@openrig/cli 0.4.2 → 0.4.4

package/daemon/dist/domain/topology/multi-rig-launcher.js

@@ -0,0 +1,132 @@
+// OPR.0.4.4.11 — MultiRigLauncher: the THIN walker (FR-3/FR-4/FR-5).
+//
+// It INVOKES the existing single-rig leaves — it never re-implements stages,
+// locks, provenance, or result shapes. A local entry runs through the SAME
+// public bootstrap() entry + tryAcquire/release lock pair routes/up.ts uses
+// (guard G-2: the per-sourceRef lock is ROUTE-side today — bootstrap() never
+// acquires; the launcher explicitly participates in that same lock set,
+// acquire before the leaf, release in finally on success AND failure). A
+// host-placed entry runs through the shipped remote POST /api/up leaf. Both
+// leaves are injected so this module stays testable and the wiring in
+// routes/up.ts (the ONLY production caller) binds the real seams.
+//
+// Aggregate contract (arch ruling 5, verbatim): status is the CLOSED enum
+// {ok | failed | skipped}; entries after the failed one report `skipped`
+// EXPLICITLY (never absent — omission-proof); `host` is present uniformly on
+// every entry (the literal "local" for local entries); overall success =
+// every entry ok. Stop-on-failure is the ONLY v0 behavior (FR-5): no new
+// entry starts after a failure; already-started rigs are reported honestly
+// (mixed state, no rollback ceremony).
+import { resolvePlacementHost } from "../hosts/hosts-registry-reader.js";
+/** Mirrors the route's 409 lock-conflict semantics for a topology entry. */
+const LOCK_CONFLICT_ERROR = "Already in progress for this source (conflict): a concurrent up holds this rig's launch lock";
+export class MultiRigLauncher {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async launch(manifest) {
+        const entries = manifest.rigs;
+        // Every entry starts explicitly skipped — an entry the walk never
+        // reaches is REPORTED, not absent (omission-proof aggregate).
+        const results = entries.map((e) => ({
+            rigRef: e.source,
+            host: e.host ?? "local",
+            status: "skipped",
+        }));
+        // ── Pre-launch placement validation (FR-1/FR-4: per-entry structured
+        // errors BEFORE any launch attempt). Registry is read once, only if a
+        // host-placed entry exists. Any placement failure aborts the whole run
+        // before the first leaf call: bad entries report failed, the rest stay
+        // skipped.
+        const placed = new Map();
+        if (entries.some((e) => e.host !== undefined)) {
+            const reg = this.deps.loadRegistry();
+            let placementFailed = false;
+            for (let i = 0; i < entries.length; i++) {
+                const hostId = entries[i].host;
+                if (hostId === undefined)
+                    continue;
+                if (!reg.ok) {
+                    results[i] = { ...results[i], status: "failed", error: reg.error };
+                    placementFailed = true;
+                    continue;
+                }
+                const res = resolvePlacementHost(reg.registry, hostId);
+                if (!res.ok) {
+                    results[i] = { ...results[i], status: "failed", error: res.error };
+                    placementFailed = true;
+                }
+                else {
+                    placed.set(i, res.host);
+                }
+            }
+            if (placementFailed)
+                return { ok: false, entries: results };
+        }
+        // ── Staged walk: entries START in manifest order under the fixed cap
+        // (default 1 = strictly sequential); a failure stops all further starts
+        // while in-flight entries complete and report honestly.
+        let nextIndex = 0;
+        let stopped = false;
+        const runEntry = async (i) => {
+            const entry = entries[i];
+            const hostEntry = placed.get(i);
+            try {
+                if (hostEntry) {
+                    const res = await this.deps.launchRemote(entry.source, hostEntry);
+                    results[i] = {
+                        rigRef: entry.source,
+                        host: hostEntry.id,
+                        status: res.ok ? "ok" : "failed",
+                        ...(res.ok ? {} : { error: res.error ?? "remote up failed" }),
+                    };
+                    return;
+                }
+                // Local: the route-side lock discipline, explicitly (guard G-2).
+                // Lock key and launch ref are the SAME resolved string (guard F1) —
+                // the aggregate's rigRef stays the raw manifest string for display.
+                const launchRef = this.deps.resolveLocalRef ? this.deps.resolveLocalRef(entry.source) : entry.source;
+                if (!this.deps.tryAcquire(launchRef)) {
+                    results[i] = { rigRef: entry.source, host: "local", status: "failed", error: LOCK_CONFLICT_ERROR };
+                    return;
+                }
+                try {
+                    const res = await this.deps.launchLocal(launchRef);
+                    results[i] = {
+                        rigRef: entry.source,
+                        host: "local",
+                        status: res.ok ? "ok" : "failed",
+                        ...(res.ok ? {} : { error: res.error ?? "bootstrap failed" }),
+                    };
+                }
+                finally {
+                    this.deps.release(launchRef);
+                }
+            }
+            catch (err) {
+                results[i] = {
+                    rigRef: entry.source,
+                    host: hostEntry ? hostEntry.id : "local",
+                    status: "failed",
+                    error: err.message,
+                };
+            }
+        };
+        const cap = Math.max(1, manifest.concurrency);
+        const workers = Array.from({ length: Math.min(cap, entries.length) }, async () => {
+            while (!stopped) {
+                const i = nextIndex;
+                if (i >= entries.length)
+                    return;
+                nextIndex += 1;
+                await runEntry(i);
+                if (results[i].status === "failed")
+                    stopped = true; // FR-5: stop at the failed entry
+            }
+        });
+        await Promise.all(workers);
+        return { ok: results.every((r) => r.status === "ok"), entries: results };
+    }
+}
+//# sourceMappingURL=multi-rig-launcher.js.map

