@ran-sh/dsh-crew 0.5.6 → 1.0.0

package/src/provider-inventory.mjs

@@ -0,0 +1,132 @@
+// Secret-free inventory projection for Harness providers.
+//
+// Harness owns the live provider/model catalog; Crew owns the routing policy
+// and (where explicitly marked) profile provenance. This module only joins
+// those observations into a bounded record set for lifecycle/readiness UIs.
+
+const LIFECYCLE_ORIGINS = new Set(['builtin', 'profile-managed', 'dynamic', 'unknown']);
+const OWNERSHIPS = new Set(['harness', 'crew-managed-profile', 'user-managed-profile', 'dynamic-user', 'unknown']);
+
+function text(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function normalizeProviderId(value) {
+  return text(value);
+}
+
+function normalizeCredentialRefs(declaration) {
+  const raw = declaration?.credential_refs ?? declaration?.credential_ref;
+  const values = Array.isArray(raw) ? raw : raw === undefined ? [] : [raw];
+  const seen = new Set();
+  const refs = [];
+  for (const candidate of values) {
+    const name = text(typeof candidate === 'object' ? candidate.name_or_handle ?? candidate.name : candidate);
+    if (!name || seen.has(name)) continue;
+    seen.add(name);
+    const kind = text(typeof candidate === 'object' ? candidate.kind : null) ?? 'env';
+    const ownership = text(typeof candidate === 'object' ? candidate.ownership : null) ?? 'crew';
+    refs.push({
+      kind: ['env', 'crew-store', 'harness-store', 'unknown'].includes(kind) ? kind : 'unknown',
+      name_or_handle: name,
+      ownership: ['crew', 'user', 'external', 'unknown'].includes(ownership) ? ownership : 'unknown',
+    });
+  }
+  return refs;
+}
+
+function findPriorityIndex(policy, key, providerId) {
+  const list = Array.isArray(policy?.[key]) ? policy[key] : [];
+  const index = list.findIndex((entry) => normalizeProviderId(entry?.provider) === providerId);
+  return index >= 0 ? index : null;
+}
+
+function declarationFor(declarations, id) {
+  return declarations.find((entry) => normalizeProviderId(entry?.id) === id) ?? null;
+}
+
+function catalogFor(providers, id) {
+  return providers.find((entry) => normalizeProviderId(entry?.id) === id) ?? null;
+}
+
+function normalizeOrigin(value) {
+  const origin = text(value) ?? 'unknown';
+  return LIFECYCLE_ORIGINS.has(origin) ? origin : 'unknown';
+}
+
+function normalizeOwnership(value) {
+  const ownership = text(value) ?? 'unknown';
+  return OWNERSHIPS.has(ownership) ? ownership : 'unknown';
+}
+
+function modelIds(provider) {
+  if (!Array.isArray(provider?.models)) return [];
+  return [...new Set(provider.models.map((model) => text(typeof model === 'object' ? model?.id : model)).filter(Boolean))];
+}
+
+/**
+ * Build a secret-free provider inventory from live Harness and Crew-owned
+ * observations. No credential value is accepted or copied into the result.
