@ouro.bot/cli 0.1.0-alpha.99 → 0.1.0-alpha.991

package/dist/heart/daemon/daemon-entry.js

@@ -34,19 +34,58 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const process_manager_1 = require("./process-manager");
 const daemon_1 = require("./daemon");
 const runtime_1 = require("../../nerves/runtime");
+const index_1 = require("../../nerves/index");
 const message_router_1 = require("./message-router");
 const health_monitor_1 = require("./health-monitor");
+const daemon_health_1 = require("./daemon-health");
+const daemon_rollup_1 = require("./daemon-rollup");
 const task_scheduler_1 = require("./task-scheduler");
 const runtime_logging_1 = require("./runtime-logging");
 const sense_manager_1 = require("./sense-manager");
 const agent_discovery_1 = require("./agent-discovery");
+const agent_home_1 = require("./agent-home");
 const identity_1 = require("../identity");
 const runtime_mode_1 = require("./runtime-mode");
+const habit_scheduler_1 = require("../habits/habit-scheduler");
+const habit_migration_1 = require("../habits/habit-migration");
+const await_scheduler_1 = require("../awaiting/await-scheduler");
+const await_expiry_1 = require("../awaiting/await-expiry");
+const a2a_await_delivery_1 = require("../awaiting/a2a-await-delivery");
+const await_runtime_state_1 = require("../awaiting/await-runtime-state");
+const os_cron_deps_1 = require("./os-cron-deps");
+const os_cron_1 = require("./os-cron");
+const container_runtime_1 = require("./container-runtime");
+const supercronic_supervisor_1 = require("./supercronic-supervisor");
+const daemon_tombstone_1 = require("./daemon-tombstone");
+const agent_config_check_1 = require("./agent-config-check");
+const pulse_1 = require("./pulse");
+const socket_client_1 = require("./socket-client");
+const await_private_wake_1 = require("./await-private-wake");
+const habit_private_wake_1 = require("./habit-private-wake");
+const habit_policy_1 = require("../../rsvp/habit-policy");
+const bundle_manifest_1 = require("../../mind/bundle-manifest");
+const mcp_canary_1 = require("./mcp-canary");
+const context_loss_sentinel_1 = require("../context-loss-sentinel");
+const provider_credentials_1 = require("../provider-credentials");
+const runtime_credentials_1 = require("../runtime-credentials");
+const machine_identity_1 = require("../machine-identity");
+const container_credential_bootstrap_1 = require("./container-credential-bootstrap");
+const daemon_bootstrap_startup_1 = require("./daemon-bootstrap-startup");
+const sanctuary_package_management_1 = require("./sanctuary-package-management");
+const sanctuary_health_runner_1 = require("../../senses/sanctuary-health-runner");
+const sanctuary_acceptance_marker_1 = require("./sanctuary-acceptance-marker");
+const sanctuary_scheduler_liveness_1 = require("./sanctuary-scheduler-liveness");
+const sanctuary_scheduler_origin_1 = require("./sanctuary-scheduler-origin");
+const telegram_1 = require("../../senses/telegram");
+const sync_health_1 = require("../sync-health");
+const sync_1 = require("../sync");
+const sync_lock_1 = require("../sync-lock");
 function parseSocketPath(argv) {
     const socketIndex = argv.indexOf("--socket");
     if (socketIndex >= 0) {
@@ -60,25 +99,231 @@ const socketPath = parseSocketPath(process.argv);
 (0, runtime_logging_1.configureDaemonRuntimeLogger)("daemon");
 const entryPath = path.resolve(__dirname, "daemon-entry.js");
 const mode = (0, runtime_mode_1.detectRuntimeMode)((0, identity_1.getRepoRoot)());
+// Each agent runs on exactly one machine: manage only agents homed here
+// (see agent-home.ts), resolved against this machine's stable id.
+const daemonMachine = (0, machine_identity_1.loadOrCreateMachineIdentity)();
+const daemonMachineId = daemonMachine.machineId;
+const managedAgents = (0, agent_discovery_1.listHomeBundleAgents)({ machineId: daemonMachineId });
+const readinessAgents = (0, daemon_bootstrap_startup_1.providerReadinessAgents)(managedAgents, process.env.OURO_DAEMON_REQUIRED_AGENT);
+const sanctuaryPackageManagement = (0, sanctuary_package_management_1.resolveSanctuaryPackageManagementActivation)({ mode, argv: process.argv, managedAgents, repoRoot: (0, identity_1.getRepoRoot)(), bundlesRoot: (0, identity_1.getAgentBundlesRoot)(), runtimePackageVersion: (0, bundle_manifest_1.getPackageVersion)() });
+try {
+    (0, sanctuary_package_management_1.requireSanctuaryPackageManagementDecision)(sanctuaryPackageManagement);
+}
+catch (failure) {
+    (0, daemon_bootstrap_startup_1.failFastSanctuaryBundlePreparationStartup)({ failure, exit: (code) => process.exit(code) });
+    throw failure;
+}
 (0, runtime_1.emitNervesEvent)({
     component: "daemon",
     event: "daemon.entry_start",
     message: "starting daemon entrypoint",
     meta: { socketPath, entryPath, mode },
 });
-const managedAgents = (0, agent_discovery_1.listEnabledBundleAgents)();
+/* v8 ignore next -- dev-mode indicator: false branch (production) tested in daemon-boot-updates.test.ts @preserve */
+if (mode === "dev") {
+    const repoRoot = (0, identity_1.getRepoRoot)();
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.dev_mode_indicator",
+        message: `[dev] running from ${repoRoot}`,
+        meta: { repoRoot },
+    });
+}
+const managedPrivateRuntimes = managedAgents.map((agent) => ({
