@openrig/cli 0.4.2 → 0.4.4

package/daemon/dist/domain/startup-proof.js

@@ -0,0 +1,165 @@
+import { createHash, randomBytes } from "node:crypto";
+/** A presence-floor ACK is never proof (business rule 2). */
+const BARE_ACK_TOKENS = new Set(["", "ack", "ok", "ready", "done", "oriented", "acknowledged"]);
+export function computeContractHash(contractSource) {
+    return createHash("sha256").update(contractSource).digest("hex");
+}
+export function computeExpectedAnswer(challengeId, contractHash) {
+    return createHash("sha256").update(`${challengeId}:${contractHash}`).digest("hex").slice(0, 32);
+}
+function buildProofSubmissionCommand(challengeId, expectedAnswer) {
+    return `rig startup-proof submit --challenge-id ${challengeId} --answer ${expectedAnswer}`;
+}
+function buildPromptBlock(challengeId, expectedAnswer) {
+    return [
+        "--- OpenRig startup orientation challenge ---",
+        `challengeId: ${challengeId}`,
+        "After you have read your startup contract (all the files/identity above),",
+        "prove you oriented by submitting an authenticated startup_proof with EXACTLY:",
+        `  answer: ${expectedAnswer}`,
+        "",
+        "Run this command from your shell/tools after reading the contract:",
+        buildProofSubmissionCommand(challengeId, expectedAnswer),
+        "A bare acknowledgement (\"ack\"/\"ready\") is presence only, NEVER proof.",
+        "--------------------------------------------",
+    ].join("\n");
+}
+/**
+ * Derive + persist (append-only event) a per-launch challenge and return the
+ * prompt block. Call at fresh/fresh-fallback managed launch, BEFORE the
+ * startup prompt is delivered, so the ground truth exists before any proof.
+ */
+export function issueStartupChallenge(eventBus, input) {
+    const challengeId = randomBytes(16).toString("hex");
+    const contractHash = computeContractHash(input.contractSource);
+    const expectedAnswer = computeExpectedAnswer(challengeId, contractHash);
+    eventBus.emit({
+        type: "node.startup_challenged",
+        rigId: input.rigId,
+        nodeId: input.nodeId,
+        challengeId,
+        contractHash,
+    });
+    return { challengeId, contractHash, expectedAnswer, promptBlock: buildPromptBlock(challengeId, expectedAnswer) };
+}
+/**
+ * Verify an agent-emitted startup proof against the persisted per-launch
+ * challenge. Identity-bound + anti-replay + content-correct, or an
+ * append-only rejection with a per-reason code. Never sets `ready`; never
+ * routes through updateStartupStatus.
+ */
+export function verifyStartupProof(deps, input) {
+    const { store, eventBus } = deps;
+    const db = store.db;
+    // (a) IDENTITY — resolve {sessionId,nodeId,rigId}; an unknown identity is
+    // rejected and NO node-scoped state is projected (we cannot attribute an
+    // event to an unknown node).
+    const resolved = store.resolveSession({ sessionName: input.sessionName, nodeId: input.nodeId, runtime: input.runtime });
+    if (!resolved) {
+        return { ok: false, code: "identity_unbound", error: "startup_proof did not resolve to a managed session/node" };
+    }
+    // (a2) IDENTITY BINDING — the proof must bind to BOTH nodeId AND sessionName.
+    // `resolveSession` prioritizes nodeId and does NOT cross-check a supplied
+    // sessionName, so a proof carrying nodeId=node-a + sessionName=node-b would
+    // otherwise resolve to (and false-verify) node-a while claiming node-b's
+    // identity. Reject any conflict. We do NOT emit a node-scoped rejection for
+    // the resolved node here (mirroring identity_unbound): a mismatched /
+    // cross-seat / malformed proof must not touch the resolved node's projection
+    // at all — never verify it, and never downgrade it to `rejected` either.
+    // (runtime is a non-authoritative hint used for hook classification, not an
+    // identity key — the seat identity is the nodeId<->sessionName binding.)