+ */
+export function buildProviderInventory({ catalog = {}, declarations = [], policy = {}, tombstones = {}, activeJobs = [], multimodalRefs = {} } = {}) {
+  const catalogProviders = Array.isArray(catalog?.providers) ? catalog.providers : [];
+  const safeDeclarations = Array.isArray(declarations) ? declarations : [];
+  const ids = [];
+  const seen = new Set();
+  for (const source of [catalogProviders, safeDeclarations]) {
+    for (const entry of source) {
+      const id = normalizeProviderId(entry?.id);
+      if (!id || seen.has(id)) continue;
+      seen.add(id);
+      ids.push(id);
+    }
+  }
+
+  const harnessDefault = normalizeProviderId(catalog?.harness_default?.provider);
+  const records = ids.map((id) => {
+    const catalogEntry = catalogFor(catalogProviders, id);
+    const declaration = declarationFor(safeDeclarations, id);
+    const declared = declaration !== null;
+    const catalogued = catalogEntry !== null;
+    const tombstoned = tombstones?.[id] === 'absent';
+    const configured = declared;
+    const active = Array.isArray(activeJobs)
+      ? activeJobs.filter((job) => normalizeProviderId(job?.provider) === id).length
+      : Number.isInteger(activeJobs?.[id]) ? Math.max(0, activeJobs[id]) : 0;
+    const multimodal = Array.isArray(multimodalRefs?.[id]) ? multimodalRefs[id].length : Number.isInteger(multimodalRefs?.[id]) ? Math.max(0, multimodalRefs[id]) : 0;
+    const declarationFile = text(declaration?.file);
+    const locator = text(declaration?.locator);
+
+    return {
+      id,
+      display_name: text(declaration?.display_name) ?? text(declaration?.name) ?? text(catalogEntry?.name) ?? id,
+      origin: normalizeOrigin(declaration?.origin ?? (declared ? 'profile-managed' : 'builtin')),
+      ownership: normalizeOwnership(declaration?.ownership ?? (declared ? 'crew-managed-profile' : 'harness')),
+      declaration: {
+        ...(declarationFile ? { file: declarationFile } : {}),
+        ...(locator ? { locator } : {}),
+        present: declared,
+      },
+      models: modelIds(catalogEntry),
+      lifecycle: {
+        installed: declared || catalogued,
+        configured,
+        enabled: !tombstoned && declaration?.enabled !== false,
+        catalogued,
+      },
+      credential_refs: normalizeCredentialRefs(declaration),
+      references: {
+        harness_default: harnessDefault === id,
+        worker_priority: findPriorityIndex(policy?.worker, 'priority', id),
+        worker_escalation: findPriorityIndex(policy?.worker, 'escalation_priority', id),
+        reviewer_priority: findPriorityIndex(policy?.reviewer ?? policy?.review, 'priority', id),
+        active_jobs: active,
+        multimodal_refs: multimodal,
+      },
+      desired_state: tombstoned ? 'absent' : 'present',
+      activation: declared ? 'restart-required' : 'live',
+    };
+  });
+
+  return { schema_version: 1, records };
+}

package/src/provider-lifecycle-state.mjs

@@ -0,0 +1,95 @@
+// Persistent, secret-free lifecycle intent for Harness provider management.
+// Tombstones prevent an explicitly removed managed route from being re-seeded;
+// transactions retain only bounded audit metadata needed for recovery.
+
+const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const REVISION_PATTERN = /^[a-f0-9]{64}$/;
+const STATES = new Set([
+  'PLANNED', 'BLOCKED', 'APPLIED', 'RESTART_PENDING', 'VERIFYING',
+  'VERIFIED', 'ROLLBACK_PENDING', 'ROLLED_BACK', 'FAILED',
+]);
+
+function validId(value) {
+  return typeof value === 'string' && ID_PATTERN.test(value);
+}
+
+function validRevision(value) {
+  return typeof value === 'string' && REVISION_PATTERN.test(value);
+}
+
+function normalizedCredentialRefs(value) {
+  if (!Array.isArray(value)) return undefined;
+  const refs = value.map((ref) => {
