@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/review/store.js

@@ -1,214 +1,168 @@
 import { existsSync } from 'node:fs';
-import { newNodeId } from '../runtime/nodes.js';
-import { openDb, withCanvasWrite } from '../canvas/db.js';
+import { withCanvasWrite } from '../canvas/db.js';
+import { getRequest, getRequestByCompanion, getRequestByIdempotencyKey, listBindingRequests, listRequests, listSubmitRequestedRequests, listUnprojectedReviews, markProjected as markRequestProjected, markProjectionError as markRequestProjectionError, openRequest, readAnchorBase as readRequestAnchorBase, replaceAnchorBaseLocked as replaceRequestAnchorBaseLocked, requestSubmit, } from '../human/requests.js';
 import { ReviewOperationError, } from './types.js';
-function recordFromRow(raw) {
+function specification(request) {
+    try {
+        const value = JSON.parse(request.specification_json);
+        if (typeof value !== 'object' || value === null)
+            throw new Error('not an object');
+        return value;
+    }
+    catch (error) {
+        throw new Error(`corrupt review specification: ${request.request_id}`, { cause: error });
+    }
+}
+function state(request) {
+    if (request.state !== 'settled')
+        return request.state;
+    return request.outcome === 'approved' ? 'approved' : 'canceled';
+}
+function record(request) {
+    if (request.kind !== 'review')
+        throw new Error(`human request is not a review: ${request.request_id}`);
+    const spec = specification(request);
+    const reviewState = state(request);
+    const settledAt = request.settled_at;
     return {
-        review_id: raw['review_id'],
-        idempotency_key: raw['idempotency_key'],
-        origin_kind: raw['origin_kind'],
-        origin_node_id: raw['origin_node_id'],
-        bridge_node_id: raw['bridge_node_id'] ?? null,
-        companion_node_id: raw['companion_node_id'],
-        review_dir: raw['review_dir'],
-        file: raw['file'],
-        origin_session_file: raw['origin_session_file'],
-        origin_session_id: raw['origin_session_id'],
-        origin_leaf_id: raw['origin_leaf_id'],
-        model_spec: raw['model_spec'],
-        branch_file: raw['branch_file'],
-        baseline_sha256: raw['baseline_sha256'],
-        baseline_bytes: raw['baseline_bytes'],
-        anchor_base_sha256: raw['anchor_base_sha256'],
-        state: raw['state'],
-        created: raw['created'],
-        captured_at: raw['captured_at'],
-        opened_at: raw['opened_at'] ?? null,
-        submit_requested_at: raw['submit_requested_at'] ?? null,
-        output_path: raw['output_path'] ?? null,
-        subtitle: raw['subtitle'] ?? null,
-        approved_at: raw['approved_at'] ?? null,
-        approved_sha256: raw['approved_sha256'] ?? null,
-        changed: raw['changed'] === null || raw['changed'] === undefined ? null : raw['changed'] !== 0,
-        comments_total: raw['comments_total'] ?? null,
-        comments_unresolved: raw['comments_unresolved'] ?? null,
-        result_json: raw['result_json'] ?? null,
-        canceled_at: raw['canceled_at'] ?? null,
-        cancel_reason: raw['cancel_reason'] ?? null,
-        cancel_actor: raw['cancel_actor'] ?? null,
-        delivery_entry_id: raw['delivery_entry_id'] ?? null,
-        delivered_at: raw['delivered_at'] ?? null,
-        delivery_error: raw['delivery_error'] ?? null,
-        projected_at: raw['projected_at'] ?? null,
-        projection_error: raw['projection_error'] ?? null,
-        source_missing: !existsSync(raw['file']),
+        review_id: request.request_id,
+        idempotency_key: request.idempotency_key ?? '',
+        origin_kind: spec.origin_kind ?? (request.inbox_listed ? 'ticket' : 'inline'),
+        origin_node_id: request.requester_node_id ?? '',
+        companion_node_id: request.companion_node_id ?? '',
+        review_dir: request.request_dir,
+        file: request.file ?? '',
+        origin_session_file: spec.origin_session_file,
+        origin_session_id: spec.origin_session_id,
+        origin_leaf_id: spec.origin_leaf_id,
+        model_spec: spec.model_spec,
+        branch_file: spec.branch_file,
+        baseline_sha256: spec.baseline_sha256,
+        baseline_bytes: spec.baseline_bytes,
+        anchor_base_sha256: request.anchor_base_sha256 ?? '',
+        state: reviewState,
+        created: request.created_at,
+        captured_at: spec.captured_at,
+        opened_at: request.opened_at,
+        submit_requested_at: request.submit_requested_at,
+        output_path: spec.output_path ?? null,
+        subtitle: request.subtitle,
+        approved_at: reviewState === 'approved' ? settledAt : null,
+        approved_sha256: reviewState === 'approved' ? (() => {
+            try {
+                return JSON.parse(request.result_json ?? '{}').approved_sha256 ?? null;
