@openrig/cli 0.5.16 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/bootstrap-orchestrator.js

@@ -1,690 +0,0 @@
-import nodePath from "node:path";
-import { LegacyRigSpecCodec as RigSpecCodec } from "./rigspec-codec.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
-import { LegacyRigSpecSchema as RigSpecSchema } from "./rigspec-schema.js"; // TODO: AS-T08b — migrate to pod-aware RigSpec
-import { resolvePackage } from "./package-resolve-helper.js";
-import { unpack } from "./bundle-archive.js";
-import { parsePodBundleManifest } from "./bundle-types.js";
-import os from "node:os";
-import fs from "node:fs";
-import { getOpenRigInstallCwdError, resolveLaunchCwd } from "./cwd-resolution.js";
-import { runSyncSite } from "./sync-site-wrap.js";
-/** Generates a deterministic action key for plan->apply identity */
-function actionKey(actionKind, subjectType, subjectName) {
-    return `${actionKind}:${subjectType ?? ""}:${subjectName}`;
-}
-/**
- * Top-level bootstrap workflow. Composes all Phase 5 services into a staged pipeline.
- * Transactional by stage, not globally atomic.
- */
-export class BootstrapOrchestrator {
-    deps;
-    activeLocks = new Set();
-    /** Try to acquire the lock for a sourceRef. Returns false if already locked. */
-    tryAcquire(sourceRef) {
-        const key = nodePath.resolve(sourceRef);
-        if (this.activeLocks.has(key))
-            return false;
-        this.activeLocks.add(key);
-        return true;
-    }
-    /** Release the lock for a sourceRef. */
-    release(sourceRef) {
-        this.activeLocks.delete(nodePath.resolve(sourceRef));
-    }
-    constructor(deps) {
-        // Same-db-handle checks
-        if (deps.bootstrapRepo.db !== deps.db)
-            throw new Error("BootstrapOrchestrator: bootstrapRepo must share the same db handle");
-        if (deps.runtimeVerifier.db !== deps.db)
-            throw new Error("BootstrapOrchestrator: runtimeVerifier must share the same db handle");
-        if (deps.installExecutor.db !== deps.db)
-            throw new Error("BootstrapOrchestrator: installExecutor must share the same db handle");
-        if (deps.packageInstallService.db !== deps.db)
-            throw new Error("BootstrapOrchestrator: packageInstallService must share the same db handle");
-        this.deps = deps;
-    }
-    async bootstrap(opts) {
-        const { mode, sourceRef, autoApprove, approvedActionKeys } = opts;
-        const sourceKind = opts.sourceKind ?? "rig_spec";
-        const stages = [];
-        const errors = [];
-        const warnings = [];
-        // Use pre-created run or create new one
-        const run = opts.runId
-            ? this.deps.bootstrapRepo.getRun(opts.runId)
-            : this.deps.bootstrapRepo.createRun(sourceKind, sourceRef);
-        let seqCounter = 1;
-        // --- Stage 1: RESOLVE_SPEC ---
-        let spec;
-        let specDir;
-        let bundleSource = null;
-        let bundleTempDir = null;
-        if (sourceKind === "rig_bundle") {
-            // Peek at bundle manifest to detect schema version
-            let bundleSchemaVersion = 1;
-            const peekDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-peek-"));
-            try {
-                await unpack(sourceRef, peekDir);
-                const manifestPath = nodePath.join(peekDir, "bundle.yaml");
-                if (fs.existsSync(manifestPath)) {
-                    const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
-                    const raw = parsePodBundleManifest(manifestYaml);
-                    if (raw && raw["schema_version"] === 2) {
-                        bundleSchemaVersion = 2;
-                    }
-                }
-            }
-            catch { /* peek failed — fall through to legacy */ }
-            finally {
-                try {
-                    fs.rmSync(peekDir, { recursive: true, force: true });
-                }
-                catch { }
-            }
-            if (bundleSchemaVersion === 2 && this.deps.podBundleSourceResolver) {
-                let podBundleTempDir = null;
-                try {
-                    const podSource = await this.deps.podBundleSourceResolver.resolve(sourceRef);
-                    const rawYaml = this.deps.fsOps.readFile(podSource.specPath);
-                    specDir = nodePath.dirname(podSource.specPath);
-                    podBundleTempDir = podSource.tempDir;
-                    stages.push({ stage: "resolve_spec", status: "ok", detail: { specName: podSource.manifest.name, source: "pod_bundle" } });
-                    try {
-                        // Reject service-backed bundles — services require a stable source directory
-                        try {