+    agent,
+    config: (0, agent_discovery_1.readPrivateRuntimeConfig)(agent),
+}));
+function currentMachineId() {
+    return (0, machine_identity_1.loadOrCreateMachineIdentity)().machineId;
+}
+function privateRuntimeCredentialBootstrapFor(agent) {
+    const machineId = currentMachineId();
+    const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
+    const machine = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent);
+    const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
+    const providerCredentialRecords = providerPool.ok
+        ? Object.values(providerPool.pool.providers).filter((record) => !!record)
+        : [];
+    const bootstrap = {
+        agentName: agent,
+        runtimeConfig: runtime.ok ? runtime.config : undefined,
+        machineRuntimeConfig: machine.ok ? machine.config : undefined,
+        machineId,
+        providerCredentialRecords: providerCredentialRecords.length > 0 ? providerCredentialRecords : undefined,
+    };
+    if (!bootstrap.runtimeConfig && !bootstrap.machineRuntimeConfig && !bootstrap.providerCredentialRecords)
+        return null;
+    return bootstrap;
+}
+function sentinelHealthStatus(receipt) {
+    if (receipt.verdict === "ready")
+        return "ok";
+    if (receipt.verdict === "watch")
+        return "warn";
+    return "critical";
+}
+async function refreshDaemonSentinel(agent, trigger, daemonHealthResults = []) {
+    const bundleRoot = path.join((0, identity_1.getAgentBundlesRoot)(), `${agent}.ouro`);
+    try {
+        const receipt = await (0, context_loss_sentinel_1.refreshContextLossSentinel)(agent, bundleRoot, { trigger, daemonHealthResults });
+        return {
+            name: `context-loss-sentinel:${agent}`,
+            status: sentinelHealthStatus(receipt),
+            message: `Sentinel ${receipt.verdict}: ${receipt.summary}`,
+        };
+    }
+    catch (error) {
+        return {
+            name: `context-loss-sentinel:${agent}`,
+            status: "critical",
+            message: `Sentinel refresh failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+function emitAwaitPrivateWakeDispatchError(options) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.await_private_wake_dispatch_error",
+        message: "failed to dispatch await private-runtime wake",
+        meta: {
+            agent: options.agent,
+            awaitName: options.awaitName,
+            triggerSource: options.triggerSource,
+            socketPath: options.socketPath,
+            error: options.error instanceof Error ? options.error.message : String(options.error),
+        },
+    });
+}
+function emitPulsePrivateWakeDispatchError(options) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.pulse_private_wake_dispatch_error",
+        message: "failed to dispatch pulse private-runtime wake",
+        meta: {
+            agent: options.request.agent,
+            triggerSource: options.request.triggerSource,
+            idempotencyKey: options.request.idempotencyKey,
+            originRefs: options.request.originRefs,
+            socketPath: options.socketPath,
+            error: options.error instanceof Error ? options.error.message : String(options.error),
+        },
+    });
+}
+function emitHabitPrivateWakeDispatchError(options) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.habit_private_wake_dispatch_error",
+        message: "failed to dispatch habit private-runtime wake",
+        meta: {
+            agent: options.agent,
+            habitName: options.habitName,
+            trigger: options.trigger,
+            triggerSource: options.triggerSource,
+            socketPath: options.socketPath,
+            error: options.error instanceof Error ? options.error.message : String(options.error),
+        },
+    });
+}
 const processManager = new process_manager_1.DaemonProcessManager({
-    agents: managedAgents.map((agent) => ({
+    agents: managedPrivateRuntimes.map(({ agent, config }) => ({
         name: agent,
         entry: "heart/agent-entry.js",
-        channel: "inner-dialog",
-        autoStart: true,
+        channel: "private-runtime",
+        autoStart: config.autoStart,
+        getRuntimeCredentialBootstrap: () => privateRuntimeCredentialBootstrapFor(agent),
     })),
     existsSync: fs.existsSync,
+    /* v8 ignore next 4 -- wiring: delegates to checkAgentConfig which has full unit tests @preserve */
+    configCheck: async (agent) => {
+        const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+        return (0, agent_config_check_1.checkAgentConfig)(agent, bundlesRoot);
+    },
+    /* v8 ignore start -- pulse flush wiring: integration code; flushPulse itself has full unit tests @preserve */
+    onSnapshotChange: () => {
+        (0, pulse_1.flushPulse)({
+            snapshots: processManager.listAgentSnapshots(),
+            bundlesRoot: (0, identity_1.getAgentBundlesRoot)(),
+            daemonVersion: (0, bundle_manifest_1.getPackageVersion)(),
+            now: new Date(),
+            // Default I/O wired into pulse.ts (writePulse, readPulse, etc.).
+            // Pulse alerts queue canonical private-runtime wakes so policy decides
+            // whether a model-backed notification turn may run.