+            }
+            catch {
+                return null;
+            }
+        })() : null,
+        changed: reviewState === 'approved' ? (() => {
+            try {
+                return JSON.parse(request.result_json ?? '{}').changed ?? null;
+            }
+            catch {
+                return null;
+            }
+        })() : null,
+        comments_total: reviewState === 'approved' ? (() => {
+            try {
+                return JSON.parse(request.result_json ?? '{}').comments_total ?? null;
+            }
+            catch {
+                return null;
+            }
+        })() : null,
+        comments_unresolved: reviewState === 'approved' ? (() => {
+            try {
+                return JSON.parse(request.result_json ?? '{}').comments_unresolved ?? null;
+            }
+            catch {
+                return null;
+            }
+        })() : null,
+        result_json: request.result_json,
+        canceled_at: reviewState === 'canceled' ? settledAt : null,
+        cancel_reason: reviewState === 'canceled' ? (() => {
+            try {
+                return JSON.parse(request.result_json ?? '{}').reason ?? null;
+            }
+            catch {
+                return null;
+            }
+        })() : null,
+        cancel_actor: reviewState === 'canceled' ? (() => {
+            try {
+                return JSON.parse(request.result_json ?? '{}').actor ?? null;
+            }
+            catch {
+                return null;
+            }
+        })() : null,
+        delivery_entry_id: request.settlement_delivery_id,
+        delivered_at: request.settlement_delivery_id === null ? null : settledAt,
+        delivery_error: null,
+        projected_at: request.projected_at,
+        projection_error: request.projection_error,
+        source_missing: !existsSync(request.file ?? ''),
     };
 }
-function readRecord(db, where, ...params) {
-    const raw = db.prepare(`SELECT * FROM reviews WHERE ${where}`).get(...params);
-    return raw === undefined ? null : recordFromRow(raw);
-}
-function readRecords(db, where, ...params) {
-    const rows = db.prepare(`SELECT * FROM reviews WHERE ${where} ORDER BY created ASC, review_id ASC`).all(...params);
-    return rows.map(recordFromRow);
-}
-export function mintReviewId() {
-    return newNodeId();
-}
-/** Atomically claim the idempotency key, without publishing any non-SQLite state. */
-export function commitBindingReview(row) {
-    return withCanvasWrite((db) => {
-        const inserted = db.prepare(`
-      INSERT INTO reviews (
-        review_id, idempotency_key, origin_kind, origin_node_id, bridge_node_id,
-        companion_node_id, review_dir, file, origin_session_file, origin_session_id,
-        origin_leaf_id, model_spec, branch_file, baseline_sha256, baseline_bytes,
-        anchor_base_sha256, anchor_base_bytes, state, created, captured_at, opened_at,
-        output_path, subtitle, approved_at, approved_sha256, changed, comments_total,
-        comments_unresolved, result_json, canceled_at, cancel_reason, cancel_actor,
-        delivery_entry_id, delivered_at, delivery_error, projected_at, projection_error
-      ) VALUES (
-        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
-      ) ON CONFLICT(idempotency_key) DO NOTHING
-    `).run(row.review_id, row.idempotency_key, row.origin_kind, row.origin_node_id, row.bridge_node_id, row.companion_node_id, row.review_dir, row.file, row.origin_session_file, row.origin_session_id, row.origin_leaf_id, row.model_spec, row.branch_file, row.baseline_sha256, row.baseline_bytes, row.anchor_base_sha256, row.anchor_base_bytes, 'binding', row.created, row.captured_at, row.opened_at, row.output_path, row.subtitle, row.approved_at, row.approved_sha256, row.changed === null ? null : row.changed ? 1 : 0, row.comments_total, row.comments_unresolved, row.result_json, row.canceled_at, row.cancel_reason, row.cancel_actor, row.delivery_entry_id, row.delivered_at, row.delivery_error, row.projected_at, row.projection_error);
-        const winner = db.prepare('SELECT review_id FROM reviews WHERE idempotency_key = ?').get(row.idempotency_key);
-        if (winner === undefined)
-            throw new Error(`review binding insert did not produce a row: ${row.idempotency_key}`);
-        return { review_id: winner.review_id, won: inserted.changes > 0 };
-    });
+function requestForReview(reviewId) {
+    const request = getRequest(reviewId);
+    return request?.kind === 'review' ? request : null;
 }
 export function getReview(reviewId) {
-    return readRecord(openDb(), 'review_id = ?', reviewId);
+    const request = requestForReview(reviewId);
+    return request === null ? null : record(request);
 }
-/** The review `reviewId` names, for a caller that cannot proceed without one.
