@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/db/migrations/061_daemon_lifecycle.d.ts

@@ -0,0 +1,22 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P7 shutdown-record — the daemon's own LIFECYCLE record (started / last-seen /
+ * stopped), distinct from the identity record (059 self_host_identity).
+ *
+ * Arch verdict d6a6c1db (FLAG-1): NET-NEW own table, NOT columns on
+ * self_host_identity — identity vs lifecycle is a type + write-cadence
+ * separation (a hot heartbeat UPDATE every tick must not churn the identity
+ * row image that alignment asserts + gateway reads consult). One home per
+ * concern. (Number: 060 was next-free at ruling time but claimed in flight by
+ * the tenure-ledger lane; P7 takes 061 — the own-table semantics are the ruling,
+ * the number is incidental. Next free after 059_self_host_identity /
+ * 060_<tenure-ledger>.)
+ *
+ * Singleton with a boot_epoch: a new boot mints a new epoch, sets started_at,
+ * and CLEARS stopped_at; the heartbeat advances last_heartbeat_at while
+ * not-stopped; a clean shutdown sets stopped_at (terminal per epoch). The render
+ * epoch-guards so a stale prior-run stopped_at is never shown for the new epoch.
+ * Row-per-epoch history is a builder option; the minimum is this singleton.
+ */
+export declare const daemonLifecycleSchema: Migration;
+//# sourceMappingURL=061_daemon_lifecycle.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/061_daemon_lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"061_daemon_lifecycle.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/061_daemon_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAWnC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/061_daemon_lifecycle.js

@@ -0,0 +1,32 @@
+/**
+ * P7 shutdown-record — the daemon's own LIFECYCLE record (started / last-seen /
+ * stopped), distinct from the identity record (059 self_host_identity).
+ *
+ * Arch verdict d6a6c1db (FLAG-1): NET-NEW own table, NOT columns on
+ * self_host_identity — identity vs lifecycle is a type + write-cadence
+ * separation (a hot heartbeat UPDATE every tick must not churn the identity
+ * row image that alignment asserts + gateway reads consult). One home per
+ * concern. (Number: 060 was next-free at ruling time but claimed in flight by
+ * the tenure-ledger lane; P7 takes 061 — the own-table semantics are the ruling,
+ * the number is incidental. Next free after 059_self_host_identity /
+ * 060_<tenure-ledger>.)
+ *
+ * Singleton with a boot_epoch: a new boot mints a new epoch, sets started_at,
+ * and CLEARS stopped_at; the heartbeat advances last_heartbeat_at while
+ * not-stopped; a clean shutdown sets stopped_at (terminal per epoch). The render
+ * epoch-guards so a stale prior-run stopped_at is never shown for the new epoch.
+ * Row-per-epoch history is a builder option; the minimum is this singleton.
+ */
+export const daemonLifecycleSchema = {
+    name: "061_daemon_lifecycle.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS daemon_lifecycle (
+      singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+      boot_epoch TEXT NOT NULL,
+      started_at TEXT NOT NULL,
+      last_heartbeat_at TEXT,
+      stopped_at TEXT
+    );
+  `,
+};
+//# sourceMappingURL=061_daemon_lifecycle.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/061_daemon_lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"061_daemon_lifecycle.js","sourceRoot":"","sources":["../../../src/db/migrations/061_daemon_lifecycle.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAc;IAC9C,IAAI,EAAE,0BAA0B;IAChC,GAAG,EAAE;;;;;;;;GAQJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/062_usage_samples.d.ts