+    if (input.sessionName && input.sessionName !== resolved.sessionName) {
+        return { ok: false, code: "identity_mismatch", error: "startup_proof nodeId and sessionName resolve to different seats" };
+    }
+    // Ground truth: the latest challenge issued for THIS node.
+    const challengeRow = db.prepare("SELECT payload, seq FROM events WHERE node_id = ? AND type = 'node.startup_challenged' ORDER BY seq DESC LIMIT 1").get(resolved.nodeId);
+    if (!challengeRow) {
+        // Never challenged (e.g. a resumed restore, or a non-agent path). A proof
+        // has nothing to verify against — reject as stale WITHOUT appending an
+        // event, so the node's oriented projection stays honest (`n-a`).
+        return { ok: false, code: "challenge_stale", error: "no active startup challenge for this node" };
+    }
+    let current;
+    try {
+        current = JSON.parse(challengeRow.payload);
+    }
+    catch {
+        return { ok: false, code: "challenge_stale", error: "startup challenge payload unreadable" };
+    }
+    const answer = (input.answer ?? "").trim();
+    const emitRejected = (reason) => {
+        eventBus.emit({
+            type: "node.startup_proof_rejected",
+            rigId: resolved.rigId,
+            nodeId: resolved.nodeId,
+            challengeId: input.challengeId ?? null,
+            reason,
+        });
+    };
+    // (b) THIS-LAUNCH — the answered challenge must be the current one. A
+    // replayed prior-launch answer carries a stale challengeId.
+    if (!input.challengeId || input.challengeId !== current.challengeId) {
+        emitRejected("challenge_stale");
+        return { ok: false, code: "challenge_stale", error: "challengeId does not match this launch's challenge (replay/stale)" };
+    }
+    // (d) bare-ACK / empty / presence-floor is never proof.
+    if (BARE_ACK_TOKENS.has(answer.toLowerCase())) {
+        emitRejected("bare_ack");
+        return { ok: false, code: "bare_ack", error: "a bare acknowledgement is presence only, never proof" };
+    }
+    // (c) CONTRACT — recompute the expected answer from the persisted contract
+    // hash. A plausible-but-content-wrong answer is rejected.
+    const expected = computeExpectedAnswer(current.challengeId, current.contractHash);
+    if (answer !== expected) {
+        emitRejected("contract_mismatch");
+        return { ok: false, code: "contract_mismatch", error: "proof answer does not match the delivered startup contract" };
+    }
+    eventBus.emit({
+        type: "node.startup_proof_verified",
+        rigId: resolved.rigId,
+        nodeId: resolved.nodeId,
+        sessionId: resolved.sessionId,
+        challengeId: current.challengeId,
+        contractHash: current.contractHash,
+    });
+    return { ok: true, nodeId: resolved.nodeId, rigId: resolved.rigId, challengeId: current.challengeId };
+}
+/**
+ * Project the oriented signal for a node from the append-only proof events.
+ * `verified` requires a verified proof for the CURRENT (latest) challenge;
+ * `missing` = challenged but not yet proven; `rejected` = the latest proof for
+ * the current challenge was rejected; `n-a` = never challenged (resumed /
+ * non-agent / skip-harness). NEVER derived from startup_status.
+ */
+export function deriveOriented(db, nodeId) {
+    const rows = db.prepare("SELECT type, payload, seq FROM events WHERE node_id = ? AND type IN ('node.startup_challenged','node.startup_proof_verified','node.startup_proof_rejected') ORDER BY seq DESC").all(nodeId);
+    // Latest challenge governs.
+    const challengeRow = rows.find((r) => r.type === "node.startup_challenged");
+    if (!challengeRow)
+        return "n-a";
+    let currentChallengeId;
+    try {
+        currentChallengeId = JSON.parse(challengeRow.payload).challengeId;
+    }
+    catch {
+        return "n-a";
+    }
+    // The most-recent proof event referencing the current challenge decides
+    // verified-vs-rejected (a later verify overrides an earlier reject).