- *  A `binding` row is still mid-creation and reads as absent. */
 export function requireVisibleReview(reviewId) {
     const review = getReview(reviewId);
-    if (review === null || review.state === 'binding') {
+    if (review === null || review.state === 'binding')
         throw new ReviewOperationError('unknown_review', 'review was not found', { received: reviewId });
-    }
     return review;
 }
 export function getReviewByIdempotencyKey(key) {
-    return readRecord(openDb(), 'idempotency_key = ?', key);
+    const request = getRequestByIdempotencyKey(key);
+    return request?.kind === 'review' ? record(request) : null;
 }
 export function getReviewByCompanion(nodeId) {
-    return readRecord(openDb(), "companion_node_id = ? AND state <> 'binding'", nodeId);
-}
-export function getReviewByBridge(nodeId) {
-    return readRecord(openDb(), "bridge_node_id = ? AND state <> 'binding'", nodeId);
+    const request = getRequestByCompanion(nodeId);
+    return request?.kind === 'review' ? record(request) : null;
 }
 export function listReviews(filter) {
-    const clauses = ["state <> 'binding'"];
-    const params = [];
-    if (filter.state !== undefined) {
-        clauses.push('state = ?');
-        params.push(filter.state);
-    }
-    if (filter.origin_node_id !== undefined) {
-        clauses.push('origin_node_id = ?');
-        params.push(filter.origin_node_id);
-    }
-    if (filter.file !== undefined) {
-        clauses.push('file = ?');
-        params.push(filter.file);
-    }
-    return readRecords(openDb(), clauses.join(' AND '), ...params);
+    return listRequests({ kind: 'review', ...(filter.origin_node_id === undefined ? {} : { requester_node_id: filter.origin_node_id }), ...(filter.file === undefined ? {} : { file: filter.file }) })
+        .map(record)
+        .filter((review) => review.state !== 'binding' && (filter.state === undefined || review.state === filter.state));
 }
-/** Review ids whose immutable origin is one of `nodeIds`, including binding
- *  rows that normal user-facing review listings intentionally hide. */
 export function reviewIdsByOriginNodes(nodeIds) {
-    const ids = [...new Set(nodeIds)];
-    if (ids.length === 0)
-        return [];
-    const placeholders = ids.map(() => '?').join(',');
-    return openDb()
-        .prepare(`SELECT review_id FROM reviews WHERE origin_node_id IN (${placeholders}) ORDER BY created, review_id`)
-        .all(...ids).map(({ review_id }) => review_id);
+    const ids = new Set(nodeIds);
+    return listRequests({ kind: 'review' }).filter((request) => request.requester_node_id !== null && ids.has(request.requester_node_id)).map((request) => request.request_id);
 }
-/** Delete review audit state for the selected origins in dependency order.
