@lazyingart/agintiflow 0.20.331 → 0.20.336-integration.2

package/examples/document-worker/README.md

@@ -0,0 +1,84 @@
+# Workstation document worker example
+
+This example is deployment input, not an installed service. It deliberately
+starts in the read/delete rollback floor with `creation.enabled=false`.
+Readiness, staged-receipt commit, content reads, and two-phase delete remain
+available; only new compile requests return `WORKER_CREATION_DISABLED` (503).
+
+The fixed application listener is `127.0.0.1:18102`. LazyEdge is the only
+intended caller and injects the distinct upstream application bearer. Store the
+same bare upstream capability in a protected LazyEdge worker binding file and
+in the root-owned, mode `0400`, non-symlink systemd credential source:
+
+`/etc/agintiflow/credentials/document-worker-upstream-token`
+
+The service receives it only through systemd at:
+
+`/run/credentials/aginti-document-worker.service/document-worker-upstream-token`
+
+Do not put that value in the JSON config, an environment variable, an argument,
+logs, documentation, or Git. The dedicated `aginti-document-worker` user/group,
+selected release path, config, and credential must be created by a reviewed
+deployment step; this example does not create them. Before installing the unit,
+deployment must replace `RELEASE_SHA256` with the exact lowercase SHA-256 release
+identifier. No mutable `current` entry is permitted beside `releases` and
+`runtimes` under `/opt/agintiflow-document-worker`.
+The root-only installer creates the mode `0755` `releases` child and performs
+each no-replace release rename inside that child; the application root itself
+can remain frozen at mode `0555` throughout staging.
+
+The unit never executes the workstation's `/usr/bin/node` or a user-owned Node
+path. A reviewed root bootstrap first verifies the versioned Node 22.21.0
+source, then installs the exact binary at the immutable `/opt` path recorded in
+`runtime-manifest.json`. The binary and its four application runtime
+directories are all `root:root` mode `0555`; `/` and `/opt` remain `root:root`
+mode `0755`. `ProtectHome=tmpfs` therefore needs no home-directory exception.
+Before enable, deployment must verify the version, SHA-256, ownership, mode,
+size, ancestry, and exact runtime inventories, then run both the CLI check and
+real bwrap/latexmk/qpdf activation canary under the installed unit.
+Both `ExecStartPre` checks and `ExecStart` use that same immutable Node. The
+worker repeats the no-follow identity, hash, stable-ancestry, and inventory
+checks after exec and fails unless it is running from that exact path as the
+non-root service user/group. Thus a later automatic restart does not trust
+deployment-time evidence alone.
+The second `ExecStartPre` is the exact mode-aware in-unit `check`. It always
+validates the immutable runtime, protected config/credential, and durable store.
+When `creation.enabled=true`, it additionally runs one bounded,
+network-isolated LaTeX/qpdf canary and refuses startup if that compiler proof
+fails. When `creation.enabled=false`, it deliberately does not touch the TeX
+toolchain: readiness advertises `compiler:null`, compile remains disabled, and
+the retained full/range read plus two-phase-delete floor can restart even while
+the compiler is unavailable.
+The exact installed candidate unit must complete `aginti-document-worker check`
+successfully before LazyEdge route activation, AgInTi broker activation, or Web
+exposure is allowed; static unit verification is not a substitute for that
+namespace and compiler activation proof.
+
+LazyEdge permits two concurrent requests and the worker admits at most one
+compiler process; at most four additional compiles remain in a bounded
+in-process queue and excess admission fails retryably.
+The private ledger also enforces fixed group/directory bounds, per-source and
+per-PDF limits, and an 8 GiB aggregate live-object ceiling; quota exhaustion
+does not disable existing reads or two-phase deletion.
+Each compiler process has a 30-second wall limit. The 120-second private-route
+timeout is intentionally longer so queueing, forced cleanup, and a structured
+failure response retain transport headroom.
+
+Completed deletion receipts are retained for the most recent 512 delete
+transactions. Compaction removes only groups whose two objects are already
+durably tombstoned; it never removes staged, committed, prepared, or deleting
+groups. Within that window, compile/commit/delete response loss replays exactly.
+When full tombstones are compacted, the store atomically advances a durable
+compile-authority epoch in the same ledger replacement. New clients fetch that
+epoch immediately before compiling and bind it into the deterministic request
+ID. Old content/commit/delete replay resolves as not-found, while a delayed old
+compile request carries a stale epoch and remains 410 Gone. Existing live-group
+replay remains exact. This bounded cutoff has no practical lifetime delete
+ceiling and the 4,096-entry live-ledger cap is no longer a lifetime creation
+limit.