package/daemon/dist/domain/topology/multi-rig-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-rig-launcher.js","sourceRoot":"","sources":["../../../src/domain/topology/multi-rig-launcher.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,uCAAuC;AAIvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAyCzE,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,8FAA8F,CAAC;AAE3H,MAAM,OAAO,gBAAgB;IACnB,IAAI,CAAuB;IAEnC,YAAY,IAA0B;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA0B;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC9B,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,OAAO,GAA0B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;YACvB,MAAM,EAAE,SAAgC;SACzC,CAAC,CAAC,CAAC;QAEJ,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,WAAW;QACX,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;gBAChC,IAAI,MAAM,KAAK,SAAS;oBAAE,SAAS;gBACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,OAAO,CAAC,CAAC,CAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;oBACrE,eAAe,GAAG,IAAI,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,OAAO,CAAC,CAAC,CAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;oBACrE,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,IAAI,eAAe;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC9D,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAClE,OAAO,CAAC,CAAC,CAAC,GAAG;wBACX,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,IAAI,EAAE,SAAS,CAAC,EAAE;wBAClB,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;wBAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;qBAC9D,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,iEAAiE;gBACjE,oEAAoE;gBACpE,oEAAoE;gBACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;oBACnG,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;oBACnD,OAAO,CAAC,CAAC,CAAC,GAAG;wBACX,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;wBAChC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;qBAC9D,CAAC;gBACJ,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,CAAC,GAAG;oBACX,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;oBACxC,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAC/E,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,MAAM,CAAC,GAAG,SAAS,CAAC;gBACpB,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAO;gBAChC,SAAS,IAAI,CAAC,CAAC;gBACf,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAClB,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,GAAG,IAAI,CAAC,CAAC,iCAAiC;YACxF,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3B,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/daemon/dist/domain/topology/remote-up-leaf.d.ts

@@ -0,0 +1,29 @@
+import type { HttpHostEntry } from "../hosts/hosts-registry-reader.js";
+export interface RemoteUpLeafDeps {
+    /** Injected for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    env?: Record<string, string | undefined>;
+    readFile?: (path: string) => string;
+    /** Bounded remote-up deadline (rev1-r2 R2-B1). Defaults to the
+     *  long-running rig-up budget — remote bootstrap legitimately runs
+     *  minutes, but never forever. Passed EXPLICITLY to the shared core
+     *  (the deadline class is this call-site's decision, per the arch
+     *  required-argument sharpening). */
+    timeoutMs?: number;
+}
+/** Matches the CLI's LONG_RUNNING_UP_TIMEOUT_MS for standalone remote ups. */
+export declare const REMOTE_UP_TIMEOUT_MS = 120000;
+export interface RemoteUpBody {
+    sourceRef: string;
+    autoApprove?: boolean;
+}
+/** POST the placed entry to the remote daemon's shipped /api/up. Returns the
+ *  launcher's normalized {ok, error?} shape; the remote daemon's own error
+ *  text rides through verbatim where available. Never hangs: the shared
+ *  core holds ONE deadline through request AND body parse (the G-R2B1-1
+ *  class is structurally closed there). */
+export declare function remoteUpLeaf(body: RemoteUpBody, host: HttpHostEntry, deps?: RemoteUpLeafDeps): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=remote-up-leaf.d.ts.map