- *  Filesystem cleanup is deliberately left to the daemon lifecycle owner. */
 export function deleteReviewsByOriginNodes(nodeIds) {
-    const ids = [...new Set(nodeIds)];
-    if (ids.length === 0)
+    const reviewIds = reviewIdsByOriginNodes(nodeIds);
+    if (reviewIds.length === 0)
         return [];
-    const originPlaceholders = ids.map(() => '?').join(',');
-    return withCanvasWrite((db) => {
-        const reviewIds = db
-            .prepare(`SELECT review_id FROM reviews WHERE origin_node_id IN (${originPlaceholders}) ORDER BY created, review_id`)
-            .all(...ids).map(({ review_id }) => review_id);
-        if (reviewIds.length === 0)
-            return [];
-        const reviewPlaceholders = reviewIds.map(() => '?').join(',');
-        db.prepare(`DELETE FROM review_comment_events WHERE review_id IN (${reviewPlaceholders})`).run(...reviewIds);
-        db.prepare(`DELETE FROM review_comments WHERE review_id IN (${reviewPlaceholders})`).run(...reviewIds);
-        db.prepare(`DELETE FROM reviews WHERE review_id IN (${reviewPlaceholders})`).run(...reviewIds);
-        return reviewIds;
+    withCanvasWrite((db) => {
+        const placeholders = reviewIds.map(() => '?').join(',');
+        db.prepare(`DELETE FROM review_comment_events WHERE review_id IN (${placeholders})`).run(...reviewIds);
+        db.prepare(`DELETE FROM review_comments WHERE review_id IN (${placeholders})`).run(...reviewIds);
+        db.prepare(`DELETE FROM human_requests WHERE request_id IN (${placeholders})`).run(...reviewIds);
     });
+    return reviewIds;
 }
-export function listBindingReviews() {
-    return readRecords(openDb(), "state = 'binding'");
-}
-/** Open reviews the human has already submitted, still waiting on their companion. */
-export function listSubmitRequestedReviews() {
-    return readRecords(openDb(), "state = 'open' AND submit_requested_at IS NOT NULL");
-}
-export function listUnprojectedTerminalReviews() {
-    return readRecords(openDb(), "state IN ('approved', 'canceled') AND projected_at IS NULL");
-}
-export function bindBridgeNode(reviewId, bridgeNodeId) {
-    return withCanvasWrite((db) => db.prepare('UPDATE reviews SET bridge_node_id = ? WHERE review_id = ? AND bridge_node_id IS NULL').run(bridgeNodeId, reviewId).changes > 0);
-}
-export function openReviewRow(reviewId, openedAt) {
-    return withCanvasWrite((db) => db.prepare("UPDATE reviews SET state = 'open', opened_at = ? WHERE review_id = ? AND state = 'binding'").run(openedAt, reviewId).changes > 0);
-}
-/** Record the human's submit intent on a review that stays open meanwhile.
- *  False when the review already left `open` or already carries an intent. */
-export function requestReviewSubmit(reviewId, at) {
-    return withCanvasWrite((db) => db.prepare("UPDATE reviews SET submit_requested_at = ? WHERE review_id = ? AND state = 'open' AND submit_requested_at IS NULL").run(at, reviewId).changes > 0);
-}
+export function listBindingReviews() { return listBindingRequests().map(record); }
+export function listSubmitRequestedReviews() { return listSubmitRequestedRequests().map(record); }
+export function listUnprojectedTerminalReviews() { return listUnprojectedReviews().map(record); }
+export function openReviewRow(reviewId, openedAt) { return openRequest(reviewId, openedAt); }
+export function requestReviewSubmit(reviewId, at) { return requestSubmit(reviewId, at); }
 export function approveReviewLocked(db, args) {
-    return db.prepare(`
-    UPDATE reviews SET
-      state = 'approved', approved_at = ?, approved_sha256 = ?, changed = ?,
-      comments_total = ?, comments_unresolved = ?, result_json = ?
-    WHERE review_id = ? AND state = 'open'
-  `).run(args.approved_at, args.approved_sha256, args.changed ? 1 : 0, args.comments_total, args.comments_unresolved, args.result_json, args.review_id).changes > 0;
+    return db.prepare(`UPDATE human_requests SET state = 'settled', outcome = 'approved', result_json = ?, settled_at = ?, progress_json = NULL, updated_at = ? WHERE request_id = ? AND kind = 'review' AND state = 'open'`).run(args.result_json, args.approved_at, args.approved_at, args.review_id).changes > 0;
 }
 export function cancelReviewRow(reviewId, args) {
-    return withCanvasWrite((db) => db.prepare(`
-    UPDATE reviews SET
-      state = 'canceled', canceled_at = ?, cancel_reason = ?, cancel_actor = ?