+            firePrivateWake: (request) => {
+                (0, socket_client_1.sendDaemonCommand)(socketPath, {
+                    kind: "private.wake",
+                    ...request,
+                }).catch((error) => {
+                    emitPulsePrivateWakeDispatchError({
+                        request,
+                        socketPath,
+                        error,
+                    });
+                });
+            },
+        });
+    },
+    /* v8 ignore stop */
 });
-const scheduler = new task_scheduler_1.TaskDrivenScheduler({
+const taskScheduler = new task_scheduler_1.TaskDrivenScheduler({
     agents: [...managedAgents],
 });
+const habitSchedulers = [];
+const awaitSchedulers = [];
+const containerRuntimePolicy = (0, container_runtime_1.readContainerRuntimePolicy)();
+const supercronicSupervisor = containerRuntimePolicy?.scheduler === "supercronic"
+    ? new supercronic_supervisor_1.SupercronicSupervisor({
+        binaryPath: "/usr/local/bin/supercronic",
+        crontabPath: path.join((0, identity_1.getAgentBundlesRoot)(), "..", ".ouro-cli", "scheduler", "sanctuary.crontab"),
+        onFatal: (error) => {
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "daemon", event: "daemon.supercronic_state", message: "Supercronic restart budget exhausted", meta: { error: error.message } });
+            process.exit(1);
+        },
+    })
+    : null;
+function habitCronLabelOwner(agent) {
+    const agentPrefix = `bot.ouro.${agent}.`;
+    const awaitPrefix = `${agentPrefix}await.`;
+    return (label) => label.startsWith(agentPrefix) && !label.startsWith(awaitPrefix);
+}
+function awaitCronLabelOwner(agent) {
+    const awaitPrefix = `bot.ouro.${agent}.await.`;
+    return (label) => label.startsWith(awaitPrefix);
+}
+function verifyOsCron(command) {
+    return (0, child_process_1.execSync)(command, { encoding: "utf-8" });
+}
+const scheduler = {
+    listJobs: () => [
+        ...taskScheduler.listJobs(),
+        ...habitSchedulers.flatMap((habitScheduler) => habitScheduler.listJobs()),
+    ],
+    listDegradedJobs: () => [
+        ...habitSchedulers.flatMap((habitScheduler) => habitScheduler.getDegradedHabits().map((habit) => ({
+            id: `habit:${habit.name}`,
+            reason: habit.reason,
+        }))),
+        ...awaitSchedulers.flatMap((awaitScheduler) => awaitScheduler.getDegradedAwaits().map((awaitItem) => ({
+            id: `await:${awaitItem.name}`,
+            reason: awaitItem.reason,
+        }))),
+    ],
+    triggerJob: (jobId) => taskScheduler.triggerJob(jobId),
+    triggerHabitJob: async (jobId) => {
+        for (const habitScheduler of habitSchedulers) {
+            const result = await habitScheduler.triggerJob(jobId, "cron");
+            if (result.ok)
+                return result;
+        }
+        return { ok: false, message: `unknown habit job: ${jobId}` };
+    },
+    start: () => taskScheduler.start(),
+    stop: () => taskScheduler.stop(),
+    reconcile: () => taskScheduler.reconcile(),
+    recordTaskRun: (agent, taskId) => taskScheduler.recordTaskRun(agent, taskId),
+};
 const router = new message_router_1.FileMessageRouter();
 const senseManager = new sense_manager_1.DaemonSenseManager({
     agents: [...managedAgents],
@@ -86,6 +331,39 @@ const senseManager = new sense_manager_1.DaemonSenseManager({
 const healthMonitor = new health_monitor_1.HealthMonitor({
     processManager,
     scheduler,
+    sentinelChecker: async (resultsSoFar) => {
+        const sentinels = await Promise.all(managedAgents.map((agent) => refreshDaemonSentinel(agent, "daemon_health", resultsSoFar)));
+        // Each agent runs on one machine: stop any agent whose lease (on disk or
+        // upstream) now names another machine. See agent-home.ts.
+        const homes = await (0, agent_home_1.checkAgentHomes)({
+            managedAgents,
+            machineId: daemonMachineId,
+            hostnameAliases: daemonMachine.hostnameAliases,
+            bundlesRoot: (0, identity_1.getAgentBundlesRoot)(),
+        });
+        for (const agent of homes.displaced) {
+            void processManager.displaceAgent(agent, `${agent} is homed on another machine`).catch(() => undefined);
+        }
+        return [...sentinels, homes.health];
+    },
+    bundleSyncChecker: () => [(0, sync_health_1.checkBundleSyncHealth)((0, agent_discovery_1.listBundleSyncRows)({ bundlesRoot: (0, identity_1.getAgentBundlesRoot)() }).filter((row) => managedAgents.includes(row.agent)))],
+    senseProbeProvider: () => [
+        ...senseManager.listHealthProbes(),
+        ...managedAgents.map((agent) => (0, mcp_canary_1.createMcpStatusCanaryProbe)({
+            agent,
+            socketPath,
+            command: process.execPath,
+            commandArgs: [
+                path.join(__dirname, "ouro-bot-entry.js"),
+                "mcp-serve",
+                "--agent",
+                agent,
+                "--socket",
+                socketPath,
+            ],
+            ignoreOverviewHealth: true,
+        })),
+    ],
     alertSink: (message) => {
         (0, runtime_1.emitNervesEvent)({
             level: "error",
@@ -95,7 +373,51 @@ const healthMonitor = new health_monitor_1.HealthMonitor({
             meta: { message },
         });
     },
+    /* v8 ignore next 3 -- wiring: delegates to processManager.restartAgent which has full unit tests @preserve */
+    onCriticalAgent: (agentName) => {
+        try {
+            processManager.restartAgent(agentName);
+        }
+        catch { /* recovery is best-effort */ }
+    },
+    /* v8 ignore next 3 -- wiring: delegates to senseManager.restartSense which has focused tests @preserve */
+    onCriticalSense: (managedName) => {
+        try {
+            void senseManager.restartSense(managedName);
+        }
+        catch { /* recovery is best-effort */ }
+    },
 });
+let entryRuntimeStopPromise = null;
+let stopCommandExitScheduled = false;
+function stopEntryRuntime() {
+    if (entryRuntimeStopPromise)
+        return entryRuntimeStopPromise;
+    entryRuntimeStopPromise = (async () => {
+        stopHealthHeartbeat();
+        for (const s of habitSchedulers) {
+            s.stopWatching();
+            s.stop();
+        }
+        for (const s of awaitSchedulers) {
+            s.stopWatching();
+            s.stop();
+        }
+        await supercronicSupervisor?.stop();
+        healthMonitor.stopPeriodicChecks();
+    })();
+    return entryRuntimeStopPromise;
+}
+function scheduleCleanProcessExitAfterStopCommand() {
+    if (stopCommandExitScheduled)
+        return;
+    stopCommandExitScheduled = true;
+    // Account for the explicit daemon.stop path so the process exit catch-all
+    // does not mislabel an operator-requested stop as an unexpected clean exit.
