@openlife/cli 1.7.3

package/dist/test_process_sandbox.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * test_process_sandbox.ts — Story 15.1 (v1.5, research-track)
+ *
+ * Unit-tests the ProcessSandbox flag construction and Node-version
+ * downgrade behaviour without actually spawning anything. The wrapper's
+ * value is in the argv it builds; running real Node sub-processes is
+ * left to v1.6 integration tests once the wrapper is wired into a
+ * production site.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const ProcessSandbox_1 = require("./orchestrator/ProcessSandbox");
+function assertTrue(cond, label) {
+    if (!cond)
+        throw new Error(`ASSERT_FAILED[${label}]`);
+}
+function arrEq(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+// ── Scenario 1: Node 20 → permission flags injected ────────────────────
+{
+    const sb = new ProcessSandbox_1.ProcessSandbox({
+        nodeMajor: 20,
+        allowFsRead: ['/tmp', '/repo'],
+        allowFsWrite: ['/repo/.artifacts'],
+    });
+    assertTrue(sb.supportsEnforcement(), '[15.1] Node 20 supports enforcement');
+    const flags = sb.buildPermissionFlags();
+    assertTrue(arrEq(flags, ['--permission', '--allow-fs-read=/tmp', '--allow-fs-read=/repo', '--allow-fs-write=/repo/.artifacts']), `[15.1] flags ordered correctly (got ${JSON.stringify(flags)})`);
+    console.log('[15.1] Node 20 enforcement flags ✓');
+}
+// ── Scenario 2: Node 18 → no enforcement, empty flag list ─────────────
+{
+    const sb = new ProcessSandbox_1.ProcessSandbox({ nodeMajor: 18, allowFsRead: ['/tmp'] });
+    assertTrue(!sb.supportsEnforcement(), '[15.1] Node 18 does not support enforcement');
+    assertTrue(arrEq(sb.buildPermissionFlags(), []), '[15.1] Node 18 → empty flags');
+    console.log('[15.1] Node 18 downgrades gracefully ✓');
+}
+// ── Scenario 3: capability toggles add their flags ─────────────────────
+{
+    const sb = new ProcessSandbox_1.ProcessSandbox({ nodeMajor: 22, allowChildProcess: true, allowWorker: true });
+    const flags = sb.buildPermissionFlags();
+    assertTrue(flags.includes('--allow-child-process'), '[15.1] allowChildProcess adds flag');
+    assertTrue(flags.includes('--allow-worker'), '[15.1] allowWorker adds flag');
+    assertTrue(!flags.includes('--allow-wasi'), '[15.1] absent options stay absent');
+    console.log('[15.1] capability toggles correct ✓');
+}
+// ── Scenario 4: spawn injects flags only for node binaries ────────────
+async function scenarioSpawn() {
+    let lastCommand = '';
+    let lastArgs = [];
+    const fakeSpawn = ((command, args) => {
+        lastCommand = command;
+        lastArgs = args;
+        const stub = {
+            stdout: { on: (_, _cb) => { } },
+            stderr: { on: (_, _cb) => { } },
+            on: (event, cb) => {
+                if (event === 'close')
+                    setTimeout(() => cb(0, null), 0);
+            },
+        };
+        return stub;
+    });
+    const sb = new ProcessSandbox_1.ProcessSandbox({ nodeMajor: 20, allowFsRead: ['/repo'], spawnImpl: fakeSpawn });
+    const r1 = await sb.spawn('node', ['build.js']);
+    assertTrue(r1.enforced, '[15.1] node command is enforced');
+    assertTrue(lastCommand === 'node', '[15.1] node command preserved');
+    assertTrue(arrEq(lastArgs, ['--permission', '--allow-fs-read=/repo', 'build.js']), `[15.1] permission flags inserted before user argv (got ${JSON.stringify(lastArgs)})`);
+    assertTrue(r1.code === 0 && r1.signal === null, '[15.1] result envelope normal');
+    console.log('[15.1] spawn(node) injects permission flags ✓');
+    const r2 = await sb.spawn('git', ['status']);
+    assertTrue(!r2.enforced, '[15.1] non-node command not enforced');
+    assertTrue(lastCommand === 'git', '[15.1] git command preserved');
+    assertTrue(arrEq(lastArgs, ['status']), '[15.1] git argv unchanged');
+    console.log('[15.1] spawn(git) is plain pass-through ✓');
+}
+scenarioSpawn()