package/daemon/dist/domain/topology/remote-up-leaf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-up-leaf.d.ts","sourceRoot":"","sources":["../../../src/domain/topology/remote-up-leaf.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAGvE,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC;;;;yCAIqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,SAAU,CAAC;AAE5C,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;2CAI2C;AAC3C,wBAAsB,YAAY,CAChC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,aAAa,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsC1C"}

package/daemon/dist/domain/topology/remote-up-leaf.js

@@ -0,0 +1,60 @@
+// OPR.0.4.4.11 — the daemon-side remote single-rig leaf (FR-4).
+//
+// A host-placed topology entry launches by POSTing the SHIPPED remote-up
+// surface: POST {host.url}/api/up with the same body shape the CLI's
+// --host path sends. Since OPR.0.4.4.15 this is a THIN CONSUMER of the
+// shared daemon→daemon transport core (domain/hosts/remote-daemon-http.ts
+// — arch cell 1: ONE copy of the security-adjacent bearer/bounded-abort/
+// classification code for the whole P3/P4 family). This module keeps its
+// shipped error-string surface byte-for-byte; only the transport plumbing
+// moved. The failure classes remain the EXISTING ones ([permission-gate] /
+// [remote-command-failed] / [remote-daemon-unreachable]) — no new taxonomy
+// (FR-4 negative AC).
+import { remoteJsonRequest } from "../hosts/remote-daemon-http.js";
+/** Matches the CLI's LONG_RUNNING_UP_TIMEOUT_MS for standalone remote ups. */
+export const REMOTE_UP_TIMEOUT_MS = 120_000;
+/** POST the placed entry to the remote daemon's shipped /api/up. Returns the
+ *  launcher's normalized {ok, error?} shape; the remote daemon's own error
+ *  text rides through verbatim where available. Never hangs: the shared
+ *  core holds ONE deadline through request AND body parse (the G-R2B1-1
+ *  class is structurally closed there). */
+export async function remoteUpLeaf(body, host, deps = {}) {
+    const timeoutMs = deps.timeoutMs ?? REMOTE_UP_TIMEOUT_MS;
+    const url = `${host.url.replace(/\/$/, "")}/api/up`;
+    const res = await remoteJsonRequest(host, "/api/up", {
+        method: "POST",
+        body,
+        timeoutMs,
+        fetchImpl: deps.fetchImpl,
+        env: deps.env,
+        readFile: deps.readFile,
+    });
+    if (res.ok)
+        return { ok: true };
+    switch (res.kind) {
+        case "bearer":
+            return { ok: false, error: `[permission-gate] ${res.detail}` };
+        case "timeout":
+            // R2-B1 / G-R2B1-1: a stalled remote /api/up — before OR after
+            // headers — is a STRUCTURED per-entry failure, never a hung walk.
+            return res.phase === "body"
+                ? {
+                    ok: false,
+                    error: `[remote-daemon-unreachable] POST ${url} timed out after ${timeoutMs}ms for host ${host.id}: response headers arrived (HTTP ${res.status}) but the error body never completed`,
+                }
+                : {
+                    ok: false,
+                    error: `[remote-daemon-unreachable] POST ${url} timed out after ${timeoutMs}ms for host ${host.id}: the remote daemon never settled the request within the rig-up budget`,
+                };
+        case "network":
+            return { ok: false, error: `[remote-daemon-unreachable] POST ${url} failed for host ${host.id}: ${res.detail}` };
+        case "http": {
+            // Same classification vocabulary as the CLI transport (classifyHttpFailedStep).
+            const status = res.status ?? 0;
+            const cls = status === 401 || status === 403 ? "permission-gate" : status >= 400 && status < 600 ? "remote-command-failed" : "remote-daemon-unreachable";
+            const detail = res.detail ? `HTTP ${res.status}: ${res.detail}` : `HTTP ${res.status}`;
+            return { ok: false, error: `[${cls}] remote up on host ${host.id} failed: ${detail}` };
+        }
+    }
+}
+//# sourceMappingURL=remote-up-leaf.js.map