@@ -0,0 +1,30 @@
+import type { Migration } from "../migrate.js";
+/**
+ * 51-08 A1 (plan-lock rev-1, PM 2026-08-07) — the append-only per-seat usage
+ * series behind token-telemetry-over-time.
+ *
+ * PM-ruled decisions bound here: DEDICATED time-series table (the events table's
+ * last-row read shape is unsuited to range queries; events stays lean); rows are
+ * APPEND-ONLY and advance-only (a sample identical to the seat's previous row is
+ * never written — an idle seat adds zero rows); retention is daemon-enforced
+ * (A2) per the queue_transitions_archive precedent.
+ *
+ * Two lanes share the table under `lane`:
+ *   'context'          — the context-window sample (tokens in/out, used %) the
+ *                        30s context-monitor tick already has in hand; the
+ *                        historical twin of context_usage's DESTRUCTIVE upsert
+ *                        (018), which stays untouched as the point-in-time lane.
+ *   'provider_window'  — the per-seat rate-limit windows (five_hour | weekly)
+ *                        from the statusline provider-usage sidecars, which had
+ *                        ZERO persistence before this table.
+ *
+ * OPTION-A BAR (provider-types.ts:106, host-usage-rollup.ts:12-16): seat/node
+ * identity ONLY — no account identity column exists and none may be added; the
+ * statusline exposes no honest account identity and this lane never fabricates
+ * one.
+ *
+ * NUMBER SEQUENCING (desk pin 2026-08-07): 060 = tenure ledger, 061 = P7
+ * lifecycle — both in-flight lanes; 062 is this slice's own mint.
+ */
+export declare const usageSamplesSchema: Migration;
+//# sourceMappingURL=062_usage_samples.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/062_usage_samples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"062_usage_samples.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/062_usage_samples.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAuBhC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/062_usage_samples.js

@@ -0,0 +1,52 @@
+/**
+ * 51-08 A1 (plan-lock rev-1, PM 2026-08-07) — the append-only per-seat usage
+ * series behind token-telemetry-over-time.
+ *
+ * PM-ruled decisions bound here: DEDICATED time-series table (the events table's
+ * last-row read shape is unsuited to range queries; events stays lean); rows are
+ * APPEND-ONLY and advance-only (a sample identical to the seat's previous row is
+ * never written — an idle seat adds zero rows); retention is daemon-enforced
+ * (A2) per the queue_transitions_archive precedent.
+ *
+ * Two lanes share the table under `lane`:
+ *   'context'          — the context-window sample (tokens in/out, used %) the
+ *                        30s context-monitor tick already has in hand; the
+ *                        historical twin of context_usage's DESTRUCTIVE upsert
+ *                        (018), which stays untouched as the point-in-time lane.
+ *   'provider_window'  — the per-seat rate-limit windows (five_hour | weekly)
+ *                        from the statusline provider-usage sidecars, which had
+ *                        ZERO persistence before this table.
+ *
+ * OPTION-A BAR (provider-types.ts:106, host-usage-rollup.ts:12-16): seat/node
+ * identity ONLY — no account identity column exists and none may be added; the
+ * statusline exposes no honest account identity and this lane never fabricates
+ * one.
+ *
+ * NUMBER SEQUENCING (desk pin 2026-08-07): 060 = tenure ledger, 061 = P7
+ * lifecycle — both in-flight lanes; 062 is this slice's own mint.
+ */
+export const usageSamplesSchema = {
+    name: "062_usage_samples.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS usage_samples (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      lane TEXT NOT NULL CHECK (lane IN ('context', 'provider_window')),
+      seat_session TEXT NOT NULL,
+      node_id TEXT,
+      source TEXT,
+      sampled_at TEXT,
+      captured_at TEXT NOT NULL,
+      total_input_tokens INTEGER,
+      total_output_tokens INTEGER,
+      used_percentage REAL,
+      window TEXT CHECK (window IN ('five_hour', 'weekly') OR window IS NULL),
+      window_used_percent REAL,
+      resets_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_usage_samples_seat_time
+      ON usage_samples(seat_session, lane, captured_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_samples_node_time
+      ON usage_samples(node_id, captured_at);
+  `,
+};
+//# sourceMappingURL=062_usage_samples.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/062_usage_samples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"062_usage_samples.js","sourceRoot":"","sources":["../../../src/db/migrations/062_usage_samples.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,IAAI,EAAE,uBAAuB;IAC7B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;GAoBJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/063_occupant_generation_stamps.d.ts

