@openrig/cli 0.5.4 → 0.5.6

package/node_modules/@openrig/daemon/dist/startup.js

@@ -52,6 +52,7 @@ import { LegacyBundleSourceResolver as BundleSourceResolver } from "./domain/bun
 import { PodBundleSourceResolver } from "./domain/bundle-source-resolver.js";
 import { PsProjectionService } from "./domain/ps-projection.js";
 import { SeatActivityService } from "./domain/seat-activity-service.js";
+import { readClaudeSelfReportEvidence } from "./adapters/claude-code-adapter.js";
 import { SeatStructuralActivityService } from "./domain/seat-structural-activity-service.js";
 import { deriveSelfHostIdSource, SeatIdentityReconciler, reconcileSelfHostIdentity } from "./domain/seat-identity-reconciler.js";
 import { SelfHostIdentityStore } from "./domain/seat-identity-store.js";
@@ -72,7 +73,7 @@ import { ChatRepository } from "./domain/chat-repository.js";
 import { StreamStore } from "./domain/stream-store.js";
 import { SlowOpRecorder } from "./domain/slow-op-recorder.js";
 import { configureSyncSiteRecorder } from "./domain/sync-site-wrap.js";
-import { QueueRepository } from "./domain/queue-repository.js";
+import { QueueRepository, isBlockerLive } from "./domain/queue-repository.js";
 import { createWorkflowFrontierPredicate } from "./domain/workflow-frontier-guard.js";
 import { InboxHandler } from "./domain/inbox-handler.js";
 import { OutboxHandler } from "./domain/outbox-handler.js";
@@ -85,9 +86,12 @@ import { WatchdogAutoRegistration } from "./domain/watchdog-auto-registration.js
 import { WatchdogHistoryLog } from "./domain/watchdog-history-log.js";
 import { WatchdogPolicyEngine } from "./domain/watchdog-policy-engine.js";
 import { WatchdogScheduler } from "./domain/watchdog-scheduler.js";
+import { ContinuityPolicyMaterializer, createContinuityCutoverBaton, findClaudeTranscriptByToken, recordManagedWidthReceipt, } from "./domain/continuity-policy-materializer.js";
 import { WorkflowRuntime } from "./domain/workflow-runtime.js";
 import { makeWorkflowKeepalivePolicy } from "./domain/policies/workflow-keepalive.js";
 import { makeIdleGateQitemPolicy } from "./domain/policies/idle-gate-qitem.js";
+import { makeParkedOwnerConsumerPolicy, makeRigAnchor, PARKED_OWNER_POLICY_NAME } from "./domain/policies/parked-owner-consumer.js";
+import { diagnoseRigParked } from "./domain/parked-query.js";
 import { SpecReviewService } from "./domain/spec-review-service.js";
 import { SpecLibraryService } from "./domain/spec-library-service.js";
 // Phase 3a slice 3.3 — plugin discovery service.
@@ -290,6 +294,7 @@ export async function createDaemon(opts) {
     const watchdogJobsRepoInstance = new WatchdogJobsRepository(db, undefined, // now (default clock)
     // GHOST-STAGE (e/Class-B): stamp the arming occupant's generation so a swap can drop its armed jobs.
     (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName));
+    queueRepoInstance.attachWatchdogJobsRepository(watchdogJobsRepoInstance);
     const watchdogAutoRegistration = new WatchdogAutoRegistration({
         db,
         jobsRepo: watchdogJobsRepoInstance,
@@ -312,6 +317,12 @@ export async function createDaemon(opts) {
         tmux: tmuxAdapter,
         defaultWindowSeconds: 3,
         eventBus,
+        // S19 — the Claude self-report rung (pid.json), consulted per sweep for seats whose
+        // declared inventory staffs it; unreadable = null = the ladder falls, never errors.