+
+The TeX compiler uses bubblewrap namespaces. Therefore the unit intentionally
+does not use `RestrictNamespaces=true`; it denies only time namespaces. Every
+candidate unit must run the real bwrap/latexmk/qpdf activation canary under the
+installed unit before creation is enabled. A hash-only executable check is not
+an activation proof.

package/examples/document-worker/aginti-document-worker.service

@@ -0,0 +1,67 @@
+[Unit]
+Description=AgInTi workstation document artifact worker
+Documentation=https://flow.lazying.art
+After=local-fs.target
+
+[Service]
+Type=simple
+User=aginti-document-worker
+Group=aginti-document-worker
+UMask=0077
+Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin
+WorkingDirectory=/var/lib/aginti-document-worker
+ExecStartPre=/opt/agintiflow-document-worker/runtimes/node-v22.21.0-29e9c28204d89d85/bin/node /opt/agintiflow-document-worker/releases/RELEASE_SHA256/bin/aginti-document-worker-runtime-check.js
+ExecStartPre=/opt/agintiflow-document-worker/runtimes/node-v22.21.0-29e9c28204d89d85/bin/node /opt/agintiflow-document-worker/releases/RELEASE_SHA256/bin/aginti-document-worker.js check --config /etc/agintiflow/document-worker.json
+ExecStart=/opt/agintiflow-document-worker/runtimes/node-v22.21.0-29e9c28204d89d85/bin/node /opt/agintiflow-document-worker/releases/RELEASE_SHA256/bin/aginti-document-worker.js serve --config /etc/agintiflow/document-worker.json
+LoadCredential=document-worker-upstream-token:/etc/agintiflow/credentials/document-worker-upstream-token
+StateDirectory=aginti-document-worker
+StateDirectoryMode=0700
+RuntimeDirectory=aginti-document-worker
+RuntimeDirectoryMode=0700
+Restart=on-failure
+RestartSec=2s
+TimeoutStartSec=120s
+TimeoutStopSec=15s
+KillMode=mixed
+KillSignal=SIGTERM
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateIPC=yes
+ProtectSystem=strict
+ProtectHome=tmpfs
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHostname=yes
+ProtectProc=invisible
+ProcSubset=pid
+RestrictAddressFamilies=AF_UNIX AF_INET AF_NETLINK
+RestrictNamespaces=~time
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+SystemCallArchitectures=native
+CapabilityBoundingSet=
+AmbientCapabilities=
+IPAddressDeny=any
+IPAddressAllow=localhost
+SocketBindDeny=any
+SocketBindAllow=tcp:18102
+ReadOnlyPaths=/etc/agintiflow/document-worker.json
+InaccessiblePaths=/etc/agintiflow/credentials
+InaccessiblePaths=/var/lib/lazyedge
+InaccessiblePaths=/var/lib/agintiflow-integration
+MemoryMax=1610612736
+MemorySwapMax=0
+TasksMax=64
+CPUQuota=200%
+CPUQuotaPeriodSec=100ms
+LimitNOFILE=512
+LimitCORE=0
+OOMPolicy=kill
+
+[Install]
+WantedBy=multi-user.target

package/examples/document-worker/document-worker.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "aginti-document-worker-service-config-v1",
+  "listen": {
+    "host": "127.0.0.1",
+    "port": 18102
+  },
+  "stateRoot": "/var/lib/aginti-document-worker",
+  "creation": {
+    "enabled": false,
+    "maximumConcurrentCompiles": 1
+  }
+}

package/examples/document-worker/runtime-manifest.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": "aginti-document-worker-runtime-manifest-v1",
+  "node": {
+    "path": "/opt/agintiflow-document-worker/runtimes/node-v22.21.0-29e9c28204d89d85/bin/node",
+    "version": "v22.21.0",
+    "sha256": "29e9c28204d89d85cc426b518b4a7c6e32aafecd5e447d65301ffb2c1c15335a",
+    "owner": "root",
+    "group": "root",
+    "mode": "0555",
+    "size": 123351032,
+    "unitMount": "none"
+  },
+  "immutableAncestry": {
+    "owner": "root",
+    "group": "root",
+    "mode": "0555",
+    "applicationRootEntries": [
+      "releases",
+      "runtimes"
+    ],
+    "paths": [
+      "/opt/agintiflow-document-worker",
+      "/opt/agintiflow-document-worker/runtimes",
+      "/opt/agintiflow-document-worker/runtimes/node-v22.21.0-29e9c28204d89d85",
+      "/opt/agintiflow-document-worker/runtimes/node-v22.21.0-29e9c28204d89d85/bin"
+    ]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.331",
+  "version": "0.20.336-integration.2",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",
@@ -31,6 +31,12 @@
     "access": "public"
   },
   "exports": {
+    "./document-worker": "./src/integration-document-worker-service.js",
+    "./document-worker/config": "./src/integration-document-worker-config.js",
+    "./document-worker/contract": "./src/integration-document-worker-contract.js",
+    "./document-worker/server": "./src/integration-document-worker-server.js",
+    "./document-worker/store": "./src/integration-document-worker-store.js",