@@ -0,0 +1,24 @@
+import type { Migration } from "../migrate.js";
+/**
+ * GHOST-STAGE (e/Class-B) — occupant-generation stamps on the durable seat-ROLE stores.
+ *
+ * Class-B stores (queue_items, watchdog_jobs) are keyed by seat NAME (member@rig), which continues
+ * across a handover — so a name-scoped drop would neutralize the SUCCESSOR's own legitimate role
+ * entries. Only an entry bound to the RETIRING generation's specific in-flight work is a ghost. These
+ * columns carry the occupant-generation (atom-B `generation_uuid`) of the CONTEXT-BINDING act, so the
+ * invalidator can discriminate the retiree's entries from the successor's by generation, not name.
+ *
+ * Stamp the binding act, not merely INSERT (orch ruling): an item MINTED by seat-A gen-X but CLAIMED
+ * by seat-B gen-Y needs the CLAIMANT's generation for the ghost test — minting-gen alone re-creates
+ * the false-positive.
+ *   - queue_items.minting_generation_uuid    — set at INSERT (the creating occupant's gen).
+ *   - queue_items.claimed_by_generation_uuid — set at CLAIM, cleared at release (the CLAIMANT's gen;
+ *                                              THIS is the queue-item ghost discriminator).
+ *   - watchdog_jobs.registered_by_generation_uuid — set at arm (the registering occupant's gen).
+ *
+ * All NULLABLE + no default: pre-063 rows and un-stamped writers stay NULL, and a NULL generation is
+ * UNKNOWN → the invalidator's gen predicate never matches it (never dropped/released on unknown —
+ * note-2). Additive ALTERs; defensive column-detect reads keep pre-063 fixtures degrading cleanly.
+ */
+export declare const occupantGenerationStampsSchema: Migration;
+//# sourceMappingURL=063_occupant_generation_stamps.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/063_occupant_generation_stamps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"063_occupant_generation_stamps.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/063_occupant_generation_stamps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAO5C,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/063_occupant_generation_stamps.js

@@ -0,0 +1,30 @@
+/**
+ * GHOST-STAGE (e/Class-B) — occupant-generation stamps on the durable seat-ROLE stores.
+ *
+ * Class-B stores (queue_items, watchdog_jobs) are keyed by seat NAME (member@rig), which continues
+ * across a handover — so a name-scoped drop would neutralize the SUCCESSOR's own legitimate role
+ * entries. Only an entry bound to the RETIRING generation's specific in-flight work is a ghost. These
+ * columns carry the occupant-generation (atom-B `generation_uuid`) of the CONTEXT-BINDING act, so the
+ * invalidator can discriminate the retiree's entries from the successor's by generation, not name.
+ *
+ * Stamp the binding act, not merely INSERT (orch ruling): an item MINTED by seat-A gen-X but CLAIMED
+ * by seat-B gen-Y needs the CLAIMANT's generation for the ghost test — minting-gen alone re-creates
+ * the false-positive.
+ *   - queue_items.minting_generation_uuid    — set at INSERT (the creating occupant's gen).
+ *   - queue_items.claimed_by_generation_uuid — set at CLAIM, cleared at release (the CLAIMANT's gen;
+ *                                              THIS is the queue-item ghost discriminator).
+ *   - watchdog_jobs.registered_by_generation_uuid — set at arm (the registering occupant's gen).
+ *
+ * All NULLABLE + no default: pre-063 rows and un-stamped writers stay NULL, and a NULL generation is
+ * UNKNOWN → the invalidator's gen predicate never matches it (never dropped/released on unknown —
+ * note-2). Additive ALTERs; defensive column-detect reads keep pre-063 fixtures degrading cleanly.
+ */
+export const occupantGenerationStampsSchema = {
+    name: "063_occupant_generation_stamps.sql",
+    sql: `
+    ALTER TABLE queue_items ADD COLUMN minting_generation_uuid TEXT;
+    ALTER TABLE queue_items ADD COLUMN claimed_by_generation_uuid TEXT;
+    ALTER TABLE watchdog_jobs ADD COLUMN registered_by_generation_uuid TEXT;
+  `,
+};
+//# sourceMappingURL=063_occupant_generation_stamps.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/063_occupant_generation_stamps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"063_occupant_generation_stamps.js","sourceRoot":"","sources":["../../../src/db/migrations/063_occupant_generation_stamps.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAc;IACvD,IAAI,EAAE,oCAAoC;IAC1C,GAAG,EAAE;;;;GAIJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/064_projection_manifest.d.ts