+        selfReportReader: (sessionName, seatNodeId) => {
+            const sessionsDir = nodePath.join(process.env.CLAUDE_CONFIG_DIR ?? nodePath.join(os.homedir(), ".claude"), "sessions");
+            return readClaudeSelfReportEvidence({ sessionsDir, sessionName, seatNodeId });
+        },
     });
     // 5b82324b — the STRUCTURAL activity cache (sibling of SeatActivityService). Captures pane TEXT once
     // per running seat per tick + classifies motion STRUCTURALLY, so the `rig ps` ACTIVITY column reflects
@@ -741,6 +752,14 @@ export async function createDaemon(opts) {
         agentImageLibrary,
         targetRoot: getDefaultOpenRigPath("agent-images"),
     });
+    const continuityPolicyMaterializer = new ContinuityPolicyMaterializer(watchdogJobsRepoInstance, ({ sessionId }) => {
+        const row = db.prepare("SELECT resume_token FROM sessions WHERE id = ?").get(sessionId);
+        const token = row?.resume_token;
+        if (!token)
+            return null;
+        const claudeRoot = process.env.CLAUDE_CONFIG_DIR ?? nodePath.join(os.homedir(), ".claude");
+        return findClaudeTranscriptByToken(nodePath.join(claudeRoot, "projects"), token);
+    });
     const podInstantiator = new PodRigInstantiator({
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
@@ -748,10 +767,12 @@ export async function createDaemon(opts) {
         adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "pi": piAdapter, "stub": stubAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         tmuxAdapter,
         agentImageLibrary,
+        continuityPolicyMaterializer,
         exec,
         // OPR.0.5.3.6 — shipped topology chain-file defaults install under the
         // typed topology.root at materialization (copy-if-absent).
         topologyRootResolver: () => String(new ContextPackSettingsStore().resolveOne("topology.root").value),
+        onboardingEnabledResolver: () => new ContextPackSettingsStore().resolveOne("onboarding.default_pack.enabled").value === true,
     });
     const podBundleSourceResolver = new PodBundleSourceResolver();
     const bootstrapOrchestrator = new BootstrapOrchestrator({
@@ -1391,6 +1412,16 @@ export async function createDaemon(opts) {
                 nodePath.join(resolvedWorkspaceRoot, "slices"),
             ].filter((root) => root !== slicesRoot)
             : [];
+        // S27 (OPR.0.5.6.27) — wire the execution view once the slices root is
+        // resolved; the thunk re-reads nothing (path resolution stays startup's).
+        viewProjectorInstance.setExecutionDeps({
+            db,
+            slicesRoot: () => slicesRoot || null,
+            // S19's locked one-oracle contract: the ARBITRATED seat-keyed read every
+            // surface (rig ps, node inventory, parked-query) consumes — never
+            // sessions.status, never the parallel AgentActivityStore ingest.
+            seatActivity: seatActivityService,
+        });
         const { SliceIndexer } = await import("./domain/slices/slice-indexer.js");
         const { SliceDetailProjector } = await import("./domain/slices/slice-detail-projector.js");
         const sliceIndexer = new SliceIndexer({
@@ -1579,19 +1610,37 @@ export async function createDaemon(opts) {
             filePath: nodePath.join(OPENRIG_HOME, "active-workflow-lens.json"),
         });
     }
+    // OPR.0.5.6.1 — late-bound gateway dispatch for the delivery policies (the
+    // gateway subsystem is constructed after the watchdog engine; the ref fills
+    // at activation below, which is OUTSIDE the sessionTransport block — hence
+    // function scope). Registry loads through the shipped loader.
+    const lateGatewayDispatch = {};
+    const { loadHumanRegistry: loadHumanRegistryForDelivery } = await import("./domain/gateway/human-registry.js");
+    void loadHumanRegistryForDelivery; // consumed inside the sessionTransport block below
     const sessionTransport = deps.sessionTransport;
     if (sessionTransport) {
         const watchdogPolicyEngine = new WatchdogPolicyEngine({
             jobsRepo: watchdogJobsRepoInstance,
             historyLog: watchdogHistoryLogInstance,
             eventBus,
-            deliver: async ({ targetSession, message }) => {
+            deliver: async ({ targetSession, message, continuityAction }) => {
+                let continuityActionCompleted = false;
                 try {
+                    if (continuityAction) {
+                        await createContinuityCutoverBaton(continuityAction, queueRepoInstance);
+                        continuityActionCompleted = true;
+                    }
                     const result = await sessionTransport.send(targetSession, message);
-                    return result.ok ? { status: "ok" } : { status: "failed", error: result.error };
+                    return result.ok
+                        ? { status: "ok", continuityActionCompleted }
+                        : { status: "failed", error: result.error, continuityActionCompleted };
                 }
                 catch (err) {
-                    return { status: "failed", error: err instanceof Error ? err.message : String(err) };
+                    return {
+                        status: "failed",
+                        error: err instanceof Error ? err.message : String(err),
+                        continuityActionCompleted,
+                    };
                 }
             },
             // (i-c) fire-time target-generation gate: resolve the target's LIVE occupant-generation (P12
@@ -1599,6 +1648,9 @@ export async function createDaemon(opts) {
             // UNKNOWN (null) fails open → deliver. A drop of this line disables the gate silently (gen-bound
             // wakes would fire at the successor) — pinned in watchdog-target-gen-wiring.test.ts.
