@kya-os/cli 1.8.1 → 1.8.3

package/dist/orchestrator/db/liveness.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Daemon liveness.
+ *
+ * Answers one question: is the single writer of this ledger still running? That
+ * matters because everything else here is designed around there being exactly
+ * one. A TUI showing tickets from a ledger whose daemon died an hour ago looks
+ * identical to one showing a quiet system, and the difference is whether
+ * anything is still being recorded.
+ *
+ * Staleness is decided by the READER, not stored. A row cannot know it has gone
+ * stale, and a daemon that dies cannot write "I died" -- which is the whole
+ * reason liveness is a timestamp to compare against rather than a status field
+ * to trust.
+ *
+ * @module cli/orchestrator/db/liveness
+ */
+import { z } from "zod";
+import type { Ledger } from "./index.js";
+export declare const LivenessRowSchema: z.ZodObject<{
+    id: z.ZodLiteral<"daemon">;
+    started_at: z.ZodString;
+    last_beat_at: z.ZodString;
+    pid: z.ZodNullable<z.ZodNumber>;
+    host: z.ZodNullable<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    id: "daemon";
+    host: string | null;
+    started_at: string;
+    last_beat_at: string;
+    pid: number | null;
+}, {
+    id: "daemon";
+    host: string | null;
+    started_at: string;
+    last_beat_at: string;
+    pid: number | null;
+}>;
+export type LivenessRow = z.infer<typeof LivenessRowSchema>;
+export interface BeatInput {
+    /** Set on the first beat of a run; later beats leave it alone. */
+    startedAt?: string;
+    pid?: number;
+    host?: string;
+}
+/**
+ * Record a beat.
+ *
+ * Upserts the single row. `started_at` is preserved across beats within a run,
+ * so the pair (started_at, last_beat_at) tells a reader both how long the daemon
+ * has been up and how recently it was alive. Overwriting started_at on every
+ * beat would collapse those into one useless number.
+ */
+export declare function beat(db: Ledger, input?: BeatInput): LivenessRow;
+/** The current liveness row, or undefined if no daemon has ever run. */
+export declare function readLiveness(db: Ledger): LivenessRow | undefined;
+/**
+ * Erase the liveness row.
+ *
+ * Called on a GRACEFUL stop, and only then. A daemon that crashes cannot
+ * write "I died" -- the entire reason staleness exists as a concept -- but
+ * one that stops on purpose can, and should: without this, a fresh restart
+ * inside the staleness window would find its OWN last beat still looking
+ * recent and could mistake it for a still-live second writer.
+ */
+export declare function clearLiveness(db: Ledger): void;
+/**
+ * Is a process with this pid currently running?
+ *
+ * `process.kill(pid, 0)` sends no signal; it only asks the OS whether the pid
+ * exists and is reachable. ESRCH means it does not. EPERM means it does, just
+ * owned by someone else, which still counts as alive for this purpose. Any
+ * other failure is treated as "cannot tell", which conservatively answers
+ * alive rather than letting a shaky syscall clear a check it should not.
+ */
+export declare function isProcessAlive(pid: number): boolean;
+/** How long a daemon may go quiet before a reader should stop trusting it. */
+export declare const DEFAULT_STALE_AFTER_MS = 90000;
+export interface LivenessVerdict {
+    /** Absent means no daemon has ever run against this ledger. */
+    present: boolean;
+    stale: boolean;
+    /** Milliseconds since the last beat, or null when there is no row. */
+    ageMs: number | null;
+}
+/**
+ * Judge a liveness row against a clock.
+ *
+ * Takes `now` rather than reading the clock itself so a caller can test the
+ * boundary, and so a TUI rendering a snapshot judges against the time it
+ * rendered rather than drifting as it sits open.
+ *
+ * A row whose timestamp does not parse counts as STALE, not fresh: an
+ * unreadable beat is not evidence of life, and defaulting the other way would
+ * report a corrupt row as a healthy daemon.
+ */
+export declare function judgeLiveness(row: LivenessRow | undefined, now: number, staleAfterMs?: number): LivenessVerdict;
+//# sourceMappingURL=liveness.d.ts.map

package/dist/orchestrator/db/liveness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveness.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/db/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;EAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,WAAW,SAAS;IACxB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,GAAE,SAAc,GAAG,WAAW,CAcnE;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAIhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,sEAAsE;IACtE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,WAAW,GAAG,SAAS,EAC5B,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,MAA+B,GAC5C,eAAe,CAMjB"}