+    if (!ref || typeof ref !== 'object' || Array.isArray(ref)) return null;
+    const kind = typeof ref.kind === 'string' && ref.kind.trim() ? ref.kind.trim() : null;
+    const name = typeof ref.name_or_handle === 'string' && ref.name_or_handle.trim() ? ref.name_or_handle.trim() : null;
+    const ownership = typeof ref.ownership === 'string' && ref.ownership.trim() ? ref.ownership.trim() : null;
+    return kind && name && ownership ? { kind, name_or_handle: name, ownership } : null;
+  }).filter(Boolean).slice(0, 32);
+  return refs;
+}
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function normalizedTransaction(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  if (!validId(value.provider_id) || typeof value.state !== 'string' || !STATES.has(value.state)) return null;
+  const refs = normalizedCredentialRefs(value.credential_refs);
+  return {
+    provider_id: value.provider_id,
+    state: value.state,
+    ...(validRevision(value.expected_revision) ? { expected_revision: value.expected_revision } : {}),
+    ...(refs === undefined ? {} : { credential_refs: refs }),
+  };
+}
+
+/** Normalize persisted lifecycle metadata; unknown fields and secret values are discarded. */
+export function normalizeProviderLifecycleState(input = {}) {
+  const out = { schema_version: 1, tombstones: {}, transactions: {}, last_verified_revision: {} };
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return out;
+  if (input.tombstones && typeof input.tombstones === 'object' && !Array.isArray(input.tombstones)) {
+    for (const [id, value] of Object.entries(input.tombstones)) if (validId(id) && value === 'absent') out.tombstones[id] = 'absent';
+  }
+  if (input.transactions && typeof input.transactions === 'object' && !Array.isArray(input.transactions)) {
+    for (const [transactionId, value] of Object.entries(input.transactions)) {
+      if (!validId(transactionId)) continue;
+      const transaction = normalizedTransaction(value);
+      if (transaction) out.transactions[transactionId] = transaction;
+    }
+  }
+  if (input.last_verified_revision && typeof input.last_verified_revision === 'object' && !Array.isArray(input.last_verified_revision)) {
+    for (const [id, revision] of Object.entries(input.last_verified_revision)) if (validId(id) && validRevision(revision)) out.last_verified_revision[id] = revision;
+  }
+  return out;
+}
+
+function requireProviderId(providerId) {
+  if (!validId(providerId)) throw new TypeError('provider id must be a bounded identifier');
+  return providerId;
+}
+
+export function markProviderTombstone(state, providerId) {
+  const id = requireProviderId(providerId);
+  const out = normalizeProviderLifecycleState(state);
+  out.tombstones[id] = 'absent';
+  return out;
+}
+
+export function clearProviderTombstone(state, providerId) {
+  const id = requireProviderId(providerId);
+  const out = normalizeProviderLifecycleState(state);
+  delete out.tombstones[id];
+  return out;
+}
+
+/** Record non-secret transaction metadata and credential reference names only. */
+export function recordProviderTransaction(state, transaction = {}) {
+  const transactionId = requireProviderId(transaction.transaction_id ?? transaction.plan_id);
+  const normalized = normalizedTransaction(transaction);
+  if (!normalized) throw new TypeError('provider transaction metadata is invalid');
+  const out = normalizeProviderLifecycleState(state);
+  out.transactions[transactionId] = clone(normalized);
+  return out;
+}

package/src/provider-lifecycle.mjs

@@ -0,0 +1,214 @@
+// Provider deletion planning and transaction state machine.
+//
+// This module is intentionally side-effect free until executeProviderDelete is
+// given explicit adapters. The live profile, credentials and restart hooks are
+// owned by the caller; plans never carry secret values.
