@openrig/cli 0.5.0 → 0.5.2

package/node_modules/@openrig/daemon/dist/domain/workflow-exception.js

@@ -0,0 +1,122 @@
+// OPR.0.4.6.WF5 FR-1: the closed exception taxonomy.
+//
+// An EXCEPTION is one of exactly three classes, each a PURE PREDICATE over
+// recorded state (BR-1: never ambient probing, never judgment in the engine —
+// agent judgment lives in RESOLVING, not detecting). Extending this taxonomy
+// is a convention change, not driver discretion.
+//
+//   (a) unmapped_failed — an instance entered status=failed. A MAPPED
+//       `failed` exit routes to its WF-2 remediation branch inside the same
+//       transaction (instance stays active) and is NOT an exception; only an
+//       unrouted failed close — including the engine-authored max_hops
+//       conversion — lands the instance in `failed`, so the recorded status
+//       IS the predicate.
+//   (b) stuck_overdue — a frontier packet past its deadline AS CLASSIFIED BY
+//       WF-1 FR-2's evaluator (workflow-deadline.ts, the single threshold
+//       home). This module consumes the verdict verbatim and never
+//       recomputes an anchor or threshold.
+//   (c) human_gate_trip — a WF-2 gate with a HUMAN target reached. The
+//       WF-2-compiled park IS the attention item (FR-2 mints no second one);
+//       this class exists so the item carries the exception identity.
+//
+// THE HANDLER-ROLE SPLIT (spec-guard blocker 2, ratified): a handler-role
+// gate-trip is NOT an exception — it is a deterministic agent handoff by
+// design. The escalation leg is the backstop BEHIND the handler: if the
+// handler's own step fails or goes stuck, classes (a)/(b) fire on it.
+//
+// v1.3: CLASSIFICATION ≠ ROUTING. The maturity dial (workflow-exception-
+// router.ts) maps class → target; nothing here knows about destinations.
+export const WORKFLOW_EXCEPTION_CLASSES = [
+    "unmapped_failed",
+    "stuck_overdue",
+    "human_gate_trip",
+];
+/**
+ * Class (a): unmapped_failed. Pure: same view → same classification,
+ * replayed N times. A non-failed instance NEVER classifies (the mapped-
+ * failed negative: branch-routed failures keep status=active and are
+ * deterministic remediation, not exceptions).
+ */
+export function classifyFailedInstance(view) {
+    if (view.instance.status !== "failed")
+        return null;
+    return {
+        identity: {
+            workflowName: view.instance.workflowName,
+            instanceId: view.instance.instanceId,
+            stepId: view.failedStepId,
+            exceptionClass: "unmapped_failed",
+            occurrenceKey: view.failedPacketId,
+        },
+        reason: view.failureReason
+            ? `workflow step failed with no remediation branch: ${view.failureReason}`
+            : "workflow step failed with no remediation branch",
+        deadlineEvidence: null,
+    };
+}
+/**
+ * Class (b): stuck_overdue. CONSUMES the WF-1 evaluator's verdict verbatim
+ * (rail: the single threshold home classifies; this function only lifts a
+ * non-healthy verdict into the exception shape). Healthy → null.
+ */
+export function classifyDeadlineVerdict(workflowName, verdict) {
+    if (verdict.state === "healthy" || !verdict.evidence)
+        return null;
+    const e = verdict.evidence;
+    return {
+        identity: {
+            workflowName,
+            instanceId: e.instanceId,
+            stepId: e.stepId,
+            exceptionClass: "stuck_overdue",
+            occurrenceKey: e.packetId,
+        },
+        reason: `workflow step ${e.stepId ?? "(unbound)"} is ${verdict.state} — packet ${e.packetId} ` +
+            `held by ${e.ownerSession}, ${e.overdueBySeconds}s past its ${e.anchor} anchor`,
+        deadlineEvidence: e,
+    };
+}
+/**
+ * Class (c): human_gate_trip — HUMAN-target gates only. THE HANDLER-ROLE
+ * NEGATIVE lives here: a handler-role gate returns null (a deterministic
+ * handoff, not an exception; the (a)/(b) backstop covers the handler's own
+ * step). Class (c) is intrinsically human-only at the dial.
+ */
+export function classifyGateTrip(view) {
+    if (view.gateKind !== "human")
+        return null;
+    return {
+        identity: {
+            workflowName: view.workflowName,
+            instanceId: view.instanceId,
+            stepId: view.gatedStepId,
+            exceptionClass: "human_gate_trip",
+            occurrenceKey: view.gatePacketId,
+        },
+        reason: `human decision required at gated step ${view.gatedStepId}` +
+            (view.parkOn ? ` (parked on ${view.parkOn})` : ""),
+        deadlineEvidence: null,
+    };
+}
+/** Tag prefixes: `workflow:`/`instance:` extend the SHIPPED stamp
+ *  (workflow-runtime.ts / workflow-projector.ts already emit them);
+ *  `step:`/`exception:`/`occurrence:` are WF-5's additions (arch cell 2).
+ *  FR-2 dedup and FR-3 cross-channel one-count JOIN on these BY QUERY —
+ *  never by summary parsing. */
+export function workflowExceptionTags(identity) {
+    const tags = [
+        "workflow-exception",
+        `workflow:${identity.workflowName}`,
+        `instance:${identity.instanceId}`,
+        `exception:${identity.exceptionClass}`,
+        `occurrence:${identity.occurrenceKey}`,
+    ];
+    if (identity.stepId)
+        tags.splice(3, 0, `step:${identity.stepId}`);
+    return tags;
+}
+/** The query key for within-occurrence dedup: one item per this tuple. */
+export function occurrenceDedupKey(identity) {
+    return `${identity.instanceId}|${identity.stepId ?? ""}|${identity.exceptionClass}|${identity.occurrenceKey}`;
+}
+//# sourceMappingURL=workflow-exception.js.map

