxF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAgB,oBAAoB,CAAC,IAAgB,EAAE,IAAmB;IACxE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,2EAA2E;IAC3E,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,IAAgB;IACrD,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,oEAAoE;AAEpE,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAgB,YAAY,CAAC,GAAW;IACtC,OAAO,cAAc,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;qEACqE;AACrE,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,gBAAgB,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAgB,iBAAiB,CAAC,UAAkB,EAAE,GAAW;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,OAAO,mBAAmB,UAAU,IAAI,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,SAAgB,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,OAAO,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAgB,YAAY,CAAC,GAAW;IACtC,OAAO,aAAa,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,OAAO,oBAAoB,GAAG,EAAE,CAAC;AACnC,CAAC;AAsBD,MAAM,YAAY,GAA6C;IAC7D,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC;IACpD,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC3B,iBAAiB,EAAE,CAAC,aAAa,CAAC;CACnC,CAAC;AAEF;;;;GAIG;AACH,SAAgB,wBAAwB,CACtC,IAAmB,EACnB,OAAgC;IAEhC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,qBAAqB,GAAG,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChF,kEAAkE;YAClE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/security/security-monitor.d.ts

@@ -29,6 +29,13 @@ declare function getCloudflareCustomListCsvPath(): string;
 declare function getCloudflareWafExpressionPath(): string;
 export declare function setSecurityAlertSender(sender: SecurityAlertSender | null): void;
 export declare function hasSecurityAlertSender(): boolean;
+/**
+ * Record-only security event: appends to the security log (durable trail,
+ * surfaced by the code audit) and NOTHING else - no incident/denylist/RDAP
+ * fabrication (PR #151 lesson), no alert cooldown consumption, no throw when
+ * no sender is registered. For tripwires whose job is observability.
+ */
+export declare function logSecurityEventOnly(event: SecurityEvent): void;
 /**
  * Deliver an alert through the registered sender WITHOUT the incident pipeline.
  *

package/dist/security/security-monitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-monitor.d.ts","sourceRoot":"","sources":["../../src/security/security-monitor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAuD/D,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAO5E;AAED,wBAAgB,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CASjE;AAED,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAuBhF;AAiBD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAaD,KAAK,mBAAmB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAgHnE,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAcjF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD;AA0OD,iBAAS,kBAAkB,IAAI,MAAM,CAEpC;AAED,iBAAS,iBAAiB,IAAI,MAAM,CAEnC;AAED,iBAAS,mBAAmB,IAAI,MAAM,CAErC;AAED,iBAAS,kBAAkB,IAAI,MAAM,CAEpC;AAED,iBAAS,8BAA8B,IAAI,MAAM,CAEhD;AAED,iBAAS,8BAA8B,IAAI,MAAM,CAEhD;AAuND,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAK/E;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrF;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CASnD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK1D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAmChE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAoC9D;AAED,wBAAgB,wBAAwB,KACxB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAgD9E;AAED,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,CAAC"}
+{"version":3,"file":"security-monitor.d.ts","sourceRoot":"","sources":["../../src/security/security-monitor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAuD/D,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAO5E;AAED,wBAAgB,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CASjE;AAED,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAuBhF;AAiBD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAaD,KAAK,mBAAmB,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAgHnE,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAcjF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD;AA0OD,iBAAS,kBAAkB,IAAI,MAAM,CAEpC;AAED,iBAAS,iBAAiB,IAAI,MAAM,CAEnC;AAED,iBAAS,mBAAmB,IAAI,MAAM,CAErC;AAED,iBAAS,kBAAkB,IAAI,MAAM,CAEpC;AAED,iBAAS,8BAA8B,IAAI,MAAM,CAEhD;AAED,iBAAS,8BAA8B,IAAI,MAAM,CAEhD;AAuND,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAK/E;AAED,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAW/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrF;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CASnD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK1D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAmChE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAoC9D;AAED,wBAAgB,wBAAwB,KACxB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAgD9E;AAED,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,CAAC"}