+
+import { randomUUID } from 'node:crypto';
+
+export const PROVIDER_DELETE_STATES = Object.freeze([
+  'PLANNED', 'BLOCKED', 'APPLIED', 'RESTART_PENDING', 'VERIFYING',
+  'VERIFIED', 'ROLLBACK_PENDING', 'ROLLED_BACK', 'FAILED',
+]);
+
+const TRANSITIONS = Object.freeze({
+  PLANNED: Object.freeze(['BLOCKED', 'APPLIED', 'FAILED']),
+  BLOCKED: Object.freeze(['PLANNED', 'FAILED']),
+  APPLIED: Object.freeze(['RESTART_PENDING', 'FAILED']),
+  RESTART_PENDING: Object.freeze(['VERIFYING', 'FAILED']),
+  VERIFYING: Object.freeze(['VERIFIED', 'FAILED']),
+  VERIFIED: Object.freeze(['ROLLBACK_PENDING']),
+  ROLLBACK_PENDING: Object.freeze(['ROLLED_BACK', 'FAILED']),
+  ROLLED_BACK: Object.freeze([]),
+  FAILED: Object.freeze([]),
+});
+
+const DELETEABLE_OWNERSHIPS = new Set(['crew-managed-profile', 'user-managed-profile', 'dynamic-user']);
+const CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,63}$/;
+
+function text(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function boundedCode(value, fallback = 'PROVIDER_DELETE_FAILED') {
+  const candidate = text(value);
+  return candidate && CODE_PATTERN.test(candidate) ? candidate : fallback;
+}
+
+function fail(code) {
+  return { ok: false, code };
+}
+
+function recordById(inventory, providerId) {
+  const records = Array.isArray(inventory?.records) ? inventory.records : [];
+  return records.find((record) => record?.id === providerId) ?? null;
+}
+
+function activeJobCount(record, activeJobs) {
+  if (Array.isArray(activeJobs)) return activeJobs.filter((job) => job?.provider === record.id).length;
+  return Number.isInteger(record?.references?.active_jobs) ? Math.max(0, record.references.active_jobs) : 0;
+}
+
+function sanitizedCredentialRefs(record) {
+  return (Array.isArray(record?.credential_refs) ? record.credential_refs : []).map((ref) => ({
+    kind: text(ref?.kind) ?? 'unknown',
+    name_or_handle: text(ref?.name_or_handle) ?? 'unknown',
+    ownership: text(ref?.ownership) ?? 'unknown',
+  }));
+}
+
+function pushState(events, state) {
+  events.push({ state, at: new Date().toISOString() });
+}
+
+/** Return whether a provider deletion state transition is legal. */
+export function canTransitionProviderDelete(from, to) {
+  return PROVIDER_DELETE_STATES.includes(from) && TRANSITIONS[from]?.includes(to) === true;
+}
+
+/**
+ * Validate a provider deletion request and return a secret-free impact plan.
+ * The caller must provide a replacement when deleting the active Harness
+ * Default; running jobs and unknown ownership always fail closed.
+ */
+export function planProviderDelete({ providerId, inventory, activeJobs = [], replacementDefault = null, expectedRevision } = {}) {
+  const id = text(providerId);
+  if (!id) return fail('PROVIDER_NOT_FOUND');
+  const record = recordById(inventory, id);
+  if (!record) return fail('PROVIDER_NOT_FOUND');
+  if (!DELETEABLE_OWNERSHIPS.has(record.ownership)) return fail('PROVIDER_OWNERSHIP_AMBIGUOUS');
+  if (record.desired_state === 'absent') return fail('PROVIDER_ALREADY_ABSENT');
+  if (activeJobCount(record, activeJobs) > 0) return fail('PROVIDER_IN_USE');
+
+  const replacement = text(replacementDefault);
+  const replacementRecord = replacement ? recordById(inventory, replacement) : null;
+  if (record.references?.harness_default) {
+    if (!replacement || replacement === id || !replacementRecord || replacementRecord.desired_state === 'absent') {
+      return fail('PROVIDER_DEFAULT_REPLACEMENT_REQUIRED');
+    }
+    if (typeof replacementRecord.models?.[0] !== 'string' || replacementRecord.models[0].trim() === '') {
+      return fail('PROVIDER_DEFAULT_REPLACEMENT_MODEL_REQUIRED');
+    }
+  }
+
+  return {
+    ok: true,
+    plan: {
+      plan_id: randomUUID(),
+      provider_id: id,
+      provider: { id, display_name: text(record.display_name) ?? id },
+      expected_revision: text(expectedRevision) ?? text(record.declaration?.revision),
+      replacement_default: replacement,
+      was_harness_default: record.references?.harness_default === true,
+      ...(replacement
+        ? { replacement_default_model: text(replacementRecord?.models?.[0]) }
+        : {}),
+      will_remove: [
+        'profile declaration', 'runtime desired registration',
+        'worker priority references', 'reviewer priority references',
+        'Harness Default reference', 'cache/health state',
+      ],
+      credential_refs: sanitizedCredentialRefs(record),
+      restart_required: true,
+      rollback: { config_snapshot_available: true, credentials_included: false },
+    },
+  };
+}
+
+function hookError(name) {
+  return Object.assign(new Error(`provider delete hook missing: ${name}`), { code: 'PROVIDER_LIFECYCLE_HOOK_MISSING' });
+}
+
+/**
+ * Execute a deletion plan through injected adapters. All mutating adapters are
+ * explicit so the Hub/API layer can provide atomic profile/config stores and a
+ * supervisor that only restarts the owned 3210 child.
