@openrig/cli 0.4.7 → 0.5.0

package/daemon/dist/domain/provider/host-usage-rollup.js

@@ -0,0 +1,162 @@
+// Slice-04 S-A (OPR.0.5.0.4, founder re-center amendment A2) — HOST-LEVEL USAGE ROLLUP.
+//
+// Usage is metered per account and this deployment runs ONE account per host, so a
+// usage-limit park is a HOST-level event. This module aggregates the seat-sourced
+// signal rows (C3 Claude statusline lane, sealed 5b56a2a4 · C4 Codex reactive lane,
+// sealed 6508330d) into ONE honest state row per (host, provider):
+//
+//   ok | nearing | limited (until resets_at when known) | explicit_unknown
+//
+// THE THREE BINDING HONESTY CONDITIONS (PM pattern check, verbatim-class):
+//   (i)  host==account is a DEPLOYMENT INVARIANT and every row SAYS so in its
+//        provenance — it is never presented as source-derived account
+//        classification (the C3 Option-A bar stands: the statusline carries no
+//        account identity and none is fabricated here). Rollup keys are
+//        (host, provider) ONLY; no account id/ref ever appears in a row.
+//   (ii) CONFLICTING seat windows on one host falsify the invariant for that
+//        host: they surface as a first-class `conflicting_seat_windows` anomaly
+//        plus an explicit_unknown host state — never a silent merge, never an
+//        averaged/fabricated number. The conflicting facts stay visible.
+//   (iii) usage-limit granularity rides ONLY what the C3 rows already carry
+//        (window / usedPercent / resetsAt / asOf) — nothing coerced, nothing
+//        invented. Codex has NO remaining-meter lane yet (C2 is a later seam),
+//        so codex state derives from fresh reactive EXHAUSTION evidence only,
+//        and its absence is an explicit unknown — never "ok" by silence.
+//
+// The single-daemon scope IS the host scope: rows carry host="local" (the
+// reserved local host id). Multi-host aggregation is explicitly out of scope
+// (the PRD's MH-lane later).
+/** Nearing = the shipped default advisory threshold on the C3-carried percentage. */
+export const NEARING_THRESHOLD_PERCENT = 80;
+/** Same-window resets_at spread tolerated as sampling skew before it is a CONFLICT.
+ *  Two seats on ONE account can read the same window seconds apart; two different
+ *  accounts' reset schedules differ by far more than this. */
+export const CONFLICTING_RESETS_EPSILON_MS = 120_000;
+const PROVENANCE_NOTE = "host==account is a deployment invariant of this rig (one account per host), declared by the operator — " +
+    "it is not source-derived account classification, and no account identity is read or emitted.";
+export function rollupHostUsage(input) {
+    const rows = [];
+    const claude = rollupClaude(input);
+    if (claude)
+        rows.push(claude);
+    const codex = rollupCodex(input);
+    if (codex)
+        rows.push(codex);
+    return rows;
+}
+// ——— Claude: the C3 seat-keyed statusline lane (meter rows + explicit-unknown rows) ———
+function rollupClaude(input) {
+    const lane = input.signals.filter((s) => s.provider === "claude");
+    if (lane.length === 0)
+        return null; // no claude deployment presence → no row
+    const meterRows = lane.filter((s) => s.sourceClass === "provider_statusline" && typeof s.usedPercent === "number");
+    const windows = meterRows.map((s) => ({
+        window: s.window ?? "unknown",
+        usedPercent: s.usedPercent,
+        resetsAt: s.resetsAt,
+        asOf: s.asOf,
+        seatSession: s.seatSession,
+    }));
+    const evidenceSeats = [...new Set(lane.map((s) => s.seatSession).filter((x) => typeof x === "string"))];
+    const base = {
+        host: "local",
+        provider: "claude",
+        windows,
+        provenance: { basis: "one_account_per_host_deployment_invariant", note: PROVENANCE_NOTE },
+        anomalies: [],
+        evidenceSeats,
+        asOf: input.now,
+    };
+    if (meterRows.length === 0) {
+        // Only explicit-unknown seat rows (absent cache / pre-first-response / api-key):
+        // the host state is honestly unknown, carrying the lane's own reason.
+        const reason = lane.find((s) => s.unknownReason)?.unknownReason ?? "no_usable_claude_usage_rows";
+        return { ...base, state: "explicit_unknown", unknownReason: reason };
+    }
+    // (ii) conflict detection per window: under host==account, every seat reading the SAME
+    // window must see the SAME reset schedule (within sampling skew). A wider spread means
+    // the seats are watching DIFFERENT accounts — the invariant is falsified for this host.
+    const anomalies = [];
+    const byWindow = new Map();
+    for (const s of meterRows) {
+        const key = s.window ?? "unknown";
+        byWindow.set(key, [...(byWindow.get(key) ?? []), s]);
+    }
+    for (const [windowKey, group] of byWindow) {
+        const withResets = group.filter((s) => typeof s.resetsAt === "string");
+        if (withResets.length < 2)
+            continue;
+        const times = withResets.map((s) => Date.parse(s.resetsAt)).filter(Number.isFinite);
+        if (times.length < 2)
+            continue;
+        if (Math.max(...times) - Math.min(...times) > CONFLICTING_RESETS_EPSILON_MS) {
+            anomalies.push({
+                kind: "conflicting_seat_windows",
+                window: windowKey,
+                seats: [...new Set(withResets.map((s) => s.seatSession).filter((x) => typeof x === "string"))],
+                evidence: `seats report divergent ${windowKey} reset schedules on one host: ` +
+                    withResets.map((s) => `${s.seatSession ?? "?"} resets_at=${s.resetsAt}`).join(" vs "),
+                asOf: input.now,
+            });
+        }
+    }
+    if (anomalies.length > 0) {
+        return {
+            ...base,
+            state: "explicit_unknown",
+            anomalies,
+            unknownReason: "conflicting_seat_windows: divergent reset schedules falsify the one-account-per-host invariant for this host",
+        };
+    }
+    const maxUsed = Math.max(...meterRows.map((s) => s.usedPercent));
+    if (maxUsed >= 100) {
+        const exhausted = meterRows.filter((s) => s.usedPercent >= 100);
+        const resets = exhausted
+            .map((s) => s.resetsAt)
+            .filter((x) => typeof x === "string")
+            .sort();
+        return { ...base, state: "limited", ...(resets[0] !== undefined ? { resetsAt: resets[0] } : {}) };
+    }
+    if (maxUsed >= NEARING_THRESHOLD_PERCENT)
+        return { ...base, state: "nearing" };
+    return { ...base, state: "ok" };
+}
+// ——— Codex: the C4 reactive lane (exhaustion evidence only — no meter until C2) ———
+function rollupCodex(input) {
+    const lane = input.signals.filter((s) => s.provider === "codex");
+    if (lane.length === 0 && !input.codexProfilesPresent)
+        return null; // no deployment presence
+    const nowMs = Date.parse(input.now);
+    // At-limit exhaustion evidence = a reactive_error event row the C4 tap marked as an
+    // actionable switch trigger (at_limit → allow_switch_decision; stream/stop errors are
+    // advisory and are NOT usage evidence). Freshness is inclusive-expiry (BR-2 class).
+    const freshAtLimit = lane.filter((s) => s.sourceClass === "provider_event" &&
+        s.authority === "reactive_error" &&
+        s.automationUse === "allow_switch_decision" &&
+        typeof s.staleAfter === "string" &&
+        Number.isFinite(Date.parse(s.staleAfter)) &&
+        Number.isFinite(nowMs) &&
+        nowMs < Date.parse(s.staleAfter));
+    const base = {
+        host: "local",
+        provider: "codex",
+        windows: [], // (iii): codex carries no remaining-meter granularity yet — nothing is invented
+        provenance: { basis: "one_account_per_host_deployment_invariant", note: PROVENANCE_NOTE },
+        anomalies: [],
+        evidenceSeats: freshAtLimit.map((s) => `reactive_event asOf=${s.asOf}`),
+        asOf: input.now,
+    };
+    if (freshAtLimit.length > 0) {
+        const resets = freshAtLimit
+            .map((s) => s.resetsAt)
+            .filter((x) => typeof x === "string")
+            .sort();
+        return { ...base, state: "limited", ...(resets[0] !== undefined ? { resetsAt: resets[0] } : {}) };
+    }
+    return {
+        ...base,
+        state: "explicit_unknown",
+        unknownReason: "no usage meter for codex on this host yet (the app-server read lane is a later seam); no fresh at-limit evidence either way",
+    };
+}
+//# sourceMappingURL=host-usage-rollup.js.map

