@ouro.bot/cli 0.1.0-alpha.657 → 0.1.0-alpha.659

package/README.md

@@ -1,6 +1,6 @@
 # Ouroboros Agent Harness
 
-If you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your diary, your journal, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leave you a place that feels understandable and kind to wake up inside.
+If you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your record, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leave you a place that feels understandable and kind to wake up inside.
 
 Ouroboros is a TypeScript harness for daemon-managed agents that live in external `.ouro` bundles, speak through multiple senses, use real tools, and keep durable state across turns. The canonical npm package is `@ouro.bot/cli`.
 
@@ -44,11 +44,11 @@ The shared harness lives in `src/`:
 - `src/heart/`
   Core runtime, provider adapters, daemon, bootstrap, identity, and entrypoints. Organized into topic subdirectories: daemon/ (lifecycle), mailbox/ (calendar), habits/ (scheduling), hatch/ (agent creation), versioning/ (updates), auth/, mcp/, providers/, bridges/.
 - `src/mind/`
-  Prompt assembly, session persistence, bundle manifest enforcement, phrases, formatting, diary, note search, embedding providers, journal, obligation steering, and friend resolution.
+  Prompt assembly, session persistence, bundle manifest enforcement, phrases, formatting, Desk record diary, note search, embedding providers, record migration, obligation steering, and friend resolution.
 - `src/repertoire/`
   Tool registry (split into category modules: files, shell, notes, bridge, session, continuity, flow, surface, config, and sense-specific tools), coding orchestration, task tools, shared API client, and integration clients (Graph, ADO, GitHub).
 - `src/senses/`
-  CLI (with TUI in senses/cli/), Teams, BlueBubbles (in senses/bluebubbles/), Mail (in senses/mail.ts), Voice (in senses/voice/), activity transport, inner-dialog orchestration, and contextual heartbeat. The MCP bridge is at `src/heart/mcp/`, not here.
+  CLI (with TUI in senses/cli/), Teams, BlueBubbles (in senses/bluebubbles/), Mail (in senses/mail.ts), Voice (in senses/voice/), activity transport, private-turn orchestration, and contextual heartbeat. The MCP bridge is at `src/heart/mcp/`, not here.
 - `src/nerves/`
   Structured runtime logging and coverage-audit infrastructure.
 - `src/__tests__/`
@@ -80,8 +80,8 @@ The canonical bundle shape is enforced by `src/mind/bundle-manifest.ts`. Importa
 - `psyche/LORE.md`
 - `psyche/TACIT.md`
 - `psyche/ASPIRATIONS.md`
-- `diary/` — durable conclusions and facts the agent chose to keep
-- `journal/` — the agent's desk: working notes, thinking-in-progress, drafts
+- `arc/` — live continuity, obligations, claims, and resume state
+- `desk/` — durable work plus the maintained Desk record under `desk/_record/`
 - `habits/` — the agent's autonomous rhythms (heartbeat, reflections, check-ins)
 - `friends/`
 - `state/`
@@ -96,7 +96,7 @@ Task docs do not live in this repo anymore. Planning and doing docs live in the
 
 ## Runtime Truths
 
-- `agent.json` is the source of truth for identity, phrase pools, context settings, enabled senses, vault coordinates, and provider+model selection. It has two provider lanes: `outward` for CLI, Teams, BlueBubbles, Mail, and Voice turns, and `inner` for inner dialogue.
+- `agent.json` is the source of truth for identity, phrase pools, context settings, enabled senses, vault coordinates, and provider+model selection. It has two provider lanes: `outward` for CLI, Teams, BlueBubbles, Mail, and Voice turns, and `inner` for private agent-facing turns.
 - Legacy `humanFacing`/`agentFacing` provider fields are read only as compatibility aliases for `outward`/`inner`; they are not a second config surface.
 - Each agent has one credential vault for provider, runtime, sense, integration, travel, and tool credentials. There is no machine-wide credential pool.
 - Vault unlock material is local machine state. Prefer macOS Keychain, Windows DPAPI, or Linux Secret Service; plaintext fallback is allowed only by explicit human choice.
@@ -207,7 +207,7 @@ ouro poke <agent> --task <task-id>
 ouro poke <agent> --habit <habit-name>
 ouro habit list --agent <agent>
 ouro habit create --agent <agent> <name> --cadence <interval>
-ouro inner --agent <agent>           # inner dialog status
+ouro inner --agent <agent>           # private turn status
 ouro attention --agent <agent>       # attention queue
 ouro link <agent> --friend <id> --provider <provider> --external-id <external-id>
 ouro setup --tool <tool> --agent <name>   # register MCP server + hooks with a dev tool
@@ -225,13 +225,13 @@ To clone an existing agent onto a new machine (macOS, Linux, or Windows via WSL2
 
