@openrig/cli 0.4.4 → 0.4.6

package/daemon/dist/builtins/workflow-specs/factory-rsi.yaml

@@ -0,0 +1,152 @@
+# OpenRig 0.4.6 canonical single-rig RSI factory MVP (OPR.0.4.6.FAC2).
+#
+# ONE rig + ONE workflow = the recursive-self-improvement factory MVP. The
+# in-band INNER LOOP is a bounded, engine-routed SDLC:
+#   plan → implement → qa_check → review → release
+# under the enforceable max_hops guard (WF-1 sanction); a failing check or
+# review routes back to implement for bounded remediation; exceptions route via
+# the WF-5 dial (orchestrator-first); the release leg PREPARES and holds the ship
+# decision at a human gate (publish is a human act). Runs on the shipped engine
+# with the v0 hardcode seam (target.rig baked + preferred_targets) — no binding
+# layer needed.
+#
+# The RSI recursion is the DECOUPLED dogfood edge: the dogfood seat runs
+# out-of-band and continuously against the SHIPPED product (not a second QA on
+# the build artifact) and feeds its findings into the next plan — ungated, with
+# no loop-stop in the MVP. The exact continuous out-of-band runtime mechanism is
+# refined in a later release; here the inner loop is in-band and dogfood is the
+# out-of-band feed, referenced by the `dogfood` role below.
+workflow:
+  id: factory-rsi
+  version: 1
+  objective: >
+    Plan, build, check, review, and release one slice as a bounded,
+    deterministic, engine-routed inner loop on a single rig. Dogfood runs
+    out-of-band against the shipped product and feeds its findings into the next
+    plan — the RSI edge, with no human required.
+  target:
+    rig: factory-rsi
+  entry:
+    role: planner
+  coordination_terminal_turn_rule: hot_potato
+  # Exceptions route orchestrator-first (the WF-5 v1.3 dial); the human knows
+  # at altitude via the awareness row. The orchestrator role below is the dial
+  # target — resolved through the same role→preferred_targets mechanism.
+  exception_routing:
+    default: orchestrator
+    orchestrator_role: orchestrator
+  roles:
+    planner:
+      skill_refs: [openrig-user, requirements-writer, writing-plans]
+      preferred_targets: [plan-planner@factory-rsi]
+    implementer:
+      skill_refs: [openrig-user, development-team, test-driven-development]
+      preferred_targets: [build-implementer@factory-rsi]
+    qa:
+      skill_refs: [openrig-user, verification-before-completion]
+      preferred_targets: [check-qa@factory-rsi]
+    reviewer:
+      skill_refs: [openrig-user, review-team, plan-review]
+      preferred_targets: [review-reviewer@factory-rsi]
+    release_manager:
+      skill_refs: [openrig-user, release-manager]
+      preferred_targets: [release-manager@factory-rsi]
+    orchestrator:
+      skill_refs: [openrig-user, orchestration-team]
+      preferred_targets: [orch-lead@factory-rsi]
+    # The dogfood role is DECOUPLED from the inner loop: it runs out-of-band
+    # against the SHIPPED product and feeds findings into the next plan (the RSI
+    # edge). It is intentionally NOT an inner-loop step here; the continuous
+    # out-of-band runtime mechanism is refined in a later release.
+    dogfood:
+      skill_refs: [openrig-user, dogfood, systematic-debugging]
+      preferred_targets: [dogfood-tester@factory-rsi]
+  steps:
+    - id: plan
+      actor_role: planner
+      objective: >
+        Turn the current input — the product corpus on cycle 1, or the recorded
+        out-of-band dogfood findings thereafter — into ONE buildable slice spec.
+        The findings arrive as recorded closure evidence, never chat.
+      allowed_exits: [handoff, waiting, failed]
+      next_hop:
+        mode: require
+        suggested_roles: [implementer]
+    - id: implement
+      actor_role: implementer
+      objective: Build the slice per the plan and produce proof for the check.
+      allowed_exits: [handoff, waiting, failed]
+      next_hop:
+        mode: require
+        suggested_roles: [qa]
+    - id: qa_check
+      actor_role: qa
+      objective: >
+        Check the built artifact. Passing hands to review; a FAILING check (the
+        artifact's verdict, not the step's dysfunction) routes back to implement
+        for bounded remediation.
+      allowed_exits: [handoff, waiting, failed]
+      next_hop:
+        mode: require
+        suggested_roles: [reviewer]
+        on:
+          failed: implement
+    - id: review
+      actor_role: reviewer
+      objective: >
+        Review the artifact (cross-runtime diversity vs the builder). Passing
+        hands to the release prep; a failing review routes back to implement.
+      allowed_exits: [handoff, waiting, failed]
+      next_hop:
+        mode: require
+        suggested_roles: [release_manager]
+        on:
+          failed: implement
+    - id: release_prep
+      actor_role: release_manager
+      objective: >
+        Prepare the release notes, docs/website updates, and the release PR, and
+        record the cycle's release evidence at `proof/PROOF.md` in the workspace
+        (the `evidence_ref` the sign-off gate points at). This is the
+        release-manager's ACTUAL work and it runs BEFORE any gate — the prepared
+        artifacts exist first; publish stays a human act (held at release_signoff).
+      allowed_exits: [handoff, waiting, failed]
+      next_hop:
+        # Explicit step-id route (NOT suggested_roles): release_prep and
+        # release_signoff share the release_manager actor_role, so a role-based
+        # hop would be ambiguous (it would match the first release_manager step).
+        # The prepared artifacts therefore exist BEFORE the human gate below.
+        on:
+          handoff: release_signoff
+    - id: release_signoff
+      actor_role: release_manager
+      objective: >
+        Hold the ship decision at the human gate, against the release artifacts
+        already prepared in release_prep. Approval lets the human proceed to
+        publish; nothing is published automatically.
+      allowed_exits: [done, waiting, failed]
+      gate:
+        target: human@kernel
+        summary: "RSI cycle clean; release artifacts prepared — sign off to publish (publish is a human act)."
+        # Workspace-relative pointer to the release evidence release_prep records
+        # (the same convention the shipped gated-release.yaml example uses); it is
+        # produced in the running workspace per cycle, not a slice file.
+        evidence_ref: proof/PROOF.md
+      next_hop:
+        mode: forbid
+  invariants:
+    continuation_required: true
+    preserve_lineage: true
+    closure_required: true
+    allowed_exits: [handoff, waiting, done, failed]
+  loop_guards:
+    # ENFORCEABLE (integer >= 1) — sanctions the bounded remediation loops
+    # (qa_check→implement, review→implement); the WF-1 validator requires it and
+    # the Argo unbounded-recursion lesson demands it. A trip becomes a WF-5
+    # exception; a resume grants one more bounded window (WF-5 FR-4 livelock rail).
+    max_hops: 20
+    spawn_budget: 0
+  closure:
+    success: RSI cycle clean; release candidate prepared and held at the human ship gate.
+    degraded: Cycle stopped with a named blocker or a bounded max_hops trip awaiting resume.
+    failed: Step failed as an exception; preserve the finding and route via the dial.