package/dist/orchestrator/db/liveness.js

@@ -0,0 +1,105 @@
+/**
+ * Daemon liveness.
+ *
+ * Answers one question: is the single writer of this ledger still running? That
+ * matters because everything else here is designed around there being exactly
+ * one. A TUI showing tickets from a ledger whose daemon died an hour ago looks
+ * identical to one showing a quiet system, and the difference is whether
+ * anything is still being recorded.
+ *
+ * Staleness is decided by the READER, not stored. A row cannot know it has gone
+ * stale, and a daemon that dies cannot write "I died" -- which is the whole
+ * reason liveness is a timestamp to compare against rather than a status field
+ * to trust.
+ *
+ * @module cli/orchestrator/db/liveness
+ */
+import { z } from "zod";
+export const LivenessRowSchema = z.object({
+    id: z.literal("daemon"),
+    started_at: z.string(),
+    last_beat_at: z.string(),
+    pid: z.number().nullable(),
+    host: z.string().nullable(),
+});
+/**
+ * Record a beat.
+ *
+ * Upserts the single row. `started_at` is preserved across beats within a run,
+ * so the pair (started_at, last_beat_at) tells a reader both how long the daemon
+ * has been up and how recently it was alive. Overwriting started_at on every
+ * beat would collapse those into one useless number.
+ */
+export function beat(db, input = {}) {
+    const now = new Date().toISOString();
+    db.prepare(`INSERT INTO daemon_liveness (id, started_at, last_beat_at, pid, host)
+     VALUES ('daemon', ?, ?, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       last_beat_at = excluded.last_beat_at,
+       pid          = excluded.pid,
+       host         = excluded.host,
+       -- Only advance started_at when the caller declares a new run. A plain
+       -- beat must not look like a restart.
+       started_at   = COALESCE(?, daemon_liveness.started_at)`).run(input.startedAt ?? now, now, input.pid ?? null, input.host ?? null, input.startedAt ?? null);
+    return readLiveness(db);
+}
+/** The current liveness row, or undefined if no daemon has ever run. */
+export function readLiveness(db) {
+    const row = db.prepare(`SELECT * FROM daemon_liveness WHERE id = 'daemon'`).get();
+    if (row === undefined || row === null)
+        return undefined;
+    return LivenessRowSchema.parse(row);
+}
+/**
+ * Erase the liveness row.
+ *
+ * Called on a GRACEFUL stop, and only then. A daemon that crashes cannot
+ * write "I died" -- the entire reason staleness exists as a concept -- but
+ * one that stops on purpose can, and should: without this, a fresh restart
+ * inside the staleness window would find its OWN last beat still looking
+ * recent and could mistake it for a still-live second writer.
+ */
+export function clearLiveness(db) {
+    db.prepare(`DELETE FROM daemon_liveness WHERE id = 'daemon'`).run();
+}
+/**
+ * Is a process with this pid currently running?
+ *
+ * `process.kill(pid, 0)` sends no signal; it only asks the OS whether the pid
+ * exists and is reachable. ESRCH means it does not. EPERM means it does, just
+ * owned by someone else, which still counts as alive for this purpose. Any
+ * other failure is treated as "cannot tell", which conservatively answers
+ * alive rather than letting a shaky syscall clear a check it should not.
+ */
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code !== "ESRCH";
+    }
+}
+/** How long a daemon may go quiet before a reader should stop trusting it. */
+export const DEFAULT_STALE_AFTER_MS = 90000;
+/**
+ * Judge a liveness row against a clock.
+ *
+ * Takes `now` rather than reading the clock itself so a caller can test the
+ * boundary, and so a TUI rendering a snapshot judges against the time it
+ * rendered rather than drifting as it sits open.
+ *
+ * A row whose timestamp does not parse counts as STALE, not fresh: an
+ * unreadable beat is not evidence of life, and defaulting the other way would
+ * report a corrupt row as a healthy daemon.
+ */
+export function judgeLiveness(row, now, staleAfterMs = DEFAULT_STALE_AFTER_MS) {
+    if (row === undefined)
+        return { present: false, stale: true, ageMs: null };
+    const beatAt = Date.parse(row.last_beat_at);
+    if (!Number.isFinite(beatAt))
+        return { present: true, stale: true, ageMs: null };
+    const ageMs = now - beatAt;
+    return { present: true, stale: ageMs > staleAfterMs, ageMs };
+}
+//# sourceMappingURL=liveness.js.map