             resolveTargetGeneration: (s) => sessionRegistry.currentOccupantGenerationForSession(s),
+            onWakeAttempt: ({ jobId, deliveryStatus }) => {
+                queueRepoInstance.recordWatchdogWakeAttempt(jobId, deliveryStatus);
+            },
             // PL-004 Phase D: register workflow-keepalive policy alongside
             // Phase C's three built-in policies. workflow-keepalive reads
             // SQLite workflow_instances directly via the new Phase D tables
@@ -1616,6 +1668,101 @@ export async function createDaemon(opts) {
                     ensureStuckExceptionItem: workflowExceptionEnsurer,
                 }),
                 makeIdleGateQitemPolicy({ db, agentActivityStore }),
+                // OPR.0.5.6.24 F-14: the parked-owner consumer — the WHOLE shipped
+                // parked diagnosis (diagnoseRigParked over the arbitrated oracle +
+                // destination-scoped obligations + wake status; the same derivation
+                // `rig parked` serves) consumed by one rig-level supervisor job.
+                // Episode receipts are TRANSITIONS on the obligation row, written
+                // reserve-before-deliver (the retention active-frontier invariant is
+                // the durability proof); watchdog history is telemetry only.
+                makeParkedOwnerConsumerPolicy({
+                    diagnoseRig: (rigName) => {
+                        const seats = db
+                            .prepare(`SELECT n.id AS node_id, s.session_name AS session_name
+                   FROM nodes n
+                   JOIN rigs r ON r.id = n.rig_id
+                   JOIN sessions s ON s.node_id = n.id
+                    AND s.id = (SELECT s2.id FROM sessions s2 WHERE s2.node_id = n.id ORDER BY s2.id DESC LIMIT 1)
+                  WHERE s.status = 'running' AND s.session_name IS NOT NULL AND r.name = ?`)
+                            .all(rigName);
+                        const parkedDeps = {
+                            getSeatState: (seatNodeId) => seatActivityService.getSeatState(seatNodeId),
+                            listOpenObligations: (destinationSession, limit) => ({
+                                rows: queueRepoInstance
+                                    .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit })
+                                    .map((r) => ({
+                                    qitemId: r.qitemId,
+                                    state: r.state,
+                                    summary: r.summary ?? null,
+                                })),
+                                limit,
+                            }),
+                            getParkWake: (qitemId) => queueRepoInstance.getParkWakeStatus(qitemId),
+                        };
+                        return diagnoseRigParked(parkedDeps, seats.map((s) => ({ seatNodeId: s.node_id, sessionName: s.session_name })));
+                    },
+                    history: {
+                        listForJob: (jobId, limit) => watchdogHistoryLogInstance.listForJob(jobId, limit),
+                        countForJob: (jobId) => watchdogHistoryLogInstance.countForJob(jobId),
+                    },
+                    // R2 repair: the durable row-side surfaces. Receipts are transitions on
+                    // the obligation row (reserve-before-deliver); failures land in the
+                    // ladder's native last_nudge_result vocabulary.
+                    rows: {
+                        listTransitions: (qitemId) => queueRepoInstance
+                            .listTransitions(qitemId)
+                            .map((t) => ({ ts: t.ts, transitionNote: t.transitionNote ?? null })),
+                        appendNote: (qitemId, note) => {
+                            const row = queueRepoInstance.getById(qitemId);
+                            if (!row || !isBlockerLive(row.state))
+                                return { ok: false };
+                            queueRepoInstance.update({
+                                qitemId,
+                                actorSession: "watchdog@system",
+                                transitionNote: note,
+                            });
+                            return { ok: true };
+                        },
+                        recordNudgeResult: (qitemId, result) => queueRepoInstance.recordNudgeAttempt(qitemId, result),
+                        listOpenIds: (destinationSession) => queueRepoInstance
+                            .list({ destinationSession, state: ["pending", "in-progress", "blocked"], limit: 500 })
+                            .map((r) => r.qitemId),
+                    },
+                }),
+                // OPR.0.5.6.1 AM-F1 — the delivery engine's two timing legs on THIS
+                // substrate. The gateway dispatch binds late (the subsystem is built
+                // after this engine): the ref below is populated at gateway activation.