-                            const parsed = parsePodBundleManifest(rawYaml);
-                            if (parsed && typeof parsed === "object" && parsed["services"] && typeof parsed["services"] === "object") {
-                                const msg = "Service-backed rigs cannot be launched from .rigbundle archives. The services block requires a stable source directory. Use the source directory path instead: rig up <path/to/rig.yaml>";
-                                stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "services_unsupported", error: msg } });
-                                errors.push(msg);
-                                this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                                return { runId: run.id, status: "failed", stages, errors, warnings };
-                            }
-                        }
-                        catch { /* YAML parse failure — let handlePodAwareSpec deal with it */ }
-                        return await this.handlePodAwareSpec(opts, run, rawYaml, specDir, stages, errors, warnings);
-                    }
-                    finally {
-                        if (podBundleTempDir)
-                            this.deps.podBundleSourceResolver.cleanup(podBundleTempDir);
-                    }
-                }
-                catch (err) {
-                    const msg = err.message;
-                    stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "bundle_error", error: msg } });
-                    errors.push(msg);
-                    this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                    return { runId: run.id, status: "failed", stages, errors, warnings };
-                }
-            }
-            // Legacy v1 bundle path
-            if (!this.deps.bundleSourceResolver) {
-                throw new Error("BundleSourceResolver required for rig_bundle source kind");
-            }
-            try {
-                bundleSource = await this.deps.bundleSourceResolver.resolve(sourceRef);
-                bundleTempDir = bundleSource.tempDir;
-                specDir = nodePath.dirname(bundleSource.specPath);
-                const rawYaml = this.deps.fsOps.readFile(bundleSource.specPath);
-                const raw = RigSpecCodec.parse(rawYaml);
-                const validation = RigSpecSchema.validate(raw);
-                if (!validation.valid) {
-                    stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "validation_failed", errors: validation.errors } });
-                    this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                    return { runId: run.id, status: "failed", stages, errors: validation.errors, warnings };
-                }
-                spec = this.resolveLegacyNodeCwds(RigSpecSchema.normalize(raw), specDir, opts.cwdOverride);
-                stages.push({ stage: "resolve_spec", status: "ok", detail: { specName: spec.name, specVersion: spec.schemaVersion, source: "rig_bundle" } });
-            }
-            catch (err) {
-                const msg = err.message;
-                stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "bundle_error", error: msg } });
-                errors.push(msg);
-                this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                return { runId: run.id, status: "failed", stages, errors, warnings };
-            }
-        }
-        else {
-            // Direct rig_spec path — detect format BEFORE legacy validation
-            try {
-                specDir = nodePath.dirname(nodePath.resolve(sourceRef));
-                const rawYaml = this.deps.fsOps.readFile(nodePath.resolve(sourceRef));
-                const raw = RigSpecCodec.parse(rawYaml);
-                // Pod-aware format detection: if has pods[], delegate to PodRigInstantiator
-                if (raw && Array.isArray(raw["pods"]) && this.deps.podInstantiator) {
-                    return this.handlePodAwareSpec(opts, run, rawYaml, specDir, stages, errors, warnings);
-                }
-                // Legacy path: validate as flat-node spec
-                const validation = RigSpecSchema.validate(raw);
-                if (!validation.valid) {
-                    stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "validation_failed", errors: validation.errors } });
-                    this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                    return { runId: run.id, status: "failed", stages, errors: validation.errors, warnings };
-                }
-                spec = this.resolveLegacyNodeCwds(RigSpecSchema.normalize(raw), specDir, opts.cwdOverride);
-                const cwdError = spec.nodes
-                    .map((node) => getOpenRigInstallCwdError(node.cwd ?? specDir, opts.cwdOverride))
