@lore-co/cli 0.1.16 → 0.1.18

package/dist/cli.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
-import { access, chmod, copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { access, chmod, copyFile, mkdir, open, readFile, readdir, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { constants as fsConstants, realpathSync } from "node:fs";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { delimiter, dirname, resolve } from "node:path";
 import { homedir, platform } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { NATIVE_CODING_AGENT_NAMES, WorkspaceIdentityResponseSchema, isNativeCodingAgent, } from "@lore-co/core";
+import { CLAUDE_RELIABILITY_INTEGRATION, CODEX_RELIABILITY_INTEGRATION, CURSOR_RELIABILITY_INTEGRATION, NATIVE_CODING_AGENT_NAMES, OPENCODE_RELIABILITY_INTEGRATION, OperationalMetricsResponseSchema, POLYTOKEN_RELIABILITY_INTEGRATION, RELIABILITY_INTEGRATION_CONTRACT_VERSION, ReliabilityInvocationRecordSchema, WorkspaceIdentityResponseSchema, canonicalJson, deriveReliabilityInvocationHealth, isNativeCodingAgent, } from "@lore-co/core";
 import { runHook, } from "./runtime.js";
+import { readInvocationHealthWriteInput, runInvocationHealthWrite, } from "./invocation-health-writer.js";
 import { runAskCommand } from "./ask.js";
 import { runGuardCommand } from "./guard.js";
 import { runContinueCommand, runResumeCommand } from "./handoff.js";
@@ -18,6 +19,7 @@ import { runHostCommand } from "./host.js";
 import { runDemoCommand } from "./demo.js";
 import { updateCommand } from "./update.js";
 import { runSelfHostCommand } from "./self-host.js";
+import { ReliabilityStore, ReliabilityStoreError, integrationInvocationStateKey, } from "./reliability-store.js";
 import { IS_STANDALONE_BINARY, LORE_VERSION } from "./version.js";
 const LORE_OWNER_ARGUMENT = "--owner lore";
 export const LORE_OPENCODE_PLUGIN = "@lore-co/opencode";
@@ -42,6 +44,13 @@ const POLYTOKEN_HOOK_EVENTS = [
     "pre_user_prompt",
     "post_model_turn",
 ];
+const AGENT_MANIFESTS = {
+    claude: CLAUDE_RELIABILITY_INTEGRATION,
+    codex: CODEX_RELIABILITY_INTEGRATION,
+    cursor: CURSOR_RELIABILITY_INTEGRATION,
+    opencode: OPENCODE_RELIABILITY_INTEGRATION,
+    polytoken: POLYTOKEN_RELIABILITY_INTEGRATION,
+};
 const ROOT_HELP = `lore
 Connect local coding agents to Lore shared engineering memory.
 
@@ -113,7 +122,7 @@ Examples:
   lore connect --token "$LORE_WORKSPACE_TOKEN" --agent cursor
 `;
 const STATUS_HELP = `lore status
-Show whether Lore is configured and each native integration is installed.
+Show exact installation, declared capabilities, and last invocation health.
 
 Usage:
   lore status [--json]
@@ -123,7 +132,7 @@ Examples:
   lore status --json
 `;
 const DOCTOR_HELP = `lore doctor
-Check local security, runtime, agent integrations, binaries, and Lore health.
+Check local security, exact wiring, invocation health, binaries, and Lore health.
 
 Usage:
   lore doctor [--json]
@@ -133,8 +142,9 @@ Examples:
   lore doctor --json
 `;
 const DISCONNECT_HELP = `lore disconnect
-Remove only Lore-owned hooks/plugin, credentials, runtime, state, and retry queue.
-Unrelated agent settings, plugins, and Lore-created backups are retained.
+Remove Lore-owned hooks/plugin, credentials, runtime, and transient state.
+Durable captures, dead letters, verified snapshots, unrelated agent settings,
+plugins, and Lore-created backups are retained.