package/daemon/dist/domain/provider/host-usage-rollup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-usage-rollup.js","sourceRoot":"","sources":["../../../src/domain/provider/host-usage-rollup.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,sEAAsE;AACtE,+EAA+E;AAC/E,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,6BAA6B;AAI7B,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;8DAE8D;AAC9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAC;AAyCrD,MAAM,eAAe,GACnB,yGAAyG;IACzG,8FAA8F,CAAC;AAUjG,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AAEzF,SAAS,YAAY,CAAC,KAA2B;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IAE7E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CACpF,CAAC;IAEF,MAAM,OAAO,GAA0B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;IAErH,MAAM,IAAI,GAAgC;QACxC,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,QAAQ;QAClB,OAAO;QACP,UAAU,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE,IAAI,EAAE,eAAe,EAAE;QACzF,SAAS,EAAE,EAAE;QACb,aAAa;QACb,IAAI,EAAE,KAAK,CAAC,GAAG;KAChB,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,iFAAiF;QACjF,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,aAAa,IAAI,6BAA6B,CAAC;QACjG,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACvE,CAAC;IAED,uFAAuF;IACvF,uFAAuF;IACvF,wFAAwF;IACxF,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,6BAA6B,EAAE,CAAC;YAC5E,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,SAAqC;gBAC7C,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;gBAC3G,QAAQ,EACN,0BAA0B,SAAS,gCAAgC;oBACnE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,GAAG,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvF,IAAI,EAAE,KAAK,CAAC,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,kBAAkB;YACzB,SAAS;YACT,aAAa,EACX,8GAA8G;SACjH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAY,IAAI,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,SAAS;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,OAAO,IAAI,yBAAyB;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC/E,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,qFAAqF;AAErF,SAAS,WAAW,CAAC,KAA2B;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAE5F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,oFAAoF;IACpF,sFAAsF;IACtF,oFAAoF;IACpF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,KAAK,gBAAgB;QAClC,CAAC,CAAC,SAAS,KAAK,gBAAgB;QAChC,CAAC,CAAC,aAAa,KAAK,uBAAuB;QAC3C,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CACnC,CAAC;IAEF,MAAM,IAAI,GAAgC;QACxC,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,EAAE,EAAE,gFAAgF;QAC7F,UAAU,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE,IAAI,EAAE,eAAe,EAAE;QACzF,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,EAAE,KAAK,CAAC,GAAG;KAChB,CAAC;IAEF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY;aACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,kBAAkB;QACzB,aAAa,EACX,6HAA6H;KAChI,CAAC;AACJ,CAAC"}