package/dist/orchestrator/db/liveness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveness.js","sourceRoot":"","sources":["../../../src/orchestrator/db/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,EAAU,EAAE,QAAmB,EAAE;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,EAAE,CAAC,OAAO,CACR;;;;;;;;8DAQ0D,CAC3D,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACnG,OAAO,YAAY,CAAC,EAAE,CAAE,CAAC;AAC3B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,EAAE,CAAC;IAClF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAM,CAAC;AAU7C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,GAA4B,EAC5B,GAAW,EACX,eAAuB,sBAAsB;IAE7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,GAAG,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,YAAY,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC"}

package/dist/orchestrator/db/mission.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The mission note.
+ *
+ * One paragraph of standing intent that an orchestrator session reads on waking.
+ * The ledger records what happened in exhaustive mechanical detail; none of it
+ * says what the operator is trying to achieve. Without that, a session resuming
+ * after a gap has to infer intent from a list of dispatches, and inferring
+ * intent is exactly the thing it will get confidently wrong.
+ *
+ * Append-only. Rewriting the note in place would lose the previous one, and
+ * changing the mission is a decision worth reading back later -- which is the
+ * same reason tickets soft-close instead of being deleted. The newest row is
+ * current; older rows are history.
+ *
+ * @module cli/orchestrator/db/mission
+ */
+import { z } from "zod";
+import type { Ledger } from "./index.js";
+export declare const MissionNoteSchema: z.ZodObject<{
+    id: z.ZodString;
+    body: z.ZodString;
+    author: z.ZodString;
+    written_at: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    body: string;
+    author: string;
+    written_at: string;
+}, {
+    id: string;
+    body: string;
+    author: string;
+    written_at: string;
+}>;
+export type MissionNote = z.infer<typeof MissionNoteSchema>;
+export interface WriteMissionNoteInput {
+    body: string;
+    /** Who set it: an operator's name, or an agent DID. */
+    author: string;
+}
+/**
+ * Append a mission note, making it current.
+ *
+ * Rejects an empty or whitespace-only body rather than storing it. A blank
+ * mission is worse than none: a session reading one has been told there IS a
+ * standing objective and handed nothing, which reads as an instruction to guess.
+ */
+export declare function writeMissionNote(db: Ledger, input: WriteMissionNoteInput): MissionNote;
+/**
+ * The current mission note, or undefined when none has been set.
+ *
+ * Ties break on rowid, meaning insertion order. written_at has millisecond
+ * resolution, so two notes set in quick succession share it, and the id is a
+ * random UUID -- tiebreaking on that returns whichever uuid happens to sort
+ * higher, so the OLDER note becomes "current" about half the time. This is the
+ * same trap as the dispatch lookup: an id that is not monotonic cannot stand in
+ * for one that is.
+ */
+export declare function currentMissionNote(db: Ledger): MissionNote | undefined;
+/** Every mission note, newest first. The history of what was being attempted. */
+export declare function listMissionNotes(db: Ledger, limit?: number): MissionNote[];
+/**
+ * Who to attribute a note to when the operator did not say.
+ *
+ * `os.userInfo()` rather than an environment variable: USER is POSIX-only and
+ * unset on Windows, where the equivalent is USERNAME, so defaulting to USER
+ * alone attributed every Windows note to "unknown" while the help text promised
+ * the shell user. userInfo reads the account directly on both.
+ *
+ * It throws when the uid has no entry in the password database -- some slim
+ * containers -- so the env vars remain a fallback rather than the source.
+ *
+ * `lookup` is injectable because otherwise the fallback is untestable on any
+ * machine where userInfo succeeds: the assertion passes via the real username
+ * and keeps passing with the fallback deleted.
+ */
+export declare function defaultAuthor(env?: NodeJS.ProcessEnv, lookup?: () => string): string;
+//# sourceMappingURL=mission.d.ts.map

package/dist/orchestrator/db/mission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/db/mission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,WAAW,CAetF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAMtE;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,WAAW,EAAE,CAKtE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,GAAE,MAAM,MAAkC,GAC/C,MAAM,CASR"}