 
 Usage:
   lore disconnect [--json]
@@ -163,6 +173,12 @@ export function getLorePaths(home, environment = process.env) {
         config: resolve(loreDirectory, "config.json"),
         runtime: resolve(loreDirectory, "bin", "lore-hook.mjs"),
         runtimeRepository: resolve(loreDirectory, "bin", "repository.js"),
+        runtimeReliabilityStore: resolve(loreDirectory, "bin", "reliability-store.js"),
+        runtimeSignedSnapshot: resolve(loreDirectory, "bin", "signed-snapshot.js"),
+        runtimeCanonicalJson: resolve(loreDirectory, "bin", "canonical-json.js"),
+        runtimeContextFallback: resolve(loreDirectory, "bin", "context-fallback.js"),
+        runtimeInvocationHealthWriter: resolve(loreDirectory, "bin", "invocation-health-writer.js"),
+        runtimeVersion: resolve(loreDirectory, "bin", "runtime-version.js"),
         runtimePackage: resolve(loreDirectory, "bin", "package.json"),
         state: resolve(loreDirectory, "state"),
         queue: resolve(loreDirectory, "queue"),
@@ -452,6 +468,120 @@ export function countLoreOpenCodePlugins(input) {
         ? input.plugin.filter(isLoreOpenCodePlugin).length
         : 0;
 }
+function installationUnitId(event, index, total) {
+    return total === 1 ? event : `installation-${index + 1}/${event}`;
+}
+function installationUnitState(ownedCount, exactCount) {
+    if (ownedCount === 0) {
+        return "missing";
+    }
+    if (ownedCount > 1 || exactCount > 1) {
+        return "duplicate";
+    }
+    return exactCount === 1 ? "exact" : "drifted";
+}
+function exactConfiguration(left, right) {
+    return canonicalJson(left) === canonicalJson(right);
+}
+function commandHookInstallationUnits(input, agent, paths, index, total) {
+    const configuration = objectConfiguration(input, agent);
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error(`${agent} configuration field "hooks" must be an object`);
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return HOOK_EVENTS.map((event) => {
+        const groups = hooks[event];
+        if (groups !== undefined && !Array.isArray(groups)) {
+            throw new Error(`${agent} hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(groups) ? groups : [];
+        const expected = {
+            ...(event === "PreToolUse" ? { matcher: GUARD_TOOL_MATCHER } : {}),
+            hooks: [eventHandler(agent, event, paths)],
+        };
+        const ownedCount = candidates.reduce((count, candidate) => {
+            if (!isObject(candidate) || !Array.isArray(candidate.hooks)) {
+                return count;
+            }
+            return count + candidate.hooks.filter(isLoreHook).length;
+        }, 0);
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function cursorInstallationUnits(input, paths, index, total) {
+    const configuration = objectConfiguration(input, "cursor");
+    if (configuration.version !== undefined && configuration.version !== 1) {
+        throw new Error('Cursor configuration field "version" must be 1');
+    }
+    if (configuration.hooks !== undefined && !isObject(configuration.hooks)) {
+        throw new Error('Cursor configuration field "hooks" must be an object');
+    }
+    const hooks = isObject(configuration.hooks) ? configuration.hooks : {};
+    return CURSOR_HOOK_EVENTS.map((event) => {
+        const values = hooks[event];
+        if (values !== undefined && !Array.isArray(values)) {
+            throw new Error(`Cursor hook event "${event}" must be an array`);
+        }
+        const candidates = Array.isArray(values) ? values : [];
+        const expected = cursorEventHandler(event, paths);
+        const ownedCount = candidates.filter(isLoreHook).length;
+        const exactCount = candidates.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(ownedCount, exactCount),
+        };
+    });
+}
+function polytokenInstallationUnits(input, paths, index, total) {
+    if (!Array.isArray(input)) {
+        throw new Error("Polytoken hooks must contain a JSON array");
+    }
+    return POLYTOKEN_HOOK_EVENTS.map((event) => {
+        const expected = polytokenEventHandler(event, paths);
+        const owned = input.filter((candidate) => isLorePolytokenHook(candidate) &&
+            (!isObject(candidate) || candidate.event === event));
+        const exactCount = owned.filter((candidate) => exactConfiguration(candidate, expected)).length;
+        return {
+            id: installationUnitId(event, index, total),
+            state: installationUnitState(owned.length, exactCount),
+        };
+    });
+}
+function openCodeInstallationUnits(input, index, total) {
+    const configuration = objectConfiguration(input, "opencode");
+    if (configuration.plugin !== undefined &&
+        !Array.isArray(configuration.plugin)) {
+        throw new Error('OpenCode configuration field "plugin" must be an array');
+    }
+    const plugins = Array.isArray(configuration.plugin)
+        ? configuration.plugin
+        : [];
+    const owned = plugins.filter(isLoreOpenCodePlugin);
+    const exactCount = owned.filter((candidate) => candidate === LORE_OPENCODE_PLUGIN).length;
+    return [
+        {
+            id: installationUnitId("plugin", index, total),
+            state: installationUnitState(owned.length, exactCount),
+        },
+    ];
+}