package/daemon/dist/builtins/workflow-specs/gated-release.yaml

@@ -0,0 +1,26 @@
+# OpenRig 0.4.6 spec-language example — the GATED STAGE shape.
+# A human sign-off gate on the final step (compiles to the shipped
+# human-route machinery: tier human-gate + summary + evidence_ref,
+# resolved by `rig queue resolve`), plus per-step harness pins.
+workflow:
+  id: gated-release
+  version: 1
+  objective: Build, prove, then hold the ship decision at a human gate.
+  roles:
+    builder:
+      preferred_targets: [flow-builder@acme-flow]
+    prover:
+      preferred_targets: [flow-prover@acme-flow, flow-prover2@acme-flow]
+  steps:
+    - id: build
+      actor_role: builder
+      harness: claude-code
+    - id: prove
+      actor_role: prover
+      harness: codex
+    - id: ship-signoff
+      actor_role: prover
+      gate:
+        target: human@kernel
+        summary: "Release candidate proven; sign off to ship"
+        evidence_ref: proof/PROOF.md

package/daemon/dist/builtins/workflow-specs/linear-build.yaml

@@ -0,0 +1,21 @@
+# OpenRig 0.4.6 spec-language example — the LINEAR PIPELINE shape.
+# Zero WF-2 features: declaration-order routing, byte-identical to the
+# WF-1 engine's behavior (the zero-regression reference shape).
+workflow:
+  id: linear-build
+  version: 1
+  objective: Move one packet through plan, build, prove in declaration order.
+  roles:
+    planner:
+      preferred_targets: [flow-planner@acme-flow]
+    builder:
+      preferred_targets: [flow-builder@acme-flow]
+    prover:
+      preferred_targets: [flow-prover@acme-flow]
+  steps:
+    - id: plan
+      actor_role: planner
+    - id: build
+      actor_role: builder
+    - id: prove
+      actor_role: prover