-                    .find((error) => Boolean(error));
-                if (cwdError) {
-                    stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "invalid_cwd", error: cwdError } });
-                    this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                    return { runId: run.id, status: "failed", stages, errors: [cwdError], warnings };
-                }
-                stages.push({ stage: "resolve_spec", status: "ok", detail: { specName: spec.name, specVersion: spec.schemaVersion } });
-            }
-            catch (err) {
-                const msg = err.message;
-                const code = err.code === "ENOENT" ? "file_not_found"
-                    : msg.includes("YAML") || msg.includes("parse") ? "parse_error"
-                        : "read_error";
-                stages.push({ stage: "resolve_spec", status: "failed", detail: { code, error: msg } });
-                errors.push(msg);
-                this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                return { runId: run.id, status: "failed", stages, errors, warnings };
-            }
-        }
-        // Wrap remaining stages in try/finally for bundle temp cleanup (legacy path)
-        try {
-            return await this.executeStages(opts, run, spec, specDir, bundleSource, stages, errors, warnings, seqCounter);
-        }
-        finally {
-            if (bundleTempDir && this.deps.bundleSourceResolver)
-                this.deps.bundleSourceResolver.cleanup(bundleTempDir);
-        }
-    }
-    async executeStages(opts, run, spec, specDir, bundleSource, stages, errors, warnings, seqCounter) {
-        const { mode, autoApprove, approvedActionKeys } = opts;
-        // --- Stage 2: RESOLVE_PACKAGES ---
-        const packageRefs = new Set();
-        for (const node of spec.nodes) {
-            if (node.packageRefs) {
-                for (const ref of node.packageRefs) {
-                    packageRefs.add(ref);
-                }
-            }
-        }
-        const resolvedPackages = new Map();
-        const unresolvedRefs = [];
-        for (const ref of packageRefs) {
-            // Bundle path: lookup in packageRefMap
-            if (bundleSource) {
-                const bundleResolved = bundleSource.packageRefMap[ref];
-                if (bundleResolved) {
-                    resolvedPackages.set(ref, { ok: true, resolved: bundleResolved });
-                    continue;
-                }
-                // Ref not in bundle map — try local resolution as fallback
-            }
-            // Check for unsupported schemes
-            if (ref.includes("github:") || ref.includes("://")) {
-                errors.push(`Unsupported package ref scheme: '${ref}'`);
-                unresolvedRefs.push(ref);
-                continue;
-            }
-            // Strip local: prefix if present
-            const cleanRef = ref.startsWith("local:") ? ref.slice(6) : ref;
-            const result = resolvePackage(cleanRef, specDir, this.deps.fsOps);
-            if (result.ok) {
-                resolvedPackages.set(ref, result);
-            }
-            else {
-                const errMsg = result.kind === "validation" ? result.errors.join("; ") : result.error;
-                errors.push(`Failed to resolve package '${ref}': ${errMsg}`);
-                unresolvedRefs.push(ref);
-            }
-        }
-        if (unresolvedRefs.length > 0) {
-            stages.push({ stage: "resolve_packages", status: "blocked", detail: { unresolved: unresolvedRefs, errors } });
-            this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-            return { runId: run.id, status: "failed", stages, errors, warnings };
-        }
-        stages.push({ stage: "resolve_packages", status: "ok", detail: { resolved: [...resolvedPackages.keys()] } });
-        // --- Stage 3: VERIFY_RUNTIMES ---
-        const runtimes = new Set(["tmux"]);
-        for (const node of spec.nodes) {
-            if (node.runtime)
-                runtimes.add(node.runtime);
-        }
-        const verifications = await this.deps.runtimeVerifier.verifyAll([...runtimes]);
-        const runtimeBlocked = [];
-        for (const v of verifications) {
-            if (mode === "apply") {
-                this.deps.bootstrapRepo.journalAction(run.id, seqCounter++, "runtime_check", null, v.runtime, v.status === "verified" || v.status === "degraded" ? "completed" : "failed", {
-                    detailJson: JSON.stringify({ version: v.version, status: v.status, error: v.error }),
-                });
-            }
-            if (v.status === "not_found" || v.status === "error") {
-                runtimeBlocked.push(v.runtime);