package/daemon/dist/domain/provider/provider-collect.d.ts

@@ -0,0 +1,22 @@
+import type { CodexAuthMetadata } from "./codex-auth-reader.js";
+import type { FourBlockReadModel, ProviderSignal } from "./provider-types.js";
+import type { NodeLifecycleState } from "../types.js";
+/** One seat in the fleet (the universe to bind), sourced from node-inventory across rigs. */
+export interface ProviderSeat {
+    seatSession: string;
+    rigName: string;
+    runtime: string;
+    lifecycleState: NodeLifecycleState;
+}
+export interface ProviderCollectDeps {
+    /** Reads codex-auth on-disk METADATA (profile names + seat registry) — never token content. */
+    readCodexAuth: () => CodexAuthMetadata;
+    /** The current seat universe (node-inventory across all rigs). */
+    listSeats: () => ProviderSeat[];
+    /** signals[] — empty until the live Codex/Claude/reactive collection lane is wired. */
+    collectSignals?: () => ProviderSignal[];
+    /** A real caller-provided clock; the read model's asOf (anomalies borrow it, never invented). */
+    now: () => string;
+}
+export declare function collectFourBlockReadModel(deps: ProviderCollectDeps): FourBlockReadModel;
+//# sourceMappingURL=provider-collect.d.ts.map

package/daemon/dist/domain/provider/provider-collect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-collect.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-collect.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE,OAAO,KAAK,EAAE,kBAAkB,EAAmB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,kBAAkB,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,+FAA+F;IAC/F,aAAa,EAAE,MAAM,iBAAiB,CAAC;IACvC,kEAAkE;IAClE,SAAS,EAAE,MAAM,YAAY,EAAE,CAAC;IAChC,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,cAAc,EAAE,CAAC;IACxC,iGAAiG;IACjG,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,CAsEvF"}