+    _tombstoneWritten = true;
+    writeStopCommandHealthState();
+    setTimeout(() => process.exit(0), 100);
+}
 const daemon = new daemon_1.OuroDaemon({
     socketPath,
     processManager,
@@ -103,21 +425,663 @@ const daemon = new daemon_1.OuroDaemon({
     scheduler,
     healthMonitor,
     router,
+    schedulerFireVerifier: (command) => {
+        if (!supercronicSupervisor)
+            throw new Error("Supercronic scheduler is unavailable");
+        const marker = (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)("sanctuary");
+        return (0, sanctuary_scheduler_origin_1.verifySanctuarySchedulerFireCommand)(command, {
+            childPid: supercronicSupervisor.authenticatedSnapshot("habit:sanctuary").childPid,
+            identityKey: (0, telegram_1.readOrCreateTelegramIdentityKey)(path.join((0, identity_1.getAgentBundlesRoot)(), "sanctuary.ouro")),
+            scenarioHandleDigest: marker?.label === "unit-16f-cron-fingerprint" ? marker.scenarioHandleDigest : null, now: () => new Date(),
+            readFile: (target) => fs.readFileSync(target, "utf8"), readLink: (target) => fs.readlinkSync(target),
+        });
+    },
+    schedulerFireConsumer: (origin) => (0, sanctuary_scheduler_liveness_1.consumeSanctuarySchedulerFire)(path.join((0, identity_1.getAgentBundlesRoot)(), "sanctuary.ouro"), origin),
+    nativeHabitRunner: async ({ agent, habitName, trigger, occurrenceId, runnerId, schedulerOrigin }) => {
+        if (agent !== "sanctuary" || habitName !== "sanctuary-health")
+            return null;
+        const marker = (0, sanctuary_acceptance_marker_1.readSanctuaryAcceptanceMarker)(agent);
+        const schedulerScenario = marker?.label === "unit-16f-cron-fingerprint" ? marker : null;
+        const agentRoot = path.join((0, identity_1.getAgentBundlesRoot)(), `${agent}.ouro`);
+        const before = schedulerScenario ? (0, sanctuary_scheduler_liveness_1.readSanctuaryHealthCursor)(agentRoot) : null;
+        let providerInvocationCount = 0;
+        let privateTurnCount = 0;
+        const result = await (0, sanctuary_health_runner_1.runSanctuaryHealthHabit)(agent, {
+            submitEvidence: async (input) => {
+                const response = await daemon.handleCommand({ kind: "external.event.submit", ...input });
+                if (!response.ok)
+                    throw new Error(response.error ?? "Sanctuary health evidence submission failed");
+                return response.data.event;
+            },
+            ...(schedulerScenario ? {
+                acceptanceMetrics: {
+                    onPrivateTurnStart: () => { privateTurnCount += 1; },
+                    onProviderInvocation: () => { providerInvocationCount += 1; },
+                },
+            } : {}),
+        });
+        if (schedulerScenario) {
+            if (!supercronicSupervisor || !before || !occurrenceId || !schedulerOrigin)
+                throw new Error("Sanctuary scheduler liveness supervisor provenance is unavailable");
+            (0, sanctuary_scheduler_liveness_1.recordSanctuarySchedulerLivenessReceipt)({
+                agentRoot,
+                trigger,
+                occurrenceId,
+                runnerId,
+                scenario: schedulerScenario,
+                supervisor: supercronicSupervisor.authenticatedSnapshot("habit:sanctuary"),
+                before,
+                providerInvocationCount,
+                privateTurnCount,
+                schedulerOrigin,
+                identityKey: (0, telegram_1.readOrCreateTelegramIdentityKey)(agentRoot),
+            });
+        }
+        return result;
+    },
+    nativeHabitMatch: (agent, habitName) => agent === "sanctuary" && habitName === "sanctuary-health",
+    mode,
+    onStopCommandComplete: async () => {
+        await stopEntryRuntime();
+        scheduleCleanProcessExitAfterStopCommand();
+    },
 });
-void daemon.start().catch(async () => {
+const daemonStartedAt = new Date().toISOString();
+const degradedComponents = [];
+function buildDaemonHealthState() {
+    const snapshots = processManager.listAgentSnapshots();
+    const agentDegradedComponents = snapshots
+        .filter((snapshot) => snapshot.status !== "running" && snapshot.autoStart !== false)
+        .map((snapshot) => {
+        const reasonParts = [
+            snapshot.errorReason ?? `${snapshot.channel} is ${snapshot.status}`,
+            snapshot.fixHint ? `Fix: ${snapshot.fixHint}` : null,
+        ].filter((part) => part !== null);
+        return {
+            component: `agent:${snapshot.name}`,
+            reason: reasonParts.join(" "),
+            since: snapshot.lastCrashAt ?? daemonStartedAt,
+        };
+    });
+    // Preserved for backwards-compatible inspection: callers (status
+    // command, mailbox surface, etc.) may still read this combined list
+    // for per-component reasons. The rollup status field above is what
+    // changed meaning — the array is still the union of bootstrap +
+    // agent-derived degradation entries.
+    const degraded = [
+        ...degradedComponents.map((entry) => ({ ...entry })),
+        ...agentDegradedComponents,
+    ];
+    // Layer 1 rollup: project per-agent snapshots into the minimal
+    // AgentRollupInput shape and let computeDaemonRollup decide. The
+    // input is "every enabled agent" — managedAgents was filtered via
+    // listHomeBundleAgents at module init, and snapshots only covers
+    // agents the process manager was told to manage, so by construction
+    // these entries are all enabled. The rollup function is a pure
+    // declarative function on the data we hand it.