-    WHERE review_id = ? AND state = 'open'
-  `).run(args.at, args.reason, args.actor, reviewId).changes > 0);
-}
-export function markProjected(reviewId, at) {
-    withCanvasWrite((db) => {
-        db.prepare('UPDATE reviews SET projected_at = ?, projection_error = NULL WHERE review_id = ?').run(at, reviewId);
-    });
-}
-export function markProjectionError(reviewId, error) {
-    withCanvasWrite((db) => {
-        db.prepare('UPDATE reviews SET projection_error = ? WHERE review_id = ? AND projected_at IS NULL').run(error, reviewId);
-    });
-}
-export function markDelivered(reviewId, receipt, at) {
-    withCanvasWrite((db) => {
-        db.prepare('UPDATE reviews SET delivery_entry_id = ?, delivered_at = ?, delivery_error = NULL WHERE review_id = ?').run(receipt, at, reviewId);
-    });
-}
-export function markDeliveryError(reviewId, error) {
-    withCanvasWrite((db) => {
-        db.prepare('UPDATE reviews SET delivery_error = ? WHERE review_id = ? AND delivered_at IS NULL').run(error, reviewId);
-    });
-}
-export function readAnchorBase(reviewId) {
-    const raw = openDb().prepare('SELECT anchor_base_bytes, anchor_base_sha256 FROM reviews WHERE review_id = ?').get(reviewId);
-    if (raw === undefined)
-        return null;
-    return { bytes: Buffer.from(raw.anchor_base_bytes), sha256: raw.anchor_base_sha256 };
-}
-export function replaceAnchorBaseLocked(db, reviewId, bytes, sha256) {
-    db.prepare('UPDATE reviews SET anchor_base_bytes = ?, anchor_base_sha256 = ? WHERE review_id = ?').run(bytes, sha256, reviewId);
-}
+    return withCanvasWrite((db) => db.prepare(`UPDATE human_requests SET state = 'settled', outcome = 'canceled', result_json = ?, settled_at = ?, progress_json = NULL, updated_at = ? WHERE request_id = ? AND kind = 'review' AND state = 'open'`).run(JSON.stringify({ schema: 'humanloop.cancel/v1', kind: 'canceled', canceledAt: args.at, ...(args.reason === '' ? {} : { reason: args.reason }), ...(args.actor === null ? {} : { actor: args.actor }) }), args.at, args.at, reviewId).changes > 0);
+}
+export function markProjected(reviewId, at) { markRequestProjected(reviewId, at); }
+export function markProjectionError(reviewId, error) { markRequestProjectionError(reviewId, error); }
+export function markDelivered(_reviewId, _receipt, _at) { }
+export function markDeliveryError(_reviewId, _error) { }
+export function readAnchorBase(reviewId) { return readRequestAnchorBase(reviewId); }
+export function replaceAnchorBaseLocked(db, reviewId, bytes, sha256) { replaceRequestAnchorBaseLocked(db, reviewId, bytes, sha256); }

package/dist/core/review/types.d.ts

@@ -30,7 +30,6 @@ export interface ReviewRow {
     idempotency_key: string;
     origin_kind: ReviewOriginKind;
     origin_node_id: string;
-    bridge_node_id: string | null;
     companion_node_id: string;
     review_dir: string;
     file: string;

package/dist/core/runtime/__tests__/install-id-cache-scoping.test.js

@@ -6,33 +6,37 @@
 // switching CRTR_HOME to a fresh home B, used to keep stamping A's install id
 // onto B's nodes. The lazy cache must be keyed by canvas-db identity so a
 // home switch can never leak one canvas's install id onto another's.
-import { test, before, after, beforeEach } from 'node:test';
+import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, rmSync } from 'node:fs';
-import { closeDb } from '../../canvas/db.js';
+import { closeDb, migrate, openDb } from '../../canvas/db.js';
 import { resolveInstallId } from '../../canvas/install-id.js';
 import { newNodeId } from '../nodes.js';
 let homeA;
 let homeB;
+const previousCrtrHome = process.env['CRTR_HOME'];
 before(() => {
     homeA = mkdtempSync('/tmp/crtr-install-id-home-a-');
     homeB = mkdtempSync('/tmp/crtr-install-id-home-b-');
 });
-beforeEach(() => {
-    closeDb();
-});
 after(() => {
     closeDb();
     rmSync(homeA, { recursive: true, force: true });
     rmSync(homeB, { recursive: true, force: true });
+    if (previousCrtrHome === undefined)
+        delete process.env['CRTR_HOME'];
+    else
+        process.env['CRTR_HOME'] = previousCrtrHome;
 });
 test('newNodeId does not leak one CRTR_HOME\'s install id onto another after a home switch', () => {
     process.env['CRTR_HOME'] = homeA;
+    migrate(openDb());
     const idFromA = newNodeId();
     const installA = resolveInstallId();
     assert.ok(idFromA.startsWith(`${installA}-`), 'a node minted in home A must be stamped with home A\'s install id');
     closeDb();
     process.env['CRTR_HOME'] = homeB;
+    migrate(openDb());
     const installB = resolveInstallId();
     assert.notEqual(installB, installA, 'home A and home B must self-mint distinct install ids for this test to be meaningful');
     const idFromB = newNodeId();

package/dist/core/runtime/__tests__/spawn-env.test.js

@@ -12,7 +12,9 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync, realpathSync } from 'nod
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { resetScopeCache } from '../../scope.js';
-import { readMergedLaunchConfig } from '../../config.js';
+import { readMergedLaunchConfig, writeRawConfig, updateConfigAtRoot } from '../../config.js';
+import { createProfile, profileRoot } from '../../profiles/manifest.js';
+import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
 import { buildOperationalEnvBase, buildBrokerEnv } from '../spawn-env.js';
 const LEAK_CLASS_HOST_ENV = {
     HOME: '/Users/tester',
@@ -61,6 +63,7 @@ beforeEach(() => {
     isolatedCwd = realpathSync(mkdtempSync(join(tmpdir(), 'crtr-spawn-env-cwd-')));
     process.env.HOME = isolatedHome;
     process.chdir(isolatedCwd);
+    initializeFreshScopedStore({ kind: 'user', root: join(isolatedHome, '.crouter') });
     resetScopeCache();
 });
 afterEach(() => {
@@ -168,8 +171,7 @@ test('buildBrokerEnv overlays inv.env + FRONT_DOOR_ENV on top of the sanitized b
 });
 // C — explicit spawnEnv.allow escape hatch: literal names + globs.