package/dist/orchestrator/db/mission.js

@@ -0,0 +1,99 @@
+/**
+ * The mission note.
+ *
+ * One paragraph of standing intent that an orchestrator session reads on waking.
+ * The ledger records what happened in exhaustive mechanical detail; none of it
+ * says what the operator is trying to achieve. Without that, a session resuming
+ * after a gap has to infer intent from a list of dispatches, and inferring
+ * intent is exactly the thing it will get confidently wrong.
+ *
+ * Append-only. Rewriting the note in place would lose the previous one, and
+ * changing the mission is a decision worth reading back later -- which is the
+ * same reason tickets soft-close instead of being deleted. The newest row is
+ * current; older rows are history.
+ *
+ * @module cli/orchestrator/db/mission
+ */
+import { randomUUID } from "node:crypto";
+import { userInfo } from "node:os";
+import { z } from "zod";
+export const MissionNoteSchema = z.object({
+    id: z.string(),
+    body: z.string(),
+    author: z.string(),
+    written_at: z.string(),
+});
+/**
+ * Append a mission note, making it current.
+ *
+ * Rejects an empty or whitespace-only body rather than storing it. A blank
+ * mission is worse than none: a session reading one has been told there IS a
+ * standing objective and handed nothing, which reads as an instruction to guess.
+ */
+export function writeMissionNote(db, input) {
+    const body = input.body.trim();
+    if (body.length === 0) {
+        throw new Error("orchestrator: a mission note cannot be empty");
+    }
+    const author = input.author.trim();
+    if (author.length === 0) {
+        throw new Error("orchestrator: a mission note needs an author");
+    }
+    const id = randomUUID();
+    const writtenAt = new Date().toISOString();
+    db.prepare(`INSERT INTO mission_notes (id, body, author, written_at) VALUES (?, ?, ?, ?)`).run(id, body, author, writtenAt);
+    return { id, body, author, written_at: writtenAt };
+}
+/**
+ * The current mission note, or undefined when none has been set.
+ *
+ * Ties break on rowid, meaning insertion order. written_at has millisecond
+ * resolution, so two notes set in quick succession share it, and the id is a
+ * random UUID -- tiebreaking on that returns whichever uuid happens to sort
+ * higher, so the OLDER note becomes "current" about half the time. This is the
+ * same trap as the dispatch lookup: an id that is not monotonic cannot stand in
+ * for one that is.
+ */
+export function currentMissionNote(db) {
+    const row = db
+        .prepare(`SELECT * FROM mission_notes ORDER BY written_at DESC, rowid DESC LIMIT 1`)
+        .get();
+    if (row === undefined || row === null)
+        return undefined;
+    return MissionNoteSchema.parse(row);
+}
+/** Every mission note, newest first. The history of what was being attempted. */
+export function listMissionNotes(db, limit = 20) {
+    const rows = db
+        .prepare(`SELECT * FROM mission_notes ORDER BY written_at DESC, rowid DESC LIMIT ?`)
+        .all(limit);
+    return z.array(MissionNoteSchema).parse(rows);
+}
+/**
+ * Who to attribute a note to when the operator did not say.
+ *
+ * `os.userInfo()` rather than an environment variable: USER is POSIX-only and
+ * unset on Windows, where the equivalent is USERNAME, so defaulting to USER
+ * alone attributed every Windows note to "unknown" while the help text promised
+ * the shell user. userInfo reads the account directly on both.
+ *
+ * It throws when the uid has no entry in the password database -- some slim
+ * containers -- so the env vars remain a fallback rather than the source.
+ *
+ * `lookup` is injectable because otherwise the fallback is untestable on any
+ * machine where userInfo succeeds: the assertion passes via the real username
+ * and keeps passing with the fallback deleted.
+ */
+export function defaultAuthor(env = process.env, lookup = () => userInfo().username) {
+    try {
+        const name = lookup();
+        if (name)
+            return name;
+    }
+    catch {
+        // No passwd entry. Fall through: an env var or "unknown" is a better answer
+        // than failing to record the note at all.
+    }
+    return env["USER"] || env["USERNAME"] || "unknown";
+}
+//# sourceMappingURL=mission.js.map

package/dist/orchestrator/db/mission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission.js","sourceRoot":"","sources":["../../../src/orchestrator/db/mission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AASH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,KAA4B;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,EAAE,CAAC,OAAO,CACR,8EAA8E,CAC/E,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,0EAA0E,CAAC;SACnF,GAAG,EAAE,CAAC;IACT,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,KAAK,GAAG,EAAE;IACrD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,0EAA0E,CAAC;SACnF,GAAG,CAAC,KAAK,CAAC,CAAC;IACd,OAAO,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAyB,OAAO,CAAC,GAAG,EACpC,SAAuB,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;QACtB,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,0CAA0C;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;AACrD,CAAC"}