+function inspectInstallationUnits(input, agent, paths, index, total) {
+    switch (agent) {
+        case "claude":
+        case "codex":
+            return commandHookInstallationUnits(input, agent, paths, index, total);
+        case "cursor":
+            return cursorInstallationUnits(input, paths, index, total);
+        case "polytoken":
+            return polytokenInstallationUnits(input, paths, index, total);
+        case "opencode":
+            return openCodeInstallationUnits(input, index, total);
+    }
+}
 async function readJsonDocument(path) {
     try {
         const [raw, metadata] = await Promise.all([
@@ -511,7 +641,7 @@ async function writeMergedJson(path, document, value, now) {
 }
 function parseConnectorConfig(value) {
     if (!isObject(value) ||
-        value.version !== 1 ||
+        (value.version !== 1 && value.version !== 2) ||
         typeof value.apiUrl !== "string" ||
         typeof value.token !== "string" ||
         !Array.isArray(value.agents) ||
@@ -547,10 +677,15 @@ function parseConnectorConfig(value) {
     const dashboardUrl = typeof value.dashboardUrl === "string"
         ? normalizeApiUrl(value.dashboardUrl)
         : undefined;
+    const parsedWorkspaceId = WorkspaceIdentityResponseSchema.shape.workspaceId.safeParse(value.workspaceId);
+    const workspaceId = parsedWorkspaceId.success
+        ? parsedWorkspaceId.data
+        : undefined;
     return {
-        version: 1,
+        version: 2,
         apiUrl: value.apiUrl,
         ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        ...(workspaceId === undefined ? {} : { workspaceId }),
         token: value.token,
         agents,
         ...(agentConfigPaths === undefined ||
@@ -979,20 +1114,65 @@ async function installRuntime(paths) {
         await Promise.all([
             rm(paths.runtime, { force: true }),
             rm(paths.runtimeRepository, { force: true }),
+            rm(paths.runtimeReliabilityStore, { force: true }),
+            rm(paths.runtimeSignedSnapshot, { force: true }),
+            rm(paths.runtimeCanonicalJson, { force: true }),
+            rm(paths.runtimeContextFallback, { force: true }),
+            rm(paths.runtimeInvocationHealthWriter, { force: true }),
+            rm(paths.runtimeVersion, { force: true }),
             rm(paths.runtimePackage, { force: true }),
         ]);
         return;
     }
     const sourceDirectory = dirname(fileURLToPath(import.meta.url));
-    const [runtime, repository] = await Promise.all([
+    const canonicalJsonModule = fileURLToPath(import.meta.resolve("@lore-co/core/canonical-json"));
+    const [runtime, repository, reliabilityStore, signedSnapshot, canonicalJson, contextFallback, invocationHealthWriter,] = await Promise.all([
         readFile(resolve(sourceDirectory, "runtime.js"), "utf8"),
         readFile(resolve(sourceDirectory, "repository.js"), "utf8"),
+        readFile(resolve(sourceDirectory, "reliability-store.js"), "utf8"),
+        readFile(resolve(sourceDirectory, "signed-snapshot.js"), "utf8"),
+        readFile(canonicalJsonModule, "utf8"),
+        readFile(resolve(sourceDirectory, "context-fallback.js"), "utf8"),
+        readFile(resolve(sourceDirectory, "invocation-health-writer.js"), "utf8"),
     ]);
+    const standaloneSignedSnapshot = signedSnapshot.replaceAll("@lore-co/core/canonical-json", "./canonical-json.js");
+    if (standaloneSignedSnapshot === signedSnapshot) {
+        throw new Error("Signed snapshot runtime dependency could not be localized");
+    }
+    const runtimeVersion = `export const RUNTIME_VERSION = ${JSON.stringify(LORE_VERSION)};\n`;
+    const runtimeFiles = {
+        "lore-hook.mjs": runtime,
+        "repository.js": repository,
+        "reliability-store.js": reliabilityStore,
+        "signed-snapshot.js": standaloneSignedSnapshot,
+        "canonical-json.js": canonicalJson,
+        "context-fallback.js": contextFallback,
+        "invocation-health-writer.js": invocationHealthWriter,
+        "runtime-version.js": runtimeVersion,
+    };
+    const runtimeManifest = {
+        type: "module",
+        loreRuntime: {
+            version: LORE_VERSION,
+            files: Object.fromEntries(Object.entries(runtimeFiles).map(([name, contents]) => [
+                name,
+                createHash("sha256").update(contents).digest("hex"),
+            ])),
+        },
+    };
     await Promise.all([
-        atomicWrite(paths.runtime, runtime, 0o700),
         atomicWrite(paths.runtimeRepository, repository, 0o600),
-        atomicWrite(paths.runtimePackage, '{"type":"module"}\n', 0o600),
+        atomicWrite(paths.runtimeReliabilityStore, reliabilityStore, 0o600),
+        atomicWrite(paths.runtimeSignedSnapshot, standaloneSignedSnapshot, 0o600),
+        atomicWrite(paths.runtimeCanonicalJson, canonicalJson, 0o600),
+        atomicWrite(paths.runtimeContextFallback, contextFallback, 0o600),
+        atomicWrite(paths.runtimeInvocationHealthWriter, invocationHealthWriter, 0o600),
+        atomicWrite(paths.runtimeVersion, runtimeVersion, 0o600),
+        atomicWrite(paths.runtimePackage, `${JSON.stringify(runtimeManifest, null, 2)}\n`, 0o600),
     ]);
+    // The hook entrypoint is the generation activation marker. Updating it last
+    // prevents a new runtime from loading before all of its local modules exist.