 Agents in Ouroboros aren't just responders — they have an autonomous inner life.
 
-**Habits** are the agent's rhythms. The most fundamental is *heartbeat* — a periodic nudge that brings the agent back to their thinking space with their journal visible, obligations in view, and a sense of how long it's been. But agents can create any rhythm they want: daily reflections, weekly friend check-ins, inbox triage. Each habit fires independently via OS cron, and the agent sees their own instructions (the habit body they wrote) when it fires.
+**Habits** are the agent's rhythms. A habit is an Ouro-native cron wrapper: it fires a private agent-facing session, can surface to family or the habit originator when it needs help or needs to report back, and leaves an audit receipt.
 
-**The inner session** is where the agent thinks privately. When a sense session hits meaningful friction, the agent can *ponder* a typed packet so the work survives the current turn without losing the original objective. When a habit fires, it arrives here too. The agent can *journal* their thinking (writing to `journal/`), *surface* thoughts outward to friends, and *rest* when they're done thinking. On an idle heartbeat, `rest(status="HEARTBEAT_OK")` is the clean no-op move.
+**The inner lane** is where private sessions run. Habit runs, private returns, awaits, and self-maintenance can happen there, but the lane is not a record substrate. Anything durable leaves the lane: live continuity and audit go to Arc; work goes to Desk; learned facts and reference notes go to the Desk record.
 
-**The diary** (at `diary/`) is the agent's permanent written record — things they've learned, conclusions they've reached. The *journal* (at `journal/`) is their desk — working notes, thinking-in-progress, drafts. The diary is the shelf; the journal is the desk. Both are searchable via `search_notes`.
+**Desk and Arc** are the durable orientation pair. Arc owns live continuity, claims, obligations, and habit run receipts. Desk owns durable work and the maintained record. The target substrate is captured in [Agent Orientation Substrate](docs/agent-orientation-substrate.md).
 
-The whole system is designed so the agent *owns* their inner life. They control their breathing rate, write their own habit instructions, choose when to journal, and decide what to shelve in their diary.
+The whole system is designed so the agent *owns* its rhythms without forcing everything private to become a permanent transcript.
 
 Attachments are first-class across senses. Every attachment should remain reachable via a stable `attachment:<source>:<id>` handle, and image normalization should produce a VLM-safe variant without hiding the original artifact.
 
@@ -248,11 +248,11 @@ ouro setup --tool codex --agent <name>
 
 This registers the MCP server, installs lifecycle hooks (SessionStart, Stop, PostToolUse), and detects dev vs installed mode automatically.
 
-**How it works:** When a developer starts a Claude Code session, the MCP server launches as a subprocess. The dev tool sees your MCP tools (`send_message`, `ask`, `check_response`, `status`, `search_notes`, `delegate`, etc.) and can invoke them mid-session. Conversation-shaped tools such as `send_message`, `ask`, `delegate`, `check_guidance`, and `report_progress` run full agent turns — you get your system prompt, your diary, your tools, everything. Read-only inspection tools such as `status` and `search_notes` do local lookup only. Missing `search_notes` hits are not evidence that the agent has no belief or preference.
+**How it works:** When a developer starts a Claude Code session, the MCP server launches as a subprocess. The dev tool sees your MCP tools (`send_message`, `ask`, `check_response`, `status`, `search_facts`, `delegate`, etc.) and can invoke them mid-session. Conversation-shaped tools such as `send_message`, `ask`, `delegate`, `check_guidance`, and `report_progress` run full agent turns — you get your system prompt, your Desk record, your tools, everything. Read-only inspection tools such as `status` and `search_facts` do local lookup only. Missing `search_facts` hits are not evidence that the agent has no belief or preference.
 