package/node_modules/@openrig/daemon/dist/domain/workflow-exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-exception.js","sourceRoot":"","sources":["../../src/domain/workflow-exception.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,0BAA0B;AAC1B,6EAA6E;AAC7E,0EAA0E;AAC1E,mEAAmE;AACnE,2CAA2C;AAC3C,uEAAuE;AACvE,6EAA6E;AAC7E,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AAKzE,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,iBAAiB;IACjB,eAAe;IACf,iBAAiB;CACT,CAAC;AAqDX;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO;QACL,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;YACxC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YACpC,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,cAAc,EAAE,iBAAiB;YACjC,aAAa,EAAE,IAAI,CAAC,cAAc;SACnC;QACD,MAAM,EAAE,IAAI,CAAC,aAAa;YACxB,CAAC,CAAC,oDAAoD,IAAI,CAAC,aAAa,EAAE;YAC1E,CAAC,CAAC,iDAAiD;QACrD,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAAoB,EACpB,OAAgC;IAEhC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,OAAO;QACL,QAAQ,EAAE;YACR,YAAY;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,CAAC,CAAC,QAAQ;SAC1B;QACD,MAAM,EACJ,iBAAiB,CAAC,CAAC,MAAM,IAAI,WAAW,OAAO,OAAO,CAAC,KAAK,aAAa,CAAC,CAAC,QAAQ,GAAG;YACtF,WAAW,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,gBAAgB,cAAc,CAAC,CAAC,MAAM,SAAS;QACjF,gBAAgB,EAAE,CAAC;KACpB,CAAC;AACJ,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,cAAc,EAAE,iBAAiB;YACjC,aAAa,EAAE,IAAI,CAAC,YAAY;SACjC;QACD,MAAM,EAAE,yCAAyC,IAAI,CAAC,WAAW,EAAE;YACjE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED;;;;gCAIgC;AAChC,MAAM,UAAU,qBAAqB,CAAC,QAAmC;IACvE,MAAM,IAAI,GAAG;QACX,oBAAoB;QACpB,YAAY,QAAQ,CAAC,YAAY,EAAE;QACnC,YAAY,QAAQ,CAAC,UAAU,EAAE;QACjC,aAAa,QAAQ,CAAC,cAAc,EAAE;QACtC,cAAc,QAAQ,CAAC,aAAa,EAAE;KACvC,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,QAAmC;IACpE,OAAO,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;AAChH,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/workflow-frontier-guard.d.ts