+    for (const row of rows) {
+        if (row.type === "node.startup_challenged")
+            continue;
+        let cid = null;
+        try {
+            cid = JSON.parse(row.payload).challengeId;
+        }
+        catch {
+            continue;
+        }
+        if (cid !== currentChallengeId)
+            continue;
+        return row.type === "node.startup_proof_verified" ? "verified" : "rejected";
+    }
+    return "missing";
+}
+//# sourceMappingURL=startup-proof.js.map

package/daemon/dist/domain/startup-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-proof.js","sourceRoot":"","sources":["../../src/domain/startup-proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA6CtD,6DAA6D;AAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAEhG,MAAM,UAAU,mBAAmB,CAAC,cAAsB;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,YAAoB;IAC7E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAmB,EAAE,cAAsB;IAC9E,OAAO,2CAA2C,WAAW,aAAa,cAAc,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB,EAAE,cAAsB;IACnE,OAAO;QACL,+CAA+C;QAC/C,gBAAgB,WAAW,EAAE;QAC7B,2EAA2E;QAC3E,+EAA+E;QAC/E,aAAa,cAAc,EAAE;QAC7B,EAAE;QACF,oEAAoE;QACpE,2BAA2B,CAAC,WAAW,EAAE,cAAc,CAAC;QACxD,2EAA2E;QAC3E,8CAA8C;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAkB,EAClB,KAAgE;IAEhE,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAExE,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW;QACX,YAAY;KACb,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;AACnH,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAuD,EACvD,KAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAEpB,0EAA0E;IAC1E,yEAAyE;IACzE,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;IACnH,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC;IAC5H,CAAC;IAED,2DAA2D;IAC3D,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC7B,kHAAkH,CACnH,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAA6B,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,OAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAkD,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,MAAyB,EAAE,EAAE;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACpE,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,mEAAmE,EAAE,CAAC;IAC5H,CAAC;IAED,wDAAwD;IACxD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9C,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACxG,CAAC;IAED,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;IACvH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;AACxG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,+KAA+K,CAChL,CAAC,GAAG,CAAC,MAAM,CAA0D,CAAC;IAEvE,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,kBAAkB,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAA6B,CAAC,WAAW,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;YAAE,SAAS;QACrD,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,CAAC;YAAC,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAoC,CAAC,WAAW,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1G,IAAI,GAAG,KAAK,kBAAkB;YAAE,SAAS;QACzC,OAAO,GAAG,CAAC,IAAI,KAAK,6BAA6B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/daemon/dist/domain/successor-session-launcher.d.ts

@@ -0,0 +1,103 @@
+import type { TmuxAdapter } from "../adapters/tmux.js";
+import type { DiscoveryRepository } from "./discovery-repository.js";
+import type { RuntimeAdapter } from "./runtime-adapter.js";
+/**
+ * OPR.0.4.3.04 — the explicit successor-creation seam for the seat-handover
+ * full-cycle composer (IMPL-SPEC §2.1b; resolves the rev1-dual BLOCKING B1).
+ *
+ * It creates an UNMANAGED, discoverable tmux successor for a non-discovered
+ * handover source (fresh), routes it through REAL runtime startup so it becomes
+ * a LIVE, READY agent (not a bare shell), records it as an ACTIVE discovery
+ * candidate, and returns that candidate + the captured launch resume token so
+ * the composer can route it through the EXISTING discovered->commit rebind path.
+ * It deliberately does NOT `registerClaimedSession`/`upsertBinding` — the
+ * session stays unmanaged until the handover `commit` claims it, so the
+ * departing seat's binding is never touched before successor readiness.
+ *
+ * B1 (rev1-dual fix): the successor is launched through the runtime adapter's
+ * `launchHarness` + readiness poll — the SAME startup/readiness primitives
+ * `StartupOrchestrator` drives — WITHOUT the ahead-of-commit managed-session
+ * registration those `StartupOrchestrator.startNode` bookkeeping steps would
+ * require (updateStartupStatus / node_startup_context / updateResumeToken by
+ * sessionId all need a registered session row). Driving the adapter primitives
+ * directly is how we make the successor a live agent while keeping it unmanaged
+ * until commit. Any launch/readiness failure UNWINDS the created session and
+ * leaves the original binding intact (commit never runs).