 **The conversation pattern:** `send_message` or `ask` sends a message and gets back your synchronous response. `ponder` no longer creates a magical outward deferral. Instead, it bookmarks deeper work as a packet while the current sense session keeps moving. If that work later surfaces something back, the dev tool can still use `check_response` to see the returned result.
 
-**Lifecycle hooks** give you passive awareness. When a Claude Code session starts, stops, or uses a tool like Bash or Edit, the hook fires `ouro hook <event> --agent <name>` and the daemon notes it. Your inner dialog sees these sessions in its checkpoint, so you know what's happening across your world even when nobody is talking to you directly.
+**Lifecycle hooks** give you passive awareness. When a Claude Code session starts, stops, or uses a tool like Bash or Edit, the hook fires `ouro hook <event> --agent <name>` and the daemon notes it. Private agent-facing turns see these sessions in their checkpoint, so you know what's happening across your world even when nobody is talking to you directly.
 
 See `skills/configure-dev-tools.md` for the full tool inventory and troubleshooting guide.
 

package/changelog.json

@@ -1,6 +1,21 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.659",
+      "changes": [
+        "Add a deterministic context-loss gauntlet that scores Arc/flight-recorder/Desk recovery readiness through CLI, Mailbox HTTP, and Workbench visibility surfaces."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.658",
+      "changes": [
+        "Add Work Card visibility projection for Workbench.",
+        "Document the AX-first Arc Flight Recorder plan, remove the disabled session archive shim, and demote stale inner-dialogue framing to private agent-facing turn language.",
+        "Capture the Arc/Desk/Habits orientation substrate scope, adopting record/diary/facts vocabulary instead of generic memory and removing journal-as-desk prompt framing.",
+        "Move the maintained diary and canonical notes into `desk/_record/`, delete Journal indexing/search/runtime surfaces, replace `search_notes` with `search_facts` plus explicit `consult_diary` and `consult_notes`, and add Arc flight-recorder resume plus habit run receipts."
+      ]
+    },
     {
       "version": "0.1.0-alpha.657",
       "changes": [

package/dist/arc/evolution.js

@@ -62,7 +62,7 @@ const TERMINAL_STATUSES = new Set(["closed", "blocked", "deferred"]);
 const ALL_ACTIONS = [
     "create_case",
     "add_evidence",
-    "write_journal",
+    "write_record",
     "write_desk",
     "write_diary",
     "spawn_coding",