+    .then(() => { console.log('TEST_PROCESS_SANDBOX_OK'); })
+    .catch((err) => {
+    console.error('[process-sandbox] FAILED:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});

package/dist/test_profile_toolset_mcp.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * test_profile_toolset_mcp.ts — Stories 5.2 + 5.3 + 5.4
+ *
+ * Combined regression for ProfileManager + ToolsetRegistry +
+ * ExternalCatalogRegistry.import.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const ProfileManager_1 = require("./cli/ProfileManager");
+const ToolsetRegistry_1 = require("./orchestrator/toolset/ToolsetRegistry");
+const ToolsetSchema_1 = require("./orchestrator/toolset/ToolsetSchema");
+const ExternalCatalogRegistry_1 = require("./orchestrator/ExternalCatalogRegistry");
+function assertTrue(cond, label) {
+    if (!cond)
+        throw new Error(`ASSERT_FAILED[${label}]`);
+}
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'profile-toolset-mcp-'));
+try {
+    // ── ProfileManager ─────────────────────────────────────────────
+    const pm = new ProfileManager_1.ProfileManager({ stateDir: tmp });
+    assertTrue(pm.list().length === 0, 'profiles start empty');
+    const safe = pm.create({
+        id: 'sandboxed',
+        name: 'Sandboxed',
+        description: 'Locked-down profile',
+        toolsetAllowed: ['file', 'memory'],
+    });
+    assertTrue(safe.id === 'sandboxed', '[5.2] create returns profile');
+    assertTrue(safe.memoryNamespace === 'profile-sandboxed', '[5.2] auto-namespace');
+    assertTrue(pm.list().length === 1, '[5.2] list includes new profile');
+    console.log('[5.2] ProfileManager.create + list ✓');
+    // use + active
+    const useRes = pm.use('sandboxed');
+    assertTrue(useRes.ok, '[5.2] use ok');
+    const { profileId, profile } = pm.active();
+    assertTrue(profileId === 'sandboxed' && profile?.toolsetAllowed.length === 2, '[5.2] active profile resolved');
+    console.log('[5.2] ProfileManager.use + active ✓');
+    // invalid id rejected
+    let invalidIdRejected = false;
+    try {
+        pm.create({ id: 'BAD ID', name: 'x' });
+    }
+    catch (e) {
+        invalidIdRejected = e.code === 'invalid_profile_id';
+    }
+    assertTrue(invalidIdRejected, '[5.2] invalid_profile_id surfaced');
+    console.log('[5.2] invalid id rejected ✓');
+    // import/export
+    const exported = pm.export('sandboxed');
+    assertTrue(exported !== null && exported.id === 'sandboxed', '[5.2] export round-trip');
+    const importRes = pm.import({ ...exported, id: 'imported-from-export' });
+    assertTrue(importRes.ok, '[5.2] import ok');
+    assertTrue(pm.list().length === 2, '[5.2] imported visible in list');
+    console.log('[5.2] ProfileManager.export + import ✓');
+    // ── ToolsetRegistry ─────────────────────────────────────────────
+    const ts = new ToolsetRegistry_1.ToolsetRegistry({ profileManager: pm });
+    assertTrue(ts.list().length === ToolsetSchema_1.ALL_TOOLSETS.length, '[5.3] list returns all categories');
+    const fileDecision = ts.isAllowed('file');
+    assertTrue(fileDecision.allowed, '[5.3] file allowed on sandboxed profile');
+    const browserDecision = ts.isAllowed('browser');
+    assertTrue(!browserDecision.allowed, '[5.3] browser denied on sandboxed profile');
+    console.log('[5.3] ToolsetRegistry decisions ✓');
+    // Wildcard profile allows all
+    pm.create({ id: 'powerful', name: 'Powerful', toolsetAllowed: ['*'] });
+    pm.use('powerful');
+    const ts2 = new ToolsetRegistry_1.ToolsetRegistry({ profileManager: pm });
+    for (const c of ToolsetSchema_1.ALL_TOOLSETS) {
+        assertTrue(ts2.isAllowed(c).allowed, `[5.3] wildcard allows ${c}`);
+    }
+    console.log('[5.3] wildcard profile allows all ✓');
+    // Empty allowlist denies everything
+    pm.create({ id: 'no-tools', name: 'No tools', toolsetAllowed: [] });
+    const ts3 = new ToolsetRegistry_1.ToolsetRegistry({ profileManager: pm });