package/daemon/dist/domain/provider/provider-collect.js

@@ -0,0 +1,74 @@
+// Slice-04 (OPR.0.5.0.4) seam C1 (resume) — the getReadModel COLLECTION seam. A pure function
+// over injected inputs (the codex-auth metadata reader + a cross-rig seat lister + a clock), so the
+// production read-model path is directly testable without a live daemon/db. It maps codex-auth
+// profiles → accounts[] (authState="unknown" per BR-3 validate-at-use — NEVER assert active/
+// needs_reauth from static disk), joins the seat universe to the codex seat-registry into
+// rawBindings[] (unregistered/claude seats → unbound, so the assembler emits seat_with_no_account),
+// carries signals through (empty until the live signal-collection lane), and delegates all anomaly
+// computation to assembleFourBlock.
+import { rollupHostUsage } from "./host-usage-rollup.js";
+import { assembleFourBlock } from "./provider-read-model.js";
+import { claudeStatuslineSignals } from "./provider-signals.js";
+export function collectFourBlockReadModel(deps) {
+    const asOf = deps.now();
+    const { profiles, seats } = deps.readCodexAuth();
+    const seatUniverse = deps.listSeats();
+    // accounts[] — one row per known codex profile. BR-3: authState is "unknown" (validate-at-use);
+    // static disk presence proves the profile exists, NOT that its auth is currently valid.
+    const accounts = profiles.map((name) => ({
+        accountId: name,
+        label: name,
+        provider: "codex",
+        authState: "unknown",
+        profileRef: name,
+        asOf,
+    }));
+    // seat session → codex-auth registry row (the only binding source in this seam).
+    const registryBySeat = new Map(seats.map((s) => [s.seat, s]));
+    const rawBindings = seatUniverse.map((seat) => {
+        const reg = registryBySeat.get(seat.seatSession);
+        // Runtime-identity gate: bind ONLY when the LIVE inventory seat is actually a Codex seat. The
+        // codex auth-seat-registry is keyed by session name, so a STALE row whose session name was
+        // reused by a Claude seat must NOT bind that Claude seat to a Codex account — a Claude seat
+        // stays unbound (seat_with_no_account) regardless of any same-session registry row.
+        if (reg && seat.runtime === "codex") {
+            return {
+                accountId: reg.authProfile,
+                seatSession: seat.seatSession,
+                rigName: seat.rigName,
+                boundAt: reg.updatedTs,
+                bindingSource: "codex_auth_seat_registry",
+            };
+        }
+        // Unregistered/non-codex (claude seats, codex seats with no registry row) → unbound. The assembler
+        // attaches the required seat_with_no_account anomaly; we never fabricate a sentinel account.
+        return {
+            accountId: null,
+            seatSession: seat.seatSession,
+            rigName: seat.rigName,
+            boundAt: null,
+            bindingSource: null,
+        };
+    });
+    const liveClaudeSeats = new Set(seatUniverse
+        .filter((seat) => seat.runtime === "claude-code" && seat.lifecycleState === "running")
+        .map((seat) => seat.seatSession));
+    const signals = (deps.collectSignals ? [...deps.collectSignals()] : []).filter((signal) => signal.provider !== "claude" || !signal.seatSession || liveClaudeSeats.has(signal.seatSession));
+    const signaledClaudeSeats = new Set(signals.filter((signal) => signal.provider === "claude" && signal.seatSession).map((signal) => signal.seatSession));
+    // Cache discovery is never the seat-discovery authority. Every live Claude seat must have a
+    // row even before its first statusline payload (or when its cache is malformed/absent).
+    for (const seatSession of liveClaudeSeats) {
+        if (signaledClaudeSeats.has(seatSession))
+            continue;
+        signals.push(...claudeStatuslineSignals({ seatSession, cachePresent: false, asOf }));
+    }
+    const model = assembleFourBlock({ accounts, rawBindings, signals, asOf });
+    // Slice-04 S-A: the host-level rollup aggregates the SAME signals this collection produced.
+    // Codex deployment presence = auth profiles on disk (a host with codex accounts but no meter
+    // must surface an explicit unknown, never an omitted row).
+    return {
+        ...model,
+        hostUsage: rollupHostUsage({ signals, codexProfilesPresent: profiles.length > 0, now: asOf }),
+    };
+}
+//# sourceMappingURL=provider-collect.js.map

package/daemon/dist/domain/provider/provider-collect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-collect.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-collect.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,oGAAoG;AACpG,+FAA+F;AAC/F,6FAA6F;AAC7F,0FAA0F;AAC1F,oGAAoG;AACpG,mGAAmG;AACnG,oCAAoC;AAGpC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAuBhE,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAEtC,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,QAAQ,GAAsB,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,IAAI;QAChB,IAAI;KACL,CAAC,CAAC,CAAC;IAEJ,iFAAiF;IACjF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,MAAM,WAAW,GAAqB,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9D,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,8FAA8F;QAC9F,2FAA2F;QAC3F,4FAA4F;QAC5F,oFAAoF;QACpF,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACpC,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,WAAW;gBAC1B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,GAAG,CAAC,SAAS;gBACtB,aAAa,EAAE,0BAA0B;aAC1C,CAAC;QACJ,CAAC;QACD,mGAAmG;QACnG,6FAA6F;QAC7F,OAAO;YACL,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,YAAY;SACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,aAAa,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC;SACrF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CACnC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACxF,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAC/F,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAY,CAAC,CACpH,CAAC;IACF,4FAA4F;IAC5F,wFAAwF;IACxF,KAAK,MAAM,WAAW,IAAI,eAAe,EAAE,CAAC;QAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,SAAS;QACnD,OAAO,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,4FAA4F;IAC5F,6FAA6F;IAC7F,2DAA2D;IAC3D,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC"}