+    await atomicWrite(paths.runtime, runtime, 0o700);
 }
 function agentConfigPath(agent, paths) {
     return targetFor(agent).configPath(paths);
@@ -1165,16 +1345,30 @@ async function connectCommand(args) {
             .map((installation) => installation.configPath);
     }
     const config = {
-        version: 1,
+        version: 2,
         apiUrl,
         ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        workspaceId: identity.workspaceId,
         token: token.trim(),
         agents,
         agentConfigPaths,
         connectedAt: existing?.connectedAt ?? now.toISOString(),
         timeoutMs,
     };
+    const reliabilityStore = new ReliabilityStore(identity.workspaceId, {
+        home: paths.home,
+    });
+    await reliabilityStore.initialize();
+    await reliabilityStore.migrateLegacyQueue(paths.queue);
     await atomicWrite(paths.config, `${JSON.stringify(config, null, 2)}\n`, 0o600);
+    if (existing !== null &&
+        existing.workspaceId === undefined &&
+        existing.apiUrl === apiUrl &&
+        existing.token === token.trim()) {
+        const credentialStore = new ReliabilityStore(credentialReliabilityWorkspaceKey(apiUrl, token.trim()), { home: paths.home });
+        await credentialStore.transferPendingTo(reliabilityStore);
+    }
+    await reliabilityStore.releaseAuthBlocked(now);
     const result = {
         connected: true,
         apiUrl: config.apiUrl,
@@ -1195,34 +1389,250 @@ async function queueCount(paths) {
         return 0;
     }
 }
-async function getAgentStatus(agent, config, paths) {
+function reliabilityWorkspaceKey(config) {
+    return (config.workspaceId ??
+        credentialReliabilityWorkspaceKey(config.apiUrl, config.token));
+}
+function credentialReliabilityWorkspaceKey(apiUrl, token) {
+    return `credential-${createHash("sha256")
+        .update(`${apiUrl}\0${token}`)
+        .digest("hex")
+        .slice(0, 32)}`;
+}
+async function inspectReliabilityStore(config, paths) {
+    if (config === null) {
+        return { inspection: null, error: null };
+    }
+    try {
+        const store = new ReliabilityStore(reliabilityWorkspaceKey(config), {
+            home: paths.home,
+        });
+        return { inspection: await store.inspectExisting(), error: null };
+    }
+    catch (error) {
+        return {
+            inspection: null,
+            error: error instanceof Error
+                ? error.message
+                : "Local reliability store is unavailable",
+        };
+    }
+}
+const MAX_RUNTIME_MODULE_BYTES = 2 * 1024 * 1024;
+const MAX_RUNTIME_MANIFEST_BYTES = 64 * 1024;
+async function readRuntimeFile(path, maxBytes, executable = false) {
+    const handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() ||
+            metadata.size > maxBytes ||
+            (executable && (metadata.mode & 0o111) === 0)) {
+            throw new Error("Runtime file is unsafe or exceeds its size limit");
+        }
+        const buffer = Buffer.allocUnsafe(maxBytes + 1);
+        let bytes = 0;
+        while (bytes < buffer.length) {
+            const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+            if (result.bytesRead === 0) {
+                break;
+            }
+            bytes += result.bytesRead;
+        }
+        if (bytes > maxBytes) {
+            throw new Error("Runtime file exceeds its size limit");
+        }
+        return buffer.subarray(0, bytes).toString("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function inspectRuntimeInstallation(required, paths) {
+    if (!required) {
+        return { state: "not_required", version: null };
+    }
+    if (IS_STANDALONE_BINARY) {
+        try {
+            await access(process.execPath, fsConstants.R_OK | fsConstants.X_OK);
+            return { state: "installed", version: LORE_VERSION };
+        }
+        catch {
+            return { state: "missing", version: null };
+        }
+    }
+    const runtimeFiles = {
+        "lore-hook.mjs": paths.runtime,
+        "repository.js": paths.runtimeRepository,
+        "reliability-store.js": paths.runtimeReliabilityStore,
+        "signed-snapshot.js": paths.runtimeSignedSnapshot,
+        "canonical-json.js": paths.runtimeCanonicalJson,
+        "context-fallback.js": paths.runtimeContextFallback,
+        "invocation-health-writer.js": paths.runtimeInvocationHealthWriter,