+    "./document-worker/runtime": "./src/integration-document-worker-runtime.js",
     "./public-research": "./src/public-research-wrapper.js",
     "./public-research/server": "./src/public-research-server.js",
     "./safe-chat": "./src/safe-chat-wrapper.js",
@@ -46,6 +52,7 @@
     "bin/",
     "docs/",
     "docker/",
+    "examples/document-worker/",
     "demos/agintiflow-cli-launch.jpg",
     "demos/agintiflow-web-console-run-output.jpg",
     "i18n/",
@@ -81,6 +88,41 @@
     "scripts/smoke-integration-retained-runtime-repository-phase-b.js",
     "scripts/smoke-integration-runtime-repository-contract.js",
     "scripts/smoke-integration-runtime-authority.js",
+    "scripts/smoke-integration-api.js",
+    "scripts/smoke-integration-authorities.js",
+    "scripts/smoke-integration-execution-worker-binding-config.js",
+    "scripts/smoke-integration-worker-directory.js",
+    "scripts/smoke-integration-worker-directory-cli.js",
+    "scripts/smoke-integration-sandbox-profile.js",
+    "scripts/smoke-execution-worker.js",
+    "scripts/smoke-execution-runtime-bundle.js",
+    "scripts/smoke-execution-worker-server.js",
+    "scripts/smoke-execution-worker-systemd-boundary.js",
+    "scripts/smoke-integration-analysis-coordinator.js",
+    "scripts/smoke-integration-document-artifacts.js",
+    "scripts/smoke-integration-document-content.js",
+    "scripts/smoke-integration-document-revision.js",
+    "scripts/smoke-integration-document-session-broker.js",
+    "scripts/smoke-integration-document-worker-contract.js",
+    "scripts/smoke-integration-document-worker-store.js",
+    "scripts/smoke-integration-document-worker-longevity.js",
+    "scripts/smoke-integration-document-worker-service.js",
+    "scripts/smoke-integration-document-worker-server.js",
+    "scripts/github-hosted-release-environment.js",
+    "scripts/smoke-integration-document-worker-systemd-boundary.js",
+    "scripts/smoke-integration-document-worker-real-compile.js",
+    "scripts/smoke-integration-document-worker-cross-boundary.js",
+    "scripts/test-document-worker-fixture.js",
+    "scripts/fixtures/integration-document-worker-smoke-fixture.js",
+    "scripts/smoke-integration-grounded-search.js",
+    "scripts/smoke-integration-analysis-planner.js",
+    "scripts/smoke-integration-analysis-session-service.js",
+    "scripts/smoke-integration-analysis-startup-recovery.js",
+    "scripts/smoke-integration-analysis-session-authority-contract.js",
+    "scripts/smoke-integration-analysis-state-migrator.js",
+    "scripts/smoke-integration-analysis-state-prewrite-gate.js",
+    "scripts/smoke-integration-analysis-api-server.js",
+    "scripts/live-production-planner-smoke.js",
     "scripts/smoke-auxiliary-tools.js",
     "scripts/smoke-agentlink.js",
     "scripts/smoke-auth.js",
@@ -115,6 +157,7 @@
     "scripts/smoke-runtime-core.js",
     "scripts/smoke-mcp.js",
     "scripts/fixtures/mcp-stdio-smoke-server.mjs",
+    "scripts/fixtures/loopback-test-port.mjs",
     "scripts/smoke-model-roles.js",
     "scripts/smoke-platform.js",
     "scripts/smoke-perception-research.js",
@@ -143,7 +186,12 @@
   "bin": {
     "aginti": "bin/aginti-cli.js",
     "aginti-cli": "bin/aginti-cli.js",
+    "aginti-execution-worker": "bin/aginti-execution-worker.js",
+    "aginti-worker-directory": "bin/aginti-worker-directory.js",
+    "aginti-document-worker": "bin/aginti-document-worker.js",
     "aginti-integration": "bin/aginti-integration.js",
+    "aginti-integration-analysis": "bin/aginti-integration-analysis.js",
+    "aginti-integration-analysis-state": "bin/aginti-integration-analysis-state.js",
     "aginti-public-research": "bin/aginti-public-research.js",
     "aginti-safe-chat": "bin/aginti-safe-chat.js"
   },
@@ -226,11 +274,47 @@
     "smoke:integration-retained-runtime-repository-phase-b": "node scripts/smoke-integration-retained-runtime-repository-phase-b.js",
     "smoke:integration-runtime-repository-contract": "node scripts/smoke-integration-runtime-repository-contract.js",
     "smoke:integration-runtime-authority": "node scripts/smoke-integration-runtime-authority.js",
+    "smoke:integration-api": "node scripts/smoke-integration-api.js",
+    "smoke:integration-authorities": "node scripts/smoke-integration-authorities.js",
+    "smoke:integration-execution-worker-binding-config": "node scripts/smoke-integration-execution-worker-binding-config.js",
+    "smoke:integration-worker-directory": "node scripts/smoke-integration-worker-directory.js",
+    "smoke:integration-worker-directory-cli": "node scripts/smoke-integration-worker-directory-cli.js",