@@ -0,0 +1,20 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P20 — the PROJECTION MANIFEST: what the projector last WROTE to each target,
+ * so a divergent target can be discriminated operator-modified (protect) vs
+ * stale-projection (safe overwrite). Follows P17 (overwrite-with-loud-warning,
+ * the manifest-less default): P17 sees only "target ≠ source" and cannot tell an
+ * operator edit from a stale projection; this table adds the third data point —
+ * last_hash = the content hash the projector last wrote to target_path.
+ *
+ * One row per projected target, keyed by absolute path. Per-row upserts are
+ * transactional (nodes launch concurrently → a whole-file JSON manifest would
+ * race; a DB table does not). Recorded ON WRITE only (idempotent: re-projecting
+ * identical content is a no-op → no row change).
+ *
+ * (Number 064: next-free at authoring on fold-64 base — 061 is P7's lifecycle
+ * table folding separately, 060/062/063 are other lanes. The desk owns the final
+ * migration-number union at restack; own-table semantics are the ruling.)
+ */
+export declare const projectionManifestSchema: Migration;
+//# sourceMappingURL=064_projection_manifest.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/064_projection_manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"064_projection_manifest.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/064_projection_manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAWtC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/064_projection_manifest.js

@@ -0,0 +1,30 @@
+/**
+ * P20 — the PROJECTION MANIFEST: what the projector last WROTE to each target,
+ * so a divergent target can be discriminated operator-modified (protect) vs
+ * stale-projection (safe overwrite). Follows P17 (overwrite-with-loud-warning,
+ * the manifest-less default): P17 sees only "target ≠ source" and cannot tell an
+ * operator edit from a stale projection; this table adds the third data point —
+ * last_hash = the content hash the projector last wrote to target_path.
+ *
+ * One row per projected target, keyed by absolute path. Per-row upserts are
+ * transactional (nodes launch concurrently → a whole-file JSON manifest would
+ * race; a DB table does not). Recorded ON WRITE only (idempotent: re-projecting
+ * identical content is a no-op → no row change).
+ *
+ * (Number 064: next-free at authoring on fold-64 base — 061 is P7's lifecycle
+ * table folding separately, 060/062/063 are other lanes. The desk owns the final
+ * migration-number union at restack; own-table semantics are the ruling.)
+ */
+export const projectionManifestSchema = {
+    name: "064_projection_manifest.sql",
+    sql: `
+    CREATE TABLE IF NOT EXISTS projection_manifest (
+      target_path TEXT PRIMARY KEY,
+      last_hash   TEXT NOT NULL,
+      written_at  TEXT NOT NULL,
+      source_spec TEXT,
+      category    TEXT
+    );
+  `,
+};
+//# sourceMappingURL=064_projection_manifest.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/064_projection_manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"064_projection_manifest.js","sourceRoot":"","sources":["../../../src/db/migrations/064_projection_manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAc;IACjD,IAAI,EAAE,6BAA6B;IACnC,GAAG,EAAE;;;;;;;;GAQJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/065_identity_provenance.d.ts

@@ -0,0 +1,15 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P21 — the CLAIMED-era vs DERIVED-era audit boundary (plan §4). Adds a NULLABLE `identity_provenance`
+ * column to the identity-carrying audit stores so a consumer can tell an actor that was verified by the
+ * transport chokepoint from a pre-P21 claimed-era row. The chokepoint writes `transport:v1`; **absence
+ * IS the claimed-era marker** — no backfill, no re-labeling (the house absent-never-fabricated doctrine).
+ * The boundary is per-ROW truth, not a timestamp: surfaces flip at different folds and each row stays
+ * individually honest. Consumers render a NULL row as "recorded (pre-verification era)", never "verified".
+ *
+ * This migration lands the column on `mission_control_actions` (I1 scope-approve + I2 mission-control
+ * both write it). Later increments extend the same era-stamp to their stores (queue_transitions,
+ * inbox/outbox, stream_items, chat_messages) — nullable + additive, same contract.
+ */
+export declare const identityProvenanceSchema: Migration;
+//# sourceMappingURL=065_identity_provenance.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/065_identity_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"065_identity_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/065_identity_provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAKtC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/065_identity_provenance.js