+    //
+    // Note: safe-mode is wired as `false` here. Existing crash-loop
+    // detection (safe-mode.ts) already runs at the daemon-up boot path
+    // (cli-exec.ts), not from inside the daemon process itself. Once
+    // the daemon is up and reaching this rollup, safe mode no longer
+    // applies — the daemon is by definition past the crash-loop gate.
+    // If a future PR moves safe-mode signal into the running daemon,
+    // wire it through this third argument.
+    const rollupStatus = (0, daemon_rollup_1.computeDaemonRollup)({
+        enabledAgents: snapshots.map((snapshot) => ({
+            name: snapshot.name,
+            // A parked non-autostart worker is intentionally not serving; it should
+            // remain visible in worker status but should not degrade daemon health.
+            status: snapshot.autoStart === false ? "running" : snapshot.status,
+        })),
+        bootstrapDegraded: degradedComponents,
+        safeMode: false,
+    });
+    return {
+        status: rollupStatus,
+        mode,
+        pid: process.pid,
+        startedAt: daemonStartedAt,
+        uptimeSeconds: Math.floor(process.uptime()),
+        safeMode: null,
+        degraded,
+        agents: Object.fromEntries(snapshots.map((snapshot) => [
+            snapshot.name,
+            {
+                status: snapshot.status,
+                pid: snapshot.pid,
+                crashes: snapshot.restartCount,
+            },
+        ])),
+        habits: {},
+    };
+}
+function recordRecoverableBootstrapFailure(options) {
+    const errorMessage = options.error instanceof Error ? options.error.message : String(options.error);
+    const existing = degradedComponents.find((entry) => entry.component === options.component);
+    const reason = `${errorMessage}. ${options.guidance}`;
+    if (existing) {
+        existing.reason = reason;
+    }
+    else {
+        degradedComponents.push({
+            component: options.component,
+            reason,
+            since: new Date().toISOString(),
+        });
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "daemon",
+        event: "daemon.bootstrap_degraded",
+        message: "recoverable daemon bootstrap failure; daemon remains available in degraded mode",
+        meta: {
+            agent: options.agent,
+            component: options.component,
+            habitsDir: options.habitsDir,
+            error: errorMessage,
+            guidance: options.guidance,
+        },
+    });
+}
+function emitHabitSetupError(agent, error) {
+    const normalized = error instanceof Error ? error : new Error(String(error));
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.habit_setup_error",
+        message: `habit setup failed for agent ${agent}`,
+        meta: { agent, error: normalized.message },
+    });
+}
+function emitAwaitSetupError(agent, error) {
+    const normalized = error instanceof Error ? error : new Error(String(error));
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.await_setup_error",
+        message: `await setup failed for agent ${agent}`,
+        meta: { agent, error: normalized.message },
+    });
+}
+/* v8 ignore start — daemon health writer wiring, tested via daemon-health.test.ts @preserve */
+const healthWriter = new daemon_health_1.DaemonHealthWriter((0, daemon_health_1.getDefaultHealthPath)());
+const healthSink = (0, daemon_health_1.createHealthNervesSink)(healthWriter, buildDaemonHealthState);
+(0, index_1.registerGlobalLogSink)(healthSink);
+const stopHealthHeartbeat = (0, daemon_health_1.startDaemonHealthHeartbeat)(healthWriter, buildDaemonHealthState);
+/* v8 ignore stop */
+function writeStopCommandHealthState() {
+    try {
+        healthWriter.writeHealth({
+            ...buildDaemonHealthState(),
+            status: "down",
+            uptimeSeconds: Math.floor(process.uptime()),
+        });
+    }
+    catch {
+        // Health writes are best-effort during shutdown.
+    }
+}
+async function prepareProviderRuntime() {
+    const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+    const readiness = await Promise.all(readinessAgents.map(async (agent) => {
+        try {
+            await (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agent, { preserveCachedOnFailure: true });
+            const result = await (0, agent_config_check_1.checkAgentConfigWithProviderHealth)(agent, bundlesRoot);
+            if (result.ok)
+                return null;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.provider_readiness_unavailable",
+                message: "fresh provider readiness was unavailable before daemon startup",
+                meta: { agent },
+            });
+            return result.issue ?? {
+                summary: `${agent}: provider runtime unavailable`,
+                actions: [{ actor: "agent-runnable", command: "ouro doctor" }],
+            };
+        }
+        catch {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "daemon",
+                event: "daemon.provider_readiness_unavailable",
+                message: "fresh provider readiness check failed before daemon startup",
+                meta: { agent },
+            });
+            throw new Error("provider runtime preparation failed");
+        }
+    }));
+    const failures = readiness.filter((entry) => entry !== null);
+    if (failures.length > 0) {
+        throw (0, daemon_bootstrap_startup_1.createProviderReadinessPreparationFailure)(failures);
+    }
+}
+function scheduleStartupSentinelAfterProviderPreload(agent, preload) {
+    void preload.then(async () => {
+        const result = await refreshDaemonSentinel(agent, "daemon_startup");
+        if (result.status === "critical") {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "daemon",
+                event: "daemon.startup_sentinel_error",
+                message: "startup Sentinel refresh reported critical after provider preload",
+                meta: {
+                    agent,
+                    error: result.message,
+                },
+            });
+        }
+        /* v8 ignore start -- refreshDaemonSentinel handles ordinary Sentinel failures; this is a promise-chain guard. @preserve */
+    }).catch((error) => {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.startup_sentinel_error",
+            message: "startup Sentinel refresh failed after provider preload",
+            meta: {
+                agent,
+                error: error instanceof Error ? error.message : String(error),
+            },
+        });
+    });
+    /* v8 ignore stop */
+}
+/* v8 ignore start -- habit wiring: lambdas delegate to processManager/fs; tested via HabitScheduler unit tests @preserve */
+void (0, daemon_bootstrap_startup_1.startDaemonAfterContainerCredentialBootstrap)({
+    preflight: () => { (0, sanctuary_package_management_1.requireSanctuaryPackageManagementDecision)(sanctuaryPackageManagement); },
+    loadBootstrap: () => (0, container_credential_bootstrap_1.loadContainerCredentialBootstrap)(managedAgents),
+    prepareManagedBundle: () => { (0, sanctuary_package_management_1.prepareSanctuaryPackageManagedBundle)(sanctuaryPackageManagement); },
+    prepareDaemon: prepareProviderRuntime,
+    startDaemon: () => daemon.start(),
+    markStartupFailure: () => { _tombstoneWritten = true; },
+    exit: (code) => process.exit(code),
+}).then(async (started) => {
+    if (!started)
+        return;
+    supercronicSupervisor?.start();
+    const providerPreload = Promise.resolve();
+    const bundlesRoot = (0, identity_1.getAgentBundlesRoot)();
+    // The daemon is PID 1 on every container boot, so a lock an earlier boot left looks like ours.