@@ -0,0 +1,24 @@
+import type Database from "better-sqlite3";
+/**
+ * OPR.0.4.6.WF3 FR-6 — the frontier close-path guard's PREDICATE (pm
+ * convention ruling: prevention over detection).
+ *
+ * THE LAYERING PIN (arch, binding, Rev-1): the queue is the lower
+ * primitive and NEVER imports the workflow domain. This module is the
+ * workflow domain's export; startup INJECTS the predicate into
+ * QueueRepository (the `validateRig` injection precedent exactly).
+ * Same functional behavior as a direct import, without the module
+ * cycle the next refactor would strangle on.
+ *
+ * The predicate answers: is this qitem a LIVE workflow-frontier
+ * packet? Null for every non-workflow qitem — the zero-friction
+ * negative (non-workflow closure behavior stays byte-identical; no
+ * new rejections ride this predicate for ordinary traffic).
+ */
+export interface WorkflowFrontierBinding {
+    instanceId: string;
+    workflowName: string;
+}
+export type WorkflowFrontierPredicate = (qitemId: string) => WorkflowFrontierBinding | null;
+export declare function createWorkflowFrontierPredicate(db: Database.Database): WorkflowFrontierPredicate;
+//# sourceMappingURL=workflow-frontier-guard.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/workflow-frontier-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-frontier-guard.d.ts","sourceRoot":"","sources":["../../src/domain/workflow-frontier-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,uBAAuB,GAAG,IAAI,CAAC;AAE5F,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,yBAAyB,CA2BhG"}

package/node_modules/@openrig/daemon/dist/domain/workflow-frontier-guard.js

@@ -0,0 +1,30 @@
+export function createWorkflowFrontierPredicate(db) {
+    return (qitemId) => {
+        // current_frontier is a JSON array column; a frontier membership
+        // check is a containment probe on the serialized id. Scoped to
+        // LIVE instances only — terminal instances hold no frontier.
+        let row;
+        try {
+            row = db
+                .prepare(`SELECT instance_id, workflow_name FROM workflow_instances
+           WHERE status IN ('active','waiting') AND current_frontier_json LIKE ?
+           LIMIT 1`)
+                .get(`%"${qitemId}"%`);
+        }
+        catch (err) {
+            // Pre-workflow schemas (no workflow_instances table): nothing to
+            // guard — identical to the predicate-absent posture. ONLY that
+            // case is tolerated: any other SQL error (e.g. a renamed column)
+            // must fail LOUD — a swallowed error here silently disables a
+            // correctness guard (VM-caught: the first draft ate its own
+            // wrong-column error and the guard never fired).
+            if (err instanceof Error && /no such table/i.test(err.message))
+                return null;
+            throw err;
+        }
+        if (!row?.instance_id)
+            return null;
+        return { instanceId: row.instance_id, workflowName: row.workflow_name ?? "(unknown)" };
+    };
+}
+//# sourceMappingURL=workflow-frontier-guard.js.map

package/node_modules/@openrig/daemon/dist/domain/workflow-frontier-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-frontier-guard.js","sourceRoot":"","sources":["../../src/domain/workflow-frontier-guard.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,+BAA+B,CAAC,EAAqB;IACnE,OAAO,CAAC,OAAe,EAAkC,EAAE;QACzD,iEAAiE;QACjE,+DAA+D;QAC/D,6DAA6D;QAC7D,IAAI,GAAiE,CAAC;QACtE,IAAI,CAAC;YACH,GAAG,GAAG,EAAE;iBACL,OAAO,CACN;;mBAES,CACV;iBACA,GAAG,CAAC,KAAK,OAAO,IAAI,CAAe,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,+DAA+D;YAC/D,iEAAiE;YACjE,8DAA8D;YAC9D,4DAA4D;YAC5D,iDAAiD;YACjD,IAAI,GAAG,YAAY,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,WAAW;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC;IACzF,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/workflow-instance-store.d.ts