+    "smoke:integration-sandbox-profile": "node scripts/smoke-integration-sandbox-profile.js",
+    "smoke:execution-worker": "node scripts/smoke-execution-worker.js",
+    "smoke:execution-runtime-bundle": "node scripts/smoke-execution-runtime-bundle.js",
+    "smoke:execution-worker-server": "node scripts/smoke-execution-worker-server.js",
+    "smoke:execution-worker-systemd-boundary": "node scripts/smoke-execution-worker-systemd-boundary.js",
+    "smoke:integration-analysis-coordinator": "node scripts/smoke-integration-analysis-coordinator.js",
+    "smoke:integration-document-artifacts": "node scripts/smoke-integration-document-artifacts.js",
+    "smoke:integration-document-content": "node scripts/smoke-integration-document-content.js",
+    "smoke:integration-document-revision": "node scripts/smoke-integration-document-revision.js",
+    "smoke:integration-document-session-broker": "node scripts/smoke-integration-document-session-broker.js",
+    "smoke:integration-document-worker-contract": "node scripts/smoke-integration-document-worker-contract.js",
+    "smoke:integration-document-worker-store": "node scripts/smoke-integration-document-worker-store.js",
+    "smoke:integration-document-worker-longevity": "node scripts/smoke-integration-document-worker-longevity.js",
+    "smoke:integration-document-worker-service": "node scripts/smoke-integration-document-worker-service.js",
+    "smoke:integration-document-worker-server": "node scripts/smoke-integration-document-worker-server.js",
+    "smoke:integration-document-worker-systemd-boundary": "node scripts/smoke-integration-document-worker-systemd-boundary.js",
+    "smoke:integration-document-worker-real-compile": "node scripts/smoke-integration-document-worker-real-compile.js",
+    "smoke:integration-document-worker-cross-boundary": "node scripts/smoke-integration-document-worker-cross-boundary.js .",
+    "smoke:integration-file-worker-store": "node scripts/smoke-integration-file-worker-store.js",
+    "smoke:integration-file-worker-client": "node scripts/smoke-integration-file-worker-client.js",
+    "test:document-worker": "npm run smoke:integration-document-worker-contract && npm run smoke:integration-document-worker-store && npm run smoke:integration-document-worker-longevity && npm run smoke:integration-document-worker-service && npm run smoke:integration-document-worker-server && npm run smoke:integration-document-worker-systemd-boundary && npm run smoke:integration-document-worker-real-compile",
+    "smoke:integration-grounded-search": "node scripts/smoke-integration-grounded-search.js",
+    "smoke:integration-analysis-planner": "node scripts/smoke-integration-analysis-planner.js",
+    "smoke:integration-analysis-session-service": "node scripts/smoke-integration-analysis-session-service.js",
+    "smoke:integration-analysis-context-compaction": "node scripts/smoke-integration-analysis-context-compaction.js",
+    "smoke:integration-analysis-startup-recovery": "node scripts/smoke-integration-analysis-startup-recovery.js",
+    "smoke:integration-analysis-session-authority-contract": "node scripts/smoke-integration-analysis-session-authority-contract.js",
+    "smoke:integration-analysis-state-migrator": "node scripts/smoke-integration-analysis-state-migrator.js",
+    "smoke:integration-analysis-state-prewrite-gate": "node scripts/smoke-integration-analysis-state-prewrite-gate.js",
+    "smoke:integration-analysis-api-server": "node scripts/smoke-integration-analysis-api-server.js",
+    "smoke:integration-analysis-live": "node scripts/live-production-planner-smoke.js",
     "storage:migrate": "node bin/aginti-cli.js storage migrate",
     "publish:env": "node scripts/npm-publish-from-env.js publish --access public",
     "publish:env:whoami": "node scripts/npm-publish-from-env.js whoami",
-    "pretest": "npm run smoke:planning-timeout-recovery",
-    "test": "npm run check && npm run smoke:integration-production-mount && npm run smoke:integration-production-runtime-bundle && npm run smoke:integration-retained-idempotency-store && npm run smoke:integration-storage-authority && npm run smoke:integration-retained-durable-common && npm run smoke:integration-retained-file-lock && npm run smoke:integration-retained-event-ledger && npm run smoke:integration-retained-event-ledger-bundle && npm run smoke:integration-retained-repository-kernel && npm run smoke:integration-retained-session-state-store && npm run smoke:integration-retained-native-session-repository-state && npm run smoke:integration-retained-native-execution-evidence && npm run smoke:integration-retained-runtime-repository-surface && npm run smoke:integration-retained-runtime-repository-phase-b && npm run smoke:integration-runtime-repository-contract && npm run smoke:integration-runtime-authority && npm run smoke:localllm-provider && npm run smoke:localllm-model-tiers && npm run smoke:localllm-code-routing && npm run smoke:local-failure-recovery && npm run smoke:localllm-auto-max && npm run smoke:local-resource-policy && npm run smoke:context-budget-recovery && npm run smoke:session-runtime && npm run smoke:runtime-core && npm run smoke:progressive-tools && npm run smoke:scoped-artifact-research && npm run smoke:truthful-completion && npm run smoke:document-artifact-quality && npm run smoke:writing-specialist-routing && npm run smoke:workspace-secret-false-positive && npm run smoke:provider-handoff && npm run eval:local-first-agent && npm run eval:provider-attribution && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:math-rendering && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:execution-policy && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:deep-research && npm run smoke:public-research && npm run smoke:safe-chat && npm run smoke:auth && npm run smoke:agentlink && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:supervision-ledger && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:run-stdin && npm run smoke:cli-chat && npm run smoke:inbox",
+    "pretest": "npm run smoke:planning-timeout-recovery && npm run smoke:integration-production-runtime-bundle && npm run smoke:integration-retained-idempotency-store && npm run smoke:scoped-artifact-research && npm run smoke:document-artifact-quality && npm run smoke:workspace-secret-false-positive && npm run smoke:provider-handoff",
+    "test": "npm run check && npm run smoke:integration-production-mount && npm run smoke:integration-storage-authority && npm run smoke:integration-retained-durable-common && npm run smoke:integration-retained-file-lock && npm run smoke:integration-retained-event-ledger && npm run smoke:integration-retained-event-ledger-bundle && npm run smoke:integration-retained-repository-kernel && npm run smoke:integration-retained-session-state-store && npm run smoke:integration-retained-native-session-repository-state && npm run smoke:integration-retained-native-execution-evidence && npm run smoke:integration-retained-runtime-repository-surface && npm run smoke:integration-retained-runtime-repository-phase-b && npm run smoke:integration-runtime-repository-contract && npm run smoke:integration-runtime-authority && npm run smoke:integration-api && npm run smoke:integration-authorities && npm run smoke:integration-execution-worker-binding-config && npm run smoke:integration-worker-directory && npm run smoke:integration-worker-directory-cli && npm run smoke:integration-sandbox-profile && npm run smoke:execution-worker && npm run smoke:execution-runtime-bundle && npm run smoke:execution-worker-server && npm run smoke:execution-worker-systemd-boundary && npm run smoke:integration-analysis-coordinator && npm run smoke:integration-document-artifacts && npm run smoke:integration-document-content && npm run test:document-worker && npm run smoke:integration-document-worker-cross-boundary && npm run smoke:integration-file-worker-store && npm run smoke:integration-file-worker-client && npm run smoke:integration-document-session-broker && npm run smoke:integration-document-revision && npm run smoke:integration-grounded-search && npm run smoke:integration-analysis-planner && npm run smoke:integration-analysis-session-service && npm run smoke:integration-analysis-context-compaction && npm run smoke:integration-analysis-startup-recovery && npm run smoke:integration-analysis-session-authority-contract && npm run smoke:integration-analysis-state-migrator && npm run smoke:integration-analysis-state-prewrite-gate && npm run smoke:integration-analysis-api-server && npm run smoke:localllm-provider && npm run smoke:localllm-model-tiers && npm run smoke:localllm-code-routing && npm run smoke:local-failure-recovery && npm run smoke:localllm-auto-max && npm run smoke:local-resource-policy && npm run smoke:context-budget-recovery && npm run smoke:session-runtime && npm run smoke:runtime-core && npm run smoke:progressive-tools && npm run smoke:truthful-completion && npm run smoke:writing-specialist-routing && npm run eval:local-first-agent && npm run eval:provider-attribution && npm run smoke:runtime-compat && npm run smoke:autoupdate && npm run smoke:web-api && npm run smoke:math-rendering && npm