+    assertTrue(!ts3.isAllowed('file', 'no-tools').allowed, '[5.3] empty allowlist denies file');
+    console.log('[5.3] empty allowlist denies all ✓');
+    // ── ExternalCatalogRegistry.import ──────────────────────────────
+    const reg = new ExternalCatalogRegistry_1.ExternalCatalogRegistry();
+    const ok = reg.import('github', 'some-pack');
+    assertTrue(ok.ok, '[5.4] import-allowed source returns ok');
+    const refOnly = reg.import('skills-sh', 'some-pack');
+    assertTrue(!refOnly.ok && refOnly.error === 'source_is_reference_only', '[5.4] reference-only refused');
+    const missing = reg.import('nonexistent', 'some-pack');
+    assertTrue(!missing.ok && missing.error === 'source_not_found', '[5.4] missing source returns source_not_found');
+    console.log('[5.4] ExternalCatalogRegistry.import ✓');
+}
+finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+}
+console.log('TEST_PROFILE_TOOLSET_MCP_OK');

package/dist/test_queue_scheduler.js

@@ -0,0 +1,239 @@
+"use strict";
+/**
+ * test_queue_scheduler — Story 6.3 regression suite.
+ *
+ * Four scenarios:
+ *   1. enqueue + tick + happy path: missions transition pending→running→
+ *      completed; queue file persists each transition atomically.
+ *   2. Backpressure: maxConcurrent caps the in-flight set; extras wait.
+ *   3. Lock-respect: a mission whose lock is already held by another
+ *      DistributedLock instance is NOT picked up.
+ *   4. reconcileOrphans: a queue with stale `running` items (no holder)
+ *      resets them to `pending` on the next start.
+ *
+ * Prints TEST_QUEUE_SCHEDULER_OK on full pass.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const QueueScheduler_1 = require("./orchestrator/QueueScheduler");
+const DistributedLock_1 = require("./orchestrator/util/DistributedLock");
+const AtomicWriter_1 = require("./orchestrator/util/AtomicWriter");
+function assert(cond, msg) {
+    if (!cond)
+        throw new Error(`assertion failed: ${msg}`);
+}
+function mkTmp() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'qs-test-'));
+}
+function rmTmp(dir) {
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch { /* ignore */ }
+}
+class CountingExecutor {
+    delayMs;
+    failFor;
+    seen = [];
+    concurrentPeak = 0;
+    inFlight = 0;
+    constructor(delayMs = 20, failFor = new Set()) {
+        this.delayMs = delayMs;
+        this.failFor = failFor;
+    }
+    async execute(m) {
+        this.inFlight += 1;
+        this.concurrentPeak = Math.max(this.concurrentPeak, this.inFlight);
+        this.seen.push(m.id);
+        await new Promise((r) => setTimeout(r, this.delayMs));
+        this.inFlight -= 1;
+        if (this.failFor.has(m.id))
+            return { status: 'failed', error: 'scripted failure' };
+        return { status: 'completed' };
+    }
+}
+function makeScheduler(tmp, opts = {}) {
+    const queueFile = path.join(tmp, '.openlife', 'agent-queue.json');
+    return new QueueScheduler_1.QueueScheduler({
+        queueFile,
+        pollIntervalMs: 100_000, // we'll call tick() manually
+        maxConcurrent: opts.maxConcurrent ?? 3,
+        executor: opts.executor,
+        lock: opts.lock,
+        maxAttempts: opts.maxAttempts,
+    });
+}
+async function waitFor(predicate, timeoutMs = 2_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate())
+            return;
+        await new Promise((r) => setTimeout(r, 20));
+    }
+    throw new Error('waitFor timed out');
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 1 — happy path
+// ─────────────────────────────────────────────────────────────
+async function scenarioHappyPath() {
+    const tmp = mkTmp();
+    try {
+        const exec = new CountingExecutor(10);
+        const sched = makeScheduler(tmp, { executor: exec, maxConcurrent: 3 });
+        sched.enqueue({ id: 'm-1', goal: 'do thing 1' });
+        sched.enqueue({ id: 'm-2', goal: 'do thing 2' });
+        sched.enqueue({ id: 'm-3', goal: 'do thing 3' });
+        await sched.tick();