@@ -0,0 +1,74 @@
+import type Database from "better-sqlite3";
+import type { WorkflowInstance, WorkflowInstanceStatus } from "./workflow-types.js";
+export interface CreateWorkflowInstanceInput {
+    workflowName: string;
+    workflowVersion: string;
+    createdBySession: string;
+    initialFrontier?: string[];
+    /** R2: durable current-step binding set at instantiate time. */
+    currentStepId?: string;
+    /**
+     * OPR.0.4.6.FAC1: the rig NAME this instance binds to (already
+     * resolved by the runtime: targetRig override ?? spec.target.rig).
+     * null/absent = unbound (today's behavior byte-identical).
+     */
+    boundRig?: string | null;
+}
+export declare class WorkflowInstanceError extends Error {
+    readonly code: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: string, message: string, details?: Record<string, unknown> | undefined);
+}
+export declare class WorkflowInstanceStore {
+    private readonly db;
+    private readonly now;
+    private readonly hasVersionColumn;
+    private readonly hasResumeColumns;
+    private readonly hasBoundRigColumn;
+    constructor(db: Database.Database, now?: () => Date);
+    create(input: CreateWorkflowInstanceInput): WorkflowInstance;
+    getById(instanceId: string): WorkflowInstance | null;
+    getByIdOrThrow(instanceId: string): WorkflowInstance;
+    listByStatus(status: WorkflowInstanceStatus): WorkflowInstance[];
+    listAll(): WorkflowInstance[];
+    /**
+     * Update frontier + status atomically. Caller is responsible for
+     * wrapping in a transaction when this needs to compose with other
+     * mutations (e.g., workflow-projector folds this into the
+     * close + create + frontier-update transaction).
+     */
+    updateFrontier(instanceId: string, nextFrontier: string[], nextStatus: WorkflowInstanceStatus, opts?: {
+        bumpHopCount?: boolean;
+        lastContinuationDecision?: Record<string, unknown> | null;
+        fallbackSynthesis?: string | null;
+        completedAt?: string | null;
+        /**
+         * R2: explicit next current_step_id. When provided, OVERWRITES
+         * the column (including to NULL by passing the empty string for
+         * "clear"). When omitted, current_step_id is preserved (the
+         * frontier packet is reused, e.g., on waiting). To clear pass
+         * the symbol "clear-current-step" (typed as the literal below).
+         */
+        currentStepId?: string | "preserve" | "clear";
+        /**
+         * OPR.0.4.6.WF1 FR-5 — the optimistic-concurrency guard. When
+         * provided, the UPDATE is qualified `WHERE version = ?` and bumps
+         * `version = version + 1`; zero rows changed throws the
+         * structured `instance_version_conflict` naming expected/actual
+         * (the caller's transaction rolls back whole). When omitted,
+         * legacy unguarded behavior (no version read, no bump) — the
+         * projector ALWAYS provides it.
+         */
+        expectedVersion?: number;
+        /**
+         * OPR.0.4.6.WF5 FR-4 — the resume stamp: sets the recorded
+         * redrive count AND the livelock-rail hops baseline atomically
+         * with the frontier rebind. Only resume() passes it.
+         */
+        resumeStamp?: {
+            resumeCount: number;
+            hopsBaseline: number;
+        };
+    }): void;
+}
+//# sourceMappingURL=workflow-instance-store.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/workflow-instance-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-instance-store.d.ts","sourceRoot":"","sources":["../../src/domain/workflow-instance-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,qBAAqB,CAAC;AA2C7B,MAAM,WAAW,2BAA2B;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;aAE5B,IAAI,EAAE,MAAM;aAEZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjC,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD;AAED,qBAAa,qBAAqB;IAM9B,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAGzB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,GAAG,GAAE,MAAM,IAAuB;IAOrD,MAAM,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB;IA8B5D,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAOpD,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB;IAYpD,YAAY,CAAC,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,EAAE;IAShE,OAAO,IAAI,gBAAgB,EAAE;IAO7B;;;;;OAKG;IACH,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EAAE,EACtB,UAAU,EAAE,sBAAsB,EAClC,IAAI,GAAE;QACJ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QAC1D,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B;;;;;;WAMG;QACH,aAAa,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;QAC9C;;;;;;;;WAQG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB;;;;WAIG;QACH,WAAW,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,IAAI;CAoDR"}