package/daemon/dist/db/migrations/049_workflow_instance_version.d.ts

@@ -0,0 +1,20 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6.WF1 FR-5 — workflow_instances.version column.
+ *
+ * The optimistic-concurrency guard for instance advancement: every
+ * project() carries the version it read into the transaction, and
+ * updateFrontier's UPDATE is qualified `WHERE version = ?` with a
+ * `version = version + 1` bump. Zero rows changed = a concurrent
+ * writer advanced the instance first → structured
+ * `instance_version_conflict` (the whole scribe transaction rolls
+ * back). SQLite's single-writer serialization orders the writes;
+ * the version guard is what stops the SECOND writer from operating on
+ * the stale instance state it read before the first committed.
+ *
+ * Additive, NOT NULL with DEFAULT 0 so existing in-flight instances
+ * adopt version 0 and their next projection bumps normally — no
+ * backfill required.
+ */
+export declare const workflowInstanceVersionSchema: Migration;
+//# sourceMappingURL=049_workflow_instance_version.d.ts.map

package/daemon/dist/db/migrations/049_workflow_instance_version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"049_workflow_instance_version.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/049_workflow_instance_version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAK3C,CAAC"}

package/daemon/dist/db/migrations/049_workflow_instance_version.js

@@ -0,0 +1,24 @@
+/**
+ * OPR.0.4.6.WF1 FR-5 — workflow_instances.version column.
+ *
+ * The optimistic-concurrency guard for instance advancement: every
+ * project() carries the version it read into the transaction, and
+ * updateFrontier's UPDATE is qualified `WHERE version = ?` with a
+ * `version = version + 1` bump. Zero rows changed = a concurrent
+ * writer advanced the instance first → structured
+ * `instance_version_conflict` (the whole scribe transaction rolls
+ * back). SQLite's single-writer serialization orders the writes;
+ * the version guard is what stops the SECOND writer from operating on
+ * the stale instance state it read before the first committed.
+ *
+ * Additive, NOT NULL with DEFAULT 0 so existing in-flight instances
+ * adopt version 0 and their next projection bumps normally — no
+ * backfill required.
+ */
+export const workflowInstanceVersionSchema = {
+    name: "049_workflow_instance_version.sql",
+    sql: `
+    ALTER TABLE workflow_instances ADD COLUMN version INTEGER NOT NULL DEFAULT 0;
+  `,
+};
+//# sourceMappingURL=049_workflow_instance_version.js.map

package/daemon/dist/db/migrations/049_workflow_instance_version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"049_workflow_instance_version.js","sourceRoot":"","sources":["../../../src/db/migrations/049_workflow_instance_version.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAc;IACtD,IAAI,EAAE,mCAAmC;IACzC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/daemon/dist/db/migrations/050_workflow_spec_json.d.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6.WF1 FR-6/FR-9 (source discovery during build) —
+ * workflow_specs.spec_json column.
+ *
+ * At ac75777a the cache stored only roles_json + steps_json (+ scalar
+ * columns), so `getByNameVersion` — the path the PROJECTOR resolves
+ * specs through at every project() — rebuilt a spec with
+ * `loop_guards`, `invariants`, `closure`, and `entry` silently DROPPED
+ * (rowToWorkflowSpec's column-only branch). readThrough compensated
+ * for VALIDATION by overriding with the freshly file-parsed spec, but
+ * projection-time enforcement (FR-6 max_hops) could never see the
+ * declared guard. This column stores the FULL parsed spec at cache
+ * time so the runtime enforces exactly what the author declared, even
+ * after the source file moves or disappears (the cache's own survival
+ * contract).
+ *
+ * NULLABLE: legacy rows fall back to the column-only reconstruction
+ * (honest degradation) and self-heal on their next readThrough.
+ */
+export declare const workflowSpecJsonSchema: Migration;
+//# sourceMappingURL=050_workflow_spec_json.d.ts.map

package/daemon/dist/db/migrations/050_workflow_spec_json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"050_workflow_spec_json.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/050_workflow_spec_json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAKpC,CAAC"}