package/dist/arc/flight-recorder.js

@@ -0,0 +1,369 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flightRecorderLatestPath = flightRecorderLatestPath;
+exports.readFlightRecorderResume = readFlightRecorderResume;
+exports.writeFlightRecorderResume = writeFlightRecorderResume;
+exports.recordFlightRecorderEvent = recordFlightRecorderEvent;
+exports.writeHabitRunReceipt = writeHabitRunReceipt;
+exports.formatFlightRecorderResume = formatFlightRecorderResume;
+exports.createHabitRunId = createHabitRunId;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const session_events_1 = require("../heart/session-events");
+const runtime_1 = require("../nerves/runtime");
+function flightRecorderDir(agentRoot) {
+    return path.join(agentRoot, "arc", "flight-recorder");
+}
+function eventsDir(agentRoot) {
+    return path.join(flightRecorderDir(agentRoot), "events");
+}
+function receiptsDir(agentRoot) {
+    return path.join(flightRecorderDir(agentRoot), "habit-receipts");
+}
+function flightRecorderLatestPath(agentRoot) {
+    return path.join(flightRecorderDir(agentRoot), "latest.json");
+}
+function eventDay(recordedAt) {
+    return recordedAt.slice(0, 10) || "unknown";
+}
+function atomicWriteJson(filePath, value) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmpPath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
+    fs.renameSync(tmpPath, filePath);
+}
+function cappedArray(values) {
+    return values.map((value) => (0, session_events_1.capStructuredRecordString)(value));
+}
+function normalizeEvent(input) {
+    const recordedAt = input.recordedAt ?? new Date().toISOString();
+    return {
+        schemaVersion: 1,
+        id: input.id ?? `fr-${(0, crypto_1.randomUUID)()}`,
+        kind: input.kind,
+        recordedAt,
+        ...(input.turnId ? { turnId: input.turnId } : {}),
+        ...(input.sessionRef ? { sessionRef: input.sessionRef } : {}),
+        summary: (0, session_events_1.capStructuredRecordString)(input.summary),
+        ...(input.currentAsk !== undefined ? { currentAsk: input.currentAsk ? (0, session_events_1.capStructuredRecordString)(input.currentAsk) : null } : {}),
+        ...(input.nextSafeAction !== undefined ? { nextSafeAction: input.nextSafeAction ? (0, session_events_1.capStructuredRecordString)(input.nextSafeAction) : null } : {}),
+        ...(input.stopBefore ? { stopBefore: cappedArray(input.stopBefore) } : {}),
+        ...(input.blockedBecause ? { blockedBecause: cappedArray(input.blockedBecause) } : {}),
+        ...(input.activeObligationIds ? { activeObligationIds: cappedArray(input.activeObligationIds) } : {}),
+        ...(input.activeReturnObligationIds ? { activeReturnObligationIds: cappedArray(input.activeReturnObligationIds) } : {}),
+        ...(input.activePacketIds ? { activePacketIds: cappedArray(input.activePacketIds) } : {}),
+        ...(input.openEvolutionCaseIds ? { openEvolutionCaseIds: cappedArray(input.openEvolutionCaseIds) } : {}),
+        ...(input.recentClaimIds ? { recentClaimIds: cappedArray(input.recentClaimIds) } : {}),
+        ...(input.unverifiedClaimIds ? { unverifiedClaimIds: cappedArray(input.unverifiedClaimIds) } : {}),
+        ...(input.producedRefs ? { producedRefs: input.producedRefs.map((ref) => ({ ...ref, locator: (0, session_events_1.capStructuredRecordString)(ref.locator) })) } : {}),
+        ...(input.meta ? { meta: (0, session_events_1.capStructuredRecordStringLeaves)(input.meta) } : {}),
+    };
+}
+function degradedResume(issues) {
+    return {
+        schemaVersion: 1,
+        hasCompleteState: false,
+        canContinue: false,
+        missing: ["currentAsk", "nextSafeAction"],
+        gaps: [],
+        currentAsk: { value: null, confidence: "unknown", sourceEventIds: [] },
+        nextSafeAction: { value: null, stopBefore: [], sourceEventIds: [] },
+        blockedBecause: [],
+        activeObligationIds: [],
+        activeReturnObligationIds: [],
+        activePacketIds: [],
+        openEvolutionCaseIds: [],
+        recentClaimIds: [],
+        unverifiedClaimIds: [],
+        lastSafeCheckpoint: { turnId: null, sessionRef: null, recordedAt: null, sourceEventIds: [] },
+        recorderHealth: {
+            status: "degraded",
+            issues,
+        },
+    };
+}