@@ -0,0 +1,19 @@
+/**
+ * P21 — the CLAIMED-era vs DERIVED-era audit boundary (plan §4). Adds a NULLABLE `identity_provenance`
+ * column to the identity-carrying audit stores so a consumer can tell an actor that was verified by the
+ * transport chokepoint from a pre-P21 claimed-era row. The chokepoint writes `transport:v1`; **absence
+ * IS the claimed-era marker** — no backfill, no re-labeling (the house absent-never-fabricated doctrine).
+ * The boundary is per-ROW truth, not a timestamp: surfaces flip at different folds and each row stays
+ * individually honest. Consumers render a NULL row as "recorded (pre-verification era)", never "verified".
+ *
+ * This migration lands the column on `mission_control_actions` (I1 scope-approve + I2 mission-control
+ * both write it). Later increments extend the same era-stamp to their stores (queue_transitions,
+ * inbox/outbox, stream_items, chat_messages) — nullable + additive, same contract.
+ */
+export const identityProvenanceSchema = {
+    name: "065_identity_provenance.sql",
+    sql: `
+    ALTER TABLE mission_control_actions ADD COLUMN identity_provenance TEXT;
+  `,
+};
+//# sourceMappingURL=065_identity_provenance.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/065_identity_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"065_identity_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/065_identity_provenance.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAc;IACjD,IAAI,EAAE,6BAA6B;IACnC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/066_watchdog_target_generation.d.ts

@@ -0,0 +1,17 @@
+import type { Migration } from "../migrate.js";
+/**
+ * GHOST-STAGE (i-c) — opt-in TARGET-generation stamp on watchdog_jobs.
+ *
+ * The registration-side ghost (a RETIRED registerer's job firing post-handover) is already closed by
+ * migration 063 + `dropArmedByRegisteringGeneration`. This column is the FIRE-TIME complement: a
+ * GENERATION-bound wake (opt-in) records the occupant-generation it is meant FOR, so the wake-issuer
+ * (WatchdogPolicyEngine) can refuse to fire it at a target that has since been handed over to a
+ * DIFFERENT live generation (the P12 `occupant_tenures` gen-check at deliver time).
+ *
+ * NULLABLE, no default: a NULL `target_generation_uuid` = ROLE-bound (fire at whoever occupies the
+ * seat NAME — the legitimate common case, fires UNCHANGED). Only a non-NULL stamp opts a job into the
+ * fire-time gen-gate. Additive ALTER; the repository's defensive column-detect keeps pre-066 fixtures
+ * degrading cleanly (writers leave it NULL, the gate no-ops → deliver).
+ */
+export declare const watchdogTargetGenerationSchema: Migration;
+//# sourceMappingURL=066_watchdog_target_generation.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/066_watchdog_target_generation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"066_watchdog_target_generation.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/066_watchdog_target_generation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAK5C,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/066_watchdog_target_generation.js

@@ -0,0 +1,21 @@
+/**
+ * GHOST-STAGE (i-c) — opt-in TARGET-generation stamp on watchdog_jobs.
+ *
+ * The registration-side ghost (a RETIRED registerer's job firing post-handover) is already closed by
+ * migration 063 + `dropArmedByRegisteringGeneration`. This column is the FIRE-TIME complement: a
+ * GENERATION-bound wake (opt-in) records the occupant-generation it is meant FOR, so the wake-issuer
+ * (WatchdogPolicyEngine) can refuse to fire it at a target that has since been handed over to a
+ * DIFFERENT live generation (the P12 `occupant_tenures` gen-check at deliver time).
+ *
+ * NULLABLE, no default: a NULL `target_generation_uuid` = ROLE-bound (fire at whoever occupies the
+ * seat NAME — the legitimate common case, fires UNCHANGED). Only a non-NULL stamp opts a job into the
+ * fire-time gen-gate. Additive ALTER; the repository's defensive column-detect keeps pre-066 fixtures
+ * degrading cleanly (writers leave it NULL, the gate no-ops → deliver).
+ */
+export const watchdogTargetGenerationSchema = {
+    name: "066_watchdog_target_generation.sql",
+    sql: `
+    ALTER TABLE watchdog_jobs ADD COLUMN target_generation_uuid TEXT;
+  `,
+};
+//# sourceMappingURL=066_watchdog_target_generation.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/066_watchdog_target_generation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"066_watchdog_target_generation.js","sourceRoot":"","sources":["../../../src/db/migrations/066_watchdog_target_generation.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAc;IACvD,IAAI,EAAE,oCAAoC;IAC1C,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/067_i3_identity_provenance.d.ts