package/daemon/dist/db/migrations/050_workflow_spec_json.js

@@ -0,0 +1,26 @@
+/**
+ * OPR.0.4.6.WF1 FR-6/FR-9 (source discovery during build) —
+ * workflow_specs.spec_json column.
+ *
+ * At ac75777a the cache stored only roles_json + steps_json (+ scalar
+ * columns), so `getByNameVersion` — the path the PROJECTOR resolves
+ * specs through at every project() — rebuilt a spec with
+ * `loop_guards`, `invariants`, `closure`, and `entry` silently DROPPED
+ * (rowToWorkflowSpec's column-only branch). readThrough compensated
+ * for VALIDATION by overriding with the freshly file-parsed spec, but
+ * projection-time enforcement (FR-6 max_hops) could never see the
+ * declared guard. This column stores the FULL parsed spec at cache
+ * time so the runtime enforces exactly what the author declared, even
+ * after the source file moves or disappears (the cache's own survival
+ * contract).
+ *
+ * NULLABLE: legacy rows fall back to the column-only reconstruction
+ * (honest degradation) and self-heal on their next readThrough.
+ */
+export const workflowSpecJsonSchema = {
+    name: "050_workflow_spec_json.sql",
+    sql: `
+    ALTER TABLE workflow_specs ADD COLUMN spec_json TEXT;
+  `,
+};
+//# sourceMappingURL=050_workflow_spec_json.js.map

package/daemon/dist/db/migrations/050_workflow_spec_json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"050_workflow_spec_json.js","sourceRoot":"","sources":["../../../src/db/migrations/050_workflow_spec_json.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAc;IAC/C,IAAI,EAAE,4BAA4B;IAClC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/daemon/dist/db/migrations/051_workflow_resume.d.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6.WF5 FR-4 — workflow_instances resume columns.
+ *
+ * `resume_count`: the recorded redrive fact (the AWS Step Functions
+ * `redriveCount` shape — a first-class recorded field, never inferred
+ * from the trail).
+ *
+ * `hops_baseline`: the LIVELOCK RAIL (arch return R1). max_hops bounds
+ * each DRIVE, not the instance lifetime: the projection guard compares
+ * hops accrued since the LATEST instantiate-OR-resume, so a human
+ * resume sanctions exactly one more bounded window instead of
+ * re-tripping instantly on the first post-resume projection. WF-1's
+ * guard comment left this exact seam open ("WF-5 FR-4's resume later
+ * amends the baseline").
+ *
+ * Additive, NOT NULL DEFAULT 0: existing instances keep the v1
+ * baseline (0) and zero resumes — no backfill, byte-identical behavior
+ * until the first resume.
+ */
+export declare const workflowResumeSchema: Migration;
+//# sourceMappingURL=051_workflow_resume.d.ts.map

package/daemon/dist/db/migrations/051_workflow_resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"051_workflow_resume.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/051_workflow_resume.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAMlC,CAAC"}

package/daemon/dist/db/migrations/051_workflow_resume.js

@@ -0,0 +1,27 @@
+/**
+ * OPR.0.4.6.WF5 FR-4 — workflow_instances resume columns.
+ *
+ * `resume_count`: the recorded redrive fact (the AWS Step Functions
+ * `redriveCount` shape — a first-class recorded field, never inferred
+ * from the trail).
+ *
+ * `hops_baseline`: the LIVELOCK RAIL (arch return R1). max_hops bounds
+ * each DRIVE, not the instance lifetime: the projection guard compares
+ * hops accrued since the LATEST instantiate-OR-resume, so a human
+ * resume sanctions exactly one more bounded window instead of
+ * re-tripping instantly on the first post-resume projection. WF-1's
+ * guard comment left this exact seam open ("WF-5 FR-4's resume later
+ * amends the baseline").
+ *
+ * Additive, NOT NULL DEFAULT 0: existing instances keep the v1
+ * baseline (0) and zero resumes — no backfill, byte-identical behavior
+ * until the first resume.
+ */
+export const workflowResumeSchema = {
+    name: "051_workflow_resume.sql",
+    sql: `
+    ALTER TABLE workflow_instances ADD COLUMN resume_count INTEGER NOT NULL DEFAULT 0;
+    ALTER TABLE workflow_instances ADD COLUMN hops_baseline INTEGER NOT NULL DEFAULT 0;
+  `,
+};
+//# sourceMappingURL=051_workflow_resume.js.map