-            }
-            if (v.status === "degraded") {
-                warnings.push(`${v.runtime} is degraded but not blocking`);
-            }
-        }
-        if (runtimeBlocked.length > 0 && mode === "apply") {
-            stages.push({ stage: "verify_runtimes", status: "blocked", detail: { blocked: runtimeBlocked } });
-            errors.push(`Required runtimes not found: ${runtimeBlocked.join(", ")}`);
-            this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-            return { runId: run.id, status: "failed", stages, errors, warnings };
-        }
-        stages.push({
-            stage: "verify_runtimes",
-            status: runtimeBlocked.length > 0 ? "blocked" : "ok",
-            detail: { verifications: verifications.map((v) => ({ runtime: v.runtime, status: v.status })) },
-        });
-        // --- Stage 4: PROBE_REQUIREMENTS ---
-        const requirementMap = new Map();
-        for (const [, resolved] of resolvedPackages) {
-            const manifest = resolved.resolved.manifest;
-            if (manifest.requirements?.cliTools) {
-                for (const tool of manifest.requirements.cliTools) {
-                    const key = `cli_tool:${tool.name}`;
-                    if (!requirementMap.has(key)) {
-                        requirementMap.set(key, { name: tool.name, kind: "cli_tool", installHints: tool.installHints });
-                    }
-                }
-            }
-            if (manifest.requirements?.systemPackages) {
-                for (const pkg of manifest.requirements.systemPackages) {
-                    const key = `system_package:${pkg.name}`;
-                    if (!requirementMap.has(key)) {
-                        requirementMap.set(key, { name: pkg.name, kind: "system_package" });
-                    }
-                }
-            }
-        }
-        const uniqueRequirements = [...requirementMap.values()];
-        const probeResults = await this.deps.probeRegistry.probeAll(uniqueRequirements);
-        for (const probe of probeResults) {
-            if (mode === "apply") {
-                this.deps.bootstrapRepo.journalAction(run.id, seqCounter++, "requirement_check", probe.kind, probe.name, "completed", {
-                    detailJson: JSON.stringify({ status: probe.status, detectedPath: probe.detectedPath, version: probe.version }),
-                });
-            }
-        }
-        stages.push({
-            stage: "probe_requirements",
-            status: "ok",
-            detail: {
-                probed: probeResults.length,
-                results: probeResults.map((p) => ({
-                    name: p.name,
-                    kind: p.kind,
-                    status: p.status,
-                    version: p.version,
-                    detectedPath: p.detectedPath,
-                })),
-            },
-        });
-        // --- Stage 5: BUILD_INSTALL_PLAN ---
-        const installPlan = this.deps.installPlanner.planInstalls(probeResults);
-        // Check for manual_only blocking
-        const hasManualOnly = installPlan.manualOnly.length > 0;
-        // Build action keys for plan output
-        const allActionKeys = installPlan.actions.map((a) => actionKey("external_install", a.kind, a.requirementName));
-        stages.push({
-            stage: "build_install_plan",
-            status: hasManualOnly ? "blocked" : "ok",
-            detail: {
-                autoApprovable: installPlan.autoApprovable.length,
-                manualOnly: installPlan.manualOnly.length,
-                alreadyInstalled: installPlan.alreadyInstalled.length,
-                actions: installPlan.actions.map((a) => ({
-                    key: actionKey("external_install", a.kind, a.requirementName),
-                    requirementName: a.requirementName,
-                    classification: a.classification,
-                    commandPreview: a.commandPreview,
-                    provider: a.provider,
-                })),
-            },
-        });
-        // *** PLAN MODE STOPS HERE ***
-        if (mode === "plan") {
-            return { runId: run.id, status: "planned", stages, errors, warnings, actionKeys: allActionKeys };
-        }
-        // --- APPLY MODE: Check manual_only blocks ---
-        if (hasManualOnly) {
-            errors.push(`${installPlan.manualOnly.length} manual-only requirements cannot be auto-installed: ${installPlan.manualOnly.map((a) => a.requirementName).join(", ")}`);
-            this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-            return { runId: run.id, status: "failed", stages, errors, warnings };
-        }
-        // --- Stage 6: EXECUTE_EXTERNAL_INSTALLS ---
-        const taggedActions = installPlan.actions.map((a) => {
