@maiaos/node 0.1.0-canary.44938d4.manual.1

package/README.md

@@ -0,0 +1,517 @@
+# `@maiaos/node`
+
+> **Publication status:** Source-implemented candidate, canary-only. npm
+> canaries use the
+> `canary` dist-tag for installation evidence and remain
+> `releaseQualified: false`. No stable version or `latest` dist-tag is
+> released.
+
+`@maiaos/node` is the headless authority foundation for Maia OS: one logical
+node is one brain. It is deliberately a service under `services/node`, not a
+desktop application package: CLI, desktop, mobile/tablet, and web consume the
+same node-owned protocol and state through `@maiaos/sdk`.
+
+The source manifest is prepared for npm packing: only built `dist` output and
+this README are packable, and pnpm preserves the internal Darwin helper's
+executable mode without publishing it as a command. The built executable
+embeds the manifest's exact Node version and exits before node command handling
+when the runtime is not Node 24.19.0. The source manifest remains `0.0.0`;
+release tooling prepares an exact canary version only in an isolated pack copy.
+Exact stable closure/provenance/clean-install evidence remains open. Homebrew is
+a later CLI distribution channel.
+
+The current package implements `help`, `version`, and a constrained `--desktop`
+process. Desktop mode owns one profile lock, a private ephemeral credential,
+authenticated user-local IPC, one readiness record, `node.status`, idempotent
+`node.shutdown`, bounded drain, crash recovery, durable SQLite command/event
+storage, bounded JSONC resolution, atomic user-configuration writes/restores,
+a durable session ledger and Codex activation mapping, and local structured
+observability. Schema v9 preserves the schema-v8 local-v1 orchestration, the
+schema-v7 terminal availability record, and the schema-v6 session/turn ledger,
+and adds the macOS live-terminal source candidate. Schema v10 adds receipt
+recent/actor/method indexes only and preserves that v9 live-terminal data.
+`receipt.list` is an ordinary no-payload read beside keyed `receipt.get`.
+Schema v11 adds the private Codex integration-authorization boundary described
+below. Schema v12 adds the exact built-in neutral execution catalog and
+workspace execution-selection binding. The node exposes
+`execution.catalog.get`, `workspace.execution.show`, and the revision-fenced,
+receipt-backed `workspace.execution.configure` candidate through authenticated
+local IPC and SQLite. Its one provider is canonical `trusted_host`, agentless,
+unbound, and not release-qualified; every resolution remains `unavailable`
+with `local_provider_unbound`. Configuration launches no process, calls no
+provider, creates no execution instance, and grants no local or remote
+execution authority. The source candidate is not release-qualified product
+behavior.
+Schema v8
+durably owns one normalized Run/Task DAG, one Attempt and Dispatch, Run and
+Dispatch mailboxes, immutable Message/Delivery records, individual
+receipt-backed acknowledgement, a Run-scoped objective-free Task index, a
+keyed Run-scoped Task show, a keyed Run-scoped Dispatch show, and
+one coordinator-authored Question that
+parks/resumes XState-owned lifecycles without model compute. Its only
+settlement re-reads the exact Terminal and fails closed; it creates no Worker,
+lease, model turn, Gate, automation, provider, or execution authority. The
+local-v1 orchestration family is a blocked, release-disabled source candidate.
+The macOS source candidate owns one fixed-login-shell PTY through the exact
+`local_user_interactive_terminal` compatibility tier. Its exact 13 active
+public methods are create/list/show/events/read, controller request/show/acquire/release,
+input write, resize/signal/close. Observer attach/check/detach/resync,
+controller renew, restart, delete, and reconcile remain unavailable or inert.
+The SDK, CLI, authenticated IPC, SQLite, and native-host path is proven at the
+real built boundary, but this remains a blocked, release-disabled source
+candidate rather than release-qualified product behavior. It supplies no
+arbitrary executable, caller argv/environment/cwd, model, runtime, plugin,
+worker, or remote authority. Schema v6 atomically records session-start intent,
+receipt, event,
+queued activation, and the bounded turn ledger before external work. A
+bounded Effect/FiberSet supervisor then drives the XState lifecycle through
+exact-version Codex `thread/start`, followed by a non-token-consuming `thread/name/set`
+acknowledgement that materializes even an empty thread; restart resumes only the
+stored native thread. The registered repository and Git-common-directory
+physical identities are revalidated before each launch. An uncertain
+launch fails closed without replay. At readiness the node atomically publishes a
+private, token-free connection descriptor consumed by `@maiaos/sdk/node` and
+`maia status`. It opens no TCP listener. Configuration CLI/migration
+operations, structured Session attachments, terminal observer fanout,
+background installation, and remote access remain later milestones.