package/node_modules/@openrig/daemon/dist/domain/workflow-instance-store.js

@@ -0,0 +1,172 @@
+// PL-004 Phase D: workflow instance store.
+//
+// Owns CRUD on workflow_instances. Frontier tracking uses
+// current_frontier_json (serialized JSON array of qitem_ids). Survives
+// daemon restart without filesystem reconciliation: list/getById query
+// SQLite directly.
+import { ulid } from "ulid";
+/** Defensive column probe (the detectQueueColumn house pattern) —
+ *  older test fixtures bypass the canonical migration list, so the
+ *  version column (migration 049) may be absent; the guard degrades
+ *  to legacy unguarded updates there. Production always migrates. */
+function detectInstanceColumn(db, columnName) {
+    try {
+        return db
+            .prepare("PRAGMA table_info(workflow_instances)")
+            .all()
+            .some((row) => row.name === columnName);
+    }
+    catch {
+        return false;
+    }
+}
+export class WorkflowInstanceError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "WorkflowInstanceError";
+    }
+}
+export class WorkflowInstanceStore {
+    db;
+    now;
+    hasVersionColumn;
+    hasResumeColumns;
+    hasBoundRigColumn;
+    constructor(db, now = () => new Date()) {
+        this.db = db;
+        this.now = now;
+        this.hasVersionColumn = detectInstanceColumn(db, "version");
+        this.hasResumeColumns = detectInstanceColumn(db, "resume_count");
+        this.hasBoundRigColumn = detectInstanceColumn(db, "bound_rig");
+    }
+    create(input) {
+        const instanceId = ulid();
+        const createdAt = this.now().toISOString();
+        const frontier = input.initialFrontier ?? [];
+        // OPR.0.4.6.FAC1: bound_rig rides the same defensive column probe
+        // as version/resume (legacy fixtures without migration 052 keep the
+        // legacy INSERT; production always migrates).
+        const boundRigCol = this.hasBoundRigColumn ? ", bound_rig" : "";
+        const boundRigVal = this.hasBoundRigColumn ? ", ?" : "";
+        const params = [
+            instanceId,
+            input.workflowName,
+            input.workflowVersion,
+            input.createdBySession,
+            createdAt,
+            JSON.stringify(frontier),
+            input.currentStepId ?? null,
+        ];
+        if (this.hasBoundRigColumn)
+            params.push(input.boundRig ?? null);
+        this.db
+            .prepare(`INSERT INTO workflow_instances (
+           instance_id, workflow_name, workflow_version, created_by_session,
+           created_at, status, current_frontier_json, current_step_id, hop_count${boundRigCol}
+         ) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, 0${boundRigVal})`)
+            .run(...params);
+        return this.getByIdOrThrow(instanceId);
+    }
+    getById(instanceId) {
+        const row = this.db
+            .prepare(`SELECT * FROM workflow_instances WHERE instance_id = ?`)
+            .get(instanceId);
+        return row ? rowToInstance(row) : null;
+    }
+    getByIdOrThrow(instanceId) {
+        const inst = this.getById(instanceId);
+        if (!inst) {
+            throw new WorkflowInstanceError("instance_not_found", `workflow instance ${instanceId} not found`, { instanceId });
+        }
+        return inst;
+    }
+    listByStatus(status) {
+        const rows = this.db
+            .prepare(`SELECT * FROM workflow_instances WHERE status = ? ORDER BY created_at ASC`)
+            .all(status);
+        return rows.map(rowToInstance);
+    }
+    listAll() {
+        const rows = this.db
+            .prepare(`SELECT * FROM workflow_instances ORDER BY created_at ASC`)
+            .all();
+        return rows.map(rowToInstance);
+    }
+    /**
+     * Update frontier + status atomically. Caller is responsible for
+     * wrapping in a transaction when this needs to compose with other
+     * mutations (e.g., workflow-projector folds this into the
+     * close + create + frontier-update transaction).
+     */
+    updateFrontier(instanceId, nextFrontier, nextStatus, opts = {}) {
+        const setHop = opts.bumpHopCount ? "hop_count = hop_count + 1, " : "";
+        const setResume = opts.resumeStamp && this.hasResumeColumns
+            ? `resume_count = ${Number(opts.resumeStamp.resumeCount)}, hops_baseline = ${Number(opts.resumeStamp.hopsBaseline)}, `
+            : "";
+        const guardVersion = opts.expectedVersion !== undefined && this.hasVersionColumn;
+        const setVersion = guardVersion ? "version = version + 1, " : "";
+        const versionWhere = guardVersion ? " AND version = ?" : "";
+        let currentStepClause = "";
+        let currentStepValue;
+        if (opts.currentStepId === "preserve" || opts.currentStepId === undefined) {
+            currentStepClause = "";
+            currentStepValue = undefined;
+        }
+        else if (opts.currentStepId === "clear") {
+            currentStepClause = "current_step_id = NULL, ";
+        }
+        else {
+            currentStepClause = "current_step_id = ?, ";
+            currentStepValue = opts.currentStepId;
+        }
+        const sql = `UPDATE workflow_instances SET
+           ${setVersion}${setHop}${setResume}${currentStepClause}status = ?, current_frontier_json = ?,
+           last_continuation_decision_json = COALESCE(?, last_continuation_decision_json),
+           fallback_synthesis = COALESCE(?, fallback_synthesis),
+           completed_at = COALESCE(?, completed_at)
+         WHERE instance_id = ?${versionWhere}`;
+        const stmt = this.db.prepare(sql);
+        const params = [];
+        if (currentStepValue !== undefined)
+            params.push(currentStepValue);
+        params.push(nextStatus, JSON.stringify(nextFrontier), opts.lastContinuationDecision ? JSON.stringify(opts.lastContinuationDecision) : null, opts.fallbackSynthesis ?? null, opts.completedAt ?? null, instanceId);
+        if (guardVersion)
+            params.push(opts.expectedVersion);
+        const info = stmt.run(...params);
+        if (guardVersion && info.changes === 0) {
+            const current = this.getById(instanceId);
+            throw new WorkflowInstanceError("instance_version_conflict", `workflow instance ${instanceId} advanced concurrently: expected version ${opts.expectedVersion}, actual ${current ? current.version : "(instance missing)"} — the losing writer's transaction rolls back whole; re-read and re-project against current state`, {
+                instanceId,
+                expectedVersion: opts.expectedVersion,
+                actualVersion: current?.version ?? null,
+            });
+        }
+    }
+}
+function rowToInstance(row) {
+    return {
+        instanceId: row.instance_id,
+        workflowName: row.workflow_name,
+        workflowVersion: row.workflow_version,
+        createdBySession: row.created_by_session,
+        createdAt: row.created_at,
+        status: row.status,
+        currentFrontier: JSON.parse(row.current_frontier_json),
+        currentStepId: row.current_step_id,
+        hopCount: row.hop_count,
+        fallbackSynthesis: row.fallback_synthesis,
+        lastContinuationDecision: row.last_continuation_decision_json
+            ? JSON.parse(row.last_continuation_decision_json)
+            : null,
+        completedAt: row.completed_at,
+        version: row.version ?? 0,
+        resumeCount: row.resume_count ?? 0,
+        hopsBaseline: row.hops_baseline ?? 0,
+        boundRig: row.bound_rig ?? null,
+    };
+}
+//# sourceMappingURL=workflow-instance-store.js.map