package/dist/orchestrator/db/schema.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Orchestrator ledger schema.
+ *
+ * Inlined as a TypeScript constant rather than shipped as a `.sql` asset.
+ * `@kya-os/cli` builds with a plain `tsc` chain that copies nothing, so a
+ * separate file would need a build step to place it beside the compiled
+ * output plus a runtime search to find it, and would fail only once, in a
+ * published artifact, after passing every local test. A template literal has
+ * none of those failure modes.
+ *
+ * @module cli/orchestrator/db/schema
+ */
+export declare const LEDGER_SCHEMA = "\n-- Two invariants are enforced here in SQL rather than in a prompt, because a\n-- prompt cannot be atomic and a language model cannot be relied on to check a\n-- precondition it was merely told about:\n--\n--   1. Claiming a ticket is one UPDATE (see db/tickets.ts claimNextTicket), so\n--      two orchestrator ticks, or two orchestrators against one ledger, cannot\n--      both staff the same ticket into two checkouts.\n--   2. There is no delete path. A bad autonomous close and a clean backlog are\n--      indistinguishable once the row is gone, so closing sets closed_reason\n--      and leaves the row selectable.\n\n-- Tickets: agent-native entries AND mirrored Linear issues in one table.\n--   linear_id NULL  -> agent-native. Surfaced for a human to promote by hand;\n--                      never auto-filed into Linear.\n--   linear_id set   -> mirrored. The agent may comment and move status on it,\n--                      and may never create one.\nCREATE TABLE IF NOT EXISTS tickets (\n  id             TEXT PRIMARY KEY,\n  linear_id      TEXT UNIQUE,\n  title          TEXT NOT NULL,\n  body           TEXT,\n  status         TEXT NOT NULL DEFAULT 'open',\n  severity       TEXT,\n  source         TEXT NOT NULL,\n  claimed_by     TEXT,\n  claimed_at     TEXT,\n  closed_reason  TEXT,\n  superseded_by  TEXT REFERENCES tickets(id),\n  created_at     TEXT NOT NULL,\n  updated_at     TEXT NOT NULL,\n  -- 'blocked' mirrors the DIDComm TaskStatus vocabulary and is the honest\n  -- resting place for work stalled on a human decision. Without it that\n  -- state has to be smuggled into prose, where nothing can query it.\n  CHECK (status IN ('open','claimed','in-progress','in-review','blocked','ready','closed')),\n  CHECK (severity IS NULL OR severity IN ('blocking','major','minor','nit')),\n  CHECK (source IN ('linear','log_scan','review_finding','manual')),\n  -- A ticket cannot supersede itself. Longer cycles are the store layer's\n  -- problem; this catches the trivial one for free.\n  CHECK (superseded_by IS NULL OR superseded_by <> id)\n);\nCREATE INDEX IF NOT EXISTS idx_tickets_status ON tickets(status);\nCREATE INDEX IF NOT EXISTS idx_tickets_linear ON tickets(linear_id);\n-- Serves the newest-first window listTickets takes before it re-sorts. See the\n-- note on idx_dispatches_dispatched: an unindexed ORDER BY makes the row cap\n-- bound the response without bounding the scan behind it.\nCREATE INDEX IF NOT EXISTS idx_tickets_created ON tickets(created_at DESC, id DESC);\n\n-- Journal: what the daemon OBSERVED, written from verified protocol events\n-- rather than from a model narrating its own behaviour.\n--\n-- event_type is TEXT, deliberately not a CHECK constraint: the hub's event\n-- union widens over time (review_verdict and pr_quorum_reached arrived with\n-- PR #661), and a ledger that rejects an event type it has not been taught is\n-- a ledger that loses exactly the events worth having.\nCREATE TABLE IF NOT EXISTS journal (\n  id          TEXT PRIMARY KEY,\n  ticket_id   TEXT REFERENCES tickets(id),\n  event_type  TEXT NOT NULL,\n  agent_did   TEXT,\n  agent_name  TEXT,\n  data        TEXT NOT NULL,\n  observed_at TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_journal_ticket ON journal(ticket_id, observed_at DESC);\nCREATE INDEX IF NOT EXISTS idx_journal_observed ON journal(observed_at DESC);\n\n-- Dispatches: one row per task handed to a worker.