package/daemon/dist/domain/topology/remote-up-leaf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-up-leaf.js","sourceRoot":"","sources":["../../../src/domain/topology/remote-up-leaf.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,sBAAsB;AAGtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAenE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAO5C;;;;2CAI2C;AAC3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAkB,EAClB,IAAmB,EACnB,OAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAEhC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACjE,KAAK,SAAS;YACZ,+DAA+D;YAC/D,kEAAkE;YAClE,OAAO,GAAG,CAAC,KAAK,KAAK,MAAM;gBACzB,CAAC,CAAC;oBACE,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,oCAAoC,GAAG,oBAAoB,SAAS,eAAe,IAAI,CAAC,EAAE,oCAAoC,GAAG,CAAC,MAAM,sCAAsC;iBACtL;gBACH,CAAC,CAAC;oBACE,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,oCAAoC,GAAG,oBAAoB,SAAS,eAAe,IAAI,CAAC,EAAE,wEAAwE;iBAC1K,CAAC;QACR,KAAK,SAAS;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,GAAG,oBAAoB,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACnH,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,gFAAgF;YAChF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,2BAA2B,CAAC;YACzJ,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,uBAAuB,IAAI,CAAC,EAAE,YAAY,MAAM,EAAE,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC"}

package/daemon/dist/domain/topology/topology-manifest.d.ts

@@ -0,0 +1,34 @@
+export interface TopologyRigEntry {
+    source: string;
+    host?: string;
+}
+export interface TopologyManifest {
+    rigs: TopologyRigEntry[];
+    /** Normalized: the manifest's cap, or the default 1 (sequential). */
+    concurrency: number;
+}
+export type TopologyManifestResult = {
+    ok: true;
+    manifest: TopologyManifest;
+} | {
+    ok: false;
+    errors: string[];
+};
+/** Validate an already-parsed YAML document as a topology manifest.
+ *  Collects EVERY structural error (per-entry, what/why/fix) rather than
+ *  failing fast — FR-1 reports them all before any launch. */
+export declare function validateTopologyManifest(parsed: unknown, sourcePath: string): TopologyManifestResult;
+/** Load + parse + validate a topology manifest file. Parse failures error AS
+ *  a topology (arch ruling 1: the declared kind binds — no rig-spec
+ *  fall-through). */
+export declare function loadTopologyManifest(path: string): TopologyManifestResult;
+/** Detection sniff (FR-1 + guard G-1/yaml folds): a parsed YAML document is
+ *  topology-SHAPED iff it carries a top-level `rigs:` LIST. A rig spec never
+ *  carries top-level `rigs`, so the sniff is unambiguous. Shape only — full
+ *  validation still runs (and rejects) as a topology afterwards. */
+export declare function hasTopLevelRigsList(parsed: unknown): boolean;
+/** Raw-text form of the sniff for router branches that have not parsed yet
+ *  (the extensionless path-form fallback). Unparseable YAML sniffs false —
+ *  it then flows to the existing non-topology handling unchanged. */
+export declare function yamlTextHasTopLevelRigsList(raw: string): boolean;
+//# sourceMappingURL=topology-manifest.d.ts.map

package/daemon/dist/domain/topology/topology-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology-manifest.d.ts","sourceRoot":"","sources":["../../../src/domain/topology/topology-manifest.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAoCpC;;8DAE8D;AAC9D,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,CA+FpG;AAED;;qBAEqB;AACrB,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAsBzE;AAED;;;oEAGoE;AACpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG5D;AAED;;qEAEqE;AACrE,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMhE"}