package/node_modules/@openrig/daemon/dist/domain/workflow-instance-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-instance-store.js","sourceRoot":"","sources":["../../src/domain/workflow-instance-store.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,0DAA0D;AAC1D,uEAAuE;AACvE,uEAAuE;AACvE,mBAAmB;AAGnB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAgC5B;;;qEAGqE;AACrE,SAAS,oBAAoB,CAAC,EAAqB,EAAE,UAAkB;IACrE,IAAI,CAAC;QACH,OAAO,EAAE;aACN,OAAO,CAAC,uCAAuC,CAAC;aAChD,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAE,GAAyB,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAiBD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAE5B;IAEA;IAHlB,YACkB,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IAMb;IACA;IANF,gBAAgB,CAAU;IAC1B,gBAAgB,CAAU;IAC1B,iBAAiB,CAAU;IAE5C,YACmB,EAAqB,EACrB,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,OAAE,GAAF,EAAE,CAAmB;QACrB,QAAG,GAAH,GAAG,CAA+B;QAEnD,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,iBAAiB,GAAG,oBAAoB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,KAAkC;QACvC,MAAM,UAAU,GAAG,IAAI,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;QAC7C,kEAAkE;QAClE,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAc;YACxB,UAAU;YACV,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,eAAe;YACrB,KAAK,CAAC,gBAAgB;YACtB,SAAS;YACT,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACxB,KAAK,CAAC,aAAa,IAAI,IAAI;SAC5B,CAAC;QACF,IAAI,IAAI,CAAC,iBAAiB;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;kFAE0E,WAAW;qDACxC,WAAW,GAAG,CAC5D;aACA,GAAG,CAAC,GAAI,MAAkB,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,UAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,wDAAwD,CAAC;aACjE,GAAG,CAAC,UAAU,CAA4B,CAAC;QAC9C,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,cAAc,CAAC,UAAkB;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,qBAAqB,CAC7B,oBAAoB,EACpB,qBAAqB,UAAU,YAAY,EAC3C,EAAE,UAAU,EAAE,CACf,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,MAA8B;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,2EAA2E,CAC5E;aACA,GAAG,CAAC,MAAM,CAAkB,CAAC;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,0DAA0D,CAAC;aACnE,GAAG,EAAmB,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,UAAkB,EAClB,YAAsB,EACtB,UAAkC,EAClC,OA6BI,EAAE;QAEN,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GACb,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB;YACvC,CAAC,CAAC,kBAAkB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,qBAAqB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI;YACtH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;QACjF,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,iBAAiB,GAAG,EAAE,CAAC;QAC3B,IAAI,gBAA2C,CAAC;QAChD,IAAI,IAAI,CAAC,aAAa,KAAK,UAAU,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC1E,iBAAiB,GAAG,EAAE,CAAC;YACvB,gBAAgB,GAAG,SAAS,CAAC;QAC/B,CAAC;aAAM,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;YAC1C,iBAAiB,GAAG,0BAA0B,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,uBAAuB,CAAC;YAC5C,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAG;aACH,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB;;;;gCAIhC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,gBAAgB,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CACT,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAC5B,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,EACpF,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAC9B,IAAI,CAAC,WAAW,IAAI,IAAI,EACxB,UAAU,CACX,CAAC;QACF,IAAI,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAI,MAAkB,CAAC,CAAC;QAC9C,IAAI,YAAY,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,IAAI,qBAAqB,CAC7B,2BAA2B,EAC3B,qBAAqB,UAAU,4CAA4C,IAAI,CAAC,eAAe,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,mGAAmG,EAC9P;gBACE,UAAU;gBACV,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,aAAa,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;aACxC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,MAAM,EAAE,GAAG,CAAC,MAAgC;QAC5C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAa;QAClE,aAAa,EAAE,GAAG,CAAC,eAAe;QAClC,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,wBAAwB,EAAE,GAAG,CAAC,+BAA+B;YAC3D,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAA6B;YAC9E,CAAC,CAAC,IAAI;QACR,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,CAAC;QAClC,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;KAChC,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/workflow-keepalive-arming.d.ts