run smoke:web-ui && npm run smoke:web-autostart && npm run smoke:webapp-command && npm run smoke:web-port-fallback && npm run smoke:docker-command && npm run smoke:coding-tools && npm run smoke:dynamic-step-budget && npm run smoke:execution-policy && npm run smoke:aaps-adapter && npm run smoke:auxiliary-tools && npm run smoke:perception-research && npm run smoke:deep-research && npm run smoke:public-research && npm run smoke:safe-chat && npm run smoke:auth && npm run smoke:agentlink && npm run smoke:canvas-artifacts && npm run smoke:capabilities && npm run smoke:mcp && npm run smoke:model-roles && npm run smoke:platform && npm run smoke:permission-modes && npm run smoke:skills && npm run smoke:skillmesh && npm run smoke:supervision-ledger && npm run smoke:tmux-tools && npm run smoke:long-jobs && npm run smoke:run-stdin && npm run smoke:cli-chat && npm run smoke:inbox",
     "pack:dry-run": "npm pack --dry-run",
     "smoke:capabilities": "node scripts/smoke-capabilities.js"
   },
@@ -240,6 +324,7 @@
     "fast-xml-parser": "^5.8.0",
     "katex": "0.16.47",
     "openai": "^6.3.0",
-    "playwright": "^1.55.0"
+    "playwright": "^1.55.0",
+    "tldts": "^7.4.11"
   }
 }

package/scripts/fixtures/integration-document-worker-smoke-fixture.js

@@ -0,0 +1,190 @@
+import crypto from "node:crypto";
+
+import {
+  DOCUMENT_WORKER_SCHEMA_VERSIONS,
+  digestDocumentWorkerRequirements,
+  documentWorkerCommitManifest,
+} from "../../src/integration-document-worker-contract.js";
+import {
+  DOCUMENT_WORKER_LISTEN_HOST,
+  DOCUMENT_WORKER_LISTEN_PORT,
+  DOCUMENT_WORKER_SERVICE_CONFIG_SCHEMA_VERSION,
+  DOCUMENT_WORKER_STATE_ROOT,
+} from "../../src/integration-document-worker-config.js";
+
+export const TEST_BEARER_TOKEN = "document-worker-test-token-0123456789abcdef";
+export const TEST_SCOPE = Object.freeze({
+  principalId: "principal.document-worker-smoke",
+  browserSessionId: "a".repeat(64),
+  threadId: "thr_00000000-0000-4000-8000-000000000001",
+  runId: "run_00000000-0000-4000-8000-000000000002",
+});
+export const TEST_THREAD_SCOPE = Object.freeze({
+  principalId: TEST_SCOPE.principalId,
+  browserSessionId: TEST_SCOPE.browserSessionId,
+  threadId: TEST_SCOPE.threadId,
+});
+export const TEST_SOURCE = [
+  "\\documentclass{article}",
+  "\\begin{document}",
+  "Document worker smoke test.",
+  "\\end{document}",
+  "",
+].join("\n");
+
+export function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+export function fixedRequestId(prefix, label) {
+  return `${prefix}${sha256(Buffer.from(label, "utf8"))}`;
+}
+
+export function testDocumentWorkerConfig(creationEnabled) {
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SERVICE_CONFIG_SCHEMA_VERSION,
+    listen: Object.freeze({ host: DOCUMENT_WORKER_LISTEN_HOST, port: DOCUMENT_WORKER_LISTEN_PORT }),
+    stateRoot: DOCUMENT_WORKER_STATE_ROOT,
+    creation: Object.freeze({ enabled: creationEnabled, maximumConcurrentCompiles: 1 }),
+  });
+}
+
+export function testRequirements(minimumFigureCount = 0) {
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SCHEMA_VERSIONS.compileRequirements,
+    profile: "self-contained-tex-v1",
+    minimumFigureCount,
+  });
+}
+
+export function testCompileRequest(label = "default", overrides = {}) {
+  const source = overrides.source ?? TEST_SOURCE;
+  const compileAuthorityEpoch = overrides.compileAuthorityEpoch ?? 1;
+  const issuanceId = overrides.issuanceId ??
+    `iss_${compileAuthorityEpoch.toString(16).padStart(16, "0")}_${sha256(Buffer.from(`issue:${label}`, "utf8"))}`;
+  const compileAuthorityToken = overrides.compileAuthorityToken ??
+    `wca_${crypto.createHash("sha256").update(`token:${label}`, "utf8").digest("base64url")}`;
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SCHEMA_VERSIONS.compileRequest,
+    issuanceId,
+    requestId: overrides.requestId ?? fixedRequestId("cmp_", label),
+    compileAuthorityEpoch,
+    compileAuthorityToken,
+    scope: overrides.scope ?? TEST_SCOPE,
+    filename: overrides.filename ?? `${label.replace(/[^A-Za-z0-9_-]/gu, "-") || "document"}.tex`,
+    source,
+    sourceSha256: overrides.sourceSha256 ?? sha256(Buffer.from(source, "utf8")),
+    requirements: overrides.requirements ?? testRequirements(0),
+  });
+}
+
+export function testCompileIssueRequest(label = "default", overrides = {}) {
+  const source = overrides.source ?? TEST_SOURCE;
+  const compileAuthorityEpoch = overrides.compileAuthorityEpoch ?? 1;
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SCHEMA_VERSIONS.compileIssueRequest,
+    issuanceId: overrides.issuanceId ??