package/daemon/dist/domain/topology/topology-manifest.js

@@ -0,0 +1,195 @@
+// OPR.0.4.4.11 — the topology manifest: the SHAREABLE artifact (FR-1).
+//
+// The key set is CLOSED (arch return R11-1 — this IS the thin-manifest
+// enforcement): an ordered `rigs[]` of entries {source, host?} plus an
+// optional manifest-level `concurrency` cap (default 1 = sequential).
+// NOTHING ELSE. Unknown keys reject loudly — silently ignoring one would
+// reopen the founder's ratified non-goal by stealth. Cross-rig
+// edge/routing/dependency keys reject with a message NAMING that non-goal
+// (thin manifest; inter-rig routing is deferred topology-Q1). `on_failure`
+// was considered and REMOVED for v0 (spec-guard + arch fold): stop-on-failure
+// is the only behavior; re-adding it is an explicit pm-lead decision.
+//
+// Detection contract (PRD FR-1 + guard G-1 folds; the router consumes the
+// exported sniffs): `.rigtopology` extension OR a YAML document with a
+// top-level `rigs:` LIST. Extension wins when both could apply (arch ruling
+// 1 — declared kind binds); a `.rigtopology` file failing validation errors
+// AS a topology, never falls through to rig-spec parsing.
+//
+// Unknown-host-id validation (the FR-1 fourth structural class) resolves
+// against the hosts registry via the shared hosts-registry-reader at the
+// launcher's pre-launch validation pass — still before any launch attempt;
+// this module is filesystem/registry-free by design.
+import { existsSync, readFileSync } from "node:fs";
+import { parse as parseYaml } from "yaml";
+/** The ratified non-goal family: any key that would smuggle cross-rig
+ *  edges/routing/dependency semantics into the thin manifest. */
+const EDGE_ROUTING_KEYS = new Set([
+    "edge",
+    "edges",
+    "route",
+    "routes",
+    "routing",
+    "dependency",
+    "dependencies",
+    "deps",
+    "depends_on",
+    "dependsOn",
+    "needs",
+    "after",
+    "links",
+    "wires",
+    "connections",
+]);
+const MANIFEST_KEYS = new Set(["rigs", "concurrency"]);
+const ENTRY_KEYS = new Set(["source", "host"]);
+function edgeRoutingRejection(prefix, key) {
+    return `${prefix}: '${key}' is a cross-rig edge/routing/dependency key — REJECTED. The topology manifest is deliberately THIN (founder-ratified non-goal: no cross-rig edges, no routing semantics; inter-rig routing is the deferred topology-Q1 decision). Remove the key; the manifest carries only rigs[]{source, host?} + concurrency.`;
+}
+function unknownKeyRejection(prefix, key, allowed) {
+    if (key === "on_failure") {
+        return `${prefix}: 'on_failure' was removed for v0 — stop-on-failure is the only behavior (the walk stops at the first failed entry; already-started rigs are reported honestly). Re-adding the key is an explicit pm-lead decision. Remove it.`;
+    }
+    return `${prefix}: unknown key '${key}' — the manifest key set is CLOSED (${allowed}). Remove or fix the key.`;
+}
+/** Validate an already-parsed YAML document as a topology manifest.
+ *  Collects EVERY structural error (per-entry, what/why/fix) rather than
+ *  failing fast — FR-1 reports them all before any launch. */
+export function validateTopologyManifest(parsed, sourcePath) {
+    const where = `topology manifest at ${sourcePath}`;
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return { ok: false, errors: [`${where}: must be a YAML object with a top-level 'rigs' list`] };
+    }
+    const obj = parsed;
+    const errors = [];
+    for (const key of Object.keys(obj)) {
+        if (MANIFEST_KEYS.has(key))
+            continue;
+        if (EDGE_ROUTING_KEYS.has(key)) {
+            errors.push(edgeRoutingRejection(where, key));
+        }
+        else {
+            errors.push(unknownKeyRejection(where, key, "'rigs' + optional 'concurrency'"));
+        }
+    }
+    let concurrency = 1;
+    const rawConcurrency = obj["concurrency"];
+    if (rawConcurrency !== undefined) {
+        if (typeof rawConcurrency !== "number" || !Number.isInteger(rawConcurrency) || rawConcurrency < 1) {
+            errors.push(`${where}: 'concurrency' must be a positive integer (a fixed staged-launch cap; default 1 = sequential; adaptive throttling is out of scope) — got ${JSON.stringify(rawConcurrency)}`);
+        }
+        else {
+            concurrency = rawConcurrency;
+        }
+    }
+    const rigs = obj["rigs"];
+    if (!Array.isArray(rigs)) {
+        errors.push(`${where}: 'rigs' must be a list of entries {source, host?} — the ordered launch plan`);
+        return { ok: false, errors };
+    }
+    if (rigs.length === 0) {
+        errors.push(`${where}: 'rigs' is empty — a topology must name at least one rig to launch`);
+        return { ok: false, errors };
+    }
+    const validated = [];
+    for (let i = 0; i < rigs.length; i++) {