@@ -0,0 +1,35 @@
+import type { WatchdogJob, WatchdogJobsRepository } from "./watchdog-jobs-repository.js";
+/**
+ * Evaluation cadence for auto-armed keepalive jobs. Deadline-gated
+ * evaluations are quiet skips until overdue, so this interval costs
+ * nothing on the happy path (quiet skips are not even recorded in
+ * watchdog history).
+ */
+export declare const WORKFLOW_KEEPALIVE_AUTO_INTERVAL_SECONDS: number;
+export declare function buildKeepaliveSpecYaml(instanceId: string, targetSession: string): string;
+/**
+ * Find the active auto/manual keepalive job carrying this instance id.
+ * Jobs carry context only inside spec_yaml (no context column); ULIDs
+ * are 26-char unique so a containment check is exact in practice.
+ */
+export declare function findArmedKeepaliveJob(repo: WatchdogJobsRepository, instanceId: string): WatchdogJob | null;
+/**
+ * Idempotent in-transaction arm: registers the per-instance keepalive
+ * job if no active one exists. Composable inside the scribe txn
+ * (register is a plain INSERT).
+ */
+export declare function ensureWorkflowKeepaliveArmed(repo: WatchdogJobsRepository, input: {
+    instanceId: string;
+    targetSession: string;
+    registeredBySession: string;
+}): {
+    jobId: string;
+    newlyArmed: boolean;
+};
+/**
+ * In-transaction disarm on terminal instance state (completed/failed):
+ * the job goes terminal so no orphaned watchdog noise survives the
+ * instance (FR-3 AC). No-op when nothing is armed.
+ */
+export declare function disarmWorkflowKeepalive(repo: WatchdogJobsRepository, instanceId: string, reason: string): string | null;
+//# sourceMappingURL=workflow-keepalive-arming.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/workflow-keepalive-arming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-keepalive-arming.d.ts","sourceRoot":"","sources":["../../src/domain/workflow-keepalive-arming.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EACV,WAAW,EACX,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,QAAU,CAAC;AAEhE,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAUxF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,UAAU,EAAE,MAAM,GACjB,WAAW,GAAG,IAAI,CAQpB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,sBAAsB,EAC5B,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GACA;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAWxC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,sBAAsB,EAC5B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAKf"}