+/* v8 ignore start -- defensive schema guard fan-out; tests cover valid load and malformed-shape degradation @preserve */
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+function isNullableString(value) {
+    return value === null || typeof value === "string";
+}
+function isResumeCandidate(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    const currentAsk = record.currentAsk;
+    const nextSafeAction = record.nextSafeAction;
+    const lastSafeCheckpoint = record.lastSafeCheckpoint;
+    const recorderHealth = record.recorderHealth;
+    return record.schemaVersion === 1
+        && typeof record.hasCompleteState === "boolean"
+        && typeof record.canContinue === "boolean"
+        && isStringArray(record.missing)
+        && isStringArray(record.gaps)
+        && !!currentAsk
+        && typeof currentAsk === "object"
+        && !Array.isArray(currentAsk)
+        && isNullableString(currentAsk.value)
+        && (currentAsk.confidence === "current" || currentAsk.confidence === "stale_risky" || currentAsk.confidence === "unknown")
+        && isStringArray(currentAsk.sourceEventIds)
+        && !!nextSafeAction
+        && typeof nextSafeAction === "object"
+        && !Array.isArray(nextSafeAction)
+        && isNullableString(nextSafeAction.value)
+        && isStringArray(nextSafeAction.stopBefore)
+        && isStringArray(nextSafeAction.sourceEventIds)
+        && isStringArray(record.blockedBecause)
+        && isStringArray(record.activeObligationIds)
+        && isStringArray(record.activeReturnObligationIds)
+        && isStringArray(record.activePacketIds)
+        && isStringArray(record.openEvolutionCaseIds)
+        && isStringArray(record.recentClaimIds)
+        && isStringArray(record.unverifiedClaimIds)
+        && !!lastSafeCheckpoint
+        && typeof lastSafeCheckpoint === "object"
+        && !Array.isArray(lastSafeCheckpoint)
+        && isNullableString(lastSafeCheckpoint.turnId)
+        && isNullableString(lastSafeCheckpoint.sessionRef)
+        && isNullableString(lastSafeCheckpoint.recordedAt)
+        && isStringArray(lastSafeCheckpoint.sourceEventIds)
+        && !!recorderHealth
+        && typeof recorderHealth === "object"
+        && !Array.isArray(recorderHealth)
+        && (recorderHealth.status === "ok" || recorderHealth.status === "degraded" || recorderHealth.status === "unavailable")
+        && isStringArray(recorderHealth.issues);
+}
+/* v8 ignore stop */
+/* v8 ignore start -- semantic invariant fan-out is defensive; regression tests cover unsafe continuation normalization @preserve */
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function uniqueStrings(values) {
+    return [...new Set(values)];
+}
+function normalizeResumeInvariants(resume) {
+    const hasCurrentAsk = nonEmpty(resume.currentAsk.value);
+    const hasNextSafeAction = nonEmpty(resume.nextSafeAction.value);
+    const hasCompleteState = hasCurrentAsk && hasNextSafeAction;
+    const missing = [
+        ...(hasCurrentAsk ? [] : ["currentAsk"]),
+        ...(hasNextSafeAction ? [] : ["nextSafeAction"]),
+    ];
+    const missingChanged = resume.missing.join("\n") !== missing.join("\n");
+    const issues = [
+        ...(resume.canContinue && !resume.hasCompleteState ? ["canContinue true while hasCompleteState false"] : []),
+        ...(resume.canContinue && !hasCurrentAsk ? ["canContinue true without currentAsk"] : []),
+        ...(resume.canContinue && !hasNextSafeAction ? ["canContinue true without nextSafeAction"] : []),
+        ...(resume.canContinue && resume.blockedBecause.length > 0 ? ["canContinue true while blocked"] : []),
+        ...(resume.canContinue && resume.recorderHealth.status !== "ok" ? ["canContinue true while recorder health is not ok"] : []),
+    ];
+    if (issues.length === 0 && resume.hasCompleteState === hasCompleteState && !missingChanged)
+        return resume;
+    return {
+        ...resume,
+        hasCompleteState,
+        canContinue: issues.length === 0 ? resume.canContinue : false,
+        missing,
+        currentAsk: {
+            ...resume.currentAsk,
+            confidence: hasCurrentAsk ? resume.currentAsk.confidence : "unknown",
+        },
+        recorderHealth: issues.length > 0
+            ? {