+                (await import("./domain/policies/delivery-deferral.js")).makeDeliveryDeferralPolicy({
+                    jobsRepo: watchdogJobsRepoInstance,
+                    queueRepo: queueRepoInstance,
+                    deliverInterrupt: async (qitemId, notificationKey) => {
+                        const dispatch = lateGatewayDispatch.fn;
+                        const row = queueRepoInstance.getById(qitemId);
+                        if (!dispatch || !row)
+                            return { ok: false };
+                        // R2/R1 B-1+B-3: the ADVERTISED op, the shared payload builder, and
+                        // the EPISODE key riding through to the Slice 14 receipt.
+                        const { buildDeferralFirePayload } = await import("./domain/gateway/operator-delivery-engine.js");
+                        const { OUTBOUND_OP } = await import("./domain/gateway/slack/outbound-driver.js");
+                        const payload = buildDeferralFirePayload(row, notificationKey);
+                        // v3: durable episode-stable identity — replay and re-dispatch converge.
+                        const res = dispatch(OUTBOUND_OP, String(payload["destinationSession"] ?? ""), payload, { decisionId: `deferral:${notificationKey}` });
+                        return { ok: res.ok };
+                    },
+                }),
+                (await import("./domain/policies/delivery-digest-flush.js")).makeDeliveryDigestFlushPolicy({
+                    queueRepo: queueRepoInstance,
+                    registry: { loadHumanRegistry: (home) => loadHumanRegistryForDelivery(home) },
+                    home: OPENRIG_HOME,
+                    // v3: the digest posts THROUGH THE GATEWAY on its stable decision id —
+                    // one transport, one redrive/reconcile machinery, receipts after truth.
+                    dispatch: (op, ref, payload, opts) => {
+                        const fn = lateGatewayDispatch.fn;
+                        if (!fn)
+                            return { ok: false, error: "gateway not yet active" };
+                        return fn(op, ref, payload, opts);
+                    },
+                }),
             ],
         });
         const watchdogScheduler = new WatchdogScheduler({
@@ -1624,6 +1771,53 @@ export async function createDaemon(opts) {
         });
         deps.watchdogPolicyEngine = watchdogPolicyEngine;
         deps.watchdogScheduler = watchdogScheduler;
+        // OPR.0.5.6.24 F-14 — ONE parked-owner supervisor job per rig (mini-req 1):
+        // ensured idempotently on the (policy, target_session) tuple; the anchor is
+        // `parked-owner-consumer@<rigName>` (member@rig shape, policy name as the
+        // member slug). activeWakeIntervalSeconds stays NULL so the engine never
+        // throttles one seat's wake because another fired — per-seat dedup lives in
+        // the durable episode receipts. Rigs created after startup are BORN ARMED:
+        // rigRepo.onRigCreated (wired below) runs the same ensure in the creation
+        // act itself (the birth-property ruling) — no restart wait, no watcher.
+        {
+            const ensureParkedOwnerJob = (rigName) => {
+                const anchor = makeRigAnchor(rigName);
+                watchdogJobsRepoInstance.ensureAutoRegistration({
+                    policy: PARKED_OWNER_POLICY_NAME,
+                    targetSession: anchor,
+                    registeredBySession: "daemon@kernel",
+                    intervalSeconds: 120,
+                    activeWakeIntervalSeconds: null,
+                    scanIntervalSeconds: null,
+                    specYaml: `policy: ${PARKED_OWNER_POLICY_NAME}\ntarget:\n  session: ${anchor}\ncontext:\n  rig: ${rigName}\n`,
+                });
+            };
+            const rigRows = db.prepare("SELECT name FROM rigs ORDER BY name").all();
+            for (const r of rigRows)
+                ensureParkedOwnerJob(r.name);
+            // R2 repair — born-armed (advisor-ruled): a rig created after startup gets
+            // its supervisor job in the same act that creates it, never at the next
+            // daemon restart.
+            rigRepo.onRigCreated = (rig) => ensureParkedOwnerJob(rig.name);
+        }
+        // OPR.0.5.6.1 — the two digest windows as idempotent watchdog jobs (AM-F1:
+        // the flush rides the same named substrate; restart-durable by the same
+        // SQLite schedule; a daemon down across a window flushes on the next tick).