+        "runtime-version.js": paths.runtimeVersion,
+    };
+    let contents;
+    let runtimePackage;
+    try {
+        [contents, runtimePackage] = await Promise.all([
+            Promise.all(Object.entries(runtimeFiles).map(async ([name, path]) => {
+                return [
+                    name,
+                    await readRuntimeFile(path, MAX_RUNTIME_MODULE_BYTES, name === "lore-hook.mjs"),
+                ];
+            })),
+            readRuntimeFile(paths.runtimePackage, MAX_RUNTIME_MANIFEST_BYTES),
+        ]);
+    }
+    catch (error) {
+        const missing = typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "ENOENT";
+        return { state: missing ? "missing" : "stale", version: null };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(runtimePackage);
+    }
+    catch {
+        return { state: "stale", version: null };
+    }
+    const loreRuntime = isObject(parsed) && isObject(parsed.loreRuntime)
+        ? parsed.loreRuntime
+        : null;
+    const hashes = loreRuntime !== null && isObject(loreRuntime.files)
+        ? loreRuntime.files
+        : null;
+    const version = loreRuntime !== null && typeof loreRuntime.version === "string"
+        ? loreRuntime.version
+        : null;
+    const hashEntries = hashes === null ? [] : Object.keys(hashes).sort();
+    const expectedEntries = Object.keys(runtimeFiles).sort();
+    const hashesValid = hashes !== null &&
+        canonicalJson(hashEntries) === canonicalJson(expectedEntries) &&
+        contents.every(([name, content]) => hashes[name] ===
+            createHash("sha256").update(content).digest("hex"));
+    return version === LORE_VERSION && hashesValid
+        ? { state: "installed", version }
+        : { state: "stale", version };
+}
+async function invocationHealth(config, paths, manifest) {
+    if (config === null) {
+        return {
+            health: deriveReliabilityInvocationHealth(null, manifest.integrationId),
+            error: null,
+        };
+    }
+    try {
+        const store = new ReliabilityStore(reliabilityWorkspaceKey(config), {
+            home: paths.home,
+        });
+        const record = await store.readStateExisting(integrationInvocationStateKey(manifest.integrationId));
+        const parsed = ReliabilityInvocationRecordSchema.safeParse(record);
+        if (record !== null &&
+            (!parsed.success ||
+                parsed.data.integrationId !== manifest.integrationId)) {
+            return {
+                health: deriveReliabilityInvocationHealth(undefined, manifest.integrationId),
+                error: "corrupt_record",
+            };
+        }
+        const health = deriveReliabilityInvocationHealth(record, manifest.integrationId);
+        return {
+            health,
+            error: manifest.integrationId === "plugin/opencode" &&
+                health.runtimeVersion !== null &&
+                health.runtimeVersion !== LORE_VERSION
+                ? "runtime_version_mismatch"
+                : null,
+        };
+    }
+    catch (error) {
+        return {
+            health: deriveReliabilityInvocationHealth(undefined, manifest.integrationId),
+            error: error instanceof ReliabilityStoreError
+                ? error.code.toLowerCase()
+                : "unavailable",
+        };
+    }
+}
+async function getAgentStatus(agent, config, paths, runtime) {
     const target = targetFor(agent);
+    const manifest = AGENT_MANIFESTS[agent];
     const configuredPaths = config?.agentConfigPaths?.[agent];
     const configPaths = config?.agents.includes(agent) === true && configuredPaths !== undefined
         ? configuredPaths
         : [agentConfigPath(agent, paths)];
     let installed = 0;
     let existing = 0;
-    for (const path of configPaths) {
+    let invalidConfiguration = false;
+    const units = [];
+    for (const [index, path] of configPaths.entries()) {
         try {
             const document = await readJsonDocument(path);
             installed += countAgentIntegrations(document.value, agent);
             existing += document.exists ? 1 : 0;
+            units.push(...inspectInstallationUnits(document.value === undefined
+                ? target.emptyValue()
+                : document.value, agent, paths, index, configPaths.length));
         }
         catch {
-            // A malformed target config is reported as missing integration state.