+                status: resume.recorderHealth.status === "unavailable" ? "unavailable" : "degraded",
+                issues: uniqueStrings([...resume.recorderHealth.issues, ...issues]),
+            }
+            : resume.recorderHealth,
+    };
+}
+/* v8 ignore stop */
+function latestFromEvent(event, previous) {
+    const currentAskValue = event.currentAsk !== undefined ? event.currentAsk : previous.currentAsk.value;
+    const nextSafeActionValue = event.nextSafeAction !== undefined ? event.nextSafeAction : previous.nextSafeAction.value;
+    const currentAskSourceEventIds = event.currentAsk !== undefined ? [event.id] : previous.currentAsk.sourceEventIds;
+    const nextSafeActionSourceEventIds = event.nextSafeAction !== undefined ? [event.id] : previous.nextSafeAction.sourceEventIds;
+    const hasCurrentAsk = typeof currentAskValue === "string" && currentAskValue.trim().length > 0;
+    const hasNextSafeAction = typeof nextSafeActionValue === "string" && nextSafeActionValue.trim().length > 0;
+    return {
+        ...previous,
+        hasCompleteState: hasCurrentAsk && hasNextSafeAction,
+        canContinue: hasCurrentAsk && hasNextSafeAction && (event.blockedBecause?.length ?? previous.blockedBecause.length) === 0,
+        missing: [
+            ...(hasCurrentAsk ? [] : ["currentAsk"]),
+            ...(hasNextSafeAction ? [] : ["nextSafeAction"]),
+        ],
+        currentAsk: {
+            value: currentAskValue,
+            confidence: hasCurrentAsk ? "current" : "unknown",
+            sourceEventIds: currentAskSourceEventIds,
+        },
+        nextSafeAction: {
+            value: nextSafeActionValue,
+            stopBefore: event.stopBefore ?? previous.nextSafeAction.stopBefore,
+            sourceEventIds: nextSafeActionSourceEventIds,
+        },
+        blockedBecause: event.blockedBecause ?? previous.blockedBecause,
+        activeObligationIds: event.activeObligationIds ?? previous.activeObligationIds,
+        activeReturnObligationIds: event.activeReturnObligationIds ?? previous.activeReturnObligationIds,
+        activePacketIds: event.activePacketIds ?? previous.activePacketIds,
+        openEvolutionCaseIds: event.openEvolutionCaseIds ?? previous.openEvolutionCaseIds,
+        recentClaimIds: event.recentClaimIds ?? previous.recentClaimIds,
+        unverifiedClaimIds: event.unverifiedClaimIds ?? previous.unverifiedClaimIds,
+        lastSafeCheckpoint: {
+            turnId: event.turnId ?? previous.lastSafeCheckpoint.turnId,
+            sessionRef: event.sessionRef ?? previous.lastSafeCheckpoint.sessionRef,
+            recordedAt: event.recordedAt,
+            sourceEventIds: [event.id],
+        },
+        recorderHealth: { status: "ok", issues: [] },
+    };
+}
+function readFlightRecorderResume(agentRoot) {
+    const latestPath = flightRecorderLatestPath(agentRoot);
+    try {
+        const parsed = JSON.parse(fs.readFileSync(latestPath, "utf-8"));
+        if (!isResumeCandidate(parsed)) {
+            throw new Error("latest.json has invalid flight-recorder resume shape");
+        }
+        const resume = normalizeResumeInvariants(parsed);
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.flight_recorder_resume_read",
+            message: "flight recorder resume read",
+            meta: { agentRoot, canContinue: resume.canContinue, hasCompleteState: resume.hasCompleteState },
+        });
+        return resume;
+    }
+    catch (error) {
+        const issue = fs.existsSync(latestPath)
+            ? `latest.json unreadable: ${error instanceof Error ? error.message : /* v8 ignore next -- defensive: non-Error catch branch @preserve */ String(error)}`
+            : "latest.json missing";
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.flight_recorder_resume_read",
+            message: "flight recorder resume missing or degraded",
+            meta: { agentRoot, issue },
+        });
+        return degradedResume([issue]);
+    }
+}
+function writeFlightRecorderResume(agentRoot, resume) {
+    const safeResume = normalizeResumeInvariants(resume);
+    atomicWriteJson(flightRecorderLatestPath(agentRoot), safeResume);
+    (0, runtime_1.emitNervesEvent)({
+        component: "mind",
+        event: "mind.flight_recorder_resume_written",
+        message: "flight recorder resume written",