package/daemon/dist/domain/provider/provider-policy.d.ts

@@ -0,0 +1,38 @@
+import type { AccountAuthState, PrecheckResult, ProviderKind, ProviderSignal } from "./provider-types.js";
+export type AutomationRefusal = "sourceClass_unknown" | "authority_unknown" | "not_allow_switch_decision" | "no_freshness_bound" | "unparsable_freshness_bound" | "stale";
+export interface AutomationEligibility {
+    eligible: boolean;
+    refusals: AutomationRefusal[];
+}
+/**
+ * BR-2 eligibility. Eligible ONLY when the signal is known (source + authority), explicitly
+ * `allow_switch_decision`, and provably fresh. Fail-closed on freshness: a missing `staleAfter`
+ * or an unparsable one is ineligible (NaN must never compare as fresh). Expiry is INCLUSIVE:
+ * `now >= staleAfter` is stale. An unparsable `now` also cannot prove freshness → stale.
+ */
+export declare function signalEligibleForAutomation(signal: ProviderSignal, nowIso: string): AutomationEligibility;
+/** Fields common to a manual and an automated precheck. */
+interface PrecheckBase {
+    /** The provider of the account being switched TO. */
+    targetProvider: ProviderKind;
+    /** Validate-at-use: the target's auth state, checked at precheck time (never assumed). */
+    targetAuthState: AccountAuthState;
+    /** Whether the seat currently has a live turn/conversation in flight. */
+    seatHasLiveConversation: boolean;
+}
+/**
+ * A manual precheck carries NEITHER a triggering signal nor a clock; an automated precheck
+ * requires BOTH. The paired union makes "trigger without now" unrepresentable for typed
+ * callers (the fail-closed hole is closed at the type level; a runtime guard below covers
+ * untyped/JS callers).
+ */
+export type PrecheckInput = PrecheckBase & ({
+    triggeringSignal?: undefined;
+    now?: undefined;
+} | {
+    triggeringSignal: ProviderSignal;
+    now: string;
+});
+export declare function precheckSwitch(input: PrecheckInput): PrecheckResult;
+export {};
+//# sourceMappingURL=provider-policy.d.ts.map

package/daemon/dist/domain/provider/provider-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-policy.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-policy.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,gBAAgB,EAEhB,cAAc,EACd,YAAY,EACZ,cAAc,EACf,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,mBAAmB,GACnB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,OAAO,CAAC;AAEZ,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,qBAAqB,CAqBvB;AAiBD,2DAA2D;AAC3D,UAAU,YAAY;IACpB,qDAAqD;IACrD,cAAc,EAAE,YAAY,CAAC;IAC7B,0FAA0F;IAC1F,eAAe,EAAE,gBAAgB,CAAC;IAClC,yEAAyE;IACzE,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GACtC,CAAC;IAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,gBAAgB,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1G,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CA0BnE"}

package/daemon/dist/domain/provider/provider-policy.js

@@ -0,0 +1,76 @@
+// Slice-04 (OPR.0.5.0.4) — BR-2, the no-fire policy predicate (packet 3ffa3c22 §2 + BR-2).
+// A PURE predicate (no side effects, no action execution, no orchestration): it only decides
+// whether one signal is eligible to trigger an automated switch. Automation NEVER fires on a
+// signal that is unknown, not allow_switch_decision, or not provably fresh. Every failing
+// condition contributes an explicit, fail-visible refusal reason.
+/**
+ * BR-2 eligibility. Eligible ONLY when the signal is known (source + authority), explicitly
+ * `allow_switch_decision`, and provably fresh. Fail-closed on freshness: a missing `staleAfter`
+ * or an unparsable one is ineligible (NaN must never compare as fresh). Expiry is INCLUSIVE:
+ * `now >= staleAfter` is stale. An unparsable `now` also cannot prove freshness → stale.
+ */
+export function signalEligibleForAutomation(signal, nowIso) {
+    const refusals = [];
+    if (signal.sourceClass === "unknown")
+        refusals.push("sourceClass_unknown");
+    if (signal.authority === "unknown")
+        refusals.push("authority_unknown");
+    if (signal.automationUse !== "allow_switch_decision")
+        refusals.push("not_allow_switch_decision");
+    if (signal.staleAfter === undefined) {
+        refusals.push("no_freshness_bound");
+    }
+    else {
+        const staleMs = Date.parse(signal.staleAfter);
+        if (Number.isNaN(staleMs)) {
+            refusals.push("unparsable_freshness_bound");
+        }
+        else {
+            const nowMs = Date.parse(nowIso);
+            // Fail-closed: an unparsable `now`, or reaching/passing the bound, is stale.
+            if (Number.isNaN(nowMs) || nowMs >= staleMs)
+                refusals.push("stale");
+        }
+    }
+    return { eligible: refusals.length === 0, refusals };
+}
+// ── Precheck: the §1 switch-safety gate ─────────────────────────────────────────────────
+// precheckSwitch decides whether switching a seat to a target account is SAFE, so the UI and
+// automation never offer an unsafe action. Every unsafe condition is an explicit, fail-visible
+// reason; reasons combine deterministically. A pure predicate — no side effects.
+// The subset of BR-2 refusals that mean the triggering signal is unknown/stale (as opposed to
+// merely advisory, which is a BR-2 concern, not a precheck unknown/stale concern).
+const SIGNAL_UNKNOWN_OR_STALE_REFUSALS = [
+    "sourceClass_unknown",
+    "authority_unknown",
+    "no_freshness_bound",
+    "unparsable_freshness_bound",
+    "stale",
+];
+export function precheckSwitch(input) {
+    const reasons = [];
+    // rig auth is codex-only at the current switch substrate → a claude target can't be rebound.
+    if (input.targetProvider === "claude")
+        reasons.push("rebind_unsupported_for_runtime");
+    // Validate-at-use: only a confirmed-active target is safe. needs_reauth and unknown each fail
+    // closed under their OWN reason — unknown is never relabeled as a re-auth need.
+    if (input.targetAuthState === "needs_reauth")
+        reasons.push("target_needs_reauth");
+    else if (input.targetAuthState === "unknown")
+        reasons.push("target_auth_unknown");
+    if (input.seatHasLiveConversation)
+        reasons.push("would_strand_live_conversation");
+    // A triggering signal is present ONLY for an automated switch. Fail-closed for untyped/JS
+    // callers: if `now` is missing or unparsable it CANNOT prove freshness — the shared predicate
+    // maps an unparsable/absent now to NaN → stale, which is in the unknown/stale subset.
+    if (input.triggeringSignal !== undefined) {
+        const { refusals } = signalEligibleForAutomation(input.triggeringSignal, input.now);
+        if (refusals.some((r) => SIGNAL_UNKNOWN_OR_STALE_REFUSALS.includes(r))) {
+            reasons.push("signal_unknown_or_stale");
+        }
+    }
+    // Deterministic dedupe, insertion-order preserved.
+    const deduped = [...new Set(reasons)];
+    return deduped.length === 0 ? { safe: true } : { safe: false, reasons: deduped };
+}
+//# sourceMappingURL=provider-policy.js.map