+            invalidConfiguration = true;
         }
     }
+    const invocation = await invocationHealth(config, paths, manifest);
+    const stalePluginRuntime = agent === "opencode" &&
+        invocation.error === "runtime_version_mismatch";
+    const agentRuntime = target.runtimeRequired
+        ? runtime
+        : stalePluginRuntime
+            ? {
+                state: "stale",
+                version: invocation.health.runtimeVersion,
+            }
+            : {
+                state: "not_required",
+                version: null,
+            };
+    const expected = target.expected * configPaths.length;
+    const exactUnits = units.filter((unit) => unit.state === "exact").length;
+    const installationState = invalidConfiguration
+        ? "invalid"
+        : installed === 0
+            ? "missing"
+            : agentRuntime.state === "stale"
+                ? "stale"
+                : exactUnits === expected &&
+                    agentRuntime.state !== "missing"
+                    ? "complete"
+                    : "partial";
+    const executable = await target.executable(paths);
     return {
         agent,
+        integrationId: manifest.integrationId,
         configured: config?.agents.includes(agent) ?? false,
-        executable: await target.executable(paths),
+        executable,
         configExists: existing === configPaths.length,
         configFile: configPaths[0] ?? agentConfigPath(agent, paths),
         ...(configPaths.length > 1 ? { configFiles: configPaths } : {}),
         integration: target.integration,
         installed,
-        expected: target.expected * configPaths.length,
+        expected,
+        capabilities: manifest.capabilities,
+        installation: {
+            state: installationState,
+            configured: config?.agents.includes(agent) ?? false,
+            executable,
+            installedUnits: exactUnits,
+            expectedUnits: expected,
+            units,
+            runtime: agentRuntime.state,
+            runtimeVersion: agentRuntime.version,
+            expectedRuntimeVersion: target.runtimeRequired || stalePluginRuntime ? LORE_VERSION : null,
+            issue: invalidConfiguration ? "invalid_configuration" : null,
+        },
+        invocation: invocation.health,
+        invocationError: invocation.error,
     };
 }
 async function statusData(paths) {
@@ -1235,28 +1645,25 @@ async function statusData(paths) {
         // Missing configuration is represented as disconnected.
     }
     const runtimeRequired = config?.agents.some((agent) => targetFor(agent).runtimeRequired) ?? false;
-    const runtimeInstalledCheck = runtimeRequired
-        ? Promise.all(IS_STANDALONE_BINARY
-            ? [access(process.execPath, fsConstants.R_OK | fsConstants.X_OK)]
-            : [
-                access(paths.runtime, fsConstants.R_OK | fsConstants.X_OK),
-                access(paths.runtimeRepository, fsConstants.R_OK),
-                access(paths.runtimePackage, fsConstants.R_OK),
-            ]).then(() => true, () => false)
-        : Promise.resolve(false);
-    const [runtimeInstalled, queuedTurns, agents] = await Promise.all([
-        runtimeInstalledCheck,
+    const runtime = await inspectRuntimeInstallation(runtimeRequired, paths);
+    const [legacyQueuedTurns, reliability, agents] = await Promise.all([
         queueCount(paths),
-        Promise.all(CONFIGURED_AGENT_NAMES.map(async (agent) => getAgentStatus(agent, config, paths))),
+        inspectReliabilityStore(config, paths),
+        Promise.all(CONFIGURED_AGENT_NAMES.map(async (agent) => getAgentStatus(agent, config, paths, runtime))),
     ]);
     return {
+        schemaVersion: "lore-cli-status-v1",
+        integrationContractVersion: RELIABILITY_INTEGRATION_CONTRACT_VERSION,
         connected: config !== null,
         apiUrl: config?.apiUrl ?? null,
         config: paths.config,
         configMode,
         runtimeRequired,
-        runtimeInstalled,
-        queuedTurns,
+        runtimeInstalled: runtime.state === "installed",
+        runtimeVersion: runtime.version,
+        queuedTurns: legacyQueuedTurns + (reliability.inspection?.outbox.total ?? 0),
+        reliability: reliability.inspection,
+        reliabilityError: reliability.error,
         agents,
     };
 }
@@ -1267,9 +1674,12 @@ async function statusCommand(args) {
     }
     const data = await statusData(getLorePaths());
     const agentLines = data.agents
-        .map((agent) => `${agent.agent}: ${agent.configured ? "configured" : "not configured"}, ${agent.integration} ${agent.installed}/${agent.expected}, executable ${agent.executable ? "yes" : "no"}, config ${agent.configExists ? "yes" : "no"}`)
+        .map((agent) => `${agent.agent}: ${agent.configured ? "configured" : "not configured"}, installation ${agent.installation.state}, invocation ${agent.invocation.state}${agent.invocationError === null ? "" : ` (${agent.invocationError})`}, capture ${agent.capabilities.captureDurability}, guard ${agent.capabilities.guardBoundaryCoverage}/${agent.capabilities.enforcement}`)
