@pellux/goodvibes-tui 1.23.0 → 1.24.1

package/src/runtime/remote-execution-composition.ts

@@ -0,0 +1,62 @@
+/**
+ * remote-execution-composition.ts — running work somewhere other than here.
+ *
+ * Four collaborators that only make sense together, so they are built together
+ * rather than as four unrelated lines in the middle of the runtime composition:
+ *
+ *   - RemoteRunnerRegistry knows which remote runners exist and how to reach
+ *     them; RemoteSupervisor drives them and is meaningless without it.
+ *
+ *   - SandboxSessionRegistry owns the sandboxes a tool call can be confined to,
+ *     and McpRegistry is the thing that confines them — an MCP server started
+ *     without the sandbox registry runs its tools directly on the host.
+ *
+ * The pairing in each case is the point: handing the supervisor a registry it
+ * did not build, or the MCP registry a sandbox runtime it does not share with
+ * the session registry, produces a runtime that looks wired and quietly is not.
+ */
+import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import {
+  RemoteRunnerRegistry,
+  RemoteSupervisor,
+  SandboxSessionRegistry,
+  type RuntimeEventBus,
+} from '@/runtime/index.ts';
+import type { AgentManager } from '@pellux/goodvibes-sdk/platform/tools';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { HookDispatcher } from '@pellux/goodvibes-sdk/platform/hooks';
+
+export interface RemoteExecutionServices {
+  readonly remoteRunnerRegistry: RemoteRunnerRegistry;
+  readonly remoteSupervisor: RemoteSupervisor;
+  readonly sandboxSessionRegistry: SandboxSessionRegistry;
+  readonly mcpRegistry: McpRegistry;
+}
+
+/**
+ * Build the remote-execution and sandboxing seam.
+ *
+ * Constructing these opens no connection and starts no server: a runner is
+ * reached when something asks for it, and an MCP server starts when a session
+ * requests it. Composing a runtime in a test therefore executes nothing.
+ */
+export function createRemoteExecutionServices(options: {
+  readonly agentManager: AgentManager;
+  readonly workingDirectory: string;
+  readonly hookDispatcher: HookDispatcher;
+  readonly configManager: ConfigManager;
+  readonly runtimeBus: RuntimeEventBus;
+}): RemoteExecutionServices {
+  const remoteRunnerRegistry = new RemoteRunnerRegistry(options.agentManager);
+  const remoteSupervisor = new RemoteSupervisor(remoteRunnerRegistry);
+  const sandboxSessionRegistry = new SandboxSessionRegistry(options.workingDirectory);
+  const mcpRegistry = new McpRegistry({
+    hookDispatcher: options.hookDispatcher,
+    sandboxSessions: sandboxSessionRegistry,
+  });
+  mcpRegistry.setRuntimeBus(options.runtimeBus);
+  // The SAME sandbox registry the session registry above owns, so a tool call
+  // confined by one is confined by the other.
+  mcpRegistry.setSandboxRuntime(options.configManager, sandboxSessionRegistry);
+  return { remoteRunnerRegistry, remoteSupervisor, sandboxSessionRegistry, mcpRegistry };
+}

package/src/runtime/services.ts

@@ -11,6 +11,7 @@ import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
 import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
 import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
 import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
+import { createDisposalScope, registerSurfaceRuntimePollers } from './disposal-wiring.ts';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import { createWebKnowledgeGapRepairer } from '@pellux/goodvibes-sdk/platform/knowledge';
@@ -19,7 +20,7 @@ import { createKnowledgeServices } from './knowledge-services.ts';
 import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/goodvibes-sdk/platform/media';
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
 import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
-import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
+import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, cancelAllAgentRuns, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
 import { FileStateCache, FileUndoManager, MemoryConsolidationScheduler, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
 import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
 import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
@@ -36,8 +37,7 @@ import type { DomainDispatch, RuntimeStore } from './store/index.ts';
 import {
   type RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService,
   IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, createShellPathService,
-  type ShellPathService, type FeatureFlagManager, createFeatureFlagManager, PolicyRuntimeState,
-  type SessionSurface,
+  type ShellPathService, type FeatureFlagManager, createFeatureFlagManager, PolicyRuntimeState, type SessionSurface,
 } from '@/runtime/index.ts';
 import { createSessionStorageServices } from './session-storage-services.ts';
 import { VoiceProviderRegistry, VoiceService, ensureBuiltinVoiceProviders } from '@pellux/goodvibes-sdk/platform/voice';
@@ -55,6 +55,8 @@ import { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import { createRemoteExecutionServices } from './remote-execution-composition.ts';
+import { createAgentGraph } from './agent-graph-composition.ts';
 import { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
@@ -67,16 +69,10 @@ import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamComm
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import type { WorkPlanStore } from '../work-plans/work-plan-store.ts';
-import { registerDaemonHandlers, type DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
-import type { HandlerContext, HandlerLogger } from '../daemon/handlers/context.ts';
-import { createDaemonCredentialStore } from '../daemon/handlers/credentials.ts';
-import { registerRouting } from '../daemon/handlers/routing/index.ts';
-import { registerInboxMethods } from '../daemon/handlers/inbox/index.ts';
-import { registerTriagedInbox } from '../daemon/handlers/triage/index.ts';
-import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
-import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
-import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
-import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
+import type { DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
+import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
+import { createClusterServices, startClusterServices, type ClusterGroupComposition } from './cluster-group-composition.ts';
+import type { ClusterCoordinator } from '@pellux/goodvibes-sdk/platform/cluster';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
 import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
 