package/node_modules/@openrig/daemon/dist/domain/workflow-keepalive-arming.js

@@ -0,0 +1,87 @@
+// OPR.0.4.6.WF1 FR-3 (G2): auto-arm the shipped workflow-keepalive
+// policy — the policy registered at startup but NOTHING created a
+// watchdog job carrying context.workflow_instance_id, so the keepalive
+// never fired for any instance.
+//
+// Arming rides the transactional scribe: instantiate and every handoff
+// projection call ensureWorkflowKeepaliveArmed INSIDE the same
+// db.transaction that routes the step (watchdog register/markTerminal
+// are plain INSERT/UPDATE on the same handle — verified composable).
+// This closes the commit-then-crash-before-nudge window: the armed job
+// exists the instant the routed frontier packet exists, so a lost
+// post-commit nudge is re-issued by the keepalive even when the daemon
+// died before nudging (FR-3 AC; the boot sweep — FR-4 — is the
+// immediate-on-restart leg of the same closure).
+//
+// ONE JOB PER INSTANCE (arch-blessed: bounded watchdog rows; the
+// single-frontier model has one owner at a time). The policy resolves
+// the CURRENT frontier owner live from SQLite at every evaluation, so
+// no per-handoff re-target is needed — the job's target_session is only
+// the registered fallback. WF-6/parallel-frontier will revisit with
+// per-packet jobs when multiple frontier packets exist (marked, not
+// built).
+//
+// AUTO-ARMED JOBS ARE DEADLINE-GATED (context.deadline_gated: true):
+// the policy stays QUIET while the instance is healthy and sends only
+// when the FR-2 evaluator reports overdue — preserving the FR-2
+// zero-noise-on-the-happy-path AC. Operator-registered keepalive jobs
+// (no flag) keep the shipped POC always-send parity unchanged.
+/**
+ * Evaluation cadence for auto-armed keepalive jobs. Deadline-gated
+ * evaluations are quiet skips until overdue, so this interval costs
+ * nothing on the happy path (quiet skips are not even recorded in
+ * watchdog history).
+ */
+export const WORKFLOW_KEEPALIVE_AUTO_INTERVAL_SECONDS = 15 * 60;
+export function buildKeepaliveSpecYaml(instanceId, targetSession) {
+    return [
+        "policy: workflow-keepalive",
+        "target:",
+        `  session: ${targetSession}`,
+        "context:",
+        `  workflow_instance_id: ${instanceId}`,
+        "  deadline_gated: true",
+        "",
+    ].join("\n");
+}
+/**
+ * Find the active auto/manual keepalive job carrying this instance id.
+ * Jobs carry context only inside spec_yaml (no context column); ULIDs
+ * are 26-char unique so a containment check is exact in practice.
+ */
+export function findArmedKeepaliveJob(repo, instanceId) {
+    return (repo
+        .listActive()
+        .find((j) => j.policy === "workflow-keepalive" && j.specYaml.includes(instanceId)) ?? null);
+}
+/**
+ * Idempotent in-transaction arm: registers the per-instance keepalive
+ * job if no active one exists. Composable inside the scribe txn
+ * (register is a plain INSERT).
+ */
+export function ensureWorkflowKeepaliveArmed(repo, input) {
+    const existing = findArmedKeepaliveJob(repo, input.instanceId);
+    if (existing)
+        return { jobId: existing.jobId, newlyArmed: false };
+    const job = repo.register({
+        policy: "workflow-keepalive",
+        specYaml: buildKeepaliveSpecYaml(input.instanceId, input.targetSession),
+        targetSession: input.targetSession,
+        intervalSeconds: WORKFLOW_KEEPALIVE_AUTO_INTERVAL_SECONDS,
+        registeredBySession: input.registeredBySession,
+    });
+    return { jobId: job.jobId, newlyArmed: true };
+}
+/**
+ * In-transaction disarm on terminal instance state (completed/failed):
+ * the job goes terminal so no orphaned watchdog noise survives the
+ * instance (FR-3 AC). No-op when nothing is armed.
+ */
+export function disarmWorkflowKeepalive(repo, instanceId, reason) {
+    const existing = findArmedKeepaliveJob(repo, instanceId);
+    if (!existing)
+        return null;
+    repo.markTerminal(existing.jobId, reason);
+    return existing.jobId;
+}
+//# sourceMappingURL=workflow-keepalive-arming.js.map

package/node_modules/@openrig/daemon/dist/domain/workflow-keepalive-arming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-keepalive-arming.js","sourceRoot":"","sources":["../../src/domain/workflow-keepalive-arming.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,kEAAkE;AAClE,uEAAuE;AACvE,gCAAgC;AAChC,EAAE;AACF,uEAAuE;AACvE,+DAA+D;AAC/D,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,uEAAuE;AACvE,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,oEAAoE;AACpE,UAAU;AACV,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,sEAAsE;AACtE,+DAA+D;AAO/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,aAAqB;IAC9E,OAAO;QACL,4BAA4B;QAC5B,SAAS;QACT,cAAc,aAAa,EAAE;QAC7B,UAAU;QACV,2BAA2B,UAAU,EAAE;QACvC,wBAAwB;QACxB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,UAAkB;IAElB,OAAO,CACL,IAAI;SACD,UAAU,EAAE;SACZ,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,oBAAoB,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC5E,IAAI,IAAI,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAA4B,EAC5B,KAIC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC;QACvE,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,eAAe,EAAE,wCAAwC;QACzD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA4B,EAC5B,UAAkB,EAClB,MAAc;IAEd,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC"}