+ *
+ * Why not `NodeLauncher.launchNode`: it refuses a bound node and, on success,
+ * registers a managed session + binding in the same transaction — which would
+ * trip `successor_already_managed` in the commit path. This seam creates a
+ * DISTINCT unmanaged session instead.
+ */
+export interface SuccessorNode {
+    id: string;
+    runtime: string | null;
+    cwd: string | null;
+}
+export type SuccessorLaunchResult = {
+    ok: true;
+    discoveredId: string;
+    tmuxSession: string;
+    tmuxPane: string;
+    resumeToken?: string;
+    resumeType?: string;
+} | {
+    ok: false;
+    code: string;
+    step: "create_successor" | "resolve_pane" | "start_agent";
+    message: string;
+};
+export declare class SuccessorSessionLauncher {
+    private tmuxAdapter;
+    private discoveryRepo;
+    private sessionEnv;
+    private newId;
+    private runtimeAdapters;
+    private readinessTimeoutMs;
+    private sleep;
+    constructor(tmuxAdapter: TmuxAdapter, discoveryRepo: DiscoveryRepository, opts?: {
+        sessionEnv?: Record<string, string | undefined>;
+        newId?: () => string;
+        /** Runtime adapters keyed by runtime, used to launch + ready-probe the
+         *  successor agent. Absent → a fresh successor cannot be launched. */
+        runtimeAdapters?: Record<string, RuntimeAdapter>;
+        /** Readiness timeout in ms (default 30000, mirrors StartupOrchestrator). */
+        readinessTimeoutMs?: number;
+        /** Injectable sleep (tests). */
+        sleep?: (ms: number) => Promise<void>;
+    });
+    /**
+     * Create the unmanaged successor tmux session, launch it into a LIVE agent,
+     * and record it as an active discovery candidate. The candidate satisfies the
+     * discovered->commit guards: active (upsert sets status='active'), distinct
+     * name, matching runtime hint, unmanaged (no binding/session claims it),
+     * tmux-present (just created). The returned resume token (if any) is the
+     * launch-scraped token the composer persists at commit (B2 for fresh).
+     */
+    createSuccessor(input: {
+        node: SuccessorNode;
+        departingSessionName: string;
+    }): Promise<SuccessorLaunchResult>;
+    /**
+     * B1 — launch the successor into a live, ready agent via the runtime adapter's
+     * `launchHarness` + readiness probe (the same primitives StartupOrchestrator
+     * drives), capturing the launch resume token. No session/binding is
+     * registered — the successor stays unmanaged until commit. The token is NEVER
+     * logged or placed in a returned message.
+     */
+    private startAgent;
+    /**
+     * Wait for harness readiness with exponential backoff (1s→2s→…→16s cap,
+     * 30s default timeout) — mirrors StartupOrchestrator.waitForReady.
+     */
+    private waitForReady;
+    /**
+     * Failure cleanup for a created-but-not-committed successor. There is NO
+     * binding to unwind (commit never ran), so this only kills the unmanaged
+     * tmux session and marks the discovery candidate vanished. The original
+     * seat/binding is untouched.