@@ -184,6 +180,12 @@ export interface RuntimeServices {
   readonly toolLLM: ToolLLM;
   readonly distributedRuntime: DistributedRuntimeManager;
   readonly daemonHandlers: DaemonHandlerSurfaces;
+  /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
+  readonly clusterCoordinator: ClusterCoordinator;
+  /** LAN group membership: identity, keys, roster, and the `cluster` verbs. */
+  readonly clusterGroup: ClusterGroupComposition;
+  /** Start the group layer and then the election, in that order. Idempotent. */
+  readonly startCluster: () => Promise<void>;
   readonly remoteRunnerRegistry: RemoteRunnerRegistry;
   readonly remoteSupervisor: RemoteSupervisor;
   readonly sessionMemoryStore: SessionMemoryStore;
@@ -231,10 +233,20 @@ export interface RuntimeServices {
   readonly integrationHelpers: IntegrationHelperService;
   /** Re-root path-bound stores (MemoryStore, ProjectIndex) to a new working directory, called by WorkspaceSwapManager after verification; stores needing a process restart just warn-log and keep serving the old path until the daemon restarts with the new --working-dir. */
   rerootStores(newWorkingDir: string): Promise<void>;
+  /**
+   * Cancel the agent runs this graph is hosting, returning how many.
+   *
+   * Required by the SDK's RuntimePollerOwners: by dispose() time the fleet
+   * registry, orchestration engine, process registry and bus these runs report
+   * through are already down, so a run still described as "running" is orphaned
+   * rather than preserved.
+   */
+  cancelHostedAgentRuns(): number;
+  dispose(): void; // Stop every poller this graph started; best-effort, total, idempotent. This surface owns its graph — see disposal-wiring.ts.
 }
 
 export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeServices {
-  const workingDirectory = options.workingDir;
+  const disposalScope = createDisposalScope('RuntimeServices'); const workingDirectory = options.workingDir; // disposal seam: see ./disposal-wiring.ts
   const homeDirectory = options.homeDirectory;
   const shellPaths = createShellPathService({
     workingDirectory,
@@ -340,34 +352,14 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
   });
-  const agentMessageBus = new AgentMessageBus();
-  agentMessageBus.setRuntimeBus(options.runtimeBus);
-  const archetypeLoader = new ArchetypeLoader(join(workingDirectory, '.goodvibes', 'agents'));
-  const agentOrchestrator = new AgentOrchestrator({
-    messageBus: agentMessageBus,
-  });
-  agentOrchestrator.setRuntimeBus(options.runtimeBus);
-  const agentManager = new AgentManager({
-    archetypeLoader,
-    messageBus: agentMessageBus,
-    executor: agentOrchestrator,
-    configManager,
-    // The live registry lets a bare model id in a spawn() override resolve
-    // through the shared resolver instead of being rejected as unqualified.
-    providerRegistry,
-  });
-  const contextAccountingHolder = new ContextAccountingHolder();
-  agentOrchestrator.setConversationSink({ // Conversation-snapshot bridge (mirrors the SDK's own createRuntimeServices)
-    register: (agentId, source) => agentManager.registerConversationSource(agentId, source),
-    release: (agentId) => agentManager.releaseConversationSource(agentId),
-  });
-  agentManager.setRuntimeBus(options.runtimeBus);
-  const wrfcController = new WrfcController(options.runtimeBus, agentMessageBus, {
-    agentManager,
-    configManager,
-    projectRoot: workingDirectory,
+  // The agent-execution graph, wired in both directions; see
+  // agent-graph-composition.ts for why the six are built as one.
+  const {
+    agentMessageBus, archetypeLoader, agentOrchestrator,
+    agentManager, contextAccountingHolder, wrfcController,
+  } = createAgentGraph({
+    runtimeBus: options.runtimeBus, workingDirectory, configManager, providerRegistry,
   });
-  agentManager.setWrfcController(wrfcController);
   const hookDispatcher = new HookDispatcher({ agentManager, toolLLM, projectRoot: workingDirectory }, hookActivityTracker);
   configManager.attachHookDispatcher(hookDispatcher);
   const hookWorkbench = createHookWorkbench({
@@ -419,6 +411,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const memorySpine = new MemorySpineClient({ local: createLocalMemoryAccess(memoryRegistry) });
   const deliveryManager = new AutomationDeliveryManager({
     configManager,
+    // This manager builds the delivery router the daemon actually replies
+    // through (bootstrap.ts hands it to the daemon facade). Without the
+    // secrets manager it cannot resolve a goodvibes://secrets/... credential,
+    // so Telegram accepted every inbound message and dropped every reply with
+    // "Missing Telegram bot token" while ntfy — which needs no secret — worked.
+    secretsManager,
     serviceRegistry,
     runtimeBus: options.runtimeBus,
     runtimeStore: options.runtimeStore,
@@ -498,43 +496,30 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     automationBridge: automationManager,
   });
 