@@ -0,0 +1,12 @@
+import type { Migration } from "../migrate.js";
+/**
+ * P21 I3 — extend the CLAIMED-era vs DERIVED-era audit boundary (plan §4, migration 065) to the
+ * QUEUE-SPINE identity-carrying stores. Adds the same NULLABLE `identity_provenance` column to
+ * `queue_transitions`, `inbox_entries`, `outbox_entries`, and `stream_items`. The I3 routes' transport
+ * chokepoint writes `transport:v1`; **absence IS the claimed-era marker** — no backfill, no re-labeling
+ * (the house absent-never-fabricated doctrine). The boundary is per-ROW truth, not a timestamp: each
+ * store's rows stay individually honest as I3's surfaces flip at their folds. Additive + nullable —
+ * identical contract to 065's `mission_control_actions` column.
+ */
+export declare const i3IdentityProvenanceSchema: Migration;
+//# sourceMappingURL=067_i3_identity_provenance.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/067_i3_identity_provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"067_i3_identity_provenance.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/067_i3_identity_provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAQxC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/067_i3_identity_provenance.js

@@ -0,0 +1,19 @@
+/**
+ * P21 I3 — extend the CLAIMED-era vs DERIVED-era audit boundary (plan §4, migration 065) to the
+ * QUEUE-SPINE identity-carrying stores. Adds the same NULLABLE `identity_provenance` column to
+ * `queue_transitions`, `inbox_entries`, `outbox_entries`, and `stream_items`. The I3 routes' transport
+ * chokepoint writes `transport:v1`; **absence IS the claimed-era marker** — no backfill, no re-labeling
+ * (the house absent-never-fabricated doctrine). The boundary is per-ROW truth, not a timestamp: each
+ * store's rows stay individually honest as I3's surfaces flip at their folds. Additive + nullable —
+ * identical contract to 065's `mission_control_actions` column.
+ */
+export const i3IdentityProvenanceSchema = {
+    name: "067_i3_identity_provenance.sql",
+    sql: `
+    ALTER TABLE queue_transitions ADD COLUMN identity_provenance TEXT;
+    ALTER TABLE inbox_entries ADD COLUMN identity_provenance TEXT;
+    ALTER TABLE outbox_entries ADD COLUMN identity_provenance TEXT;
+    ALTER TABLE stream_items ADD COLUMN identity_provenance TEXT;
+  `,
+};
+//# sourceMappingURL=067_i3_identity_provenance.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/067_i3_identity_provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"067_i3_identity_provenance.js","sourceRoot":"","sources":["../../../src/db/migrations/067_i3_identity_provenance.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAc;IACnD,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE;;;;;GAKJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/068_enforcer_decisions.d.ts

@@ -0,0 +1,4 @@
+import type { Migration } from "../migrate.js";
+/** W4 — durable, attributable human hold/authorize decisions for enforcers. */
+export declare const enforcerDecisionsSchema: Migration;
+//# sourceMappingURL=068_enforcer_decisions.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/068_enforcer_decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"068_enforcer_decisions.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/068_enforcer_decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,EAAE,SAqCrC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/068_enforcer_decisions.js