\nCREATE TABLE IF NOT EXISTS dispatches (\n  task_id       TEXT PRIMARY KEY,\n  ticket_id     TEXT NOT NULL REFERENCES tickets(id),\n  worker_did    TEXT NOT NULL,\n  repo          TEXT,\n  branch        TEXT,\n  pr_number     INTEGER,\n  status        TEXT NOT NULL,\n  dispatched_at TEXT NOT NULL,\n  completed_at  TEXT,\n  CHECK (status IN ('dispatched','in-progress','completed','failed'))\n);\nCREATE INDEX IF NOT EXISTS idx_dispatches_pr ON dispatches(repo, pr_number);\n-- Serves the newest-first read. Without it a capped list is a full scan plus a\n-- temp B-tree sort, so LIMIT bounds the answer while the work grows with a table\n-- nothing ever deletes from. The journal's idx_journal_observed exists for the\n-- same reason; these two were simply missed.\nCREATE INDEX IF NOT EXISTS idx_dispatches_dispatched\n  ON dispatches(dispatched_at DESC, task_id DESC);\n\n-- Verdicts: populated once the review loop is wired. Created now so that is a\n-- pure wire-up with no migration of its own.\n--\n-- The UNIQUE is what makes quorum counting idempotent under replay: one\n-- verdict per reviewer per head SHA, so a redelivered event updates rather\n-- than double-counts.\nCREATE TABLE IF NOT EXISTS verdicts (\n  id           TEXT PRIMARY KEY,\n  ticket_id    TEXT REFERENCES tickets(id),\n  repo         TEXT NOT NULL,\n  pr_number    INTEGER NOT NULL,\n  head_sha     TEXT NOT NULL,\n  reviewer_did TEXT NOT NULL,\n  verdict      TEXT NOT NULL,\n  findings     TEXT,\n  counted      INTEGER NOT NULL DEFAULT 0,\n  received_at  TEXT NOT NULL,\n  UNIQUE (repo, pr_number, head_sha, reviewer_did),\n  CHECK (verdict IN ('approve','request-changes','comment'))\n);\nCREATE INDEX IF NOT EXISTS idx_verdicts_pr ON verdicts(repo, pr_number, head_sha);\n\n-- Quorum reached, at the grain quorum actually has: a property of one PR head,\n-- not of a reviewer. It cannot live in the verdicts table, whose natural key\n-- includes reviewer_did. The hub is the authority on whether quorum was met: it\n-- owns verdict validation, so re-deriving the threshold here could disagree\n-- with it. Recording the hub's conclusion under its own natural key is what\n-- makes acting on it idempotent without a synthetic marker.\n-- Daemon liveness. Deliberately NOT called a heartbeat: compute already owns\n-- that word for agent liveness posted to AgentShield, which is a different\n-- process reporting a different thing to a different consumer. Conflating them\n-- would also drag the daemon toward compute, against the placement decision\n-- that keeps the single writer of this ledger out of a Fly worker's PID 1.\n--\n-- ONE row, replaced in place, and the only table here that is not append-only.\n-- Liveness is a current fact: \"is the daemon up\" has one answer, and a history\n-- of beats grows without bound while answering nothing the journal cannot.\nCREATE TABLE IF NOT EXISTS daemon_liveness (\n  id           TEXT PRIMARY KEY CHECK (id = 'daemon'),\n  started_at   TEXT NOT NULL,\n  last_beat_at TEXT NOT NULL,\n  pid          INTEGER,\n  host         TEXT\n);\n\n-- The standing objective an orchestrator session reads on waking, so it can\n-- resume intent rather than re-derive it from a ledger full of mechanics.\n--\n-- Append-only, unlike liveness: changing the mission IS a decision, and the\n-- previous one is worth being able to read back. Newest row is current.\nCREATE TABLE IF NOT EXISTS mission_notes (\n  id         TEXT PRIMARY KEY,\n  body       TEXT NOT NULL,\n  author     TEXT NOT NULL,\n  written_at TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_mission_written ON mission_notes(written_at DESC);\n\nCREATE TABLE IF NOT EXISTS pr_quorum (\n  repo        TEXT NOT NULL,\n  pr_number   INTEGER NOT NULL,\n  head_sha    TEXT NOT NULL,\n  ticket_id   TEXT REFERENCES tickets(id),\n  quorum_n    INTEGER,\n  reached_at  TEXT NOT NULL,\n  PRIMARY KEY (repo, pr_number, head_sha)\n);\n";
+//# sourceMappingURL=schema.d.ts.map