-  // Daemon handler surfaces: attach HOST handlers to the SDK-auto-registered builtin
-  // gateway descriptors (channels.* / email.* / calendar.*) via catalog.register(descriptor,
-  // handler, { replace: true }) — the SDK owns every id/descriptor/schema. The remote
-  // surface reuses the SAME DistributedRuntimeManager the SDK facade injects.
-  const handlerLogger: HandlerLogger = {
-    info: (message, meta) => console.info(message, meta ?? ''),
-    warn: (message, meta) => console.warn(message, meta ?? ''),
-    error: (message, meta) => console.error(message, meta ?? ''),
-  };
-  const handlerContext: HandlerContext = {
-    catalog: gatewayMethods,
-    credentials: createDaemonCredentialStore(secretsManager),
+  // Which machines on this network are "us", and which of them reads the
+  // shared inbox. Both inert until startCluster() — no socket, no key material
+  // read; see cluster-group-composition.ts for why they are built together.
+  const { clusterGroup, clusterCoordinator } = createClusterServices({
+    configManager, shellPaths, secretsManager,
+  });
+  // Daemon handler surfaces (see daemon-handler-composition.ts); the inbox
+  // poller registers itself with the coordinator rather than starting eagerly.
+  const daemonHandlers = createDaemonHandlerComposition({
+    gatewayMethods,
+    secretsManager,
     configManager,
     workingDirectory,
     homeDirectory,
-    logger: handlerLogger,
-  };
-  const daemonHandlers = registerDaemonHandlers(handlerContext, {
-    registerRouting,
-    registerInbox: (ctx, routing) =>
-      registerTriagedInbox(ctx, (inboxCtx) => registerInboxMethods(inboxCtx, routing))
-        .unregister,
-    registerDrafts: (ctx) => registerDraftMethods(ctx),
-    registerCalendar,
-    registerEmail: (ctx) => registerEmailMethods(ctx),
-    registerRemote: (ctx) => registerRemoteSurface(ctx, { manager: distributedRuntime }),
+    distributedRuntime,
+    clusterCoordinator,
   });
 
-  const remoteRunnerRegistry = new RemoteRunnerRegistry(agentManager);
-  const remoteSupervisor = new RemoteSupervisor(remoteRunnerRegistry);
-  const sandboxSessionRegistry = new SandboxSessionRegistry(workingDirectory);
-  const mcpRegistry = new McpRegistry({
-    hookDispatcher,
-    sandboxSessions: sandboxSessionRegistry,
-  });
-  mcpRegistry.setRuntimeBus(options.runtimeBus);
-  mcpRegistry.setSandboxRuntime(configManager, sandboxSessionRegistry);
+  // Remote runners and the sandboxes tool calls are confined to; see
+  // remote-execution-composition.ts for why the four are built as one.
+  const { remoteRunnerRegistry, remoteSupervisor, sandboxSessionRegistry, mcpRegistry }
+    = createRemoteExecutionServices({
+      agentManager, workingDirectory, hookDispatcher, configManager, runtimeBus: options.runtimeBus,
+    });
   const tokenAuditor = new ApiTokenAuditor({ managed: false });
   const componentHealthMonitor = new ComponentHealthMonitor();
   const worktreeRegistry = new WorktreeRegistry(workingDirectory);
@@ -572,7 +557,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // code-index-services.ts's header doc.
   const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry, isReindexPaused: () => pauseController.isPaused('code-index-reindex'), admitExpensiveWork });
   // Store snapshots, the periodic append-only sweep, durable remembered-approval rules + the live credential chain — see durability-services.ts.
-  const { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping } = createDurabilityServices({
+  const { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping, stopConfigWatch } = createDurabilityServices({
     configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory), surface, shellPaths, // + retention-sweep roots & live config watch (mirrors the SDK)
     ...(options.currentSessionId ? { currentSessionId: options.currentSessionId } : {}), // exempts the running session from crash-residue reaping
   });
@@ -618,7 +603,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const { voiceSetup } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork });
 
   // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
   const integrationHelpers = new IntegrationHelperService({
     surface, // surface-scoped: continuity's recovery-file check must read the SAME paths the app writes with, not the unscoped legacy pair.
     runtimeStore: options.runtimeStore,
@@ -684,7 +669,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // bridge (the high-churn 'ops' domain stays out of the wholesale allowlist).
   wireMemoryPressureNotice(options.runtimeBus, notificationDispatcher);
 
-  return {
+  const services: RuntimeServices = {
     workingDirectory,
     homeDirectory,
     surface,
@@ -762,6 +747,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     toolLLM,
     distributedRuntime,
     daemonHandlers,
+    clusterCoordinator,
+    clusterGroup,
+    startCluster: () => startClusterServices({ clusterGroup, clusterCoordinator }),
     remoteRunnerRegistry,
     remoteSupervisor,
     sessionMemoryStore,
@@ -796,5 +784,14 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workspaceCheckpointManager,
     integrationHelpers,
     rerootStores: createStoreRerooter({ codeIndexStore, projectIndex }),
+    // Cancels the agent runs this graph was hosting. By dispose() time the
+    // fleet registry, orchestration engine, process registry and bus these runs
+    // report through are already down, so a run still described as "running" is
+    // orphaned rather than preserved — and this is the only shutdown-reachable
+    // way to abort its in-flight provider call instead of letting it sleep out
+    // a retry backoff nobody is waiting on.
+    cancelHostedAgentRuns: () => cancelAllAgentRuns(agentManager),
+    dispose: (): void => disposalScope.dispose(),
   };
+  registerSurfaceRuntimePollers(disposalScope.registry, services, { stopConfigWatch }); return services;
 }

package/src/verification/verification-ledger.ts

@@ -206,9 +206,47 @@ const ENABLEMENT_KEYS_BEHAVIOR_VERIFIED = new Set(
 ).size;
 
 /** Settings with real local behavior verification: the authored baseline plus the persistence-tested feature-knob, device/trigger, and enablement keys. */
+/**
+ * Config keys added by the LAN group-key layer: the automatic group-key
+ * rotation interval, the dual-generation acceptance window around a rotation,
+ * the discovery beacon interval, and the roster gossip interval.
+ *
+ * THIS CONSTANT IS NOT A DIAL, for the same reason as the two above. Each key
+ * is counted because a test that exercises it was actually written:
+ * `src/test/verification/cluster-group-settings-persistence.test.ts` runs the
+ * same four-part persistence contract — schema default exposure, `set()`
+ * through the key's own validator to disk, reload into a fresh ConfigManager
+ * with read-back equality, and reset-to-default that survives reload.
+ *
+ * PER-KEY EVIDENCE. All four have a LIVE consumer in this build, which is more
+ * than several of the keys counted above can claim:
+ *   cluster.keyRotationHours        — read by resolveClusterGroupSettings and
+ *                                     compared against the current key's age in
+ *                                     the group runtime's rotation check.
+ *   cluster.keyRotationGraceMinutes — sets how long the previous generation
+ *                                     stays accepted after a scheduled
+ *                                     rotation; drives the keyring's accepted
+ *                                     generation set.
+ *   cluster.beaconSeconds           — the discovery beacon timer interval, and
+ *                                     the basis of the "recently heard from"
+ *                                     window that decides which member mints a
+ *                                     rotation.
+ *   cluster.rosterGossipSeconds     — how often the member list is shared.
+ *
+ * `cluster.enabled` is NOT here: it is a feature enablement key and the ledger
+ * counts those in its own set.
+ */
+export const CLUSTER_GROUP_LOCAL_SETTINGS = [
+  'cluster.keyRotationHours',
+  'cluster.keyRotationGraceMinutes',
+  'cluster.beaconSeconds',
+  'cluster.rosterGossipSeconds',
+] as const;
+
 const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE
   + FEATURE_KNOB_LOCAL_SETTINGS.length
   + DEVICE_AND_TRIGGER_LOCAL_SETTINGS.length
+  + CLUSTER_GROUP_LOCAL_SETTINGS.length
   + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.23.0';
+let _version = '1.24.1';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file