+    // Clearing a lock never stops the boot; an unreadable one is judged again by the next sync.
+    try {
+        for (const row of (0, agent_discovery_1.listBundleSyncRows)({ bundlesRoot })) {
+            if (!row.enabled || !row.gitInitialized)
+                continue;
+            try {
+                (0, sync_lock_1.clearOwnStaleSyncLock)(path.join(bundlesRoot, `${row.agent}.ouro`));
+            }
+            catch {
+                // Next bundle.
+            }
+        }
+    }
+    catch {
+        // The bundle list could not be read.
+    }
+    const ouroPath = supercronicSupervisor
+        ? "/usr/local/bin/node /opt/ouro/dist/heart/daemon/ouro-entry.js"
+        : (0, os_cron_deps_1.resolveOuroBinaryPath)();
+    const osCronDeps = (0, os_cron_deps_1.createRealOsCronDeps)();
+    for (const agent of managedAgents) {
+        scheduleStartupSentinelAfterProviderPreload(agent, providerPreload);
+        const bundleRoot = path.join(bundlesRoot, `${agent}.ouro`);
+        const habitsDir = path.join(bundleRoot, "habits");
+        const degradedComponent = `habits:${agent}`;
+        try {
+            // Migrate old tasks/habits/ to habits/ at bundle root
+            (0, habit_migration_1.migrateHabitsFromTaskSystem)(bundleRoot);
+            const osCronManager = supercronicSupervisor
+                ? supercronicSupervisor.namespace(`habit:${agent}`)
+                : new os_cron_1.LaunchdCronManager(osCronDeps, { ownsLabel: habitCronLabelOwner(agent) });
+            const scheduler = new habit_scheduler_1.HabitScheduler({
+                agent,
+                habitsDir,
+                osCronManager,
+                onHabitFire: (habitName, trigger, context) => {
+                    if ((0, habit_policy_1.isRsvpHabitName)(habitName) || (agent === "sanctuary" && habitName === "sanctuary-health")) {
+                        (0, socket_client_1.sendDaemonCommand)(socketPath, {
+                            kind: "habit.poke",
+                            agent,
+                            habitName,
+                            trigger,
+                            ...(context?.occurrenceId ? { occurrenceId: context.occurrenceId } : {}),
+                        }).catch((error) => {
+                            emitHabitPrivateWakeDispatchError({
+                                agent,
+                                habitName,
+                                trigger,
+                                triggerSource: `habit-${trigger}`,
+                                socketPath,
+                                error,
+                            });
+                        });
+                        return;
+                    }
+                    const command = (0, habit_private_wake_1.buildHabitPrivateWakeCommand)({
+                        agent,
+                        habitName,
+                        trigger,
+                        sourceRef: { kind: "daemon-entry", id: "habit-scheduler" },
+                        occurrenceId: context?.occurrenceId,
+                    });
+                    (0, socket_client_1.sendDaemonCommand)(socketPath, command).catch((error) => {
+                        emitHabitPrivateWakeDispatchError({
+                            agent,
+                            habitName,
+                            trigger,
+                            triggerSource: command.triggerSource,
+                            socketPath,
+                            error,
+                        });
+                    });
+                },
+                deps: {
+                    readdir: (dir) => fs.readdirSync(dir),
+                    readFile: (p, enc) => fs.readFileSync(p, enc),
+                    writeFile: (p, c, enc) => fs.writeFileSync(p, c, enc),
+                    existsSync: (p) => fs.existsSync(p),
+                    now: () => Date.now(),
+                    ouroPath,
+                    watch: (dir, cb) => fs.watch(dir, cb),
+                },
+                execForVerify: supercronicSupervisor ? () => supercronicSupervisor.verificationOutput() : verifyOsCron,
+                verifyJobs: supercronicSupervisor ? (jobs) => supercronicSupervisor.verifyNamespace(`habit:${agent}`, jobs) : undefined,
+                platform: supercronicSupervisor ? "linux" : undefined,
+            });
+            try {
+                scheduler.start();
+                scheduler.startPeriodicReconciliation();
+                scheduler.watchForChanges();
+                habitSchedulers.push(scheduler);
+            }
+            catch (error) {
+                try {
+                    scheduler.stopWatching();
+                    scheduler.stop();
+                }
+                catch {
+                    // Cleanup is best-effort for partially initialized schedulers.
+                }
+                emitHabitSetupError(agent, error);
+                recordRecoverableBootstrapFailure({
+                    agent,
+                    component: degradedComponent,
+                    habitsDir,
+                    error,
+                    guidance: `fix ${agent} habits or cron setup and rerun ouro up to restore habit automation`,
+                });
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err : new Error(String(err));
+            emitHabitSetupError(agent, error);
+            recordRecoverableBootstrapFailure({
+                agent,
+                component: degradedComponent,
+                habitsDir,
+                error,
+                guidance: `fix ${agent} habits or cron setup and rerun ouro up to restore habit automation`,
+            });
+        }
+        // Parallel await-condition scheduler. Uses its own OS cron manager so
+        // habits and awaits don't share label namespace and stale removals can't
+        // collide.