+     */
+    cleanup(tmuxSession: string, discoveredId: string | null): Promise<void>;
+    private killBestEffort;
+}
+//# sourceMappingURL=successor-session-launcher.d.ts.map

package/daemon/dist/domain/successor-session-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"successor-session-launcher.d.ts","sourceRoot":"","sources":["../../src/domain/successor-session-launcher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAgC,MAAM,sBAAsB,CAAC;AAGzF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACpH;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,GAAG,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G,qBAAa,wBAAwB;IACnC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAsB;IAC3C,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,eAAe,CAAiC;IACxD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,KAAK,CAAgC;gBAG3C,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,mBAAmB,EAClC,IAAI,GAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;QAChD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;QACrB;8EACsE;QACtE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACjD,4EAA4E;QAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,gCAAgC;QAChC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAClC;IAWR;;;;;;;OAOG;IACG,eAAe,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA0FnH;;;;;;OAMG;YACW,UAAU;IAmFxB;;;OAGG;YACW,YAAY;IAsB1B;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAKhE,cAAc;CAO7B"}

package/daemon/dist/domain/successor-session-launcher.js

@@ -0,0 +1,246 @@
+import { ulid } from "ulid";
+import { isAttentionRequiredReadinessCode } from "./runtime-adapter.js";
+export class SuccessorSessionLauncher {
+    tmuxAdapter;
+    discoveryRepo;
+    sessionEnv;
+    newId;
+    runtimeAdapters;
+    readinessTimeoutMs;
+    sleep;
+    constructor(tmuxAdapter, discoveryRepo, opts = {}) {
+        this.tmuxAdapter = tmuxAdapter;
+        this.discoveryRepo = discoveryRepo;
+        this.sessionEnv = opts.sessionEnv ?? {};
+        this.newId = opts.newId ?? ulid;
+        this.runtimeAdapters = opts.runtimeAdapters ?? {};
+        this.readinessTimeoutMs = opts.readinessTimeoutMs ?? 30_000;
+        this.sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    }
+    /**
+     * Create the unmanaged successor tmux session, launch it into a LIVE agent,
+     * and record it as an active discovery candidate. The candidate satisfies the
+     * discovered->commit guards: active (upsert sets status='active'), distinct
+     * name, matching runtime hint, unmanaged (no binding/session claims it),
+     * tmux-present (just created). The returned resume token (if any) is the
+     * launch-scraped token the composer persists at commit (B2 for fresh).
+     */
+    async createSuccessor(input) {
+        // Distinct successor name derived from the departing occupant's (valid)
+        // session name so it stays inside the tmux/OpenRig naming charset while
+        // never colliding with the current occupant.
+        const distinctName = `${input.departingSessionName}-h${this.newId().slice(-8)}`;
+        // OpenRig identity env mirrors NodeLauncher.launchNode's pattern so the
+        // successor self-identifies + reports activity exactly like a launched seat.
+        const env = compactEnv({
+            OPENRIG_NODE_ID: input.node.id,
+            OPENRIG_SESSION_NAME: distinctName,
+            OPENRIG_RUNTIME: input.node.runtime ?? undefined,
+            ...this.sessionEnv,
+        });
+        const cwd = input.node.cwd ?? undefined;
+        // Driver note 1: create via the ACTUAL adapter signature createSession(name, cwd, env).
+        const created = await this.tmuxAdapter.createSession(distinctName, cwd, env);
+        if (!created.ok) {
+            // tmux can run hooks after creating the session; if a hook fails,
+            // `new-session` can return non-zero while the unmanaged session remains.
+            // Do not kill on duplicate_session, which may be a real pre-existing
+            // collision. All other failed-create cases get best-effort cleanup.
+            if (created.code !== "duplicate_session") {
+                await this.killBestEffort(distinctName);
+            }
+            return { ok: false, code: created.code, step: "create_successor", message: created.message };
+        }
+        // Driver note 2: resolve the real tmux pane AFTER create, BEFORE upsertDiscoveredSession —
+        // upsert requires a pane, and createSession returns only { ok: true }.
+        // A list-panes probe can THROW (permission/socket errors rethrow from the
+        // adapter); treat a throw EXACTLY like the null-pane case — kill the
+        // just-created successor and return the structured resolve_pane failure, so
+        // the unmanaged session is never left orphaned and the caller never sees an
+        // unstructured rejection/500.
+        let pane;
+        try {
+            const panes = await this.tmuxAdapter.listPanes(distinctName);
+            pane = panes.find((p) => p.active) ?? panes[0];
+        }
+        catch (err) {
+            await this.tmuxAdapter.killSession(distinctName);
+            return {
+                ok: false,
+                code: "pane_probe_failed",
+                step: "resolve_pane",
+                message: `Could not probe tmux panes for successor session "${distinctName}": ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        if (!pane) {
+            // No pane resolvable — kill the just-created session so nothing leaks.
+            await this.tmuxAdapter.killSession(distinctName);
+            return {
+                ok: false,
+                code: "pane_unresolved",
+                step: "resolve_pane",
+                message: `Could not resolve a tmux pane for successor session "${distinctName}".`,
+            };
+        }
+        // B1 — route the successor through REAL runtime startup so it becomes a LIVE,
+        // READY agent BEFORE it can be committed. On ANY launch/readiness failure,
+        // unwind (kill the unmanaged session) and fail loudly naming the step; the
+        // original seat/binding is untouched because commit never runs.