         .join("\n");
-    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? "installed" : "missing") : "not required"}\nqueued_turns: ${data.queuedTurns}\n${agentLines}\n`);
+    const metricRate = (value) => value === null || value === undefined
+        ? "-"
+        : `${(value * 100).toFixed(1)}%`;
+    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? `installed (${data.runtimeVersion})` : data.runtimeVersion === null ? "missing" : `stale (${data.runtimeVersion})`) : "not required"}\ndurable_outbox: ${data.reliability?.outbox.total ?? 0} ready=${data.reliability?.outbox.ready ?? 0} auth_blocked=${data.reliability?.outbox.authBlocked ?? 0} dead=${data.reliability?.outbox.dead ?? 0}\noldest_capture: ${data.reliability?.outbox.oldestEnqueuedAt ?? "-"}\ncontext_snapshots: ${data.reliability?.cache.context ?? 0}\noldest_context_snapshot: ${data.reliability?.cache.oldestContextWrittenAt ?? "-"}\npolicy_snapshots: ${data.reliability?.cache.policy ?? 0}\nlocal_context_fallback_rate: ${metricRate(data.reliability?.operational.retrieval.fallbackRate)}\nlocal_guard_coverage: ${metricRate(data.reliability?.operational.guard.coverageRate)}\nlocal_guard_failures: ${data.reliability?.operational.guard.failures ?? 0}\nlocal_retrieval_failures: ${data.reliability?.operational.retrieval.failed ?? 0}\n${data.reliabilityError === null ? "" : `reliability_error: ${data.reliabilityError}\n`}${agentLines}\n`);
 }
 async function disconnectCommand(args) {
     const parsed = parseOutputArguments(args, DISCONNECT_HELP, "disconnect");
@@ -1303,6 +1713,12 @@ async function disconnectCommand(args) {
         rm(paths.config, { force: true }),
         rm(paths.runtime, { force: true }),
         rm(paths.runtimeRepository, { force: true }),
+        rm(paths.runtimeReliabilityStore, { force: true }),
+        rm(paths.runtimeSignedSnapshot, { force: true }),
+        rm(paths.runtimeCanonicalJson, { force: true }),
+        rm(paths.runtimeContextFallback, { force: true }),
+        rm(paths.runtimeInvocationHealthWriter, { force: true }),
+        rm(paths.runtimeVersion, { force: true }),
         rm(paths.runtimePackage, { force: true }),
         rm(paths.state, { recursive: true, force: true }),
         rm(paths.queue, { recursive: true, force: true }),
@@ -1363,6 +1779,46 @@ async function apiChecks(config) {
                 : detail,
         });
     }
+    try {
+        const response = await fetch(`${config.apiUrl}/v1/reliability/metrics`, {
+            headers: {
+                authorization: `Bearer ${config.token}`,
+                "user-agent": `lore-cli/${LORE_VERSION}`,
+            },
+            signal: AbortSignal.timeout(3_000),
+        });
+        if (!response.ok) {
+            throw new Error("Operational metrics request failed");
+        }
+        const metrics = OperationalMetricsResponseSchema.parse(await response.json());
+        const captureBacklog = metrics.captureReplay.captureExtraction.pending +
+            metrics.captureReplay.captureExtraction.running;
+        const embeddingBacklog = metrics.captureReplay.memoryEmbedding.pending +
+            metrics.captureReplay.memoryEmbedding.running;
+        const deadLetters = metrics.captureReplay.captureExtraction.dead +
+            metrics.captureReplay.memoryEmbedding.dead;
+        const detectedFailures = metrics.silentFailures.count +
+            metrics.guard.failures +
+            deadLetters;
+        checks.push({
+            name: "server-operational-metrics",
+            status: metrics.silentFailures.count > 0 || deadLetters > 0
+                ? "error"
+                : metrics.guard.failures > 0 ||
+                    captureBacklog > 0 ||
+                    embeddingBacklog > 0
+                    ? "warning"
+                    : "ok",
+            detail: `${detectedFailures} detected failure(s), ${captureBacklog} capture and ${embeddingBacklog} embedding job(s) in backlog; ${metrics.guard.latency.samples} Guard latency sample(s)`,
+        });
+    }
+    catch {
+        checks.push({
+            name: "server-operational-metrics",
+            status: "warning",
+            detail: "authenticated operational metrics are unavailable",
+        });
+    }
     return checks;
 }
 async function doctorCommand(args) {
@@ -1415,14 +1871,80 @@ async function doctorCommand(args) {
         });
         checks.push({
             name: `${agent.agent}-${agent.integration}`,
-            status: agent.installed === agent.expected ? "ok" : "error",
-            detail: `${agent.installed}/${agent.expected} Lore ${agent.integration} in ${agent.configFile}`,
+            status: agent.installation.state === "complete" ? "ok" : "error",