+        const awaitsDir = path.join(bundleRoot, "awaiting");
+        const awaitDegradedComponent = `awaits:${agent}`;
+        try {
+            const awaitOsCronManager = supercronicSupervisor
+                ? supercronicSupervisor.namespace(`await:${agent}`)
+                : new os_cron_1.LaunchdCronManager(osCronDeps, { ownsLabel: awaitCronLabelOwner(agent) });
+            const awaitScheduler = new await_scheduler_1.AwaitScheduler({
+                agent,
+                awaitsDir,
+                osCronManager: awaitOsCronManager,
+                onAwaitFire: (awaitName) => {
+                    (0, socket_client_1.sendDaemonCommand)(socketPath, (0, await_private_wake_1.buildAwaitPrivateWakeCommand)({
+                        agent,
+                        awaitName,
+                        triggerSource: "await-scheduler",
+                    })).then(() => {
+                        // Record the dispatch here so the cadence advances whatever the woken
+                        // turn does. Without this the only writer of `last_checked` is the
+                        // agent calling `resolve_await`, so a turn that does anything else
+                        // leaves the await permanently "never checked" and it re-fires on
+                        // every reconciliation. Recorded only on a successful wake: a failed
+                        // dispatch is not a check.
+                        (0, await_runtime_state_1.recordAwaitDispatch)(bundleRoot, awaitName, new Date().toISOString());
+                    }).catch((error) => {
+                        emitAwaitPrivateWakeDispatchError({
+                            agent,
+                            awaitName,
+                            triggerSource: "await-scheduler",
+                            socketPath,
+                            error,
+                        });
+                    });
+                },
+                onAwaitExpire: (awaitName) => {
+                    void (0, await_expiry_1.archiveAndAlertExpiredAwait)({
+                        agentRoot: bundleRoot,
+                        agentName: agent,
+                        awaitName,
+                        deliveryDeps: {
+                            agentName: agent,
+                            deliverers: {
+                                a2a: (0, a2a_await_delivery_1.createA2AAwaitOwnerDeliverer)(agent),
+                                telegram: async (request) => {
+                                    const { sendTelegramAwaitFollowUp } = await Promise.resolve().then(() => __importStar(require("../../senses/telegram")));
+                                    return sendTelegramAwaitFollowUp(agent, request);
+                                },
+                            },
+                            queuePending: () => {
+                                // Best-effort: queue private-runtime wake so the agent processes the alert path.
+                                (0, socket_client_1.sendDaemonCommand)(socketPath, (0, await_private_wake_1.buildAwaitPrivateWakeCommand)({
+                                    agent,
+                                    awaitName,
+                                    triggerSource: "await-expiry",
+                                })).catch((error) => {
+                                    emitAwaitPrivateWakeDispatchError({
+                                        agent,
+                                        awaitName,
+                                        triggerSource: "await-expiry",
+                                        socketPath,
+                                        error,
+                                    });
+                                });
+                            },
+                        },
+                    }).catch((err) => {
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "error",
+                            component: "daemon",
+                            event: "daemon.await_expire_error",
+                            message: "await expiry handler threw",
+                            meta: { agent, awaitName, error: err instanceof Error ? err.message : String(err) },
+                        });
+                    });
+                },
+                deps: {
+                    readdir: (dir) => fs.readdirSync(dir),
+                    readFile: (p, enc) => fs.readFileSync(p, enc),
+                    existsSync: (p) => fs.existsSync(p),
+                    mkdir: (dir) => { fs.mkdirSync(dir, { recursive: true }); },
+                    now: () => Date.now(),
+                    ouroPath,
+                    watch: (dir, cb) => fs.watch(dir, cb),
+                },
+                execForVerify: supercronicSupervisor ? () => supercronicSupervisor.verificationOutput() : verifyOsCron,
+                verifyJobs: supercronicSupervisor ? (jobs) => supercronicSupervisor.verifyNamespace(`await:${agent}`, jobs) : undefined,
+                platform: supercronicSupervisor ? "linux" : undefined,
+            });
+            try {
+                awaitScheduler.start();
+                awaitScheduler.startPeriodicReconciliation();
+                awaitScheduler.watchForChanges();
+                awaitSchedulers.push(awaitScheduler);
+            }
+            catch (error) {
+                try {
+                    awaitScheduler.stopWatching();
+                    awaitScheduler.stop();
+                }
+                catch {
+                    // best-effort cleanup
+                }
+                emitAwaitSetupError(agent, error);
+                recordRecoverableBootstrapFailure({
+                    agent,
+                    component: awaitDegradedComponent,
+                    habitsDir: awaitsDir,
+                    error,
+                    guidance: `fix ${agent} awaits or cron setup and rerun ouro up to restore await automation`,
+                });
+            }
+        }
+        catch (err) {
+            const error = err instanceof Error ? err : new Error(String(err));
+            emitAwaitSetupError(agent, error);
+            recordRecoverableBootstrapFailure({
+                agent,
+                component: awaitDegradedComponent,
+                habitsDir: awaitsDir,
+                error,
+                guidance: `fix ${agent} awaits or cron setup and rerun ouro up to restore await automation`,
+            });
+        }
+    }
+    healthMonitor.startPeriodicChecks(60_000);
+    /* v8 ignore start -- startup failure + signal handlers: call process.exit, untestable in vitest @preserve */
+}).catch(async (err) => {
+    const error = err instanceof Error ? err : new Error(String(err));
+    _tombstoneWritten = true;
+    (0, daemon_tombstone_1.writeDaemonTombstone)("startupFailure", error);
     (0, runtime_1.emitNervesEvent)({
         level: "error",
         component: "daemon",
         event: "daemon.entry_error",
         message: "daemon entrypoint failed",
-        meta: {},
+        meta: { error: error.message },
     });
-    await daemon.stop();
-    process.exit(1);
+    const forcedExit = setTimeout(() => process.exit(1), 5_000);
+    forcedExit.unref();
+    try {
+        await daemon.stop();
+    }
+    finally {
+        clearTimeout(forcedExit);
+        process.exit(1);
+    }
 });
 process.on("SIGINT", () => {
-    void daemon.stop().then(() => process.exit(0));
+    // ALWAYS write a tombstone, even on signal-driven shutdown. The previous
+    // behavior was to set _gracefulShutdown=true and skip the tombstone, which
+    // meant ANY external SIGINT/SIGTERM (launchd policy, OOM killer, manual
+    // kill, killOrphanProcesses from a sibling daemon) silently disappeared
+    // from the death log. The user lost weeks of visibility into why their
+    // daemon kept dying. Tombstones are informational — having a "sigint"
+    // tombstone is strictly better than silence.