package/daemon/dist/db/migrations/051_workflow_resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"051_workflow_resume.js","sourceRoot":"","sources":["../../../src/db/migrations/051_workflow_resume.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAc;IAC7C,IAAI,EAAE,yBAAyB;IAC/B,GAAG,EAAE;;;GAGJ;CACF,CAAC"}

package/daemon/dist/db/migrations/052_workflow_instance_bound_rig.d.ts

@@ -0,0 +1,26 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6.FAC1 — workflow_instances.bound_rig column.
+ *
+ * The binding layer's A1 substrate: a workflow instance is pointed at a
+ * rig at INSTANTIATION (`--rig` / route `targetRig`, defaulting to the
+ * spec's `target.rig`), and the binding persists on the instance so
+ * every owner-resolution site (projection, gate compile, entry, resume,
+ * exception routing) resolves roles against THAT rig's inventory.
+ *
+ * Persists the rig NAME, not the id (ARCH Q4): the name is the durable
+ * operator-space coordinate — consistent with the seat-name doctrine; a
+ * torn-down-and-recreated rig keeps the binding. Name→id is resolved
+ * FRESH at each resolution site (an exists-check-class read); a
+ * vanished rig fails loud there, never silently.
+ *
+ * NULLABLE, no default: NULL = unbound = byte-identical pre-FAC-1
+ * behavior for every pre-existing row and every instantiate that names
+ * no rig. No backfill.
+ *
+ * NUMBERING (binding, arch supersession 2026-07-07): FAC-1 fixed-claims
+ * 052; FS-1 renumbers its in-flight 051/052-adjacent migrations to 053+
+ * at its own rebase regardless of merge order.
+ */
+export declare const workflowInstanceBoundRigSchema: Migration;
+//# sourceMappingURL=052_workflow_instance_bound_rig.d.ts.map

package/daemon/dist/db/migrations/052_workflow_instance_bound_rig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"052_workflow_instance_bound_rig.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/052_workflow_instance_bound_rig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAK5C,CAAC"}

package/daemon/dist/db/migrations/052_workflow_instance_bound_rig.js

@@ -0,0 +1,30 @@
+/**
+ * OPR.0.4.6.FAC1 — workflow_instances.bound_rig column.
+ *
+ * The binding layer's A1 substrate: a workflow instance is pointed at a
+ * rig at INSTANTIATION (`--rig` / route `targetRig`, defaulting to the
+ * spec's `target.rig`), and the binding persists on the instance so
+ * every owner-resolution site (projection, gate compile, entry, resume,
+ * exception routing) resolves roles against THAT rig's inventory.
+ *
+ * Persists the rig NAME, not the id (ARCH Q4): the name is the durable
+ * operator-space coordinate — consistent with the seat-name doctrine; a
+ * torn-down-and-recreated rig keeps the binding. Name→id is resolved
+ * FRESH at each resolution site (an exists-check-class read); a
+ * vanished rig fails loud there, never silently.
+ *
+ * NULLABLE, no default: NULL = unbound = byte-identical pre-FAC-1
+ * behavior for every pre-existing row and every instantiate that names
+ * no rig. No backfill.
+ *
+ * NUMBERING (binding, arch supersession 2026-07-07): FAC-1 fixed-claims
+ * 052; FS-1 renumbers its in-flight 051/052-adjacent migrations to 053+
+ * at its own rebase regardless of merge order.
+ */
+export const workflowInstanceBoundRigSchema = {
+    name: "052_workflow_instance_bound_rig.sql",
+    sql: `
+    ALTER TABLE workflow_instances ADD COLUMN bound_rig TEXT;
+  `,
+};
+//# sourceMappingURL=052_workflow_instance_bound_rig.js.map

package/daemon/dist/db/migrations/052_workflow_instance_bound_rig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"052_workflow_instance_bound_rig.js","sourceRoot":"","sources":["../../../src/db/migrations/052_workflow_instance_bound_rig.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAc;IACvD,IAAI,EAAE,qCAAqC;IAC3C,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/daemon/dist/db/migrations/053_sessions_node_id_index.d.ts