+        // Wait for all to complete
+        await waitFor(() => sched.list().every((m) => m.status === 'completed'));
+        const items = sched.list();
+        assert(items.length === 3, `expected 3 items, got ${items.length}`);
+        assert(items.every((m) => m.status === 'completed'), 'all must be completed');
+        assert(exec.seen.length === 3, `executor must have seen 3, got ${exec.seen.length}`);
+        console.log('✅ scenario 1: enqueue + happy path (3 missions completed)');
+    }
+    finally {
+        rmTmp(tmp);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 2 — backpressure
+// ─────────────────────────────────────────────────────────────
+async function scenarioBackpressure() {
+    const tmp = mkTmp();
+    try {
+        const exec = new CountingExecutor(80); // each takes ~80ms
+        const sched = makeScheduler(tmp, { executor: exec, maxConcurrent: 2 });
+        for (let i = 0; i < 5; i++)
+            sched.enqueue({ id: `m-${i}`, goal: `goal ${i}` });
+        // First tick: picks 2; others stay pending
+        await sched.tick();
+        // While the first 2 are still in flight, peak should be 2
+        await new Promise((r) => setTimeout(r, 40));
+        assert(exec.concurrentPeak <= 2, `concurrent peak must respect maxConcurrent, got ${exec.concurrentPeak}`);
+        // Wait for first 2 to complete, then tick again
+        await waitFor(() => sched.list().filter((m) => m.status === 'completed').length >= 2);
+        await sched.tick();
+        await waitFor(() => sched.list().filter((m) => m.status === 'completed').length >= 4);
+        await sched.tick();
+        await waitFor(() => sched.list().every((m) => m.status === 'completed'));
+        assert(exec.concurrentPeak <= 2, `final peak must not exceed maxConcurrent, got ${exec.concurrentPeak}`);
+        console.log(`✅ scenario 2: backpressure (peak ${exec.concurrentPeak} ≤ maxConcurrent=2)`);
+    }
+    finally {
+        rmTmp(tmp);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 3 — lock-respect (mission lock pre-held)
+// ─────────────────────────────────────────────────────────────
+async function scenarioLockRespect() {
+    const tmp = mkTmp();
+    try {
+        const baseDir = path.join(tmp, '.openlife', 'locks');
+        const externalLock = new DistributedLock_1.DistributedLock({ baseDir });
+        const sharedLock = new DistributedLock_1.DistributedLock({ baseDir });
+        // Pre-hold the lock for mission m-locked
+        const acq = externalLock.acquire('mission:m-locked', 60_000, { startHeartbeat: false });
+        assert(acq.ok, 'external acquire must succeed');
+        const exec = new CountingExecutor(10);
+        const sched = makeScheduler(tmp, { executor: exec, maxConcurrent: 5, lock: sharedLock });
+        sched.enqueue({ id: 'm-locked', goal: 'should be skipped' });
+        sched.enqueue({ id: 'm-free', goal: 'should run' });
+        await sched.tick();
+        await waitFor(() => sched.list().find((m) => m.id === 'm-free')?.status === 'completed');
+        const locked = sched.list().find((m) => m.id === 'm-locked');
+        assert(locked?.status === 'pending', `locked mission must stay pending, got ${locked?.status}`);
+        assert(exec.seen.includes('m-free'), 'free mission must have executed');
+        assert(!exec.seen.includes('m-locked'), 'locked mission must NOT have executed');
+        // Release external lock — next tick should now pick it up
+        externalLock.release(acq.lockId);
+        await sched.tick();
+        await waitFor(() => sched.list().find((m) => m.id === 'm-locked')?.status === 'completed');
+        console.log('✅ scenario 3: lock-respect (locked mission skipped, picked up after release)');
+    }
+    finally {
+        rmTmp(tmp);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Scenario 4 — reconcile orphans
+// ─────────────────────────────────────────────────────────────