+        const raw = rigs[i];
+        const prefix = `${where}: rigs[${i}]`;
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            errors.push(`${prefix}: must be an object with a 'source' rig ref (spec path, library name, or .rigbundle path) and optional 'host'`);
+            continue;
+        }
+        const entry = raw;
+        for (const key of Object.keys(entry)) {
+            if (ENTRY_KEYS.has(key))
+                continue;
+            if (EDGE_ROUTING_KEYS.has(key)) {
+                errors.push(edgeRoutingRejection(prefix, key));
+            }
+            else {
+                errors.push(unknownKeyRejection(prefix, key, "'source' + optional 'host'"));
+            }
+        }
+        const source = entry["source"];
+        if (typeof source !== "string" || source.trim() === "") {
+            errors.push(`${prefix}.source: required non-empty string — a rig SPEC PATH (v0 boundary; see the per-form rejections below)`);
+            continue;
+        }
+        // ── v0 source-form boundary (arch ruling 2026-07-05, guard F2/F3 fold):
+        // topology entries are SPEC PATHS ONLY, rejected at PARSE time — uniform
+        // entry semantics beat mid-walk failure, and neither widening is free:
+        // bundle targetRoot is a pm-gated closed-key extension (R11-1); library
+        // names need a daemon resolution seam (P4-adjacent+). Both are NAMED
+        // DEFERRALS. Direct-to-rig-up forms are untouched (FR-2 stands).
+        if (/\.rigbundle$/i.test(source)) {
+            errors.push(`${prefix}.source: '.rigbundle' entries are not supported in v0 — topology entries are SPEC PATHS ONLY (a bundle entry needs an explicit per-entry targetRoot, a pm-gated extension of the closed key set; deferred). Workaround: launch that rig directly — single-rig 'rig up ${source}' accepts all source kinds unchanged.`);
+            continue;
+        }
+        if (/\.rigtopology$/i.test(source)) {
+            errors.push(`${prefix}.source: nested topology manifests are not supported — every entry must be a single-rig spec path.`);
+            continue;
+        }
+        if (!source.includes("/") && !/\.ya?ml$/i.test(source)) {
+            errors.push(`${prefix}.source: '${source}' is a bare library/rig name — v0 topology entries are SPEC PATHS ONLY (name entries need a daemon-side resolution seam; deferred). Workaround: run 'rig up ${source}' individually, or reference its spec file by path.`);
+            continue;
+        }
+        const host = entry["host"];
+        if (host !== undefined && (typeof host !== "string" || host.trim() === "")) {
+            errors.push(`${prefix}.host: optional, but if present must be a non-empty registered host id (per-entry 'host:' is the ONLY topology placement mechanism)`);
+            continue;
+        }
+        validated.push({ source, ...(host !== undefined ? { host: host } : {}) });
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, manifest: { rigs: validated, concurrency } };
+}
+/** Load + parse + validate a topology manifest file. Parse failures error AS
+ *  a topology (arch ruling 1: the declared kind binds — no rig-spec
+ *  fall-through). */
+export function loadTopologyManifest(path) {
+    if (!existsSync(path)) {
+        return {
+            ok: false,
+            errors: [
+                `topology manifest not found at ${path}. Create a .rigtopology YAML file with a top-level 'rigs:' list of {source, host?} entries (+ optional 'concurrency').`,
+            ],
+        };
+    }
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch (err) {
+        return { ok: false, errors: [`failed to read topology manifest at ${path}: ${err.message}`] };
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        return { ok: false, errors: [`failed to parse topology manifest YAML at ${path}: ${err.message}`] };
+    }
+    return validateTopologyManifest(parsed, path);
+}
+/** Detection sniff (FR-1 + guard G-1/yaml folds): a parsed YAML document is
+ *  topology-SHAPED iff it carries a top-level `rigs:` LIST. A rig spec never
+ *  carries top-level `rigs`, so the sniff is unambiguous. Shape only — full
+ *  validation still runs (and rejects) as a topology afterwards. */
+export function hasTopLevelRigsList(parsed) {
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return false;
+    return Array.isArray(parsed["rigs"]);
+}
+/** Raw-text form of the sniff for router branches that have not parsed yet
+ *  (the extensionless path-form fallback). Unparseable YAML sniffs false —
+ *  it then flows to the existing non-topology handling unchanged. */
+export function yamlTextHasTopLevelRigsList(raw) {
+    try {
+        return hasTopLevelRigsList(parseYaml(raw));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=topology-manifest.js.map