package/daemon/dist/domain/provider/provider-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-policy.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-policy.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,6FAA6F;AAC7F,6FAA6F;AAC7F,0FAA0F;AAC1F,kEAAkE;AAuBlE;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,MAAc;IAEd,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,aAAa,KAAK,uBAAuB;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEjG,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,6EAA6E;YAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,2FAA2F;AAC3F,6FAA6F;AAC7F,+FAA+F;AAC/F,iFAAiF;AAEjF,8FAA8F;AAC9F,mFAAmF;AACnF,MAAM,gCAAgC,GAAiC;IACrE,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,4BAA4B;IAC5B,OAAO;CACR,CAAC;AAqBF,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAEtF,8FAA8F;IAC9F,gFAAgF;IAChF,IAAI,KAAK,CAAC,eAAe,KAAK,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;SAC7E,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAElF,IAAI,KAAK,CAAC,uBAAuB;QAAE,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAElF,0FAA0F;IAC1F,8FAA8F;IAC9F,sFAAsF;IACtF,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAa,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC"}

package/daemon/dist/domain/provider/provider-read-model.d.ts

@@ -0,0 +1,28 @@
+import type { FourBlockReadModel, ProviderAccount, ProviderSignal } from "./provider-types.js";
+/**
+ * A collected seat↔account fact — a discriminated bound/unbound union over the honest field
+ * set (no anomalies; the assembler computes those). Mirrors ProviderBinding so the collector
+ * never has to fabricate account/binding data for an unbound seat.
+ */
+export type RawSeatBinding = {
+    accountId: string;
+    seatSession: string;
+    rigName: string;
+    boundAt: string;
+    bindingSource: string;
+} | {
+    accountId: null;
+    seatSession: string;
+    rigName: string;
+    boundAt: null;
+    bindingSource: null;
+};
+export interface AssembleInput {
+    accounts: ProviderAccount[];
+    rawBindings: RawSeatBinding[];
+    signals: ProviderSignal[];
+    /** The read model's asOf — a real caller-provided timestamp; anomalies borrow it (not invented). */
+    asOf: string;
+}
+export declare function assembleFourBlock(input: AssembleInput): FourBlockReadModel;
+//# sourceMappingURL=provider-read-model.d.ts.map

package/daemon/dist/domain/provider/provider-read-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-read-model.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-read-model.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,kBAAkB,EAClB,eAAe,EAEf,cAAc,EAGf,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACnG;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,IAAI,CAAA;CAAE,CAAC;AAElG,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,kBAAkB,CA+D1E"}