-            const key = actionKey("external_install", a.kind, a.requirementName);
-            let approved = false;
-            if (autoApprove && a.classification === "auto_approvable") {
-                approved = true;
-            }
-            else if (approvedActionKeys?.includes(key)) {
-                approved = true;
-            }
-            return { action: a, approved };
-        });
-        // Warn for unknown approved keys
-        if (approvedActionKeys) {
-            const validKeys = new Set(taggedActions.map((t) => actionKey("external_install", t.action.kind, t.action.requirementName)));
-            for (const key of approvedActionKeys) {
-                if (!validKeys.has(key)) {
-                    warnings.push(`Unknown approved action key ignored: '${key}'`);
-                }
-            }
-        }
-        // Block if external installs exist but none are approved
-        const anyApproved = taggedActions.some((t) => t.approved);
-        const hasActionableInstalls = taggedActions.some((t) => t.action.classification !== "manual_only" && t.action.commandPreview);
-        if (hasActionableInstalls && !anyApproved) {
-            errors.push("External installs require approval. Use --yes for auto-approvable actions, or provide approvedActionKeys.");
-            stages.push({ stage: "execute_external_installs", status: "blocked", detail: { reason: "no approval provided" } });
-            this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-            return { runId: run.id, status: "failed", stages, errors, warnings };
-        }
-        const execSummary = await this.deps.installExecutor.execute(run.id, taggedActions, seqCounter);
-        seqCounter += taggedActions.length;
-        const hasExecFailures = execSummary.failed.length > 0;
-        stages.push({
-            stage: "execute_external_installs",
-            status: hasExecFailures ? "failed" : "ok",
-            detail: { completed: execSummary.completed.length, failed: execSummary.failed.length, skipped: execSummary.skipped.length },
-        });
-        // --- Stage 7: INSTALL_PACKAGES ---
-        let packageInstallFailed = false;
-        for (const [ref, resolved] of resolvedPackages) {
-            const runtimesForRef = new Set();
-            for (const node of spec.nodes) {
-                if (node.packageRefs?.includes(ref) && node.runtime) {
-                    runtimesForRef.add(node.runtime);
-                }
-            }
-            // Install once per runtime that references this package
-            const runtimes = runtimesForRef.size > 0 ? [...runtimesForRef] : ["claude-code"];
-            for (const rt of runtimes) {
-                const runtime = rt;
-                const outcome = this.deps.packageInstallService.install({
-                    resolved: resolved.resolved,
-                    targetRoot: opts.targetRoot ?? specDir,
-                    runtime,
-                    allowMerge: true,
-                    bootstrapId: run.id,
-                    fsOps: this.deps.fsOps,
-                });
-                this.deps.bootstrapRepo.journalAction(run.id, seqCounter++, "package_install", runtime, resolved.resolved.manifest.name, outcome.ok ? "completed" : "failed", {
-                    detailJson: JSON.stringify(outcome),
-                });
-                if (!outcome.ok) {
-                    errors.push(`Package install failed for '${ref}' (${runtime}): ${outcome.message}`);
-                    packageInstallFailed = true;
-                }
-            }
-        }
-        stages.push({
-            stage: "install_packages",
-            status: packageInstallFailed ? "failed" : "ok",
-            detail: { installed: resolvedPackages.size },
-        });
-        // --- Stage 8: IMPORT_RIG ---
-        // Skip rig import if package installs failed — a rig without its packages is broken
-        if (packageInstallFailed) {
-            errors.push("Rig import skipped due to package install failures");
-            stages.push({ stage: "import_rig", status: "skipped", detail: { reason: "package install failures" } });
-            this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-            return { runId: run.id, status: "failed", stages, errors, warnings };
-        }
-        const instantiateOutcome = await this.deps.rigInstantiator.instantiate(spec);
-        this.deps.bootstrapRepo.journalAction(run.id, seqCounter++, "rig_import", null, spec.name, instantiateOutcome.ok ? "completed" : "failed", {
-            detailJson: JSON.stringify(instantiateOutcome),
-        });
-        if (!instantiateOutcome.ok) {
-            errors.push(`Rig import failed: ${instantiateOutcome.code}`);