+ */
+export async function executeProviderDelete(plan, hooks = {}, { deferRestart = false } = {}) {
+  let state = 'PLANNED';
+  const events = [];
+  pushState(events, state);
+  let errorCode = null;
+  let verification = null;
+  let mutationsStarted = false;
+  let rollbackAttempted = false;
+  let rollbackErrorCode = null;
+  let rollbackRuntimeRestarted = null;
+  let rollbackRuntimeVerified = null;
+  const transition = (next) => {
+    if (!canTransitionProviderDelete(state, next)) throw Object.assign(new Error(`illegal provider delete transition ${state} -> ${next}`), { code: 'PROVIDER_DELETE_STATE_INVALID' });
+    state = next;
+    pushState(events, state);
+  };
+  try {
+    if (!plan?.plan_id || !plan?.provider_id) throw Object.assign(new Error('provider delete plan is invalid'), { code: 'PROVIDER_DELETE_PLAN_INVALID' });
+    for (const name of ['backup', 'markTombstone', 'scrubReferences', 'removeDeclarations', 'restart', 'rollback']) {
+      if (typeof hooks[name] !== 'function') throw hookError(name);
+    }
+    await hooks.backup(plan);
+    // From this point onward at least one destructive adapter may have
+    // committed; any later failure must attempt compensation before returning.
+    mutationsStarted = true;
+    await hooks.markTombstone(plan.provider_id, 'absent', plan);
+    await hooks.scrubReferences(plan);
+    await hooks.removeDeclarations(plan);
+    transition('APPLIED');
+    transition('RESTART_PENDING');
+    if (!deferRestart) {
+      const restarted = await hooks.restart(plan);
+      if (restarted?.ok === false) throw Object.assign(new Error('provider delete restart failed'), { code: restarted.code });
+      if (typeof hooks.verify !== 'function') throw hookError('verify');
+      transition('VERIFYING');
+      verification = await hooks.verify(plan);
+      if (verification?.providerAbsent !== true || verification?.routingClear !== true || verification?.tombstonePresent !== true) {
+        throw Object.assign(new Error('provider delete verification incomplete'), { code: 'PROVIDER_DELETE_VERIFY_FAILED' });
+      }
+      transition('VERIFIED');
+    }
+  } catch (error) {
+    errorCode = boundedCode(error?.code);
+    if (mutationsStarted && typeof hooks.rollback === 'function') {
+      rollbackAttempted = true;
+      try {
+        await hooks.rollback(plan);
+        if (typeof hooks.restartRollback === 'function') {
+          const restarted = await hooks.restartRollback(plan);
+          rollbackRuntimeRestarted = restarted?.ok !== false;
+          if (rollbackRuntimeRestarted && typeof hooks.verifyRollback === 'function') {
+            const verified = await hooks.verifyRollback(plan);
+            rollbackRuntimeVerified = verified?.ok !== false;
+          }
+        }
+      } catch (rollbackError) {
+        rollbackErrorCode = boundedCode(rollbackError?.code, 'PROVIDER_DELETE_ROLLBACK_FAILED');
+        rollbackRuntimeRestarted = false;
+      }
+    }
+    if (state !== 'FAILED' && canTransitionProviderDelete(state, 'FAILED')) transition('FAILED');
+  }
+  const result = {
+    transaction_id: plan?.plan_id ?? null,
+    provider_id: plan?.provider_id ?? null,
+    state,
+    error_code: errorCode,
+    rollback_attempted: rollbackAttempted,
+    rollback_error_code: rollbackErrorCode,
+    rollback_runtime_restarted: rollbackRuntimeRestarted,
+    rollback_runtime_verified: rollbackRuntimeVerified,
+    verification,
+    events,
+  };
+  if (typeof hooks.recordTransaction === 'function') {
+    try {
+      await hooks.recordTransaction(result, plan);
+      result.audit_recorded = true;
+    } catch (error) {
+      result.audit_recorded = false;
+      result.audit_error_code = boundedCode(error?.code, 'PROVIDER_LIFECYCLE_RECORD_FAILED');
+    }
+  }
+  if (typeof hooks.release === 'function') {
+    try { await hooks.release(plan); } catch {}
+  }
+  return result;
+}

package/src/provider-profile-store.mjs

@@ -0,0 +1,171 @@
+// Safe, structure-aware mutations for the Crew profile's provider patch.