+Client multi-node registration/switching, organization-node creation,
+transactional node bootstrap, one-time remote pairing, and forget/destroy
+lifecycles are also unimplemented. The source implements the Client-principal
+`context.show` Invocation-context candidate over authenticated local IPC
+only. It is release-disabled. The projection uses the authenticated local-user
+actor with `attachmentUsed: false` and performs no Session, Run, or Dispatch
+inference or Invocation-attachment minting. SDK `showCurrentContext` and
+`maia context show --json` consume that same candidate. Authenticated
+Invocation attachments and general current-context resolution remain planned
+and unimplemented. The node will be the sole issuer/resolver: caller-supplied
+IDs, cwd, Git metadata, environment strings, and project files will never
+establish a Client, Session, Run, or Dispatch principal. The node is not a node factory: planned
+local, self-hosted-operator, and managed bootstrap providers allocate one empty
+authority outside the ordinary public protocol, then pair a client only after
+authenticated readiness. See
+[ADR-014](../README.md#adr-014).
+Revision-guarded `turn.send` and
+bounded `turn.show` are
+source-implemented candidates that persist before runtime wake, but they are
+not release-qualified or enabled. Ordinary authenticated control requests for
+either method fail before database or runtime access; only the exact internal
+test authority can reach the retained candidate, and desktop/product
+composition never supplies it. The same identity gate wraps the turn claim and
+pre-dispatch callbacks shared by new Session activation and restart recovery,
+so ordinary composition does not claim or dispatch an already queued turn; the
+turn remains queued. The bounded `runtime.probe` compatibility
+path is an implemented compatibility check. Durable session start/resume is a
+source-implemented candidate, but no Codex consumer is migrated or enabled and
+the path remains blocked and release-disabled; approvals and release-enabled
+model work are not implemented. Both explicit-endpoint and
+discovered SDK paths are tested against the exact built node executable.
+
+The node also source-implements the candidate `harness.installed.list`
+application path through authenticated local IPC. It is an ordinary read that
+returns the closed four-item schema-v1 catalog and keeps `selected` and
+`authorized` false. Desktop-node composition builds one scanner layer from an
+immutable startup PATH snapshot and platform; each request only performs the
+bounded filesystem inventory scan. That scoped layer enforces four
+node-lifetime outstanding native filesystem operations across all requests,
+retains two lookups per scan, queues no saturated caller, and holds each slot
+until the actual non-abortable Promise settles after any request timeout or
+disconnect. Saturation returns the fixed redacted four-item indeterminate
+projection immediately and emits bounded count-only telemetry. Shutdown
+reports exact remaining admitted work as cleanup-unavailable and does not wait
+indefinitely. The path does not consult cwd, projects,
+configuration, the database, receipts/events, Codex or version probes, process
+resource authority, caches, or watchers, and it launches no executable. This
+N2 node candidate is not release-qualified or exposed through an implemented
+SDK/CLI surface; S1, C1, and R1 remain separate work. See the
+[harness component](./src/harness/README.md).
+
+ADR-009 now owns a release-disabled Pi RPC conversation-only node candidate.
+Pi-specific integration plan/apply/status/remove uses separate schema-v14
+authorization for exact owner kinds `pi-rpc-probe`, `pi-rpc-session`. The probe
+disables automatic retry/compaction and reads only `get_state`. The Session
+owner is workspace-attributed for resource metrics but receives no repository
+authority; it binds one exact node-private Pi 0.84.2 v3 file, resumes without
+replay, admits at most eight outstanding turns total per Session, of which at
+most one may be dispatching or running,
+persists assistant-only completion, and supports interrupt. Startup recovery
+fences uncertain permits before Session reconciliation, and `cleanup_unknown`
+drains all trees on the authorization revision. Tools, extensions, Skills,
+context, approvals, attachments, credentials/providers, repository mutation,
+and execution-provider authority remain denied. The exact built boundary now
+proves two independent Sessions started concurrently through the Maia CLI,
+with distinct Maia/native Session identities, session files, permits, and
+process trees; graceful node restart settles the original trees and resumes
+the same native identities under new permits, and authorization removal settles
+both resumed trees before node shutdown. The proof observes exactly two new
+macOS `pi` process titles and zero new survivors, while recording that Pi
+rewrites its process title so original argv is unavailable through `ps`. Both
+private Pi files retain one header and zero message records, and Maia retains
+zero Turns. This is exact no-model lifecycle evidence only; no model completion,
+provider call, repository authority, release qualification, or product
+enablement is claimed.