@@ -0,0 +1,48 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W1.1) — sessions per-node recency index.
+ *
+ * ROOT CAUSE (arch grounding ARCH-DESIGN-GROUNDING-fs1-2026-07-06, F1;
+ * re-verified firsthand at 384e60f1): the `sessions` table
+ * (002_bindings_sessions.ts) was created with ZERO indexes on `node_id` — its
+ * only index is the `id` PRIMARY-KEY autoindex. The "latest session per node"
+ * subquery `(SELECT s2.id FROM sessions s2 WHERE s2.node_id = ? ORDER BY … LIMIT 1)`
+ * is therefore a FULL SCAN of `sessions`, and it appears PER NODE at THREE sites
+ * on the hot `/api/ps` path — multiplied by the rig-level N+1 (getEntries loops
+ * rigs), one poll scanned `sessions` many times over (the 0.6-0.9s wedge at the
+ * host shape). The three sites, and their ORDER BY (why the index is 3-column):
+ *   - ps-projection.ts:157      ORDER BY created_at DESC, id DESC   ← the load-bearing shape
+ *   - node-inventory.ts:442     ORDER BY id DESC
+ *   - ps-projection.ts:256      ORDER BY id DESC
+ *
+ * INDEX SHAPE = (node_id, created_at DESC, id DESC) — arch RULING (B), decided
+ * by FIXTURE-MEASURED evidence, NOT preference. Measured before/after on the real
+ * incident fixture (24 rigs / 175 nodes / 445 sessions) — evidence:
+ *   missions/release-0.4.6/slices/01-fs1-daemon-read-path-hardening/proof/
+ *   perf-hardening-evidence/W1.1-sessions-index-measure-2026-07-06-dev44-driver2.md
+ *   - id-DESC sites (:442, :256): full-scan → covering seek, ~63x (0.677s→0.011s / 52.5k evals).
+ *   - created_at site (:157): under a 2-col (node_id, id DESC) index it SEARCHes
+ *     node_id but keeps a TEMP B-TREE sort (~18.6x); under THIS 3-col index it is
+ *     `SEARCH … USING COVERING INDEX` with NO sort (~95x, 0.856s→0.009s) — the
+ *     measured ~5x that decided the shape.
+ *   - Bound proven at 10x scale (4450 sessions): full-scan 8.4s (grows with data)
+ *     vs seek 0.024s (~flat) = ~350x. CREATE INDEX = 0.013s, safe on populated data.
+ * The 3-column index leads with `node_id` (the equality seek), so the two id-DESC
+ * sites still get the node_id seek (full-scan eliminated); their residual is a
+ * per-node sort over ~2-3 rows (445 sessions / 175 nodes) — arch-accepted as noise.
+ * ONE index by ruling: this migration WIDENS to the 3-column shape and never grows
+ * a sibling (a second index = write amplification + space for no measured need).
+ *
+ * CREATE INDEX IF NOT EXISTS is idempotent + safe on a live/populated table
+ * (SQLite builds it in one pass; no schema/data change).
+ *
+ * Sibling audit (arch D1.1): the snapshots(rig_id, created_at) subqueries in the
+ * rigs projection are a separate index-audit item in W1, not this migration.
+ *
+ * Number 053: main shipped 051_workflow_resume and FAC-1 reserves
+ * 052_workflow_instance_bound_rig, so FS-1's index migration renumbered
+ * 051→053 (orch deconflict 2026-07-06; re-verify the free slot against the
+ * final merged tree at rebase/proof time). The index NAME + shape are unchanged.
+ */
+export declare const sessionsNodeIdIndexSchema: Migration;
+//# sourceMappingURL=053_sessions_node_id_index.d.ts.map

package/daemon/dist/db/migrations/053_sessions_node_id_index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"053_sessions_node_id_index.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/053_sessions_node_id_index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAMvC,CAAC"}