+            detail: `${agent.installation.state}: ${agent.installation.installedUnits}/${agent.installation.expectedUnits} exact Lore ${agent.integration} units`,
+        });
+        checks.push({
+            name: `${agent.agent}-invocation`,
+            status: agent.invocationError !== null
+                ? "error"
+                : agent.invocation.state === "successful"
+                    ? "ok"
+                    : agent.invocation.state === "failed" ||
+                        agent.invocation.state === "incomplete"
+                        ? "error"
+                        : "warning",
+            detail: agent.invocationError !== null
+                ? agent.invocationError === "runtime_version_mismatch"
+                    ? `observed Lore ${agent.invocation.runtimeVersion}; expected ${LORE_VERSION}`
+                    : `health record unavailable (${agent.invocationError})`
+                : agent.invocation.state === "successful"
+                    ? `last completed ${agent.invocation.lastSuccessfulAt}`
+                    : agent.invocation.state === "failed"
+                        ? `last invocation failed (${agent.invocation.failureCode})`
+                        : agent.invocation.state === "incomplete"
+                            ? `last invocation did not complete (${agent.invocation.lastAttemptedAt})`
+                            : agent.invocation.state === "never_observed"
+                                ? "installed, but no invocation has been observed yet"
+                                : "invocation health is unavailable",
+        });
+    }
+    checks.push({
+        name: "reliability-store",
+        status: status.reliabilityError !== null
+            ? "error"
+            : status.reliability === null
+                ? "warning"
+                : "ok",
+        detail: status.reliabilityError ??
+            status.reliability?.directory ??
+            "not initialized",
+    });
+    if (status.reliability !== null) {
+        checks.push({
+            name: "durable-capture-outbox",
+            status: status.reliability.outbox.authBlocked > 0 ||
+                status.reliability.outbox.dead > 0
+                ? "error"
+                : status.reliability.outbox.ready > 0 ||
+                    status.reliability.outbox.inFlight > 0
+                    ? "warning"
+                    : "ok",
+            detail: `${status.reliability.outbox.total} total; ${status.reliability.outbox.ready} ready, ${status.reliability.outbox.authBlocked} authentication-blocked, ${status.reliability.outbox.dead} dead-letter`,
+        });
+        checks.push({
+            name: "verified-snapshot-cache",
+            status: status.reliability.trustKeys > 0 ? "ok" : "warning",
+            detail: `${status.reliability.cache.context} context, ${status.reliability.cache.policy} policy, ${status.reliability.trustKeys} pinned key(s)`,
+        });
+        const operational = status.reliability.operational;
+        const detectedFailures = operational.guard.failures + operational.retrieval.failed;
+        checks.push({
+            name: "local-operational-metrics",
+            status: detectedFailures > 0 ? "warning" : "ok",
+            detail: `${detectedFailures} detected failure(s); Guard coverage ${operational.guard.coverageRate === null ? "not yet sampled" : `${(operational.guard.coverageRate * 100).toFixed(1)}%`}, context fallback ${operational.retrieval.fallbackRate === null ? "not yet sampled" : `${(operational.retrieval.fallbackRate * 100).toFixed(1)}%`}`,
         });
     }
+    const incompleteInvocations = status.agents.filter((agent) => agent.configured && agent.invocation.state === "incomplete").length;
+    const failedInvocations = status.agents.filter((agent) => agent.configured && agent.invocation.state === "failed").length;
     checks.push({
-        name: "retry-queue",
-        status: status.queuedTurns === 0 ? "ok" : "warning",
-        detail: `${status.queuedTurns} queued turn(s)`,
+        name: "integration-invocation-completion",
+        status: incompleteInvocations > 0
+            ? "error"
+            : failedInvocations > 0
+                ? "warning"
+                : "ok",
+        detail: `${incompleteInvocations} incomplete and ${failedInvocations} explicitly failed latest invocation(s); target 0`,
     });
     if (config !== null) {
         checks.push(...(await apiChecks(config)));
@@ -1508,6 +2030,11 @@ export async function runCli(args = process.argv.slice(2)) {
         case "hook":
             await runHook(commandArgs);
             return;
+        case "internal-health-write": {
+            const encoded = commandArgs[0] ?? (await readInvocationHealthWriteInput());
+            await runInvocationHealthWrite(encoded);
+            return;
+        }
         default:
             throw new Error(`Unknown command: ${command}\nTry: lore --help`);
     }