+
+ADR-009 D2 is source-complete for the exact macOS tiers:
+`ProcessResourceManager` selects `cooperative_multi_pgid` only for official
+Codex and retains `vouched_runtime` only for Git while owning admission,
+registration, and fencing through the native host, XState lifecycle, and Effect
+resources. Git and Codex consumer source already call that neutral manager. H2
+now source-qualifies the exact ordinary Darwin-arm64 composition: layer
+acquisition verifies the embedded sibling helper and fixed system Git identity,
+authenticated `node.status` reports `macos_cooperative` with
+`sourceCandidate: true` and `releaseQualified: false`, exact static
+`git-inspection` requests are admitted, and Codex requires an active private
+authorization plus permit. No public product consumer is release-enabled.
+Schema v11 now source-implements the private SQLite plan, authorization-revision, permit-fence, replay, and
+bounded-rollup storage for the ADR-009 integration gate. Ordinary Darwin
+composition privately binds a current authorization row and revision-fenced
+permit to each Codex process-manager launch. The node now handles the strict
+public plan/apply/status/remove protocol slice: plan resolves and hashes only
+the startup-captured closed-catalog Codex target, apply reopens and revalidates
+it, status emits one bounded display-safe item, and remove first persists
+`revoking` before manager cleanup and preserves `cleanup_unknown`. The exact
+built lifecycle is source-qualified at revision
+`80631fb5c9adeb38ab58b12a7db80647161d5871` through CLI, SDK, authenticated
+IPC, SQLite, restart, hostile replacement, active-tree cleanup, and
+`cleanup_unknown` recovery. E1 now source-qualifies the exact authorized
+`codex-probe` and `codex-session` migration at revision
+`54fb0400793507017c0f3f4c2b11a227f2c180b1`: the source node consumer modules
+running through the exact built helper proved
+PREPARED-before-START, descendant observation, synthetic interruption,
+shutdown/cleanup, revocation races, restart fencing, and default denial without
+a model runtime or model turn. E2 now source-qualifies exact repository
+inspection at revision `c29f1166932a837f7482e2f46bb155b573006bad` through the
+fixed Apple system-Git `vouched_runtime` target, including per-spawn identity
+revalidation, bounded output/deadlines, hostile-root and replacement denial,
+`cleanup_unknown` fencing, and no numeric PID fallback. These slices remain
+release-disabled; product enablement remains planned. Scanner/config/caller
+state does not grant process authority. The exact
+macOS F1 artifact/SBOM/notices/combined-size
+evidence is complete, while its manifest remains `releaseQualified: false`.
+The current G2 record is phase-qualified only for source revision
+`e7f784b4aa567d19311235d729b047f96c9dfc7c` and its bound
+application/helper pair; prior records remain unchanged and qualify only their
+exact identities. The current-source authorized one-turn real-Codex lifecycle
+is source-qualified at revision `d85d059ce7db15fd054fa5752414c9542496fb61`:
+the official artifact completed one model turn through the exact source-built
+test entries, durable authorization and runtime binding survived restart,
+duplicate receipt/event identity remained stable, no known process survived,
+and the unrelated sentinel remained. The harness retains no prompt, response,
+credentials, account configuration, or raw logs. The bounded repository
+coding-task gate is separately source-qualified at revision
+`8f590e8865289b1d43deb6a6ddd2bb3c67e5b242`: one private test-only
+`workspace-write` turn produced the exact 21-byte requested file and clean
+system-Git diff, recovered a lost mutation response, preserved duplicate
+receipt/event and runtime-binding identity across restart, exposed bounded SDK
+CPU/RSS/peak-RSS/process/FD/I/O accounting, cleaned both observed process trees,
+and preserved the sentinel. The active-node-crash subcase remains blocked on
+unavailable strong containment. A1 npm package/install evidence remains open;
+app/DMG qualification is later.