+async function scenarioReconcileOrphans() {
+    const tmp = mkTmp();
+    try {
+        const queueFile = path.join(tmp, '.openlife', 'agent-queue.json');
+        // Seed queue with a "running" orphan (simulates a crash mid-flight)
+        (0, AtomicWriter_1.writeJsonAtomic)(queueFile, {
+            items: [
+                { id: 'm-orphan', goal: 'crashed last run', status: 'running', enqueuedAt: new Date().toISOString(), attempts: 1, startedAt: new Date(Date.now() - 60_000).toISOString() },
+                { id: 'm-fresh', goal: 'never started', status: 'pending', enqueuedAt: new Date().toISOString(), attempts: 0 },
+            ],
+            lastFlushedAt: new Date().toISOString(),
+        });
+        const exec = new CountingExecutor(10);
+        const sched = makeScheduler(tmp, { executor: exec });
+        const resetCount = sched.reconcileOrphans();
+        assert(resetCount === 1, `expected 1 orphan reset, got ${resetCount}`);
+        assert(sched.list().find((m) => m.id === 'm-orphan')?.status === 'pending', 'orphan must be reset to pending');
+        // Now tick — both should complete
+        await sched.tick();
+        await waitFor(() => sched.list().every((m) => m.status === 'completed'));
+        assert(exec.seen.includes('m-orphan') && exec.seen.includes('m-fresh'), 'both must execute after reconcile');
+        console.log('✅ scenario 4: reconcileOrphans resets stale running missions');
+    }
+    finally {
+        rmTmp(tmp);
+    }
+}
+// ─────────────────────────────────────────────────────────────
+// Driver
+// ─────────────────────────────────────────────────────────────
+async function main() {
+    console.log('🧪 test_queue_scheduler — Story 6.3 regression suite');
+    await scenarioHappyPath();
+    await scenarioBackpressure();
+    await scenarioLockRespect();
+    await scenarioReconcileOrphans();
+    console.log('');
+    console.log('TEST_QUEUE_SCHEDULER_OK');
+}
+main().catch((err) => {
+    console.error('❌ test_queue_scheduler FAILED:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});

package/dist/test_release_gate.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ReleaseWorkflow_1 = require("./orchestrator/ReleaseWorkflow");
+function assert(condition, message) {
+    if (!condition)
+        throw new Error(message);
+}
+async function main() {
+    const workflow = new ReleaseWorkflow_1.ReleaseWorkflow();
+    const checklist = workflow.create('release-gate-test', [
+        { name: 'doctor:models.json', ok: true },
+        { name: 'runtime:codex', ok: true },
+        { name: 'harness:runtime-policy-chain', ok: true }
+    ]);
+    assert(Array.isArray(checklist.checks), 'release gate workflow should return checks');
+    assert(checklist.checks.length === 3, 'release gate workflow should persist provided checks');
+    assert(checklist.approved === true, 'release gate workflow should approve when all checks pass');
+    console.log('TEST_RELEASE_GATE_OK');
+}
+main().catch((error) => {
+    console.error(error.message || error);
+    process.exit(1);
+});

package/dist/test_remote_publish.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * test_remote_publish.ts — Story 14.1 (v1.5)
+ *
+ * Asserts:
+ *   1. RemotePublisher.isConfigured() reflects the env flag.
+ *   2. Without OPENLIFE_REMOTE_PUBLISH_URL, publishAsset returns
+ *      `remote_publish_not_configured` without making a network call.
+ *   3. With a stubbed fetch and a valid PUT URL, publishAsset issues
+ *      a single PUT carrying:
+ *        - Content-Type: text/markdown
+ *        - X-Asset-Sha256 / X-Asset-Kind / X-Asset-Id headers
+ *        - Authorization: Bearer <token> when token env is set
+ *        - The asset body
+ *   4. Non-2xx response surfaces as `http_<status>`; never throws.
+ *   5. fetch throwing surfaces as `fetch_error`.
+ *   6. SquadCreator.publishWithRemote composes local publish + remote PUT
+ *      and carries both results on the envelope.