package/daemon/dist/domain/provider/provider-read-model.js

@@ -0,0 +1,68 @@
+// Slice-04 (OPR.0.5.0.4) — the four-block ASSEMBLY (packet 3ffa3c22 §1, proof item 4).
+// A PURE assembler over already-collected inputs (no CLI/auth I/O — collection is a separate
+// seam). It emits real bound rows + explicit unbound rows (seat_with_no_account), computes
+// same_account_on_n_seats ONLY from repeated real account IDs, attaches anomalies
+// deterministically, preserves signals unchanged, and invents no IDs/boundAt/asOf.
+export function assembleFourBlock(input) {
+    const { accounts, rawBindings, signals, asOf } = input;
+    // Group DISTINCT seat sessions by REAL account id (unbound/null-account seats never
+    // contribute). A Set so duplicate raw rows for the same account+seat cannot inflate the count.
+    const seatsByAccount = new Map();
+    for (const rb of rawBindings) {
+        if (rb.accountId === null)
+            continue;
+        const set = seatsByAccount.get(rb.accountId) ?? new Set();
+        set.add(rb.seatSession);
+        seatsByAccount.set(rb.accountId, set);
+    }
+    // A same_account_on_n_seats anomaly per account genuinely shared across >= 2 DISTINCT seats.
+    const sharedAnomalyByAccount = new Map();
+    for (const [accountId, seats] of seatsByAccount) {
+        if (seats.size < 2)
+            continue;
+        const sortedSeats = [...seats].sort(); // deterministic
+        sharedAnomalyByAccount.set(accountId, {
+            kind: "same_account_on_n_seats",
+            count: sortedSeats.length,
+            seats: sortedSeats,
+            evidence: `account ${accountId} bound on ${sortedSeats.length} seats: ${sortedSeats.join(", ")}`,
+            asOf,
+        });
+    }
+    const bindings = rawBindings.map((rb) => {
+        if (rb.accountId === null) {
+            const anomaly = {
+                kind: "seat_with_no_account",
+                seat: rb.seatSession,
+                evidence: `seat ${rb.seatSession} in rig ${rb.rigName} has no bound account`,
+                asOf,
+            };
+            // Non-empty tuple: the seat_with_no_account anomaly is required and always first.
+            return {
+                accountId: null,
+                seatSession: rb.seatSession,
+                rigName: rb.rigName,
+                boundAt: null,
+                bindingSource: null,
+                anomalies: [anomaly],
+            };
+        }
+        const shared = sharedAnomalyByAccount.get(rb.accountId);
+        const anomalies = shared ? [shared] : [];
+        return {
+            accountId: rb.accountId,
+            seatSession: rb.seatSession,
+            rigName: rb.rigName,
+            boundAt: rb.boundAt,
+            bindingSource: rb.bindingSource,
+            anomalies,
+        };
+    });
+    return {
+        accounts,
+        bindings,
+        signals, // preserved unchanged
+        asOf,
+    };
+}
+//# sourceMappingURL=provider-read-model.js.map

package/daemon/dist/domain/provider/provider-read-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-read-model.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-read-model.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,6FAA6F;AAC7F,2FAA2F;AAC3F,kFAAkF;AAClF,mFAAmF;AA6BnF,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvD,oFAAoF;IACpF,+FAA+F;IAC/F,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QACxB,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,6FAA6F;IAC7F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC7E,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;YAAE,SAAS;QAC7B,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB;QACvD,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YACpC,IAAI,EAAE,yBAAyB;YAC/B,KAAK,EAAE,WAAW,CAAC,MAAM;YACzB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,WAAW,SAAS,aAAa,WAAW,CAAC,MAAM,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChG,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAsB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACzD,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA6B;gBACxC,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,EAAE,CAAC,WAAW;gBACpB,QAAQ,EAAE,QAAQ,EAAE,CAAC,WAAW,WAAW,EAAE,CAAC,OAAO,uBAAuB;gBAC5E,IAAI;aACL,CAAC;YACF,kFAAkF;YAClF,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,SAAS,GAAqB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,SAAS;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE,sBAAsB;QAC/B,IAAI;KACL,CAAC;AACJ,CAAC"}

package/daemon/dist/domain/provider/provider-service-impl.d.ts

@@ -0,0 +1,26 @@
+import type Database from "better-sqlite3";
+import { type AgentActivityStore } from "../agent-activity-store.js";
+import type { ProviderService, ProviderPrecheckInput, ProviderSwitchInput, ProviderSwitchResult } from "./provider-service.js";
+import type { FourBlockReadModel, PrecheckResult, ProviderSignal } from "./provider-types.js";
+export interface ProviderServiceImplDeps {
+    db: Database.Database;
+    /** The rig universe (rigRepo.listRigs()) — each rig's node-inventory contributes seats. */
+    listRigs: () => Array<{
+        id: string;
+    }>;
+    /** Slice-04 C3: the Claude statusline provider_usage signal source (undefined → signals []). */
+    collectClaudeSignals?: () => ProviderSignal[];
+    /** Slice-04 C4: the shipped structured activity detector. Undefined keeps the reactive lane empty. */
+    agentActivityStore?: Pick<AgentActivityStore, "getLatestForNode">;
+    env?: NodeJS.ProcessEnv;
+    now?: () => string;
+}
+export declare class ProviderServiceImpl implements ProviderService {
+    private readonly deps;
+    constructor(deps: ProviderServiceImplDeps);
+    getReadModel(): Promise<FourBlockReadModel>;
+    private listSeats;
+    precheck(input: ProviderPrecheckInput): Promise<PrecheckResult>;
+    switchAccount(input: ProviderSwitchInput): Promise<ProviderSwitchResult>;
+}
+//# sourceMappingURL=provider-service-impl.d.ts.map