package/dist/orchestrator/db/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/db/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,aAAa,2qOA2JzB,CAAC"}

package/dist/orchestrator/db/schema.js

@@ -0,0 +1,169 @@
+/**
+ * Orchestrator ledger schema.
+ *
+ * Inlined as a TypeScript constant rather than shipped as a `.sql` asset.
+ * `@kya-os/cli` builds with a plain `tsc` chain that copies nothing, so a
+ * separate file would need a build step to place it beside the compiled
+ * output plus a runtime search to find it, and would fail only once, in a
+ * published artifact, after passing every local test. A template literal has
+ * none of those failure modes.
+ *
+ * @module cli/orchestrator/db/schema
+ */
+export const LEDGER_SCHEMA = `
+-- Two invariants are enforced here in SQL rather than in a prompt, because a
+-- prompt cannot be atomic and a language model cannot be relied on to check a
+-- precondition it was merely told about:
+--
+--   1. Claiming a ticket is one UPDATE (see db/tickets.ts claimNextTicket), so
+--      two orchestrator ticks, or two orchestrators against one ledger, cannot
+--      both staff the same ticket into two checkouts.
+--   2. There is no delete path. A bad autonomous close and a clean backlog are
+--      indistinguishable once the row is gone, so closing sets closed_reason
+--      and leaves the row selectable.
+
+-- Tickets: agent-native entries AND mirrored Linear issues in one table.
+--   linear_id NULL  -> agent-native. Surfaced for a human to promote by hand;
+--                      never auto-filed into Linear.
+--   linear_id set   -> mirrored. The agent may comment and move status on it,
+--                      and may never create one.
+CREATE TABLE IF NOT EXISTS tickets (
+  id             TEXT PRIMARY KEY,
+  linear_id      TEXT UNIQUE,
+  title          TEXT NOT NULL,
+  body           TEXT,
+  status         TEXT NOT NULL DEFAULT 'open',
+  severity       TEXT,
+  source         TEXT NOT NULL,
+  claimed_by     TEXT,
+  claimed_at     TEXT,
+  closed_reason  TEXT,
+  superseded_by  TEXT REFERENCES tickets(id),
+  created_at     TEXT NOT NULL,
+  updated_at     TEXT NOT NULL,
+  -- 'blocked' mirrors the DIDComm TaskStatus vocabulary and is the honest
+  -- resting place for work stalled on a human decision. Without it that
+  -- state has to be smuggled into prose, where nothing can query it.
+  CHECK (status IN ('open','claimed','in-progress','in-review','blocked','ready','closed')),
+  CHECK (severity IS NULL OR severity IN ('blocking','major','minor','nit')),
+  CHECK (source IN ('linear','log_scan','review_finding','manual')),
+  -- A ticket cannot supersede itself. Longer cycles are the store layer's
+  -- problem; this catches the trivial one for free.
+  CHECK (superseded_by IS NULL OR superseded_by <> id)
+);
+CREATE INDEX IF NOT EXISTS idx_tickets_status ON tickets(status);
+CREATE INDEX IF NOT EXISTS idx_tickets_linear ON tickets(linear_id);
+-- Serves the newest-first window listTickets takes before it re-sorts. See the
+-- note on idx_dispatches_dispatched: an unindexed ORDER BY makes the row cap
+-- bound the response without bounding the scan behind it.
+CREATE INDEX IF NOT EXISTS idx_tickets_created ON tickets(created_at DESC, id DESC);
+
+-- Journal: what the daemon OBSERVED, written from verified protocol events
+-- rather than from a model narrating its own behaviour.
+--
+-- event_type is TEXT, deliberately not a CHECK constraint: the hub's event
+-- union widens over time (review_verdict and pr_quorum_reached arrived with
+-- PR #661), and a ledger that rejects an event type it has not been taught is
+-- a ledger that loses exactly the events worth having.
+CREATE TABLE IF NOT EXISTS journal (
+  id          TEXT PRIMARY KEY,
+  ticket_id   TEXT REFERENCES tickets(id),
+  event_type  TEXT NOT NULL,
+  agent_did   TEXT,
+  agent_name  TEXT,
+  data        TEXT NOT NULL,
+  observed_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_journal_ticket ON journal(ticket_id, observed_at DESC);
+CREATE INDEX IF NOT EXISTS idx_journal_observed ON journal(observed_at DESC);
+