+
+The node now projects compact process-resource developer health through
+authenticated `node.status`: active/tracked trees, watcher fibers, immediate
+non-queued admission usage/headroom, fenced and cleanup-unknown counts,
+capability/pressure truth, and one bounded operator next step. On the H2-qualified exact Darwin-arm64 composition, this projection is
+`macos_cooperative` with `sourceCandidate: true`, host-sampled metrics, no hard
+CPU/memory/process-limit claim, no observed-pressure auto-termination, and
+`releaseQualified: false`. Its atomic bounded accounting snapshot also
+projects latest-target CPU, RSS/peak RSS, process, FD, and I/O availability;
+declared-limit crossings are inspect-only warnings. Cleanup uncertainty retains the affected permit
+and degrades admission; it never triggers raw PID/PGID signalling. This status
+slice does not migrate or enable a process consumer.
+
+The implemented Codex probe is a compatibility check, not an authentication or
+model-readiness check. It validates the App Server-reported exact version,
+completes initialize/initialized, and confirms protocol consumption through
+read-only `account/read` with token refresh disabled; account identity is
+discarded. Production probing is enabled on macOS and Linux. Windows returns
+`platform_unsupported` until lifetime process-tree ownership is qualified.
+
+Node 24.19.0 is the sole supported JavaScript runtime and reference runtime.
+
+Device endpoints are a separate planned node capability surface, not Workers,
+terminals, or execution instances. No registry, grant mailbox, invocation
+receipt, or native device adapter is implemented; see
+[Device capabilities](../README.md#device-capabilities).
+
+ADR-015 also accepts a later node-owned Notebook aggregate and Public operation
+catalog projection. The node will own Space identity, one-Session controller
+binding, control/fencing epochs, cell commands and Receipts, portable variable
+and checkpoint heads, retention, handoff planning, restart recovery, and
+authorization. It will not evaluate TypeScript. A separate Node 24.19.0 Runtime
+process inside a hard-contained ExecutionInstance owns live cell evaluation and
+receives only a revocable Session Invocation attachment plus an SDK-conformant
+operation bridge.
+
+This package currently contains no Notebook migration, record, handler,
+protocol method, catalog handler, kernel supervisor, or bridge. The A3 node
+slice may add catalog and non-executing Notebook persistence/projections, but
+execution must return unavailable until A6/W3 hard containment passes. The
+current cooperative macOS process tier is ineligible and cannot be used as a
+fallback. See the [canonical contract](../README.md#execution--portable-notebooks)
+and [ADR-015](../README.md#adr-015).
+
+## Is this like Orca Server?
+
+Yes at the process boundary, but not as a copy of its implementation.
+
+Maia adopts the useful server shape: one standalone headless process owns
+durable product state and can eventually serve desktop, CLI, mobile, web, and
+automation clients. The first Maia delivery is narrower than a general server:
+
+| Property         | First Maia node                                                                         | Later Maia node                                                                               |
+| ---------------- | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| Lifecycle        | Started and stopped by Maia Desktop                                                     | OS user service, self-hosted server, or managed service                                       |
+| Transport        | User-owned Unix socket or user-scoped Windows named pipe                                | The same local IPC plus authenticated TLS/WSS when explicitly enabled                         |
+| Authority        | Single local user; lifecycle and durable local storage                                  | Personal or managed authority through the same public contracts                               |
+| Runtime          | Codex probe/internal turn evidence; release-disabled Pi no-model Session/Turn candidate | Qualified credentials/model turns/attachments, then ACP, Hermes, OpenClaw, and other adapters |
+| Execution        | Local-only; no hosted provider dependency                                               | Trusted broker plus provider-neutral local, self-hosted, and hosted workers/sandboxes         |
+| Network exposure | None; no TCP listener                                                                   | Pairing, identity, revocation, policy, TLS, and recovery are prerequisites                    |
+
+The node never depends on Electron, a virtual display, or an open desktop
+window. Tauri supervises the first mode, but it does not become the authority.