@@ -0,0 +1,40 @@
+/** W4 — durable, attributable human hold/authorize decisions for enforcers. */
+export const enforcerDecisionsSchema = {
+    name: "068_enforcer_decisions.sql",
+    sql: `
+    CREATE TABLE enforcer_decisions (
+      decision_id TEXT PRIMARY KEY,
+      enforcer_kind TEXT NOT NULL,
+      session_name TEXT NOT NULL,
+      generation_uuid TEXT NOT NULL,
+      direction TEXT NOT NULL CHECK (direction IN ('hold', 'authorize')),
+      automatic_reason TEXT,
+      reason TEXT NOT NULL,
+      actor_session TEXT NOT NULL,
+      identity_provenance TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      expires_at TEXT,
+      active INTEGER NOT NULL DEFAULT 1 CHECK (active IN (0, 1)),
+      release_kind TEXT,
+      released_at TEXT,
+      released_by_session TEXT,
+      release_identity_provenance TEXT,
+      release_reason TEXT,
+      consumed_at TEXT,
+      consumed_by_enforcer_kind TEXT,
+      lifted_reason TEXT,
+      attempt_outcome TEXT,
+      attempt_failure_reason TEXT,
+      last_observed_at TEXT,
+      last_observed_outcome TEXT
+    );
+
+    CREATE UNIQUE INDEX idx_enforcer_decisions_one_active
+      ON enforcer_decisions(enforcer_kind, session_name, generation_uuid)
+      WHERE active = 1;
+
+    CREATE INDEX idx_enforcer_decisions_lookup
+      ON enforcer_decisions(enforcer_kind, session_name, direction, active, generation_uuid);
+  `,
+};
+//# sourceMappingURL=068_enforcer_decisions.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/068_enforcer_decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"068_enforcer_decisions.js","sourceRoot":"","sources":["../../../src/db/migrations/068_enforcer_decisions.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAc;IAChD,IAAI,EAAE,4BAA4B;IAClC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/069_applied_launch_observations.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const appliedLaunchObservationsSchema: Migration;
+//# sourceMappingURL=069_applied_launch_observations.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/069_applied_launch_observations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"069_applied_launch_observations.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/069_applied_launch_observations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAK/C,eAAO,MAAM,+BAA+B,EAAE,SAa7C,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/069_applied_launch_observations.js

@@ -0,0 +1,18 @@
+// W3 permission-drift visibility: an APPLIED launch observation is a separate,
+// generation-keyed fact. The occupant-tenure ledger stays append-only and is
+// never repurposed as mutable observation storage.
+export const appliedLaunchObservationsSchema = {
+    name: "069_applied_launch_observations.sql",
+    sql: `
+    CREATE TABLE applied_launch_observations (
+      generation_uuid TEXT PRIMARY KEY REFERENCES occupant_tenures(generation_uuid) ON DELETE CASCADE,
+      runtime         TEXT NOT NULL,
+      axis            TEXT NOT NULL,
+      observation_state TEXT NOT NULL CHECK (observation_state IN ('observed', 'unknown')),
+      value           TEXT,
+      reason          TEXT,
+      observed_at     TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `,
+};
+//# sourceMappingURL=069_applied_launch_observations.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/069_applied_launch_observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"069_applied_launch_observations.js","sourceRoot":"","sources":["../../../src/db/migrations/069_applied_launch_observations.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,6EAA6E;AAC7E,mDAAmD;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAc;IACxD,IAAI,EAAE,qCAAqC;IAC3C,GAAG,EAAE;;;;;;;;;;GAUJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const appliedLaunchObservationInvalidationsSchema: Migration;
+//# sourceMappingURL=070_applied_launch_observation_invalidations.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"070_applied_launch_observation_invalidations.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/070_applied_launch_observation_invalidations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI/C,eAAO,MAAM,2CAA2C,EAAE,SAQzD,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.js