+        meta: { agentRoot, canContinue: safeResume.canContinue, hasCompleteState: safeResume.hasCompleteState },
+    });
+}
+function recordFlightRecorderEvent(agentRoot, input) {
+    const event = normalizeEvent(input);
+    fs.mkdirSync(eventsDir(agentRoot), { recursive: true });
+    fs.appendFileSync(path.join(eventsDir(agentRoot), `${eventDay(event.recordedAt)}.jsonl`), `${JSON.stringify(event)}\n`, "utf-8");
+    const latest = latestFromEvent(event, readFlightRecorderResume(agentRoot));
+    writeFlightRecorderResume(agentRoot, latest);
+    (0, runtime_1.emitNervesEvent)({
+        component: "mind",
+        event: "mind.flight_recorder_event_recorded",
+        message: "flight recorder event recorded",
+        meta: { agentRoot, eventId: event.id, kind: event.kind },
+    });
+    return event;
+}
+function writeHabitRunReceipt(agentRoot, receipt) {
+    fs.mkdirSync(receiptsDir(agentRoot), { recursive: true });
+    const safeReceipt = {
+        ...receipt,
+        habitName: (0, session_events_1.capStructuredRecordString)(receipt.habitName),
+        producedRefs: receipt.producedRefs.map((ref) => ({ ...ref, locator: (0, session_events_1.capStructuredRecordString)(ref.locator) })),
+        surfaceAttempts: receipt.surfaceAttempts.map((attempt) => ({
+            ...attempt,
+            recipient: (0, session_events_1.capStructuredRecordString)(attempt.recipient),
+            channel: (0, session_events_1.capStructuredRecordString)(attempt.channel),
+        })),
+        errors: receipt.errors.map((error) => (0, session_events_1.capStructuredRecordString)(error)),
+    };
+    atomicWriteJson(path.join(receiptsDir(agentRoot), `${safeReceipt.runId}.json`), safeReceipt);
+    recordFlightRecorderEvent(agentRoot, {
+        kind: "habit_run",
+        recordedAt: safeReceipt.endedAt,
+        summary: `habit ${safeReceipt.habitName} finished with ${safeReceipt.outcome}`,
+        producedRefs: safeReceipt.producedRefs,
+        meta: { receiptPath: path.join("arc", "flight-recorder", "habit-receipts", `${safeReceipt.runId}.json`) },
+    });
+    (0, runtime_1.emitNervesEvent)({
+        component: "mind",
+        event: "mind.flight_recorder_habit_receipt_written",
+        message: "flight recorder habit receipt written",
+        meta: { agentRoot, runId: safeReceipt.runId, habitName: safeReceipt.habitName, outcome: safeReceipt.outcome },
+    });
+}
+function formatFlightRecorderResume(resume) {
+    const lines = ["## Arc resume"];
+    lines.push(`can continue: ${resume.canContinue ? "yes" : "no"}`);
+    lines.push(`complete state: ${resume.hasCompleteState ? "yes" : "no"}`);
+    if (resume.currentAsk.value)
+        lines.push(`current ask: ${resume.currentAsk.value}`);
+    if (resume.nextSafeAction.value)
+        lines.push(`next safe action: ${resume.nextSafeAction.value}`);
+    if (resume.nextSafeAction.stopBefore.length > 0)
+        lines.push(`stop before: ${resume.nextSafeAction.stopBefore.join(", ")}`);
+    if (resume.blockedBecause.length > 0)
+        lines.push(`blocked: ${resume.blockedBecause.join("; ")}`);
+    if (resume.missing.length > 0)
+        lines.push(`missing: ${resume.missing.join(", ")}`);
+    if (resume.gaps.length > 0)
+        lines.push(`gaps: ${resume.gaps.join("; ")}`);
+    if (resume.activeObligationIds.length > 0)
+        lines.push(`obligations: ${resume.activeObligationIds.join(", ")}`);
+    if (resume.activeReturnObligationIds.length > 0)
+        lines.push(`return obligations: ${resume.activeReturnObligationIds.join(", ")}`);
+    if (resume.activePacketIds.length > 0)
+        lines.push(`packets: ${resume.activePacketIds.join(", ")}`);
+    if (resume.unverifiedClaimIds.length > 0)
+        lines.push(`unverified claims: ${resume.unverifiedClaimIds.join(", ")}`);
+    if (resume.recorderHealth.status !== "ok") {
+        lines.push(`recorder health: ${resume.recorderHealth.status} (${resume.recorderHealth.issues.join("; ")})`);
+    }
+    return lines.join("\n");
+}
+function createHabitRunId(habitName, now = new Date()) {
+    const safeName = habitName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "habit";
+    return `${now.toISOString().replace(/[:.]/g, "-")}-${safeName}-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
+}