+    _tombstoneWritten = true;
+    (0, sync_1.abortInFlightSync)();
+    (0, daemon_tombstone_1.writeDaemonTombstone)("sigint", new Error("daemon received SIGINT"));
+    const forcedExit = setTimeout(() => process.exit(1), 12_000);
+    forcedExit.unref();
+    void stopEntryRuntime().then(() => daemon.stop()).then(() => {
+        clearTimeout(forcedExit);
+        process.exit(0);
+    }, () => {
+        clearTimeout(forcedExit);
+        process.exit(1);
+    });
 });
 process.on("SIGTERM", () => {
-    void daemon.stop().then(() => process.exit(0));
+    _tombstoneWritten = true;
+    // Kill sync's git process groups and release the bundle locks before anything slower.
+    (0, sync_1.abortInFlightSync)();
+    (0, daemon_tombstone_1.writeDaemonTombstone)("sigterm", new Error("daemon received SIGTERM"));
+    const forcedExit = setTimeout(() => process.exit(1), 12_000);
+    forcedExit.unref();
+    void stopEntryRuntime().then(() => daemon.stop()).then(() => {
+        clearTimeout(forcedExit);
+        process.exit(0);
+    }, () => {
+        clearTimeout(forcedExit);
+        process.exit(1);
+    });
+});
+/* v8 ignore stop */
+// Suppress EPIPE on stdout/stderr — normal when detached daemon's parent exits
+/* v8 ignore start -- EPIPE suppression: only fires when parent process exits @preserve */
+process.stdout?.on?.("error", () => { });
+process.stderr?.on?.("error", () => { });
+/* v8 ignore stop */
+/* v8 ignore start -- global exception handlers: genuinely untestable in vitest; exercised by real daemon crashes @preserve */
+let _uncaughtCount = 0;
+let _tombstoneWritten = false;
+let _lastKnownCause = null;
+const CIRCUIT_BREAKER_WINDOW_MS = 60_000;
+const CIRCUIT_BREAKER_MAX = 10;
+process.on("uncaughtException", (error) => {
+    // EPIPE is normal for detached daemon processes — parent closed the pipe
+    if (error.code === "EPIPE")
+        return;
+    _uncaughtCount++;
+    _lastKnownCause = error;
+    setTimeout(() => { _uncaughtCount--; }, CIRCUIT_BREAKER_WINDOW_MS).unref();
+    _tombstoneWritten = true;
+    (0, daemon_tombstone_1.writeDaemonTombstone)("uncaughtException", error);
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.uncaught_exception",
+        message: "uncaught exception in daemon process (continuing)",
+        meta: { error: error.message, stack: error.stack ?? null, uncaughtCount: _uncaughtCount },
+    });
+    // Circuit breaker: if too many exceptions in a short window, the process
+    // is in a bad state — exit so launchd/self-spawn can restart fresh.
+    if (_uncaughtCount >= CIRCUIT_BREAKER_MAX) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "daemon",
+            event: "daemon.circuit_breaker_exit",
+            message: `daemon exiting: ${_uncaughtCount} uncaught exceptions in ${CIRCUIT_BREAKER_WINDOW_MS / 1000}s`,
+            meta: { uncaughtCount: _uncaughtCount },
+        });
+        const forcedExit = setTimeout(() => process.exit(1), 5_000);
+        forcedExit.unref();
+        void daemon.stop().finally(() => {
+            clearTimeout(forcedExit);
+            process.exit(1);
+        });
+    }
+});
+process.on("unhandledRejection", (reason) => {
+    const error = reason instanceof Error ? reason : new Error(String(reason));
+    _lastKnownCause = error;
+    _tombstoneWritten = true;
+    (0, daemon_tombstone_1.writeDaemonTombstone)("unhandledRejection", error);
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "daemon",
+        event: "daemon.unhandled_rejection",
+        message: "unhandled promise rejection in daemon process",
+        meta: { reason: error.message, stack: error.stack ?? null },
+    });
+});
+// Catch-all: write tombstone on any exit where we didn't already record the cause.
+// process.on('exit') is synchronous-only — writeDaemonTombstone uses writeFileSync, so it works.
+//
+// Previously this skipped writing if `_gracefulShutdown` was true, which made
+// SIGINT/SIGTERM-driven exits invisible in the death log. The signal handlers
+// above now always write their own tombstone before exiting, so this catch-all
+// only runs for exits the signal handlers didn't reach (e.g. process.exit
+// called from somewhere unexpected).
+process.on("exit", (code) => {
+    if (_tombstoneWritten)
+        return;
+    const reason = code === 0 ? "unexpectedCleanExit" : "unexpectedExit";
+    const error = _lastKnownCause ?? new Error(`daemon exited with code ${code} (no specific cause captured)`);
+    (0, daemon_tombstone_1.writeDaemonTombstone)(reason, error);
 });
+/* v8 ignore stop */