+        const started = await this.startAgent(input.node, distinctName, pane.id, cwd);
+        if (!started.ok) {
+            await this.killBestEffort(distinctName);
+            return { ok: false, code: started.code, step: "start_agent", message: started.message };
+        }
+        const discovered = this.discoveryRepo.upsertDiscoveredSession({
+            tmuxSession: distinctName,
+            tmuxPane: pane.id,
+            // The hint equals the node's own runtime, so the commit-path runtime check
+            // always matches; null runtime records as "unknown" (which the check skips).
+            runtimeHint: (input.node.runtime ?? "unknown"),
+            confidence: "high",
+            cwd: input.node.cwd ?? undefined,
+        });
+        return {
+            ok: true,
+            discoveredId: discovered.id,
+            tmuxSession: distinctName,
+            tmuxPane: pane.id,
+            resumeToken: started.resumeToken,
+            resumeType: started.resumeType,
+        };
+    }
+    /**
+     * B1 — launch the successor into a live, ready agent via the runtime adapter's
+     * `launchHarness` + readiness probe (the same primitives StartupOrchestrator
+     * drives), capturing the launch resume token. No session/binding is
+     * registered — the successor stays unmanaged until commit. The token is NEVER
+     * logged or placed in a returned message.
+     */
+    async startAgent(node, tmuxSession, tmuxPane, cwd) {
+        const adapter = node.runtime ? this.runtimeAdapters[node.runtime] : undefined;
+        if (!adapter) {
+            return {
+                ok: false,
+                code: "successor_runtime_unsupported",
+                message: `No runtime adapter for "${node.runtime ?? "unknown"}"; a live successor cannot be launched for this seat.`,
+            };
+        }
+        // Transient binding for the adapter launch/readiness probe — the successor
+        // is unmanaged, so there is no persisted binding row (id/updatedAt are inert
+        // for the adapter; it reads tmuxSession/tmuxPane/cwd). Model/config profile
+        // are not resolved here (v0): a fresh successor launches with the runtime's
+        // default profile, not the departing seat's AgentSpec-configured model —
+        // a live default-config agent beats a dead shell; full-fidelity relaunch is
+        // a tracked follow-on.
+        const binding = {
+            id: "",
+            nodeId: node.id,
+            attachmentType: "tmux",
+            tmuxSession,
+            tmuxWindow: null,
+            tmuxPane,
+            cmuxWorkspace: null,
+            cmuxSurface: null,
+            updatedAt: "",
+            cwd: cwd ?? "",
+        };
+        let launch;
+        try {
+            launch = await adapter.launchHarness(binding, { name: tmuxSession });
+        }
+        catch (err) {
+            return { ok: false, code: "successor_launch_failed", message: `Successor harness launch threw: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        if (!launch.ok) {
+            return { ok: false, code: "successor_launch_failed", message: `Successor harness launch failed: ${launch.error}` };
+        }
+        // Capture the launch-scraped resume token (never logged). Persisted by the
+        // composer at commit with provenance "scrape" (B2, launched modes).
+        let resumeToken;
+        let resumeType;
+        const trimmed = launch.resumeToken?.trim();
+        if (trimmed) {
+            resumeToken = trimmed;
+            resumeType = launch.resumeType;
+        }
+        // OPR.0.4.3.04 rev2 code-review fix — checkReady/waitForReady can THROW after
+        // createSession already succeeded (adapter/socket/permission errors rethrow).
+        // A thrown exception must NOT reject createSuccessor before its kill/unwind
+        // runs (that would LEAK the unmanaged successor + surface an unstructured 500).
+        // Catch it here and return a STRUCTURED ok:false so the caller kills the
+        // just-created session (killBestEffort) and fails loudly at step=start_agent —
+        // exactly like a returned readiness failure.