+      `iss_${compileAuthorityEpoch.toString(16).padStart(16, "0")}_${sha256(Buffer.from(`issue:${label}`, "utf8"))}`,
+    compileAuthorityEpoch,
+    scope: overrides.scope ?? TEST_SCOPE,
+    filename: overrides.filename ?? `${label.replace(/[^A-Za-z0-9_-]/gu, "-") || "document"}.tex`,
+    sourceSha256: overrides.sourceSha256 ?? sha256(Buffer.from(source, "utf8")),
+    requirements: overrides.requirements ?? testRequirements(0),
+  });
+}
+
+export async function issueTestCompileRequest(store, label = "default", overrides = {}) {
+  const issue = testCompileIssueRequest(label, overrides);
+  const authority = await store.issueCompile(issue);
+  return testCompileRequest(label, {
+    ...overrides,
+    issuanceId: authority.issuanceId,
+    requestId: authority.requestId,
+    compileAuthorityEpoch: authority.compileAuthorityEpoch,
+    compileAuthorityToken: authority.compileAuthorityToken,
+  });
+}
+
+export function fakeCompiledPayload(request, label = "default") {
+  const sourceBytes = Buffer.from(request.source, "utf8");
+  const pdfBytes = Buffer.from(`%PDF-1.7\n% AgInTi isolated test payload ${label}\n%%EOF\n`, "utf8");
+  const sourceSha256 = sha256(sourceBytes);
+  const pdfSha256 = sha256(pdfBytes);
+  return Object.freeze({
+    schemaVersion: "aginti-tex-compiler-v1",
+    compilerReceipt: Object.freeze({
+      compilerDigest: sha256(Buffer.from("test-compiler", "utf8")),
+      compileLogSha256: sha256(Buffer.from(`test-log:${label}`, "utf8")),
+      sourceSha256,
+      sourceBytes: sourceBytes.byteLength,
+      pdfSha256,
+      pdfBytes: pdfBytes.byteLength,
+      issuedAt: "2026-08-26T00:00:00.000Z",
+    }),
+    source: Object.freeze({
+      filename: request.filename,
+      mime: "application/x-tex",
+      bytes: sourceBytes,
+      sha256: sourceSha256,
+    }),
+    pdf: Object.freeze({
+      filename: `${request.filename.slice(0, -4)}.pdf`,
+      mime: "application/pdf",
+      bytes: pdfBytes,
+      sha256: pdfSha256,
+    }),
+  });
+}
+
+export function testEvidence(request, verifiedFigureCount = 0) {
+  return Object.freeze({
+    requirementsDigest: digestDocumentWorkerRequirements(request.requirements),
+    verifiedFigureCount,
+  });
+}
+
+export function testCommitRequest(compileResponse, scope = TEST_SCOPE, label = "default") {
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SCHEMA_VERSIONS.commitRequest,
+    requestId: fixedRequestId("cmt_", label),
+    scope,
+    receiptDigest: compileResponse.receipt.digest,
+    objects: documentWorkerCommitManifest(compileResponse.artifacts),
+  });
+}
+
+export function testContentRequest(compileResponse, role = "pdf", overrides = {}) {
+  const artifact = compileResponse.artifacts.find((candidate) => candidate.role === role);
+  if (!artifact) throw new Error(`Missing ${role} artifact in smoke fixture.`);
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SCHEMA_VERSIONS.contentRequest,
+    scope: overrides.scope ?? TEST_SCOPE,
+    ref: artifact.ref,
+    receiptDigest: overrides.receiptDigest ?? compileResponse.receipt.digest,
+    metadataOnly: overrides.metadataOnly ?? false,
+    ...(overrides.range === undefined ? {} : { range: overrides.range }),
+  });
+}
+
+export function testDeleteRequest(compileResponse, phase, label = "default") {
+  const objects = compileResponse.artifacts
+    .map((artifact) => Object.freeze({
+      ref: artifact.ref,
+      runId: TEST_SCOPE.runId,
+      receiptDigest: compileResponse.receipt.digest,
+    }))
+    .sort((left, right) => left.ref < right.ref ? -1 : left.ref > right.ref ? 1 : 0);
+  return Object.freeze({
+    schemaVersion: DOCUMENT_WORKER_SCHEMA_VERSIONS.deleteRequest,
+    deletionId: fixedRequestId("del_", label),
+    phase,
+    scope: TEST_THREAD_SCOPE,
+    objects: Object.freeze(objects),
+  });
+}
+
+export async function readStream(stream) {
+  const chunks = [];
+  for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}

package/scripts/fixtures/loopback-test-port.mjs