+
+## Implemented command surface
+
+```sh
+pnpm turbo run build --filter=@maiaos/node
+node services/node/dist/bin/maia-node.mjs --help
+node services/node/dist/bin/maia-node.mjs --json --version
+node services/node/dist/bin/maia-node.mjs --desktop --json
+```
+
+The desktop command stays attached until an authenticated shutdown request or
+process signal interrupts its Effect scope. Standard output is reserved for one
+LF-terminated readiness record; structured diagnostics use standard error and
+the private per-profile observability file. `maia-node --background` and
+`maia-node serve` remain rejected.
+
+## Storage and migrations
+
+The node—not the CLI or a client—owns one private SQLite database per profile.
+Startup acquires the profile lock, verifies file ownership/type/link count and
+database integrity, and then performs automatic forward-only migrations.
+Three values must agree:
+
+- SQLite `PRAGMA user_version`, the ordered machine version;
+- immutable migration history containing version, name, SHA-256 checksum, and
+  application time;
+- `maia.node-storage/vN`, the readable compatibility tag surfaced by
+  `node.status`.
+
+Every existing database is checkpointed and copied to a bounded private backup
+before migration. The complete pending batch—including migration
+infrastructure and every SQL/history/tag/version update—commits in one immediate
+transaction. An intermediate failure rolls back the whole pending batch. A
+newer schema, downgrade attempt, altered checksum, missing history, mismatched
+tag, failed integrity check, foreign application identifier, unsafe file, or
+failed backup stops startup. There is no automatic downgrade. See
+[ADR-007](../README.md#adr-007).
+
+## File configuration
+
+`NodeConfiguration` resolves the canonical private user root and one registered
+project overlay with deterministic include/profile precedence and per-pointer
+provenance. User edits use an expected SHA-256 digest, a stale-recoverable
+cross-process write lease, exclusive `0600` sibling files, fsync, atomic
+replacement, verified read-back, and content-addressed backups. Restore runs
+through the same write transaction and therefore remains reversible. Backup
+retention is bounded to 20 revisions and 10 MiB; an unsafe, conflicting, or
+uncertain recovery state fails closed.
+
+The filesystem implementation deliberately retains Node-native open/stat/sync
+calls inside named Effect boundaries: Effect v4 `FileSystem.open` does not expose
+the `O_NOFOLLOW`, inode/link-count, or directory-fsync controls required at this
+authority boundary. Effect still owns the service, typed failure channel,
+resource bracket, uninterruptible commit region, time, and traces.
+
+## Runtime architecture rule
+
+Maia standardizes on complementary tools for non-trivial orchestration:
+
+- **Effect** owns typed services, resource scopes, failures, cancellation,
+  retries, timeouts, dependency injection, and observability.
+- **XState** owns explicit long-lived state topology and legal transitions for
+  node, connection, session, runtime, approval, synchronization, and deployment
+  lifecycles.
+- XState actions and actors call Effect-owned services at effectful boundaries.
+  State machines do not become an alternative service container, and Effect
+  programs do not hide an important lifecycle in ad hoc booleans.
+
+The help/version parser remains pure. The desktop lifecycle uses the exact
+pinned Effect v4 prerelease, `@effect/platform-node-shared/NodeRuntime`, and
+XState v5. See
+[ADR-003](../README.md#adr-003).
+Provider-neutral worker/sandbox ownership and the local-first sequence are in
+[the execution specification](../README.md#execution) and
+[ADR-004](../README.md#adr-004).
+
+## Development
+
+```sh
+pnpm turbo run lint --filter=@maiaos/node
+pnpm turbo run typecheck --filter=@maiaos/node
+pnpm turbo run test --filter=@maiaos/node
+pnpm --filter @maiaos/node test:fresh
+pnpm --filter @maiaos/node test:integration-authorization
+MAIA_REAL_PI_RPC_EVIDENCE=1 pnpm --filter @maiaos/node exec vitest run --maxWorkers=1 src/harness/pi-rpc/product-boundary.integration.test.ts # installed Pi; zero model turns
+pnpm --filter @maiaos/node test:real-codex # explicit digest/version/path; one model turn
+pnpm --filter @maiaos/node test:real-codex-coding # exact bounded coding proof; one model turn
+pnpm --filter @maiaos/node test:startup-budget
+pnpm --filter @maiaos/node test:configuration-budget
+pnpm --filter @maiaos/node test:orchestration-budget
+pnpm turbo run build --filter=@maiaos/node
+```
+
+The gated Pi command requires the exact installed Node 24.19.0 and Pi 0.84.2
+artifacts plus a current built CLI/node. It creates a private temporary Git
+repository only to satisfy Project/Workspace registration, grants the runtime
+no repository path authority, sends no prompt, performs no provider call, and
+consumes no model turn. `test:real-codex` and `test:real-codex-coding` require
+explicit `MAIA_REAL_CODEX_EXECUTABLE`, `MAIA_REAL_CODEX_SHA256`, and
+`MAIA_REAL_CODEX_VERSION` inputs. Each consumes one model turn; run either only
+for its authorized exact-revision evidence gate. The coding command exercises
+private test authority only and does not enable product `workspace-write`.