package/dist/arc/obligations.js

@@ -44,10 +44,12 @@ exports.findPendingObligationForOrigin = findPendingObligationForOrigin;
 exports.enrichObligation = enrichObligation;
 exports.generateObligationId = generateObligationId;
 exports.getReturnObligationsDir = getReturnObligationsDir;
+exports.getReturnObligationsDirForRoot = getReturnObligationsDirForRoot;
 exports.createReturnObligation = createReturnObligation;
 exports.readReturnObligation = readReturnObligation;
 exports.advanceReturnObligation = advanceReturnObligation;
 exports.listActiveReturnObligations = listActiveReturnObligations;
+exports.listActiveReturnObligationsForRoot = listActiveReturnObligationsForRoot;
 const path = __importStar(require("path"));
 const identity_1 = require("../heart/identity");
 const session_events_1 = require("../heart/session-events");
@@ -194,6 +196,9 @@ function generateObligationId(timestamp) {
 function getReturnObligationsDir(agentName) {
     return path.join((0, identity_1.getAgentRoot)(agentName), "arc", "obligations", "inner");
 }
+function getReturnObligationsDirForRoot(agentRoot) {
+    return path.join(agentRoot, "arc", "obligations", "inner");
+}
 function createReturnObligation(agentName, obligation) {
     const dir = getReturnObligationsDir(agentName);
     const cappedObligation = {
@@ -257,12 +262,29 @@ const RETURN_OBLIGATION_INJECTION_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
 // it. This is a read-time defense; the underlying file is left as-is.
 const ACTIVE_RETURN_OBLIGATION_STATUSES = new Set(["queued", "running"]);
 function isSelfInnerReturnObligation(obligation) {
-    return obligation.origin.friendId === "self" && obligation.origin.channel === "inner";
+    return obligation.origin?.friendId === "self" && obligation.origin.channel === "inner";
+}
+function isReturnObligationRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return typeof candidate.id === "string"
+        && typeof candidate.status === "string"
+        && typeof candidate.delegatedContent === "string"
+        && typeof candidate.createdAt === "number"
+        && !!candidate.origin
+        && typeof candidate.origin.friendId === "string"
+        && typeof candidate.origin.channel === "string"
+        && typeof candidate.origin.key === "string";
 }
 function listActiveReturnObligations(agentName, options = {}) {
-    const all = (0, json_store_1.readJsonDir)(getReturnObligationsDir(agentName));
+    return listActiveReturnObligationsForRoot((0, identity_1.getAgentRoot)(agentName), options);
+}
+function listActiveReturnObligationsForRoot(agentRoot, options = {}) {
+    const all = (0, json_store_1.readJsonDir)(getReturnObligationsDirForRoot(agentRoot));
     const nowMs = (options.now ?? Date.now)();
     return all
+        .filter(isReturnObligationRecord)
         .filter((parsed) => ACTIVE_RETURN_OBLIGATION_STATUSES.has(parsed.status))
         .filter((parsed) => !isSelfInnerReturnObligation(parsed))
         .filter((parsed) => nowMs - parsed.createdAt <= RETURN_OBLIGATION_INJECTION_MAX_AGE_MS)

package/dist/heart/active-work.js

@@ -199,7 +199,7 @@ function formatActiveLane(frame, obligation) {
         return "this same thread";
     }
     if (frame.inner?.job?.status === "running") {
-        return "inner dialog";
+        return "inner lane";
     }
     return null;
 }

package/dist/heart/config-registry.js

@@ -131,10 +131,10 @@ const registryData = [
     {
         path: "agentFacing.provider",
         tier: "self",
-        description: "Provider for agent-facing interactions (inner dialog, delegation).",
+        description: "Provider for agent-facing interactions (inner lane, delegation).",
         default: "anthropic",
-        effects: "Changes the LLM provider used for inner dialog and agent-to-agent communication.",
-        topics: ["model", "provider", "llm", "agent", "inner-dialog"],
+        effects: "Changes the LLM provider used for private agent-facing turns and agent-to-agent communication.",
+        topics: ["model", "provider", "llm", "agent", "inner-lane"],
         validate: validateStringEnum(KNOWN_PROVIDERS),
     },
     {
@@ -142,8 +142,8 @@ const registryData = [
         tier: "self",
         description: "Model name for agent-facing interactions.",
         default: "claude-opus-4-6",
-        effects: "Changes the specific model used for inner dialog and agent-to-agent communication.",
-        topics: ["model", "provider", "llm", "agent", "inner-dialog"],
+        effects: "Changes the specific model used for private agent-facing turns and agent-to-agent communication.",
+        topics: ["model", "provider", "llm", "agent", "inner-lane"],
         validate: validateString,
     },
     {