+-- Dispatches: one row per task handed to a worker.
+CREATE TABLE IF NOT EXISTS dispatches (
+  task_id       TEXT PRIMARY KEY,
+  ticket_id     TEXT NOT NULL REFERENCES tickets(id),
+  worker_did    TEXT NOT NULL,
+  repo          TEXT,
+  branch        TEXT,
+  pr_number     INTEGER,
+  status        TEXT NOT NULL,
+  dispatched_at TEXT NOT NULL,
+  completed_at  TEXT,
+  CHECK (status IN ('dispatched','in-progress','completed','failed'))
+);
+CREATE INDEX IF NOT EXISTS idx_dispatches_pr ON dispatches(repo, pr_number);
+-- Serves the newest-first read. Without it a capped list is a full scan plus a
+-- temp B-tree sort, so LIMIT bounds the answer while the work grows with a table
+-- nothing ever deletes from. The journal's idx_journal_observed exists for the
+-- same reason; these two were simply missed.
+CREATE INDEX IF NOT EXISTS idx_dispatches_dispatched
+  ON dispatches(dispatched_at DESC, task_id DESC);
+
+-- Verdicts: populated once the review loop is wired. Created now so that is a
+-- pure wire-up with no migration of its own.
+--
+-- The UNIQUE is what makes quorum counting idempotent under replay: one
+-- verdict per reviewer per head SHA, so a redelivered event updates rather
+-- than double-counts.
+CREATE TABLE IF NOT EXISTS verdicts (
+  id           TEXT PRIMARY KEY,
+  ticket_id    TEXT REFERENCES tickets(id),
+  repo         TEXT NOT NULL,
+  pr_number    INTEGER NOT NULL,
+  head_sha     TEXT NOT NULL,
+  reviewer_did TEXT NOT NULL,
+  verdict      TEXT NOT NULL,
+  findings     TEXT,
+  counted      INTEGER NOT NULL DEFAULT 0,
+  received_at  TEXT NOT NULL,
+  UNIQUE (repo, pr_number, head_sha, reviewer_did),
+  CHECK (verdict IN ('approve','request-changes','comment'))
+);
+CREATE INDEX IF NOT EXISTS idx_verdicts_pr ON verdicts(repo, pr_number, head_sha);
+
+-- Quorum reached, at the grain quorum actually has: a property of one PR head,
+-- not of a reviewer. It cannot live in the verdicts table, whose natural key
+-- includes reviewer_did. The hub is the authority on whether quorum was met: it
+-- owns verdict validation, so re-deriving the threshold here could disagree
+-- with it. Recording the hub's conclusion under its own natural key is what
+-- makes acting on it idempotent without a synthetic marker.
+-- Daemon liveness. Deliberately NOT called a heartbeat: compute already owns
+-- that word for agent liveness posted to AgentShield, which is a different
+-- process reporting a different thing to a different consumer. Conflating them
+-- would also drag the daemon toward compute, against the placement decision
+-- that keeps the single writer of this ledger out of a Fly worker's PID 1.
+--
+-- ONE row, replaced in place, and the only table here that is not append-only.
+-- Liveness is a current fact: "is the daemon up" has one answer, and a history
+-- of beats grows without bound while answering nothing the journal cannot.
+CREATE TABLE IF NOT EXISTS daemon_liveness (
+  id           TEXT PRIMARY KEY CHECK (id = 'daemon'),
+  started_at   TEXT NOT NULL,
+  last_beat_at TEXT NOT NULL,
+  pid          INTEGER,
+  host         TEXT
+);
+
+-- The standing objective an orchestrator session reads on waking, so it can
+-- resume intent rather than re-derive it from a ledger full of mechanics.
+--
+-- Append-only, unlike liveness: changing the mission IS a decision, and the
+-- previous one is worth being able to read back. Newest row is current.
+CREATE TABLE IF NOT EXISTS mission_notes (
+  id         TEXT PRIMARY KEY,
+  body       TEXT NOT NULL,
+  author     TEXT NOT NULL,
+  written_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_mission_written ON mission_notes(written_at DESC);
+
+CREATE TABLE IF NOT EXISTS pr_quorum (
+  repo        TEXT NOT NULL,
+  pr_number   INTEGER NOT NULL,
+  head_sha    TEXT NOT NULL,
+  ticket_id   TEXT REFERENCES tickets(id),
+  quorum_n    INTEGER,
+  reached_at  TEXT NOT NULL,
+  PRIMARY KEY (repo, pr_number, head_sha)
+);
+`;
+//# sourceMappingURL=schema.js.map

package/dist/orchestrator/db/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/orchestrator/db/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2J5B,CAAC"}