@@ -0,0 +1,12 @@
+// W3 cutover truth: once a generation's process is physically gone, no delayed
+// startup/restore completion may recreate its applied-launch observation.
+export const appliedLaunchObservationInvalidationsSchema = {
+    name: "070_applied_launch_observation_invalidations.sql",
+    sql: `
+    CREATE TABLE applied_launch_observation_invalidations (
+      generation_uuid TEXT PRIMARY KEY REFERENCES occupant_tenures(generation_uuid) ON DELETE CASCADE,
+      invalidated_at  TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+  `,
+};
+//# sourceMappingURL=070_applied_launch_observation_invalidations.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/070_applied_launch_observation_invalidations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"070_applied_launch_observation_invalidations.js","sourceRoot":"","sources":["../../../src/db/migrations/070_applied_launch_observation_invalidations.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2CAA2C,GAAc;IACpE,IAAI,EAAE,kDAAkD;IACxD,GAAG,EAAE;;;;;GAKJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/071_drop_enforcer_decisions.d.ts

@@ -0,0 +1,3 @@
+import type { Migration } from "../migrate.js";
+export declare const dropEnforcerDecisionsSchema: Migration;
+//# sourceMappingURL=071_drop_enforcer_decisions.d.ts.map

package/node_modules/@openrig/daemon/dist/db/migrations/071_drop_enforcer_decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"071_drop_enforcer_decisions.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/071_drop_enforcer_decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAa/C,eAAO,MAAM,2BAA2B,EAAE,SAKzC,CAAC"}

package/node_modules/@openrig/daemon/dist/db/migrations/071_drop_enforcer_decisions.js

@@ -0,0 +1,18 @@
+// Unbuild of the W4 compaction-enforcement suite (founder-ruled, over-engineering audit).
+//
+// FORWARD-ONLY BY RULING: 068_enforcer_decisions is APPLIED on live DBs and 069/070 sit above it,
+// so its migration file stays as history and is NOT deleted — removing it would leave an applied
+// ledger row with no migration and two migrations above the gap. This drops the table instead, so
+// schema_migrations keeps an honest record of both the create and the drop.
+//
+// IF EXISTS is load-bearing, not defensive noise: 068 is excluded from the shared full-test DB
+// fixture (test-app.ts migrationsForFullTestDbExclusions), so on that fixture this migration runs
+// against a database where enforcer_decisions was never created. The indexes are dropped with the
+// table by SQLite.
+export const dropEnforcerDecisionsSchema = {
+    name: "071_drop_enforcer_decisions.sql",
+    sql: `
+    DROP TABLE IF EXISTS enforcer_decisions;
+  `,
+};
+//# sourceMappingURL=071_drop_enforcer_decisions.js.map

package/node_modules/@openrig/daemon/dist/db/migrations/071_drop_enforcer_decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"071_drop_enforcer_decisions.js","sourceRoot":"","sources":["../../../src/db/migrations/071_drop_enforcer_decisions.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAClG,4EAA4E;AAC5E,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,mBAAmB;AACnB,MAAM,CAAC,MAAM,2BAA2B,GAAc;IACpD,IAAI,EAAE,iCAAiC;IACvC,GAAG,EAAE;;GAEJ;CACF,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/active-lens-store.d.ts

@@ -0,0 +1,23 @@
+export interface ActiveLens {
+    specName: string;
+    specVersion: string;
+    /** ISO timestamp of the most recent activation; useful for
+     *  diagnostics + UI staleness display. */
+    activatedAt: string;
+}
+export interface ActiveLensStoreOpts {
+    /** Absolute file path. Should fall under the daemon's OPENRIG_HOME so
+     *  the lens stays isolated per host. */
+    filePath: string;
+    /** Test seam — defaults to () => new Date(). */
+    now?: () => Date;
+}
+export declare class ActiveLensStore {
+    private readonly filePath;
+    private readonly now;
+    constructor(opts: ActiveLensStoreOpts);
+    get(): ActiveLens | null;
+    set(specName: string, specVersion: string): ActiveLens;
+    clear(): void;
+}
+//# sourceMappingURL=active-lens-store.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/active-lens-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-lens-store.d.ts","sourceRoot":"","sources":["../../src/domain/active-lens-store.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;8CAC0C;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC;4CACwC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,IAAI,EAAE,mBAAmB;IAKrC,GAAG,IAAI,UAAU,GAAG,IAAI;IAqBxB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU;IAuBtD,KAAK,IAAI,IAAI;CAOd"}