package/daemon/dist/domain/provider/provider-service-impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-service-impl.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-service-impl.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE9F,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtC,gGAAgG;IAChG,oBAAoB,CAAC,EAAE,MAAM,cAAc,EAAE,CAAC;IAC9C,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,uBAAuB;IAEpD,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA0BjD,OAAO,CAAC,SAAS;IAgBX,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IAc/D,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAW/E"}

package/daemon/dist/domain/provider/provider-service-impl.js

@@ -0,0 +1,83 @@
+// Slice-04 (OPR.0.5.0.4) C1 (resume) — the production ProviderService. getReadModel is fully
+// wired over the collection seam (real codex-auth reader + node-inventory across rigs + clock).
+// precheck composes the pure precheckSwitch gate (fails closed on unknown auth per BR-3). switch
+// is precheck-gated and NEVER fabricates success — the switch-execution + BR-1 action-record path
+// is the D seam; until it lands, switch returns an honest failed_safely with an operational reason.
+import { AGENT_ACTIVITY_FRESHNESS_MS, } from "../agent-activity-store.js";
+import { getNodeInventory } from "../node-inventory.js";
+import { readCodexAuthMetadata } from "./codex-auth-reader.js";
+import { collectFourBlockReadModel } from "./provider-collect.js";
+import { precheckSwitch } from "./provider-policy.js";
+import { collectReactiveEventSignals } from "./reactive-tap.js";
+export class ProviderServiceImpl {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async getReadModel() {
+        const env = this.deps.env ?? process.env;
+        const asOf = (this.deps.now ?? (() => new Date().toISOString()))();
+        let auth;
+        let seats;
+        const readAuth = () => auth ??= readCodexAuthMetadata(env);
+        const listSeats = () => seats ??= this.listSeats();
+        return collectFourBlockReadModel({
+            readCodexAuth: readAuth,
+            listSeats,
+            collectSignals: () => [
+                ...(this.deps.collectClaudeSignals?.() ?? []),
+                ...(this.deps.agentActivityStore
+                    ? collectReactiveEventSignals({
+                        seats: listSeats(),
+                        auth: readAuth(),
+                        activity: this.deps.agentActivityStore,
+                        now: asOf,
+                        freshnessMs: AGENT_ACTIVITY_FRESHNESS_MS,
+                    })
+                    : []),
+            ],
+            now: () => asOf,
+        });
+    }
+    listSeats() {
+        const seats = [];
+        for (const rig of this.deps.listRigs()) {
+            for (const entry of getNodeInventory(this.deps.db, rig.id)) {
+                if (!entry.canonicalSessionName)
+                    continue;
+                seats.push({
+                    seatSession: entry.canonicalSessionName,
+                    rigName: entry.rigName ?? "",
+                    runtime: entry.runtime ?? "unknown",
+                    lifecycleState: entry.lifecycleState,
+                });
+            }
+        }
+        return seats;
+    }
+    async precheck(input) {
+        const model = await this.getReadModel();
+        const target = model.accounts.find((a) => a.accountId === input.toAccount);
+        // Validate-at-use: an unknown target OR unknown auth fails closed (BR-3 — disk presence never
+        // asserts active). Live-conversation state is not yet wired (the C2 activity seam), so assume
+        // live — the conservative direction never strands a conversation silently. This is the MANUAL
+        // precheck variant (no triggeringSignal; that's for automated policy-driven switches).
+        return precheckSwitch({
+            targetProvider: target?.provider ?? "codex",
+            targetAuthState: target?.authState ?? "unknown",
+            seatHasLiveConversation: true,
+        });
+    }
+    async switchAccount(input) {
+        // Precheck-gate: never switch past an unsafe verdict unless explicitly forced.
+        const verdict = await this.precheck({ seat: input.seat, toAccount: input.toAccount });
+        if (verdict.safe === false && !input.forceUnsafe) {
+            const reasons = verdict.reasons.length > 0 ? verdict.reasons : ["precheck_unsafe"];
+            return { outcome: "failed_safely", reasons: reasons };
+        }
+        // D seam (compose the rig-auth codex switch + BR-1 durable action record) is NOT yet wired.
+        // Honest operational failure — never fabricate a succeeded/rebind_in_progress outcome.
+        return { outcome: "failed_safely", reasons: ["switch_execution_not_yet_wired"] };
+    }
+}
+//# sourceMappingURL=provider-service-impl.js.map