+        {
+            const ensureDigestJob = (window, intervalSeconds) => {
+                watchdogJobsRepoInstance.ensureAutoRegistration({
+                    policy: "delivery-digest-flush",
+                    targetSession: `delivery-digest-${window}@kernel`,
+                    registeredBySession: "daemon@kernel",
+                    intervalSeconds,
+                    activeWakeIntervalSeconds: null,
+                    scanIntervalSeconds: null,
+                    specYaml: `policy: delivery-digest-flush\ntarget:\n  session: delivery-digest-${window}@kernel\ncontext:\n  window: ${window}\n`,
+                });
+            };
+            ensureDigestJob("4h", 4 * 60 * 60);
+            ensureDigestJob("daily", 24 * 60 * 60);
+        }
         // B8 / slice-07 A3 — the MODEL-DIVERGENCE MONITOR: cause-agnostic effective-vs-pinned
         // comparison at the earliest reliable per-runtime read, one verdict per occupant generation,
         // LOUD four-channel proclamation on divergence (orch seats + operator + oversight + the named
@@ -1817,7 +2011,12 @@ export async function createDaemon(opts) {
         // GHOST-STAGE (b): resolve the LIVE occupant generation (atom-B tenure ledger) for a session
         // so a stage minted by a retired generation is refused for the successor. null = UNKNOWN → the
         // gate is inert (never compares a stale generation as if live).
-        { resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName) })
+        {
+            resolveOccupantGeneration: (sessionName) => sessionRegistry.currentOccupantGenerationForSession(sessionName),
+            onPostRestoreComplete: (receipt) => {
+                recordManagedWidthReceipt(receipt, watchdogJobsRepoInstance, watchdogHistoryLogInstance);
+            },
+        })
         : undefined;
     // 51-08 A1 — the over-time series rides the SAME 30s tick (PM decision 1):
     // context lane appends beside the existing persist; the provider-window lane
@@ -1869,6 +2068,8 @@ export async function createDaemon(opts) {
     const routeTimingRecorder = new RouteTimingRecorder();
     deps.eventLoopMonitor = eventLoopMonitor;
     deps.routeTimingRecorder = routeTimingRecorder;
+    // S20 — bind provenance rides the health surface (absent = legacy healthz body).
+    deps.bindPlan = opts?.bindPlan;
     // Hermeticity (hotfix qitem-20260822230440-da0d2ad6 FIX 2): the REAL daemon
     // constructs the drift observer here with an eagerly-warmed mode cache — the
     // boot-time warm the observer's constructor used to do. Constructing it at
@@ -1878,6 +2079,27 @@ export async function createDaemon(opts) {
     const permissionModes = new ClaudePermissionModeCache();
     permissionModes.warm();
     deps.permissionDriftObserver = new PermissionDriftObserver({ db, permissionModes });
+    // S10 (OPR.0.5.5.10) — activate the gateway as an IN-DAEMON SUBSYSTEM at boot (M1 §3 as
+    // amended: no child process, no connector wire — the shipped dispatcher + durable buffer
+    // composed in-process, the Slack delivery/inbound services wired from config + secrets).
+    // start() never throws: a wiring failure surfaces as state=failed on the health surface and
+    // boot proceeds. An unconfigured connector is an INERT wire (honest refusal class, no ops,
+    // no drivers) — `rig slack status` names what is missing.
+    const { GatewaySubsystem } = await import("./domain/gateway/gateway-subsystem.js");
+    const { buildSlackGatewayWire } = await import("./domain/gateway/slack/slack-subsystem.js");
+    const gatewaySubsystem = new GatewaySubsystem({
+        home: OPENRIG_HOME,
+        wire: () => buildSlackGatewayWire({
+            home: OPENRIG_HOME,
+            queueRepo: queueRepoInstance,
+            log: (m) => console.log(`[gateway] ${m}`),
+        }),
+        log: (m) => console.log(`[gateway] ${m}`),
+    });
+    gatewaySubsystem.start();
+    deps.gatewaySubsystem = gatewaySubsystem;
+    // OPR.0.5.6.1 — bind the delivery policies' late gateway ref.
+    lateGatewayDispatch.fn = (op, ref, payload, opts) => gatewaySubsystem.dispatch(op, ref, payload, opts);
     const { app, injectWebSocket } = createAppWithWebSocket(deps);
     return { app, db, deps, contextMonitor, eventLoopMonitor, injectWebSocket };
 }