package/daemon/dist/db/migrations/053_sessions_node_id_index.js

@@ -0,0 +1,53 @@
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W1.1) — sessions per-node recency index.
+ *
+ * ROOT CAUSE (arch grounding ARCH-DESIGN-GROUNDING-fs1-2026-07-06, F1;
+ * re-verified firsthand at 384e60f1): the `sessions` table
+ * (002_bindings_sessions.ts) was created with ZERO indexes on `node_id` — its
+ * only index is the `id` PRIMARY-KEY autoindex. The "latest session per node"
+ * subquery `(SELECT s2.id FROM sessions s2 WHERE s2.node_id = ? ORDER BY … LIMIT 1)`
+ * is therefore a FULL SCAN of `sessions`, and it appears PER NODE at THREE sites
+ * on the hot `/api/ps` path — multiplied by the rig-level N+1 (getEntries loops
+ * rigs), one poll scanned `sessions` many times over (the 0.6-0.9s wedge at the
+ * host shape). The three sites, and their ORDER BY (why the index is 3-column):
+ *   - ps-projection.ts:157      ORDER BY created_at DESC, id DESC   ← the load-bearing shape
+ *   - node-inventory.ts:442     ORDER BY id DESC
+ *   - ps-projection.ts:256      ORDER BY id DESC
+ *
+ * INDEX SHAPE = (node_id, created_at DESC, id DESC) — arch RULING (B), decided
+ * by FIXTURE-MEASURED evidence, NOT preference. Measured before/after on the real
+ * incident fixture (24 rigs / 175 nodes / 445 sessions) — evidence:
+ *   missions/release-0.4.6/slices/01-fs1-daemon-read-path-hardening/proof/
+ *   perf-hardening-evidence/W1.1-sessions-index-measure-2026-07-06-dev44-driver2.md
+ *   - id-DESC sites (:442, :256): full-scan → covering seek, ~63x (0.677s→0.011s / 52.5k evals).
+ *   - created_at site (:157): under a 2-col (node_id, id DESC) index it SEARCHes
+ *     node_id but keeps a TEMP B-TREE sort (~18.6x); under THIS 3-col index it is
+ *     `SEARCH … USING COVERING INDEX` with NO sort (~95x, 0.856s→0.009s) — the
+ *     measured ~5x that decided the shape.
+ *   - Bound proven at 10x scale (4450 sessions): full-scan 8.4s (grows with data)
+ *     vs seek 0.024s (~flat) = ~350x. CREATE INDEX = 0.013s, safe on populated data.
+ * The 3-column index leads with `node_id` (the equality seek), so the two id-DESC
+ * sites still get the node_id seek (full-scan eliminated); their residual is a
+ * per-node sort over ~2-3 rows (445 sessions / 175 nodes) — arch-accepted as noise.
+ * ONE index by ruling: this migration WIDENS to the 3-column shape and never grows
+ * a sibling (a second index = write amplification + space for no measured need).
+ *
+ * CREATE INDEX IF NOT EXISTS is idempotent + safe on a live/populated table
+ * (SQLite builds it in one pass; no schema/data change).
+ *
+ * Sibling audit (arch D1.1): the snapshots(rig_id, created_at) subqueries in the
+ * rigs projection are a separate index-audit item in W1, not this migration.
+ *
+ * Number 053: main shipped 051_workflow_resume and FAC-1 reserves
+ * 052_workflow_instance_bound_rig, so FS-1's index migration renumbered
+ * 051→053 (orch deconflict 2026-07-06; re-verify the free slot against the
+ * final merged tree at rebase/proof time). The index NAME + shape are unchanged.
+ */
+export const sessionsNodeIdIndexSchema = {
+    name: "053_sessions_node_id_index.sql",
+    sql: `
+    CREATE INDEX IF NOT EXISTS idx_sessions_node_created_id
+      ON sessions(node_id, created_at DESC, id DESC);
+  `,
+};
+//# sourceMappingURL=053_sessions_node_id_index.js.map

package/daemon/dist/db/migrations/053_sessions_node_id_index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"053_sessions_node_id_index.js","sourceRoot":"","sources":["../../../src/db/migrations/053_sessions_node_id_index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAc;IAClD,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE;;;GAGJ;CACF,CAAC"}

package/daemon/dist/db/migrations/054_queue_transitions_archive.d.ts

@@ -0,0 +1,34 @@
+import type { Migration } from "../migrate.js";
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W2) — queue_transitions ARCHIVE
+ * sibling table (arch D3: ARCHIVE-never-plain-delete for the audit surface).
+ *
+ * `queue_transitions` is an AUDIT surface with product meaning (chain of record;
+ * `rig queue resolve` records decision text here) — INSERT-ONLY today, no prune
+ * path exists, so it grows unbounded (13691 rows on the incident fixture) and
+ * bloats backups + any transitions-reading surface. Arch D3 ruling: NEVER
+ * plain-delete; MOVE terminal-and-aged transitions into this sibling table, in
+ * the SAME transaction, so the audit trail is preserved (queryable in place),
+ * not lost.
+ *
+ * Schema MIRRORS `queue_transitions` (025) column-for-column so a move is a
+ * single `INSERT INTO queue_transitions_archive (...) SELECT ... FROM
+ * queue_transitions WHERE ...` + `DELETE`, both inside one txn. `transition_id`
+ * is a plain PRIMARY KEY (NOT AUTOINCREMENT) so archived rows KEEP their original
+ * id — audit references stay resolvable across the move. `archived_at` records
+ * when the row was archived (provenance; the source `ts` is preserved untouched).
+ *
+ * THE ACTIVE-FRONTIER INVARIANT (enforced by the W2 runner, not this migration):
+ * only transitions of TERMINAL qitems whose LAST transition is older than the
+ * retention window (default 30d) are ever moved; a non-terminal qitem's full
+ * transition history is never touched, at any age. The move runner + retention
+ * knobs land in the W2 maintenance-tick change; this migration is the sibling
+ * table + its read index only (additive; no data change to `queue_transitions`).
+ *
+ * Number 054: renumbered 052→054 with the FS-1 index (053) after the
+ * 051_workflow_resume ship + FAC-1's 052 reservation (orch deconflict
+ * 2026-07-06; re-verify against the final merged tree at rebase/proof time).
+ * The archive table + index names are unchanged.
+ */
+export declare const queueTransitionsArchiveSchema: Migration;
+//# sourceMappingURL=054_queue_transitions_archive.d.ts.map