-            stages.push({ stage: "import_rig", status: "failed", detail: instantiateOutcome });
-            const finalStatus = hasExecFailures || packageInstallFailed ? "partial" : "failed";
-            this.deps.bootstrapRepo.updateRunStatus(run.id, finalStatus);
-            return { runId: run.id, status: finalStatus, stages, errors, warnings };
-        }
-        stages.push({ stage: "import_rig", status: "ok", detail: instantiateOutcome.result });
-        if (instantiateOutcome.result.warnings?.length) {
-            warnings.push(...instantiateOutcome.result.warnings);
-        }
-        // --- DONE ---
-        const finalStatus = hasExecFailures || packageInstallFailed ? "partial" : "completed";
-        this.deps.bootstrapRepo.updateRunStatus(run.id, finalStatus, { rigId: instantiateOutcome.result.rigId });
-        return {
-            runId: run.id,
-            status: finalStatus,
-            stages,
-            rigId: instantiateOutcome.result.rigId,
-            errors,
-            warnings,
-        };
-    }
-    // -- Pod-aware bootstrap path --
-    async handlePodAwareSpec(opts, run, rigSpecYaml, specDir, stages, errors, warnings) {
-        const { mode } = opts;
-        const podInstantiator = this.deps.podInstantiator;
-        const rigRoot = specDir;
-        if (mode === "plan") {
-            // Plan mode: validate + preflight only
-            const { rigPreflight } = await import("./rigspec-preflight.js");
-            const { RigSpecCodec: PodCodec } = await import("./rigspec-codec.js");
-            const { RigSpecSchema: PodSchema } = await import("./rigspec-schema.js");
-            try {
-                const raw = PodCodec.parse(rigSpecYaml);
-                const validation = PodSchema.validate(raw);
-                if (!validation.valid) {
-                    stages.push({ stage: "resolve_spec", status: "failed", detail: { code: "validation_failed", errors: validation.errors } });
-                    this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                    return { runId: run.id, status: "failed", stages, errors: validation.errors, warnings };
-                }
-                const spec = PodSchema.normalize(raw);
-                stages.push({ stage: "resolve_spec", status: "ok", detail: { specName: spec.name, specVersion: spec.version } });
-                const { execSync } = await import("node:child_process");
-                const execFn = async (cmd) => runSyncSite("bootstrap.plan.preflight", () => execSync(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], timeout: 10_000 }));
-                const preflight = await rigPreflight({
-                    rigSpecYaml,
-                    rigRoot,
-                    cwdOverride: opts.cwdOverride,
-                    fsOps: podInstantiator["deps"].fsOps,
-                    skillsRoot: podInstantiator.resolveSkillsRoot?.(),
-                    exec: execFn,
-                });
-                stages.push({
-                    stage: "preflight",
-                    status: preflight.ready ? "ok" : "blocked",
-                    detail: { errors: preflight.errors, warnings: preflight.warnings },
-                });
-                this.deps.bootstrapRepo.updateRunStatus(run.id, preflight.ready ? "planned" : "failed");
-                return {
-                    runId: run.id,
-                    status: preflight.ready ? "planned" : "failed",
-                    stages,
-                    errors: preflight.errors,
-                    warnings: preflight.warnings,
-                };
-            }
-            catch (err) {
-                stages.push({ stage: "resolve_spec", status: "failed", detail: { error: err.message } });
-                this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-                return { runId: run.id, status: "failed", stages, errors: [err.message], warnings };
-            }
-        }
-        // Apply mode: full instantiation via PodRigInstantiator
-        // If services exist, the prelaunch hook boots them between topology creation and node launch
-        const prelaunchHook = await this.buildServicePrelaunchHook(rigSpecYaml, rigRoot, stages, errors);
-        const outcome = await podInstantiator.instantiate(rigSpecYaml, rigRoot, { cwdOverride: opts.cwdOverride, prelaunchHook });
-        if (!outcome.ok) {
-            // OPR.0.3.2.CT — attention_required is a recoverable outcome
-            // (rig + sessions preserved). Surface it distinctly from terminal
-            // failure so the route can return a 3-part error pointing the
-            // operator at the approve→resume path. The bootstrap run status
-            // is `partial` (not `failed`) because the rig exists and is
-            // operator-actionable.