 test('C: an explicit spawnEnv.allow literal name admits a var that would otherwise be dropped', () => {
-    mkdirSync(join(isolatedHome, '.crouter'), { recursive: true });
-    writeFileSync(join(isolatedHome, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['GOOGLE_GENERATIVE_AI_API_KEY'] } }));
+    writeRawConfig('user', { spawnEnv: { allow: ['GOOGLE_GENERATIVE_AI_API_KEY'] } });
     resetScopeCache();
     const env = base(LEAK_CLASS_HOST_ENV);
     assert.equal(env.GOOGLE_GENERATIVE_AI_API_KEY, 'fake-g', 'explicitly allowlisted name now crosses');
@@ -177,8 +179,7 @@ test('C: an explicit spawnEnv.allow literal name admits a var that would otherwi
     assert.equal(env.GIT_ASKPASS, undefined);
 });
 test('C (glob, Minor fix): AWS_* admits only AWS_-prefixed names, nothing else', () => {
-    mkdirSync(join(isolatedHome, '.crouter'), { recursive: true });
-    writeFileSync(join(isolatedHome, '.crouter', 'config.json'), JSON.stringify({ spawnEnv: { allow: ['AWS_*'] } }));
+    writeRawConfig('user', { spawnEnv: { allow: ['AWS_*'] } });
     resetScopeCache();
     const env = base(LEAK_CLASS_HOST_ENV);
     assert.equal(env.AWS_ACCESS_KEY_ID, 'fake-aws-id', 'AWS_-prefixed name admitted by the glob');
@@ -248,10 +249,8 @@ test('target-scope: buildBrokerEnv resolves spawnEnv.allow from inv.env.CRTR_NOD
     }
 });
 test('target-scope: spawnEnv.allow is read from the TARGET profile id, not this process\'s ambient CRTR_PROFILE_ID', () => {
-    const profileId = 'testprof-aaaaaaaa'; // must match the profile-id shape (<slug>-<8-hex>)
-    const profileDir = join(isolatedHome, '.crouter', 'profiles', profileId);
-    mkdirSync(profileDir, { recursive: true });
-    writeFileSync(join(profileDir, 'config.json'), JSON.stringify({ spawnEnv: { allow: ['AWS_ACCESS_KEY_ID'] } }));
+    const { profileId } = createProfile('test profile');
+    updateConfigAtRoot(profileRoot(profileId), (config) => { config.spawnEnv = { allow: ['AWS_ACCESS_KEY_ID'] }; });
     resetScopeCache();
     const withoutTargetProfile = buildOperationalEnvBase({ targetCwd: isolatedCwd, targetProfileId: null, host: LEAK_CLASS_HOST_ENV });
     assert.equal(withoutTargetProfile.AWS_ACCESS_KEY_ID, undefined, 'no profile passed — the profile-scoped allow must not apply');

package/dist/core/runtime/broker/auth-reload.js

@@ -1,7 +1,7 @@
 import { AUTH_FAULT_RECOVERY_BODY, formatCard, } from '../../../shared/generated-context.js';
 import { envModelIntent } from '../../../shared/env.js';
 import { emitEvent } from '../../events/emit.js';
-import { clearFault, readFault } from '../fault.js';
+import { brokerRecovery, mutateBrokerFault } from './daemon-ops.js';
 import { isUnknownModel } from '../model-selection.js';
 import { announceMessageOrigin } from '../stamp/channel.js';
 export function createAuthReloadGate(deps) {
@@ -74,22 +74,21 @@ export function createAuthReloadGate(deps) {
     /** Rewind to the entry the recorded auth fault killed and re-drive the turn
      *  with the recovery prompt — once, after the reconcile it depends on. */
     const redriveAuthFault = (reload) => {
-        const authFault = readFault(nodeId);
         const generation = rebind.installedGeneration();
         const faultSession = session();
-        if (authFault?.link !== 'pi→provider' ||
-            authFault.kind !== 'auth' ||
-            faultSession.isStreaming ||
-            faultRedriveInFlight)
+        if (faultSession.isStreaming || faultRedriveInFlight)
             return;
         faultRedriveInFlight = true;
         void (async () => {
             try {
+                const authFault = (await brokerRecovery(nodeId)).fault;