+
+Turbo's focused tasks preserve the dependency-ordered build graph. Its `test`
+task consumes the node build without mutating shared build output. Use
+`test:fresh` when invoking this package directly; it serializes a complete
+dependency build before Vitest. TypeScript emits modular
+library/types output, while the executable is bundled, tree-shaken, and
+minified across whitespace, syntax, and identifiers. It remains linked to an
+external source map and is accompanied by bundle metadata, exact-input
+third-party notices, and a
+CycloneDX 1.6 SBOM tied to its SHA-256 digest. Its version is embedded during
+the build, and a staged-artifact test runs the copied `.mjs` without package
+metadata or dependencies. The test suite launches that exact release binary
+over real Unix sockets or Windows named pipes. It covers readiness, status,
+shutdown, eight-way stale-lock
+contention, mixed live/stale owners, bounded prepared-claim recovery,
+owner-read and rename races, authentication, malformed/byte-chunked/
+oversized/slow frames, connection saturation, permissions, signal cleanup,
+forced drain, deterministic post-acquisition startup cancellation, hard-crash
+recovery, a physically blocked telemetry writer with fail-closed successor
+denial, single-writer trace hierarchy, timestamped metrics, and local
+observability. The built session suite also proves transactionally durable
+activation intent, exact Codex thread identity, restart resume, no replay after
+an unknown launch outcome, migration-v6 crash rollback, and bounded activation
+trace/metric emission. The built local-v1 orchestration suite crosses the
+actual CLI/SDK/socket/node/SQLite boundary, kills and restarts the node before
+acknowledgement, proves redelivery, individual ack, Question park/resume and
+reply/cancel fencing, duplicate unavailable-Terminal settlement, and a second
+restart with exact DAG projection. Its optional budget writes 30 exact-artifact
+SDK check/ack and built CLI samples to
+`.artifacts/benchmarks/orchestration-local-v1.json`; the local candidate result
+and footprint decision are in the
+[benchmark ledger](../README.md#benchmarks--local-v1-orchestration-candidate).
+Successful startup records bounded per-phase histograms and one
+structured phase ledger for profile paths, profile lock, the Effect-owned
+built-in SQLite runtime load, observability, database, credential, local server,
+and readiness publication. The SQLite runtime load performs no profile access,
+overlaps lock acquisition, and is joined before database open. A missed
+physical-drain deadline retains the exact profile claim
+until dead-PID recovery instead of admitting an overlapping writer. The Linux
+built-process suite explicitly opts into an exact-allowlist cooperative test
+fixture for Git and Codex drivers. That fixture is independently revoked
+outside test mode, does not enable a product compatibility tier, and provides
+no Linux containment or release evidence; production remains fail-closed until
+the ADR-009 cgroup/namespace host is qualified. The
+optional budget command enforces 1.25 MiB node and 256 KiB CLI executable
+ceilings, and measures 30
+bootstrap processes, 30 isolated process starts through SDK-authenticated
+status, the corresponding 30 built `maia status --json` processes, and 30 SDK
+status round trips. It records every sample plus p50/p95/maximum and enforces
+respective p95 ceilings of 250, 200, 150, and 150 milliseconds. Before asserting
+those budgets, the test writes raw
+samples, stage summaries, host/runtime/OS/hardware identity, host-load
+context, a pass/fail verdict, the non-retroactive rerun policy, and both
+executable digests to
+`.artifacts/benchmarks/node-startup.json`. A later run archives the previous
+artifact into `.artifacts/benchmarks/node-startup-history/` through an
+exclusive, descriptor-bound, digest-verified transaction. Only ENOENT means
+the live artifact is absent; observation failures, symlinks, unsafe modes,
+wrong owners, and extra hard links fail closed and retain the live file.