+//
+// This module deliberately does not parse or return credential values. It only
+// recognizes the known llm-pi-ai -> config -> providers mapping and performs
+// bounded, revision-checked text edits while preserving unrelated patch items.
+
+import { createHash } from 'node:crypto';
+
+const PROVIDER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+function sha256(value) {
+  return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function indentOf(line) {
+  return (line.match(/^\s*/) ?? [''])[0].length;
+}
+
+function nonBlank(line) {
+  return line.trim() !== '' && !line.trimStart().startsWith('#');
+}
+
+function parseProviderMap(source) {
+  if (typeof source !== 'string') return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+  const lines = source.split(/\r?\n/);
+  const llmStart = lines.findIndex((line) => /^-\s+id:\s*llm-pi-ai\s*$/.test(line));
+  if (llmStart < 0) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+
+  let blockEnd = lines.length;
+  for (let index = llmStart + 1; index < lines.length; index += 1) {
+    // Only a true top-level sequence item can end the managed llm-pi-ai item;
+    // nested list entries are part of a provider value and must be validated.
+    if (indentOf(lines[index]) === 0 && /^-\s+/.test(lines[index])) {
+      blockEnd = index;
+      break;
+    }
+  }
+
+  const providersLine = lines.findIndex((line, index) => index > llmStart && index < blockEnd && /^\s+providers:\s*$/.test(line));
+  if (providersLine < 0) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+  const providersIndent = indentOf(lines[providersLine]);
+  const providerIndent = providersIndent + 2;
+  const entries = [];
+
+  for (let index = providersLine + 1; index < blockEnd; index += 1) {
+    const line = lines[index];
+    if (!nonBlank(line)) continue;
+    const indent = indentOf(line);
+    if (indent <= providersIndent) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+    if (indent !== providerIndent) {
+      if (/^\s*-\s+/.test(line)) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+      continue;
+    }
+    const match = line.match(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*):\s*$/);
+    if (!match) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+    const id = match[1];
+    let end = index + 1;
+    while (end < blockEnd) {
+      const next = lines[end];
+      if (nonBlank(next)) {
+        const nextIndent = indentOf(next);
+        if (nextIndent < providerIndent) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+        if (nextIndent === providerIndent) break;
+        // Provider values may contain nested YAML sequences (for example the
+        // `models:` list emitted by the live Harness profile). A sequence at
+        // the same indentation as a provider field is malformed, however;
+        // valid child items must be indented below that field. Keep the
+        // parser structure-aware without attempting to deserialize values.