-            if (outcome.code === "attention_required") {
-                const attentionMsg = outcome.message;
-                const attentionNodes = outcome.attentionNodes;
-                stages.push({
-                    stage: "import_rig",
-                    status: "blocked",
-                    detail: {
-                        code: "attention_required",
-                        message: attentionMsg,
-                        attentionNodes,
-                    },
-                });
-                this.deps.bootstrapRepo.updateRunStatus(run.id, "partial", { rigId: outcome.rigId });
-                return {
-                    runId: run.id,
-                    status: "partial",
-                    stages,
-                    rigId: outcome.rigId,
-                    errors: [attentionMsg],
-                    warnings,
-                };
-            }
-            const outErrors = outcome.code === "validation_failed" || outcome.code === "preflight_failed"
-                ? outcome.errors
-                : [outcome.message];
-            const outWarnings = outcome.warnings ?? [];
-            stages.push({ stage: "import_rig", status: "failed", detail: { code: outcome.code } });
-            this.deps.bootstrapRepo.updateRunStatus(run.id, "failed");
-            return { runId: run.id, status: "failed", stages, errors: outErrors, warnings: outWarnings };
-        }
-        const result = outcome.result;
-        const anyFailed = result.nodes.some((n) => n.status === "failed");
-        const anyAttention = result.nodes.some((n) => n.status === "attention_required");
-        // OPR.0.3.2.CT (guard verdict qitem-20260518082933 BLOCKER 1):
-        // attention_required nodes are recoverable but NOT done — the
-        // launch is partial and the operator needs the same inspection
-        // surface the all-attention path already gets. Treating mixed
-        // launched+attention as "completed" would hide the parked seat
-        // behind a 201 success response. finalStatus is partial whenever
-        // any node is failed OR attention_required; the import_rig stage
-        // is "blocked" (not "ok") with attentionNodes detail so the route
-        // can build the 3-part error from the same path the all-attention
-        // case uses.
-        const finalStatus = anyFailed || anyAttention ? "partial" : "completed";
-        if (anyAttention) {
-            const attentionNodes = result.nodes
-                .filter((n) => n.status === "attention_required")
-                .map((n) => ({
-                logicalId: n.logicalId,
-                sessionName: n.sessionName ?? "",
-                evidence: n.evidence,
-                reason: n.error ?? "node awaiting attention",
-            }));
-            const message = `${attentionNodes.length} node${attentionNodes.length === 1 ? " requires" : "s require"} attention before becoming interactive. Inspect the affected sessions and reasons before choosing recovery.`;
-            stages.push({
-                stage: "import_rig",
-                status: "blocked",
-                detail: {
-                    code: "attention_required",
-                    message,
-                    rigId: result.rigId,
-                    specName: result.specName,
-                    nodes: result.nodes,
-                    attentionNodes,
-                },
-            });
-        }
-        else {
-            stages.push({
-                stage: "import_rig",
-                status: anyFailed ? "failed" : "ok",
-                detail: { rigId: result.rigId, specName: result.specName, nodes: result.nodes },
-            });
-        }
-        if (result.warnings?.length) {
-            warnings.push(...result.warnings);
-        }
-        this.deps.bootstrapRepo.updateRunStatus(run.id, finalStatus);
-        return {
-            runId: run.id,
-            status: finalStatus,
-            stages,
-            rigId: result.rigId,
-            errors: result.nodes.filter((n) => n.error).map((n) => n.error),
-            warnings,
-        };
-    }
-    /**
-     * Build a prelaunch hook for the service gate. Returns undefined if no services
-     * are configured or no ServiceOrchestrator is available.