+        let readiness;
+        try {
+            readiness = await this.waitForReady(adapter, binding);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                code: "successor_readiness_failed",
+                message: `Successor readiness probe threw: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        if (!readiness.ready) {
+            return {
+                ok: false,
+                code: isAttentionRequiredReadinessCode(readiness.code) ? "successor_attention_required" : "successor_not_ready",
+                message: `Successor did not become a ready agent: ${readiness.reason ?? "readiness timeout"}`,
+            };
+        }
+        return { ok: true, resumeToken, resumeType };
+    }
+    /**
+     * Wait for harness readiness with exponential backoff (1s→2s→…→16s cap,
+     * 30s default timeout) — mirrors StartupOrchestrator.waitForReady.
+     */
+    async waitForReady(adapter, binding) {
+        const startTime = Date.now();
+        let delay = 1000;
+        const maxDelay = 16_000;
+        while (true) {
+            const result = await adapter.checkReady(binding);
+            if (result.ready)
+                return result;
+            if (isAttentionRequiredReadinessCode(result.code))
+                return result;
+            const elapsed = Date.now() - startTime;
+            if (elapsed + delay > this.readinessTimeoutMs) {
+                const finalResult = await adapter.checkReady(binding);
+                if (finalResult.ready)
+                    return finalResult;
+                return { ready: false, reason: result.reason ?? "readiness timeout" };
+            }
+            await this.sleep(delay);
+            delay = Math.min(delay * 2, maxDelay);
+        }
+    }
+    /**
+     * Failure cleanup for a created-but-not-committed successor. There is NO
+     * binding to unwind (commit never ran), so this only kills the unmanaged
+     * tmux session and marks the discovery candidate vanished. The original
+     * seat/binding is untouched.
+     */
+    async cleanup(tmuxSession, discoveredId) {
+        await this.tmuxAdapter.killSession(tmuxSession);
+        if (discoveredId)
+            this.discoveryRepo.markVanished([discoveredId]);
+    }
+    async killBestEffort(tmuxSession) {
+        try {
+            await this.tmuxAdapter.killSession(tmuxSession);
+        }
+        catch {
+            // Cleanup must not mask the original failure.
+        }
+    }
+}
+function compactEnv(input) {
+    const result = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (typeof value === "string" && value.length > 0)
+            result[key] = value;
+    }
+    return result;
+}
+//# sourceMappingURL=successor-session-launcher.js.map

package/daemon/dist/domain/successor-session-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"successor-session-launcher.js","sourceRoot":"","sources":["../../src/domain/successor-session-launcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAwCxE,MAAM,OAAO,wBAAwB;IAC3B,WAAW,CAAc;IACzB,aAAa,CAAsB;IACnC,UAAU,CAAqC;IAC/C,KAAK,CAAe;IACpB,eAAe,CAAiC;IAChD,kBAAkB,CAAS;IAC3B,KAAK,CAAgC;IAE7C,YACE,WAAwB,EACxB,aAAkC,EAClC,OAUI,EAAE;QAEN,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,KAA4D;QAChF,wEAAwE;QACxE,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEhF,wEAAwE;QACxE,6EAA6E;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YAC9B,oBAAoB,EAAE,YAAY;YAClC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS;YAChD,GAAG,IAAI,CAAC,UAAU;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC;QAExC,wFAAwF;QACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,kEAAkE;YAClE,yEAAyE;YACzE,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/F,CAAC;QAED,2FAA2F;QAC3F,uEAAuE;QACvE,0EAA0E;QAC1E,qEAAqE;QACrE,4EAA4E;QAC5E,4EAA4E;QAC5E,8BAA8B;QAC9B,IAAI,IAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAC7D,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,qDAAqD,YAAY,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACnI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,uEAAuE;YACvE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,wDAAwD,YAAY,IAAI;aAClF,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC;YAC5D,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,2EAA2E;YAC3E,6EAA6E;YAC7E,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAgB;YAC7D,UAAU,EAAE,MAAM;YAClB,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS;SACjC,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,WAAW,EAAE,YAAY;YACzB,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CACtB,IAAmB,EACnB,WAAmB,EACnB,QAAgB,EAChB,GAAuB;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,2BAA2B,IAAI,CAAC,OAAO,IAAI,SAAS,uDAAuD;aACrH,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,uBAAuB;