+        if (/^\s*-\s+/.test(next) && nextIndent < providerIndent + 4) {
+          return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+        }
+      }
+      end += 1;
+    }
+    entries.push({ id, start: index, end });
+    index = end - 1;
+  }
+  if (entries.length === 0) return { ok: false, code: 'PROVIDER_PROFILE_SCHEMA_UNSUPPORTED' };
+  return { ok: true, lines, llmStart, blockEnd, providersLine, providerIndent, entries };
+}
+
+/** Return only bounded provider ids and a content revision; never values. */
+export function inspectProviderProfile(source) {
+  const revision = typeof source === 'string' ? sha256(source) : null;
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code, revision };
+  return {
+    ok: true,
+    schema: 'cordis-patch-llm-pi-ai-v1',
+    providerIds: parsed.entries.map((entry) => entry.id),
+    revision,
+  };
+}
+
+function scalarField(lines, entry, field) {
+  const pattern = new RegExp(`^\\s+${field}:\\s*(.*?)\\s*$`);
+  for (const line of lines.slice(entry.start, entry.end)) {
+    const match = line.match(pattern);
+    if (!match) continue;
+    const value = match[1].trim();
+    if (!value) return null;
+    return value.replace(/^(?:"([\\s\\S]*)"|'([\\s\\S]*)')$/, '$1$2');
+  }
+  return null;
+}
+
+/** Return profile provider provenance and credential reference names only. */
+export function readProviderDeclarations(source, { file = 'profile.yml' } = {}) {
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code };
+  const declarations = parsed.entries.map((entry) => {
+    const displayName = scalarField(parsed.lines, entry, 'displayName');
+    const credentialRef = scalarField(parsed.lines, entry, 'apiKeyEnv');
+    return {
+      id: entry.id,
+      display_name: displayName ?? entry.id,
+      origin: 'profile-managed',
+      ownership: 'crew-managed-profile',
+      file,
+      ...(credentialRef ? { credential_ref: credentialRef } : {}),
+    };
+  });
+  return { ok: true, declarations };
+}
+
+/**
+ * Remove provider declarations from a known profile patch after an optional
+ * content-revision check. The returned text is safe to write atomically by the
+ * lifecycle layer; this pure helper never touches the filesystem.
+ */
+export function removeProviderDeclarations(source, { providerIds = [], expectedRevision } = {}) {
+  const currentRevision = typeof source === 'string' ? sha256(source) : null;
+  if (expectedRevision !== undefined && expectedRevision !== currentRevision) {
+    return { ok: false, code: 'PROVIDER_PROFILE_CHANGED', revision: currentRevision };
+  }
+  const requested = [...new Set(providerIds.filter((id) => typeof id === 'string' && PROVIDER_ID.test(id)))];
+  if (requested.length === 0 || requested.length !== providerIds.length) {
+    return { ok: false, code: 'PROVIDER_NOT_FOUND', revision: currentRevision };
+  }
+  const parsed = parseProviderMap(source);
+  if (!parsed.ok) return { ok: false, code: parsed.code, revision: currentRevision };
+  const byId = new Map(parsed.entries.map((entry) => [entry.id, entry]));
+  if (requested.some((id) => !byId.has(id))) {
+    return { ok: false, code: 'PROVIDER_NOT_FOUND', revision: currentRevision };
+  }
+
+  const removedSet = new Set(requested);
+  const remaining = parsed.entries.filter((entry) => !removedSet.has(entry.id)).map((entry) => entry.id);
+  const removeRanges = [];
+  if (remaining.length === 0) {
+    // Avoid leaving an empty `llm-pi-ai.config.providers` mapping that could
+    // fail the next profile parse. Remove the complete managed sequence item.