-     */
-    async buildServicePrelaunchHook(rigSpecYaml, rigRoot, stages, errors) {
-        if (!this.deps.serviceOrchestrator || !this.deps.rigRepo)
-            return undefined;
-        // Parse and normalize via the canonical pod-aware codec/schema path
-        let normalizedSpec;
-        try {
-            const { RigSpecCodec: PodCodec } = await import("./rigspec-codec.js");
-            const { RigSpecSchema: PodSchema } = await import("./rigspec-schema.js");
-            const raw = PodCodec.parse(rigSpecYaml);
-            const validation = PodSchema.validate(raw);
-            if (!validation.valid)
-                return undefined;
-            normalizedSpec = PodSchema.normalize(raw);
-        }
-        catch {
-            return undefined;
-        }
-        if (!normalizedSpec.services || normalizedSpec.services.kind !== "compose")
-            return undefined;
-        const serviceOrch = this.deps.serviceOrchestrator;
-        const rigRepo = this.deps.rigRepo;
-        const services = normalizedSpec.services;
-        const rigName = normalizedSpec.name;
-        return async (rigId) => {
-            // Persist services record for the now-created rig
-            const { deriveComposeProjectName } = await import("./compose-project-name.js");
-            const composeFile = nodePath.resolve(rigRoot, services.composeFile);
-            const projectName = services.projectName ?? deriveComposeProjectName(rigName);
-            rigRepo.setServicesRecord(rigId, {
-                kind: "compose",
-                specJson: JSON.stringify(services),
-                rigRoot,
-                composeFile,
-                projectName,
-            });
-            // Boot services — strict health gate before any agent launch
-            const bootResult = await serviceOrch.boot(rigId);
-            if (!bootResult.ok) {
-                errors.push(`Service boot failed: ${bootResult.error}`);
-                stages.push({
-                    stage: "service_boot",
-                    status: "failed",
-                    detail: { code: bootResult.code, error: bootResult.error, receipt: bootResult.receipt },
-                });
-                // OPR.0.3.2.22 Bug 2 follow-up — serviceOrch.boot can already have
-                // started compose resources before failing during status/wait. The
-                // PodRigInstantiator will delete the rig record next, which cascades
-                // away rig_services and the normal teardown handle — so any
-                // already-started compose containers would orphan. Tear them down
-                // here best-effort while the rig handle still exists. Teardown
-                // errors are swallowed so they cannot mask the boot failure that
-                // is the load-bearing return.
-                try {
-                    await serviceOrch.teardown(rigId);
-                }
-                catch {
-                    // Best-effort. If teardown also fails, the boot-failure error
-                    // is what the operator needs; manual `docker compose down`
-                    // remains available with the compose file path from the spec.
-                }
-                return { ok: false, code: "service_boot_failed", message: `Service boot failed: ${bootResult.error}` };
-            }
-            stages.push({
-                stage: "service_boot",
-                status: "ok",
-                detail: { receipt: bootResult.receipt, health: bootResult.health },
-            });
-            return { ok: true };
-        };
-    }
-    resolveLegacyNodeCwds(spec, specRoot, cwdOverride) {
-        return {
-            ...spec,
-            nodes: spec.nodes.map((node) => ({
-                ...node,
-                cwd: resolveLaunchCwd(node.cwd, specRoot, cwdOverride),
-            })),
-        };
-    }
-}
-//# sourceMappingURL=bootstrap-orchestrator.js.map