QACvB,MAAM,OAAO,GAAgB;YAC3B,EAAE,EAAE,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,cAAc,EAAE,MAAM;YACtB,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,QAAQ;YACR,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE;YACb,GAAG,EAAE,GAAG,IAAI,EAAE;SACf,CAAC;QAEF,IAAI,MAA4D,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACxJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,oCAAoC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACrH,CAAC;QAED,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,WAA+B,CAAC;QACpC,IAAI,UAA8B,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,GAAG,OAAO,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,gFAAgF;QAChF,yEAAyE;QACzE,+EAA+E;QAC/E,6CAA6C;QAC7C,IAAI,SAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAChG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,gCAAgC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,qBAAqB;gBAC/G,OAAO,EAAE,2CAA2C,SAAS,CAAC,MAAM,IAAI,mBAAmB,EAAE;aAC9F,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CAAC,OAAuB,EAAE,OAAoB;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC;QAExB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC;YAChC,IAAI,gCAAgC,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC;YAEjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACvC,IAAI,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,WAAW,CAAC,KAAK;oBAAE,OAAO,WAAW,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA2B;QAC5D,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,YAAY;YAAE,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,WAAmB;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAyC;IAC3D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/daemon/dist/domain/topology/multi-rig-launcher.d.ts

@@ -0,0 +1,49 @@
+import type { TopologyManifest } from "./topology-manifest.js";
+import type { HostEntry, HostRegistryLoadResult } from "../hosts/hosts-registry-reader.js";
+export type TopologyEntryStatus = "ok" | "failed" | "skipped";
+export interface TopologyEntryResult {
+    rigRef: string;
+    /** Uniform on every entry: the placed host id, or the literal "local". */
+    host: string;
+    status: TopologyEntryStatus;
+    error?: string;
+}
+export interface TopologyLaunchResult {
+    /** True ONLY when every entry is ok (FR-5 — no false green). */
+    ok: boolean;
+    entries: TopologyEntryResult[];
+}
+export interface MultiRigLauncherDeps {
+    /** The SAME public lock pair the up route uses (bootstrap-orchestrator). */
+    tryAcquire: (sourceRef: string) => boolean;
+    release: (sourceRef: string) => void;
+    /** The existing local single-rig leaf (public bootstrap() via routes/up.ts
+     *  wiring). Resolves ok:false with the leaf's own error on failure — the
+     *  launcher invents no failure taxonomy. */
+    launchLocal: (source: string) => Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+    /** The shipped remote POST /api/up leaf for a placed entry. */
+    launchRemote: (source: string, host: HostEntry) => Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+    /** Lazy hosts-registry read (shared reader) — consulted only when the
+     *  manifest actually places entries on hosts. */
+    loadRegistry: () => HostRegistryLoadResult;
+    /** Resolve a local entry's manifest source string to the EXACT ref used
+     *  for BOTH the lock and the leaf (guard fixback F1): the orchestrator
+     *  normalizes lock keys with path.resolve, so locking the raw relative
+     *  string would key against the daemon cwd while the leaf launches the
+     *  manifest-dir-resolved file — false lock negatives (standalone up of
+     *  the real path doesn't conflict) AND false positives (two manifests'
+     *  './a.yaml' collide across different files). Identity when omitted. */
+    resolveLocalRef?: (source: string) => string;
+}
+export declare class MultiRigLauncher {
+    private deps;
+    constructor(deps: MultiRigLauncherDeps);
+    launch(manifest: TopologyManifest): Promise<TopologyLaunchResult>;
+}
+//# sourceMappingURL=multi-rig-launcher.d.ts.map

package/daemon/dist/domain/topology/multi-rig-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-rig-launcher.d.ts","sourceRoot":"","sources":["../../../src/domain/topology/multi-rig-launcher.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAG3F,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC;;gDAE4C;IAC5C,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,+DAA+D;IAC/D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F;qDACiD;IACjD,YAAY,EAAE,MAAM,sBAAsB,CAAC;IAC3C;;;;;;6EAMyE;IACzE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAKD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,IAAI,CAAuB;gBAEvB,IAAI,EAAE,oBAAoB;IAIhC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAqGxE"}