package/daemon/dist/domain/topology/topology-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology-manifest.js","sourceRoot":"","sources":["../../../src/domain/topology/topology-manifest.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,yEAAyE;AACzE,+DAA+D;AAC/D,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,qDAAqD;AAErD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAiB1C;iEACiE;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,cAAc;IACd,MAAM;IACN,YAAY;IACZ,WAAW;IACX,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/C,SAAS,oBAAoB,CAAC,MAAc,EAAE,GAAW;IACvD,OAAO,GAAG,MAAM,MAAM,GAAG,mTAAmT,CAAC;AAC/U,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe;IACvE,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,OAAO,GAAG,MAAM,gOAAgO,CAAC;IACnP,CAAC;IACD,OAAO,GAAG,MAAM,kBAAkB,GAAG,uCAAuC,OAAO,2BAA2B,CAAC;AACjH,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,wBAAwB,CAAC,MAAe,EAAE,UAAkB;IAC1E,MAAM,KAAK,GAAG,wBAAwB,UAAU,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,sDAAsD,CAAC,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,cAAc,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAClG,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,6IAA6I,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CACtL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,cAAc,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,8EAA8E,CAAC,CAAC;QACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qEAAqE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,+GAA+G,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,GAA8B,CAAC;QAE7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,uGAAuG,CAAC,CAAC;YAC9H,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,yQAAyQ,MAAM,uCAAuC,CAChU,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,oGAAoG,CAAC,CAAC;YAC3H,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,aAAa,MAAM,+JAA+J,MAAM,qDAAqD,CACvP,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,qIAAqI,CAAC,CAAC;YAC5J,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC;AAClE,CAAC;AAED;;qBAEqB;AACrB,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE;gBACN,kCAAkC,IAAI,wHAAwH;aAC/J;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,uCAAuC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,6CAA6C,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IACD,OAAO,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;oEAGoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,KAAK,CAAC,OAAO,CAAE,MAAkC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/daemon/dist/domain/types.d.ts