+History names include the content digest and are created with `O_EXCL`, so an
+existing history file is never overwritten. Pruning keeps at most eight
+validated owned regular history files and ignores unrelated JSON and symlink
+entries. An unexplained hard-gate failure remains a failure; a later
+local-unqualified retry does not reclassify it, and reference acceptance
+requires a newly qualified run on the documented `macos-15` arm64 class with
+observed host load. Host load uses `os.loadavg()` on Darwin and Linux; other
+platforms record `unavailable` rather than fabricating zeroes, and missing
+load identity cannot qualify the reference class. The 2026-08-14 local built
+gate recorded authenticated-readiness p95 `219.303875 ms` against the
+unchanged 200 ms ceiling. Later local-unqualified observations at
+`111.49 ms` and `102.58 ms` remain diagnostic only and do not erase that
+failed sample. CI retains that exact-revision JSON
+for 14 days. The CI authority is the consolidated standard `macos-15` arm64 M1
+reference lane (three CPUs, 7 GB RAM, 14 GB SSD), which records and validates
+its runner class, image/version, OS release, CPU, memory, run URL/attempt, Node,
+commit, and artifacts before enforcing the unchanged ceilings. It qualifies
+that macOS class only; Linux and Windows lifecycle lanes are compatibility
+evidence. The settled alpha coordinator snapshot records 55 node test files,
+351 passed and 5 skipped node tests, 33 passed CLI tests, and a green full
+repository `pnpm check` under Node 24.19.0. Its 555,547-byte node artifact has
+SHA-256
+`d63e33ba61b7c71f78d73bd70cd9297d3ca9aa70599e6dd373792ab3643ef8cc`.
+The current phase-qualified, attempt-specific H2 G2 record binds source
+revision `e7f784b4aa567d19311235d729b047f96c9dfc7c` to Node v24.19.0, the
+1,051,808-byte node artifact with SHA-256
+`6e1170baf36dbadbe05bc49911458eff120dd0fe4eba3707683b6ca02ef0641b`, and
+the 55,360-byte helper with SHA-256
+`81a4c238344c6657a931c759071027ec57cce963143c11bf361fadd35ac57bce`.
+Attempt `e9d2e7ee-2bc8-4a96-9258-ea2e8bab3412` ran for 3,600,044 ms across
+100 trees, recorded 359,714 sampling observations, ended with 100 clean
+outcomes and all 300 recorded PIDs absent, preserved the unrelated sentinel,
+recorded a 91 ms sampling p99 and 6,094,848-byte RSS delta, returned to a
+zero-byte after-cleanup RSS delta, and observed no monotonic memory growth. Its
+10-file verified local archive is
+`.artifacts/benchmarks/darwin-g2-e7f784b-e9d2e7ee-2bc8-4a96-9258-ea2e8bab3412`.
+The prior `653c917e...` and older historical records remain unchanged. Each
+qualifies G2 only for its exact artifact set and enables no consumer. A new G2
+runner invocation now creates an exclusive, exact-attempt pending marker before
+fixture work. Completion durably writes an immutable attempt-named record before
+removing the marker; observed interrupted, concurrent, malformed, symlinked,
+foreign, or ancestor-redirected state therefore fails verification without
+replacing an older retained record. Retention is capped at two immutable records
+per soak duration, and the official command's clean build starts from zero. An
+interrupted attempt remains unqualified and requires explicit process
+reconciliation plus a clean rebuild before retry. This evidence path assumes the
+required controlled, single-user qualification host; malicious concurrent
+same-account directory renames are outside that host trust boundary and cannot
+be closed by Node's path APIs without a native directory-handle operation. The retained seven-file H2/F1 root manifest binds 3,054,114 bytes and remains
+`releaseQualified: false` with the five exact historical macOS identifiers in
+[the benchmark ledger](../README.md#benchmarks--current-f1-manifest-state).
+Those app/DMG-oriented deficits are not the A1 headless install gate. Current
+source prepares `@maiaos/node` for bounded pnpm packing and preserves the
+internal Darwin helper's executable mode without exposing it as a public bin.