+ *   7. SHA mismatch (caller-provided != content-hash) is caught locally
+ *      and returns `sha_mismatch_local` without fetch ever being called.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+function assertTrue(cond, label) {
+    if (!cond)
+        throw new Error(`ASSERT_FAILED[${label}]`);
+}
+function mockFetch(captured, response) {
+    return (async (input, init) => {
+        const initObj = (init || {});
+        const headers = {};
+        if (initObj.headers && typeof initObj.headers === 'object') {
+            for (const [k, v] of Object.entries(initObj.headers))
+                headers[k] = v;
+        }
+        captured.calls += 1;
+        captured.lastUrl = String(input);
+        captured.lastInit = { method: initObj.method, headers, body: typeof initObj.body === 'string' ? initObj.body : undefined };
+        const respHeaders = new Map();
+        if (response.etag)
+            respHeaders.set('etag', response.etag);
+        return {
+            status: response.status,
+            headers: { get: (k) => respHeaders.get(k.toLowerCase()) ?? null },
+            text: async () => response.body || '',
+        };
+    });
+}
+async function main() {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'remote-pub-'));
+    process.env.OPENLIFE_STATE_DIR = tmp;
+    try {
+        const { RemotePublisher } = require('./orchestrator/RemotePublisher');
+        // ── Scenario 1 + 2: unconfigured returns stable code, no fetch ─────
+        delete process.env.OPENLIFE_REMOTE_PUBLISH_URL;
+        delete process.env.OPENLIFE_REMOTE_PUBLISH_TOKEN;
+        const captured0 = { calls: 0 };
+        const pub0 = new RemotePublisher({ fetchImpl: mockFetch(captured0, { status: 200 }) });
+        assertTrue(!pub0.isConfigured(), '[14.1] unconfigured isConfigured=false');
+        const assetFile = path.join(tmp, 'asset.md');
+        fs.writeFileSync(assetFile, '# hi\n', 'utf-8');
+        const sha = crypto.createHash('sha256').update('# hi\n').digest('hex');
+        const r0 = await pub0.publishAsset('squad', 'demo', sha, assetFile);
+        assertTrue(!r0.ok && r0.error === 'remote_publish_not_configured', `[14.1] unconfigured error code (got ${r0.error})`);
+        assertTrue(captured0.calls === 0, '[14.1] unconfigured does not fetch');
+        console.log('[14.1] unconfigured → stable error code, no fetch ✓');
+        // ── Scenario 3: happy path with token ──────────────────────────────
+        const captured1 = { calls: 0 };
+        const pub1 = new RemotePublisher({
+            baseUrl: 'https://registry.example/openlife',
+            token: 'tk-test',
+            fetchImpl: mockFetch(captured1, { status: 201, etag: 'W/"deadbeef"' }),
+        });
+        const r1 = await pub1.publishAsset('squad', 'demo', sha, assetFile);
+        assertTrue(r1.ok && r1.status === 201, `[14.1] happy path status=201 (got ${r1.status})`);
+        assertTrue(r1.etag === 'W/"deadbeef"', '[14.1] etag passthrough');
+        assertTrue(captured1.calls === 1, '[14.1] exactly one PUT');
+        assertTrue(captured1.lastInit?.method === 'PUT', `[14.1] verb is PUT (got ${captured1.lastInit?.method})`);
+        assertTrue(captured1.lastUrl === `https://registry.example/openlife/squad/demo/${encodeURIComponent(sha)}.md`, `[14.1] URL shape correct (got ${captured1.lastUrl})`);
+        assertTrue(captured1.lastInit?.headers?.['Content-Type'] === 'text/markdown', '[14.1] content-type set');
+        assertTrue(captured1.lastInit?.headers?.['X-Asset-Sha256'] === sha, '[14.1] sha header set');
+        assertTrue(captured1.lastInit?.headers?.['X-Asset-Kind'] === 'squad', '[14.1] kind header set');
+        assertTrue(captured1.lastInit?.headers?.['X-Asset-Id'] === 'demo', '[14.1] id header set');
+        assertTrue(captured1.lastInit?.headers?.['Authorization'] === 'Bearer tk-test', '[14.1] bearer auth set');
+        assertTrue(captured1.lastInit?.body === '# hi\n', '[14.1] body is the asset contents');