+                if (authFault?.link !== 'pi→provider' || authFault.kind !== 'auth')
+                    return;
                 if (reload !== undefined)
                     await reload;
                 if (supersededBy(generation, faultSession))
                     return;
-                const anchorEntryId = authFault.anchorEntryId;
+                const anchorEntryId = authFault.anchor_entry_id;
                 if (anchorEntryId !== undefined) {
                     try {
                         const leafId = faultSession.sessionManager.getLeafId?.() ?? null;
@@ -106,19 +105,19 @@ export function createAuthReloadGate(deps) {
                         });
                     }
                 }
-                const fresh = readFault(nodeId);
+                const fresh = (await brokerRecovery(nodeId)).fault;
                 if (supersededBy(generation, faultSession) ||
                     faultSession.isStreaming ||
                     fresh?.link !== 'pi→provider' ||
                     fresh.kind !== 'auth' ||
                     fresh.since !== authFault.since)
                     return;
-                await turnAdmission.admit((release) => {
+                await turnAdmission.admit(async (release) => {
                     if (supersededBy(generation, faultSession) || faultSession.isStreaming) {
                         release();
                         return Promise.resolve();
                     }
-                    clearFault(nodeId, { link: 'pi→provider' });
+                    await mutateBrokerFault(nodeId, { op: 'clear', link: 'pi→provider' });
                     const card = formatCard('recovery', {}, AUTH_FAULT_RECOVERY_BODY);
                     announceMessageOrigin(card, { type: 'runtime', kind: 'recovery' });
                     return faultSession.prompt(card, { preflightResult: release });

package/dist/core/runtime/broker/daemon-ops.d.ts

@@ -1,17 +1,33 @@
-import type { BrokerExtensionStateDTO, BrokerGeneratedNameRequest, BrokerGeneratedNameResultDTO, BrokerInboxCursorDirective, BrokerInboxCursorRequest, BrokerModelCommitRequest, BrokerModelCommitResultDTO, BrokerParkActivityResultDTO, BrokerParkCompleteRequest, BrokerPersonaAckRequest, BrokerPersonaAckResultDTO, BrokerSessionBoundRequest, BrokerSessionBoundResultDTO, BrokerSettleDirective, BrokerSettleRequest } from '../../../api/dto/broker-ops.js';
+import type { BrokerExtensionStateDTO, BrokerGeneratedNameRequest, BrokerGeneratedNameResultDTO, BrokerModelCommitRequest, BrokerModelCommitResultDTO, BrokerParkActivityResultDTO, BrokerParkCompleteRequest, BrokerPersonaAckRequest, BrokerPersonaAckResultDTO, BrokerSessionBoundRequest, BrokerSessionBoundResultDTO, BrokerSettleDirective, BrokerSettleRequest } from '../../../api/dto/broker-ops.js';
+import type { AcknowledgeMailResultDTO, ClaimMailResultDTO, MailReceiptDTO } from '../../../api/dto/mail.js';
+import type { BrokerFaultInputDTO, BrokerFaultRequest, BrokerFaultResultDTO, BrokerProviderRetryRequest, BrokerProviderRetryResultDTO, BrokerTurnRequest, BrokerTurnResultDTO, RecoveryStateDTO } from '../../../api/dto/recovery.js';
 import type { RelaunchRootResultDTO } from '../../../api/dto/lifecycle.js';
 import type { PushReportRequest } from '../../../api/dto/reports.js';
-export declare function bindBrokerSession(nodeId: string, request: BrokerSessionBoundRequest): Promise<BrokerSessionBoundResultDTO>;
-export declare function settleBroker(nodeId: string, request: BrokerSettleRequest): Promise<BrokerSettleDirective>;
-export declare function completeBrokerPark(nodeId: string, request: BrokerParkCompleteRequest): Promise<BrokerSettleDirective>;
+export declare function brokerExecutionId(): string;