@@ -75,6 +75,9 @@ export interface Session {
     status: string;
     resumeType: string | null;
     resumeToken: string | null;
+    resumeProvenance?: string | null;
+    resumeLastVerified?: string | null;
+    resumeLastProbeStatus?: string | null;
     restorePolicy: string;
     lastSeenAt: string | null;
     createdAt: string;
@@ -199,6 +202,18 @@ export type RigEvent = {
     reason?: string;
     operator?: string;
     redacted: true;
+} | {
+    type: "session.resume_token_captured";
+    rigId: string;
+    nodeId: string;
+    sessionName: string;
+    sessionId: string;
+    runtime: string;
+    outcome: "captured" | "preserved" | "skipped";
+    resumeType?: string;
+    provenance?: "adoption";
+    reason?: "missing_sidecar" | "parse_error" | "probe_timeout" | "invalid_token" | "higher_rank_present";
+    redacted: true;
 } | {
     type: "seat.attention_cleared";
     rigId: string;
@@ -341,6 +356,25 @@ export type RigEvent = {
     rigId: string;
     nodeId: string;
     error: string;
+} | {
+    type: "node.startup_challenged";
+    rigId: string;
+    nodeId: string;
+    challengeId: string;
+    contractHash: string;
+} | {
+    type: "node.startup_proof_verified";
+    rigId: string;
+    nodeId: string;
+    sessionId: string;
+    challengeId: string;
+    contractHash: string;
+} | {
+    type: "node.startup_proof_rejected";
+    rigId: string;
+    nodeId: string;
+    challengeId: string | null;
+    reason: "identity_unbound" | "identity_mismatch" | "challenge_stale" | "contract_mismatch" | "bare_ack";
 } | {
     type: "continuity.sync";
     rigId: string;
@@ -394,23 +428,27 @@ export type RigEvent = {
     destinationSession: string;
     priority: string;
     tier: string | null;
+    summary: string | null;
 } | {
     type: "queue.handed_off";
     qitemId: string;
     fromSession: string;
     toSession: string;
     closureReason: "handed_off_to";
+    summary: string | null;
 } | {
     type: "queue.claimed";
     qitemId: string;
     destinationSession: string;
     claimedAt: string;
     closureRequiredAt: string | null;
+    summary: string | null;
 } | {
     type: "queue.unclaimed";
     qitemId: string;
     destinationSession: string;
     reason: string;
+    summary: string | null;
 } | {
     type: "qitem.fallback_routed";
     qitemId: string;
@@ -443,6 +481,7 @@ export type RigEvent = {
     closureReason: string | null;
     closureTarget: string | null;
     actorSession: string;
+    summary: string | null;
 } | {
     type: "project.classified";
     projectId: string;
@@ -695,6 +734,7 @@ export type RestoreOutcome = {
     result: RestoreResult;
 };
 export type NodeRestoreOutcome = "resumed" | "rebuilt" | "fresh" | "fresh-primed" | "awaiting-decision" | "failed" | "attention_required" | "operator_recovered" | "n-a";
+export type NodeOriented = "verified" | "missing" | "rejected" | "n-a";
 export type OccupantLifecycle = "active" | "retiring" | "retired" | "context_walled" | "compacted" | "crashed" | "unknown";
 export type ContinuityOutcome = "resumed" | "rebuilt" | "forked" | "fresh" | "failed";
 export type HandoverResult = "complete" | "unchanged" | "partial" | "failed" | null;
@@ -719,6 +759,41 @@ export interface NodeRecoveryGuidance {
     notes: string[];
 }
 export type NodeLifecycleState = "running" | "detached" | "recoverable" | "attention_required";
+/**
+ * OPR.0.4.3.19 — the liveness identity verdict for a managed seat.
+ *
+ * A THIRD axis, orthogonal to slice-15's `terminalActive` (tmux output
+ * recency) and `hasAssignedWork` (queue-derived). It answers: does the process
+ * currently in the seat's registered tmux pane match the seat we are reporting?
+ * Computed by the periodic SeatIdentityReconciler from the pane PID/command vs
+ * the registered `bindings.tmux_pane`, NEVER from queue/classifier/hook
+ * heartbeats. Only `mismatch` and `pane_missing` down-rank a `running`
+ * projection; `verified` and `tmux_unavailable` (and an absent verdict) leave
+ * it unchanged.
+ */
+export type SeatIdentityVerdictKind = "verified" | "mismatch" | "pane_missing" | "tmux_unavailable";
+export interface SeatIdentityVerdict {
+    nodeId: string;
+    verdict: SeatIdentityVerdictKind;
+    /** Which observation axis produced the verdict. Null for `verified`. */
+    evidenceSource: "pane_process" | "tmux_session" | null;
+    /** The specific reason for a non-verified verdict. Null for `verified`. */
+    reason: "process_identity_mismatch" | "pane_pid_gone" | "session_missing" | "tmux_unavailable" | null;
+    evidence: {
+        registeredPane: string | null;
+        observedPid: number | null;
+        observedCommand: string | null;
+        matchedLayer: number | null;
+    };
+    sessionName: string | null;
+    observedAt: string;
+}
+/**
+ * OPR.0.4.3.19 — the two verdict kinds that down-rank a `running`/`active`
+ * projection to a non-green state. `verified`, `tmux_unavailable`, and an
+ * ABSENT verdict all leave the projection unchanged (fail-open on unknown).
+ */
+export declare function identityVerdictDownranksRunning(verdict: SeatIdentityVerdictKind | null | undefined): boolean;
 export type RigLifecycleState = "running" | "recoverable" | "stopped" | "degraded" | "attention_required";
 export interface NodeInventoryEntry {
     rigId: string;
@@ -733,6 +808,7 @@ export interface NodeInventoryEntry {
     sessionStatus: string | null;
     startupStatus: "pending" | "ready" | "attention_required" | "failed" | null;
     restoreOutcome: NodeRestoreOutcome;
+    oriented: NodeOriented;
     lifecycleState: NodeLifecycleState;
     occupantLifecycle: OccupantLifecycle;
     continuityOutcome: ContinuityOutcome | null;
@@ -785,6 +861,16 @@ export interface NodeInventoryEntry {
     hasAssignedWork?: boolean;
     /** Optional count of pending qitems assigned to this seat (cheap aggregate). */
     pendingWorkCount?: number;
+    /**
+     * OPR.0.4.3.19 — liveness identity verdict (the THIRD axis). Present when
+     * the SeatIdentityReconciler has recorded a verdict for this node; absent
+     * (undefined) when never polled. A `mismatch`/`pane_missing` verdict
+     * down-ranks the node's `lifecycleState`/`occupantLifecycle` away from
+     * running/active and carries the evidence. MUST NOT be derived from
+     * `terminalActive`, `hasAssignedWork`, or any queue/classifier/hook
+     * heartbeat — process identity only.
+     */
+    identityVerdict?: SeatIdentityVerdict | null;
     /** OPR.0.3.4.11 — held reason derived from the latest `node.held` event.
      *  Null when no held event, or superseded by a running session / later launch. */
     heldReason?: string | null;