+The local-artifact gate now fails closed unless the source-verified native
+release entry, exact source revision, helper and build-metadata bytes, SHA-256,
+and packed modes agree; it records that identity while retaining
+`missing_release_signature`. This is source preparation only: exact revised
+`0.1.0` tarball closure, signature, integrity/provenance, and clean-host npm
+evidence remain open. The earlier 2026-08-10 Apple M4 Pro/repository-pinned Node 24.19.0
+project/workspace/session-activation plus runtime-probe, startup-overlap, and
+standalone-minification run measured a 513,237-byte node, a 143,119-byte
+standalone CLI, and p95 values of 65.61 ms bootstrap, 85.07 ms authenticated
+readiness, 62.86 ms built `maia status --json`, and 1.80 ms SDK status. These
+are local diagnostics, not cross-platform qualification.
+An Effect-scoped 90-second supervisor owns the benchmark process tree and
+force-terminates every descendant if the deadline wins; the real
+failure-injection test proves no child survives.
+The configuration suite uses real files and independent Node processes for
+conflict, replacement, rollback, restore, retention, permission, symbolic-link,
+hard-link, and interrupted-artifact cases. Its optional 30-write, 4 KiB durable
+benchmark enforces a 50 ms local p95; the 2026-08-09 macOS reference run measured
+36.76 ms p95 with every raw sample emitted by the test. This is a local
+reference-host diagnostic, not cross-platform release qualification.
+
+```bash
+pnpm --filter @maiaos/node test:configuration-budget
+pnpm test:resource-diagnostic
+```
+
+The delivery sequence and gates live in [ROADMAP.md](../README.md#node-roadmap). The system
+boundary is retained by [ADR-001](../README.md#adr-001),
+while product order and logical-node authority are owned by
+[ADR-011](../README.md#adr-011)
+and the [canonical roadmap](../../ROADMAP.md).

package/dist/admin-monitor/application-projection.d.ts

@@ -0,0 +1,27 @@
+import type { ExecutionCatalogGetResult, LocalNodeStatusResult, OrchestrationDispatchShowResult, OrchestrationRunListResult, OrchestrationTaskListResult, ProjectListResult, SessionListResult, WorkspaceExecutionShowResult, WorkspaceListResult } from "@maiaos/protocol";
+import { Effect } from "effect";
+import { type NodeRuntimeError } from "../runtime/errors.js";
+import type { AdminMonitorSnapshotReader } from "./projection.js";
+type Read<T> = () => Effect.Effect<T, NodeRuntimeError>;
+type ReadById<T> = (id: string) => Effect.Effect<T, NodeRuntimeError>;
+export type AdminMonitorApplicationReads = {
+    readonly catalog: Read<ExecutionCatalogGetResult>;
+    readonly dispatch: ReadById<OrchestrationDispatchShowResult>;
+    readonly execution: ReadById<WorkspaceExecutionShowResult>;
+    readonly projects: Read<ProjectListResult>;
+    readonly runs: ReadById<OrchestrationRunListResult>;
+    readonly sessions: ReadById<SessionListResult>;
+    readonly status: Read<LocalNodeStatusResult>;
+    readonly tasks: ReadById<OrchestrationTaskListResult>;
+    readonly workspaces: ReadById<WorkspaceListResult>;
+};
+export declare const makeAdminMonitorSnapshotReader: (reads: AdminMonitorApplicationReads) => AdminMonitorSnapshotReader;
+export declare const adminMonitorReadLimits: {
+    readonly childPage: 8;
+    readonly projects: 8;
+    readonly runPage: 4;
+    readonly taskPage: 4;
+    readonly total: 12;
+};
+export {};
+//# sourceMappingURL=application-projection.d.ts.map

package/dist/admin-monitor/application-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-projection.d.ts","sourceRoot":"","sources":["../../src/admin-monitor/application-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,EAC1B,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAalE,KAAK,IAAI,CAAC,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACxD,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACtE,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;CACpD,CAAC;AAucF,eAAO,MAAM,8BAA8B,GACxC,OAAO,4BAA4B,KAAG,0BAElB,CAAC;AAExB,eAAO,MAAM,sBAAsB;;;;;;CAMzB,CAAC"}