+        console.log('[14.1] happy path PUT request shape ✓');
+        // ── Scenario 4: non-2xx surfaces as http_<status> ──────────────────
+        const captured2 = { calls: 0 };
+        const pub2 = new RemotePublisher({ baseUrl: 'https://r.example', fetchImpl: mockFetch(captured2, { status: 403 }) });
+        const r2 = await pub2.publishAsset('skill', 'foo', sha, assetFile);
+        assertTrue(!r2.ok && r2.error === 'http_403', `[14.1] 403 → http_403 (got ${r2.error})`);
+        console.log('[14.1] non-2xx → http_<status> ✓');
+        // ── Scenario 5: fetch throws → fetch_error ────────────────────────
+        const throwingFetch = (async () => { throw new Error('network down'); });
+        const pub3 = new RemotePublisher({ baseUrl: 'https://r.example', fetchImpl: throwingFetch });
+        const r3 = await pub3.publishAsset('squad', 'foo', sha, assetFile);
+        assertTrue(!r3.ok && r3.error === 'fetch_error', `[14.1] thrown fetch → fetch_error (got ${r3.error})`);
+        console.log('[14.1] fetch throws → fetch_error, no crash ✓');
+        // ── Scenario 7: SHA mismatch caught locally ────────────────────────
+        const captured4 = { calls: 0 };
+        const pub4 = new RemotePublisher({ baseUrl: 'https://r.example', fetchImpl: mockFetch(captured4, { status: 200 }) });
+        const r4 = await pub4.publishAsset('squad', 'demo', '0'.repeat(64), assetFile);
+        assertTrue(!r4.ok && r4.error === 'sha_mismatch_local', `[14.1] sha mismatch caught (got ${r4.error})`);
+        assertTrue(captured4.calls === 0, '[14.1] sha mismatch → no fetch');
+        console.log('[14.1] sha mismatch detected locally, no fetch ✓');
+        // ── Scenario 6: SquadCreator.publishWithRemote composes both ───────
+        // We stub the RemotePublisher require to inject a mock fetch.
+        const pubPath = require.resolve('./orchestrator/RemotePublisher');
+        const origPub = require.cache[pubPath];
+        const captured5 = { calls: 0 };
+        require.cache[pubPath] = {
+            ...origPub,
+            exports: {
+                RemotePublisher: class {
+                    async publishAsset(kind, id, sha256) {
+                        captured5.calls += 1;
+                        return { ok: true, url: `https://stub/${kind}/${id}/${sha256}.md`, status: 201 };
+                    }
+                },
+            },
+        };
+        try {
+            const { SquadCreator } = require('./orchestrator/SquadCreator');
+            const sc = new SquadCreator({
+                catalogRoot: path.join(tmp, '.catalog', 'squads'),
+                templateRoot: path.resolve(__dirname, '..', 'dist-templates', 'squad-template'),
+            });
+            const seed = sc.create({
+                id: 'compose-squad', name: 'Compose', description: 'demo', version: '0.1.0', status: 'draft',
+                agents: [{ id: 'lead', name: 'Lead', role: 'lead' }],
+            });
+            assertTrue(seed.ok, '[14.1] seed squad created');
+            const composed = await sc.publishWithRemote('compose-squad');
+            assertTrue(composed.ok, '[14.1] local publish ok');
+            assertTrue(composed.remote && composed.remote.ok, '[14.1] remote publish ok');
+            assertTrue(captured5.calls === 1, '[14.1] composed call invokes RemotePublisher exactly once');
+        }
+        finally {
+            if (origPub)
+                require.cache[pubPath] = origPub;
+            else
+                delete require.cache[pubPath];
+        }
+        console.log('[14.1] SquadCreator.publishWithRemote composes local + remote ✓');
+    }
+    finally {
+        delete process.env.OPENLIFE_STATE_DIR;
+        delete process.env.OPENLIFE_REMOTE_PUBLISH_URL;
+        delete process.env.OPENLIFE_REMOTE_PUBLISH_TOKEN;
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+    console.log('TEST_REMOTE_PUBLISH_OK');
+}
+main().catch((err) => {
+    console.error('[remote-publish] FAILED:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});