@@ -0,0 +1,16 @@
+import net from "node:net";
+
+export async function allocateLoopbackTestPort() {
+  const reservation = net.createServer((socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    reservation.once("error", reject);
+    reservation.listen(0, "127.0.0.1", resolve);
+  });
+  const address = reservation.address();
+  const port = typeof address === "object" && address ? Number(address.port) : 0;
+  await new Promise((resolve, reject) => {
+    reservation.close((error) => error ? reject(error) : resolve());
+  });
+  if (!port) throw new Error("kernel did not allocate a loopback test port");
+  return port;
+}

package/scripts/github-hosted-release-environment.js

@@ -0,0 +1,22 @@
+const RELEASE_REPOSITORY = "lazyingart/AgInTiFlow";
+const RELEASE_WORKFLOW = "Publish npm package";
+const RELEASE_WORKFLOW_PATH = ".github/workflows/npm-publish.yml";
+const RELEASE_TAG_PATTERN = /^v[^/\s]+$/u;
+
+export function isPinnedGithubHostedReleaseEnvironment(environment = process.env) {
+  const tag = String(environment.GITHUB_REF_NAME || "");
+  const ref = `refs/tags/${tag}`;
+  return (
+    environment.AGINTIFLOW_GITHUB_HOSTED_BWRAP_NAMESPACE_RESTRICTION === "allow-sigkill" &&
+    environment.AGINTIFLOW_GITHUB_RUNNER_ENVIRONMENT === "github-hosted" &&
+    environment.GITHUB_ACTIONS === "true" &&
+    environment.GITHUB_EVENT_NAME === "push" &&
+    environment.GITHUB_REPOSITORY === RELEASE_REPOSITORY &&
+    environment.GITHUB_REF_TYPE === "tag" &&
+    environment.GITHUB_REF === ref &&
+    environment.GITHUB_WORKFLOW === RELEASE_WORKFLOW &&
+    environment.GITHUB_WORKFLOW_REF === `${RELEASE_REPOSITORY}/${RELEASE_WORKFLOW_PATH}@${ref}` &&
+    environment.RUNNER_OS === "Linux" &&
+    RELEASE_TAG_PATTERN.test(tag)
+  );
+}

package/scripts/live-production-planner-smoke.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+
+import { createSystemdIntegrationAnalysisCoordinator } from "../src/integration-analysis-coordinator.js";
+import { createIntegrationAnalysisPlanner } from "../src/integration-analysis-planner.js";
+
+const CREDENTIAL_ROOT = "/run/credentials/agintiflow-integration.service";
+const LOCAL_LLM_TOKEN_PATH = `${CREDENTIAL_ROOT}/localllm-token`;
+
+const coordinator = await createSystemdIntegrationAnalysisCoordinator();
+
+try {
+  const planner = createIntegrationAnalysisPlanner({
+    coordinator,
+    localModelConfig: {
+      baseURL: "http://127.0.0.1:18080/v1",
+      model: "localllm-code",
+      apiKey: fs.readFileSync(LOCAL_LLM_TOKEN_PATH, "utf8").trim(),
+      contextWindowTokens: 32_768,
+      maxOutputTokens: 2_048,
+      modelTimeoutMs: 180_000,
+    },
+  });
+  const plannerActivation = await planner.activate();
+  const progress = [];
+  const streamedArtifacts = [];
+  const final = await planner.run(
+    {
+      principalId: "production-planner-smoke",
+      browserSessionId: "a".repeat(64),
+      threadId: "thr_11111111-1111-4111-8111-111111111111",
+      runId: "run_22222222-2222-4222-8222-222222222222",
+    },
+    {
+      prompt:
+        "Run Python code to calculate the squares of 1 through 5. Show a line plot, a table, and a short Markdown summary of the real result.",
+      conversation: [],
+    },
+    {
+      onProgress(value) {
+        progress.push(value);
+      },
+      onArtifact(value) {
+        streamedArtifacts.push({ id: value.id, kind: value.kind, title: value.title });
+      },
+    }
+  );
+
+  process.stdout.write(`${JSON.stringify({
+    ok: true,
+    readiness: plannerActivation.readinessProof,
+    plannerActivation,
+    plannerAttestation: planner.attestation,
+    progress,
+    streamedArtifacts,
+    final,
+  })}\n`);
+} catch (error) {
+  process.stderr.write(`${JSON.stringify({
+    ok: false,
+    name: error?.name || "Error",
+    code: error?.code || "UNKNOWN",
+    status: error?.status || null,
+    message: error?.message || "Production planner smoke failed.",
+  })}\n`);
+  process.exitCode = 1;
+} finally {
+  coordinator.close();
+}