+    removeRanges.push([parsed.llmStart, parsed.blockEnd]);
+  } else {
+    for (const id of requested) {
+      const entry = byId.get(id);
+      removeRanges.push([entry.start, entry.end]);
+    }
+  }
+  const shouldRemove = (index) => removeRanges.some(([start, end]) => index >= start && index < end);
+  const lines = parsed.lines.filter((_line, index) => !shouldRemove(index));
+  const newline = source.includes('\r\n') ? '\r\n' : '\n';
+  const text = lines.join(newline);
+  return {
+    ok: true,
+    text,
+    removed: requested,
+    remaining,
+    revision: sha256(text),
+  };
+}

package/src/readiness-matrix.mjs

@@ -13,8 +13,11 @@ export const READINESS_REASON_CODES = Object.freeze({
   HUB_INCOMPATIBLE: 'HUB_INCOMPATIBLE',
   PROVIDER_CATALOG_RESOLVED: 'PROVIDER_CATALOG_RESOLVED',
   PROVIDER_CATALOG_UNAVAILABLE: 'PROVIDER_CATALOG_UNAVAILABLE',
-  PROVIDER_CATALOG_HEALTH_WARNING: 'PROVIDER_CATALOG_HEALTH_WARNING',
-  PROVIDER_CATALOG_NOT_REQUIRED: 'PROVIDER_CATALOG_NOT_REQUIRED',
+  PROVIDER_CATALOG_HEALTH_WARNING: 'PROVIDER_CATALOG_HEALTH_WARNING',
+  PROVIDER_CATALOG_NOT_REQUIRED: 'PROVIDER_CATALOG_NOT_REQUIRED',
+  PROVIDER_LIFECYCLE_CONSISTENT: 'PROVIDER_LIFECYCLE_CONSISTENT',
+  PROVIDER_LIFECYCLE_INCONSISTENT: 'PROVIDER_LIFECYCLE_INCONSISTENT',
+  PROVIDER_INVENTORY_UNAVAILABLE: 'PROVIDER_INVENTORY_UNAVAILABLE',
   PROVIDER_MODE_UNKNOWN: 'PROVIDER_MODE_UNKNOWN',
   NO_CI_EVIDENCE: 'NO_CI_EVIDENCE',
   NO_EXECUTION_EVIDENCE: 'NO_EXECUTION_EVIDENCE',
@@ -29,10 +32,13 @@ const TARGET_ROWS = Object.freeze([
   ['hub_compatibility', 'live-runtime'],
   ['provider_catalog', 'live-runtime'],
   ['model_execution', 'real-execution'],
+  ['worker_primary_callable', 'real-execution'],
+  ['worker_escalation_callable', 'real-execution'],
+  ['reviewer_primary_callable', 'real-execution'],
+  ['provider_lifecycle_consistent', 'live-runtime'],
   ['deepseek_flash', 'real-execution'],
-  ['deepseek_pro', 'real-execution'],
-  ['opencode_go_mimo_qwen', 'real-execution'],
-  ['reviewer_pipeline', 'real-execution'],
+  ['deepseek_pro', 'real-execution'],
+  ['reviewer_pipeline', 'real-execution'],
   ['cancellation_timeout_escalation', 'real-execution'],
   ['standalone_official', 'real-execution'],
 ]);

package/src/removable-waiter.mjs

@@ -0,0 +1,29 @@
+// Long-poll wait registration that removes itself: the terminal transition
+// bulk-clears job.waiters, so a timed-out waiter that stayed registered would
+// linger (and accumulate across polls) for the remaining lifetime of a
+// long-running job. All three wait surfaces (hub, standalone jobs, workflow
+// runtime) share this one implementation so the cleanup invariant cannot
+// drift again.
+
+/**
+ * Race the job's waiters against a timeout, always unregistering the waiter
+ * afterwards. `timeoutMs <= 0` means "no timeout": wait forever unless
+ * `immediateWithoutTimeout` is set, which resolves immediately (poll
+ * semantics, used by the hub route).
+ */
+export async function raceWaiters(waiters, { timeoutMs = 0, immediateWithoutTimeout = false } = {}) {
+  let waiter = null;
+  let timer = null;
+  try {
+    await Promise.race([
+      new Promise((resolve) => { waiter = resolve; waiters.push(resolve); }),
+      timeoutMs > 0
+        ? new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); })
+        : (immediateWithoutTimeout ? Promise.resolve() : new Promise(() => {})),
+    ]);
+  } finally {
+    const index = waiters.indexOf(waiter);
+    if (index !== -1) waiters.splice(index, 1);
+    if (timer !== null) clearTimeout(timer);
+  }
+}