package/daemon/dist/db/migrations/054_queue_transitions_archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"054_queue_transitions_archive.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/054_queue_transitions_archive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAgB3C,CAAC"}

package/daemon/dist/db/migrations/054_queue_transitions_archive.js

@@ -0,0 +1,49 @@
+/**
+ * OPR.0.4.6 FS-1 (daemon read-path hardening, W2) — queue_transitions ARCHIVE
+ * sibling table (arch D3: ARCHIVE-never-plain-delete for the audit surface).
+ *
+ * `queue_transitions` is an AUDIT surface with product meaning (chain of record;
+ * `rig queue resolve` records decision text here) — INSERT-ONLY today, no prune
+ * path exists, so it grows unbounded (13691 rows on the incident fixture) and
+ * bloats backups + any transitions-reading surface. Arch D3 ruling: NEVER
+ * plain-delete; MOVE terminal-and-aged transitions into this sibling table, in
+ * the SAME transaction, so the audit trail is preserved (queryable in place),
+ * not lost.
+ *
+ * Schema MIRRORS `queue_transitions` (025) column-for-column so a move is a
+ * single `INSERT INTO queue_transitions_archive (...) SELECT ... FROM
+ * queue_transitions WHERE ...` + `DELETE`, both inside one txn. `transition_id`
+ * is a plain PRIMARY KEY (NOT AUTOINCREMENT) so archived rows KEEP their original
+ * id — audit references stay resolvable across the move. `archived_at` records
+ * when the row was archived (provenance; the source `ts` is preserved untouched).
+ *
+ * THE ACTIVE-FRONTIER INVARIANT (enforced by the W2 runner, not this migration):
+ * only transitions of TERMINAL qitems whose LAST transition is older than the
+ * retention window (default 30d) are ever moved; a non-terminal qitem's full
+ * transition history is never touched, at any age. The move runner + retention
+ * knobs land in the W2 maintenance-tick change; this migration is the sibling
+ * table + its read index only (additive; no data change to `queue_transitions`).
+ *
+ * Number 054: renumbered 052→054 with the FS-1 index (053) after the
+ * 051_workflow_resume ship + FAC-1's 052 reservation (orch deconflict
+ * 2026-07-06; re-verify against the final merged tree at rebase/proof time).
+ * The archive table + index names are unchanged.
+ */
+export const queueTransitionsArchiveSchema = {
+    name: "054_queue_transitions_archive.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS queue_transitions_archive (
+      transition_id INTEGER PRIMARY KEY,
+      qitem_id TEXT NOT NULL,
+      ts TEXT NOT NULL,
+      state TEXT NOT NULL,
+      transition_note TEXT,
+      actor_session TEXT NOT NULL,
+      closure_reason TEXT,
+      closure_target TEXT,
+      archived_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_queue_transitions_archive_qitem ON queue_transitions_archive(qitem_id, ts);
+  `,
+};
+//# sourceMappingURL=054_queue_transitions_archive.js.map

package/daemon/dist/db/migrations/054_queue_transitions_archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"054_queue_transitions_archive.js","sourceRoot":"","sources":["../../../src/db/migrations/054_queue_transitions_archive.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAc;IACtD,IAAI,EAAE,mCAAmC;IACzC,GAAG,EAAE;;;;;;;;;;;;;GAaJ;CACF,CAAC"}