+export declare function bindBrokerSession(nodeId: string, request: Omit<BrokerSessionBoundRequest, 'executionId'>): Promise<BrokerSessionBoundResultDTO>;
+type BrokerInput<T> = T extends unknown ? Omit<T, 'expected_execution_id'> : never;
+export declare function settleBroker(nodeId: string, request: BrokerInput<BrokerSettleRequest>): Promise<BrokerSettleDirective>;
+export declare function completeBrokerPark(nodeId: string, request: BrokerInput<BrokerParkCompleteRequest>): Promise<BrokerSettleDirective>;
 export declare function recordBrokerParkActivity(nodeId: string): Promise<BrokerParkActivityResultDTO>;
-export declare function advanceBrokerInboxCursor(nodeId: string, request: BrokerInboxCursorRequest): Promise<BrokerInboxCursorDirective>;
+export declare function claimBrokerMail(nodeId: string, channel: 'wake' | 'passive'): Promise<ClaimMailResultDTO>;
+export declare function acknowledgeBrokerMail(nodeId: string, deliveries: MailReceiptDTO[]): Promise<AcknowledgeMailResultDTO>;
+export declare function recordBrokerTurn(nodeId: string, request: Omit<BrokerTurnRequest, 'expected_execution_id'>): Promise<BrokerTurnResultDTO>;
+export declare function mutateBrokerProviderRetry(nodeId: string, request: Omit<BrokerProviderRetryRequest, 'expected_execution_id'>): Promise<BrokerProviderRetryResultDTO>;
+export declare function mutateBrokerFault(nodeId: string, request: Omit<BrokerFaultRequest, 'expected_execution_id'>): Promise<BrokerFaultResultDTO>;
+export declare function brokerRecovery(nodeId: string): Promise<RecoveryStateDTO>;
+/** Node-scoped fault writes are for non-broker clients such as attach transport.
+ * Broker-owned recovery mutations use the execution-fenced wrappers above. */
+export declare function recordNodeFault(nodeId: string, input: BrokerFaultInputDTO): Promise<BrokerFaultResultDTO>;
+export declare function clearNodeFault(nodeId: string, opts?: {
+    link?: BrokerFaultInputDTO['link'];
+    preserveEpisode?: boolean;
+}): Promise<boolean>;
 /** Fixed canvas projection for broker extension rendering. It deliberately
  * exposes no generic node/database facade. */
-export declare function commitBrokerModel(nodeId: string, request: BrokerModelCommitRequest): Promise<BrokerModelCommitResultDTO>;
+export declare function commitBrokerModel(nodeId: string, request: BrokerInput<BrokerModelCommitRequest>): Promise<BrokerModelCommitResultDTO>;
 export declare function brokerExtensionState(nodeId: string): Promise<BrokerExtensionStateDTO>;
-export declare function commitBrokerGeneratedName(nodeId: string, request: BrokerGeneratedNameRequest): Promise<BrokerGeneratedNameResultDTO>;
-export declare function commitBrokerPersonaAck(nodeId: string, request: BrokerPersonaAckRequest): Promise<BrokerPersonaAckResultDTO>;
+export declare function commitBrokerGeneratedName(nodeId: string, request: BrokerInput<BrokerGeneratedNameRequest>): Promise<BrokerGeneratedNameResultDTO>;
+export declare function commitBrokerPersonaAck(nodeId: string, request: BrokerInput<BrokerPersonaAckRequest>): Promise<BrokerPersonaAckResultDTO>;
 /** Reports still use the canonical daemon report handler; this broker adapter
  * only preserves terminal structured output's idempotent finalization result. */
 export declare function publishBrokerReport(nodeId: string, request: PushReportRequest): Promise<void>;
@@ -19,3 +35,4 @@ export declare function publishBrokerReport(nodeId: string, request: PushReportR
  * a replacement broker and tears down this broker. Callers must not await it
  * from Pi's session-start dispatch. */
 export declare function relaunchBrokerRoot(nodeId: string): Promise<RelaunchRootResultDTO>;
+export {};