@sigrun/sigrun 0.2.0 → 0.3.0

package/dist/extension.d.ts

@@ -139,7 +139,13 @@ export type ExtensionLifecyclePayload = {
 export type ExtensionRunSettledHandler = (event: RunSettledEvent, api: MemoryEventApi, context: HandlerContext) => void | Promise<void>;
 /** A factory-result lifecycle handler for one event, deadline-bounded. */
 export type ExtensionLifecycleHandler<K extends keyof ExtensionLifecyclePayload> = (event: ExtensionLifecyclePayload[K], api: MemoryEventApi, context: HandlerContext) => void | Promise<void>;
-/** A factory-result `harnessShutdown` handler (no event payload — shutdown is conversation-less). */
+/**
+ * A factory-result `harnessShutdown` handler (no event payload — shutdown is
+ * conversation-less). All extension handlers run CONCURRENTLY under one
+ * shared hook deadline, in no guaranteed relative execution or commit order.
+ * Handlers may still commit; a wedged handler is abandoned without undoing
+ * other handlers' durable commits.
+ */
 export type ExtensionHarnessShutdownHandler = (api: MemoryEventApi, context: HandlerContext) => void | Promise<void>;
 /**
  * The `userDeleted` payload (core hardening W1): which directory user
@@ -349,14 +355,18 @@ export interface ExtensionCommandContribution {
         readonly notice?: string;
     } | void>;
 }
-/** One notification core delivers to every registered notifier (best-effort). */
-export interface NotificationEvent {
-    readonly type: "interaction.pending" | "job.failed" | "run.settled";
+/** The settled-run outcome: the notification-safe projection of the host
+ *  event's `outcome`/`reason` (status and reason only — no answer text). */
+export type RunSettledOutcome = {
+    readonly status: "answered";
+} | {
+    readonly status: "unanswered";
+    readonly reason: string;
+};
+/** Fields shared by every notification variant. */
+interface NotificationEventBase {
     readonly conversationId?: number;
     readonly jobId?: string;
-    /** Gateway C6: the pending record's id — set on `interaction.pending` only
-     *  (read the record via `host.snapshotInteraction`). */
-    readonly callId?: string;
     /** The recipient. */
     readonly user: string | undefined;
     readonly title: string;
@@ -364,6 +374,21 @@ export interface NotificationEvent {
     /** `${server.publicUrl}/#/c/<conversationId>` when `server.publicUrl` is set; absent otherwise. */
     readonly url?: string;
 }
+/** One notification core delivers to every registered notifier (best-effort). */
+export type NotificationEvent = NotificationEventBase & ({
+    readonly type: "interaction.pending";
+    /** Gateway C6: the pending record's id — set on `interaction.pending` only
+     *  (inspect it via `host.peekInteraction`; the OWNING extension's
+     *  delivery read is `host.snapshotInteraction`). */
+    readonly callId?: string;
+} | {
+    readonly type: "job.failed";
+} | {
+    readonly type: "run.settled";
+    /** Whether the run answered or not (model error, abort, …), with
+     *  the wire reason verbatim. Never infer success from the body. */
+    readonly outcome: RunSettledOutcome;
+});
 /** One notifier transport (ntfy, Signal, web push — core ships none). */
 export interface NotifierContribution {
     readonly name: string;
@@ -800,7 +825,22 @@ export interface SigrunHost {
     }): Promise<boolean>;
     /** Mark a pending interaction expired/cancelled/skipped (extension-owned semantics). */
     settleInteraction(conversationId: ConversationId, callId: string, status: "skipped" | "expired" | "cancelled", context: HandlerContext): Promise<boolean>;
-    /** Read one interaction record (the poll loop's read). */
+    /**
+     * Inspect one interaction record WITHOUT consuming anything: returns
+     * the same stored projection as {@link SigrunHost.snapshotInteraction}
+     * (secret values stay `SECRET_MASK`), but never touches the one-shot
+     * secret-delivery `take` path. Safe to repeat; neither extends nor
+     * shortens secret TTL; creates, settles, and mutates nothing. Use for
+     * inspection/rendering (notifiers, outcome edits, correlation).
+     */
+    peekInteraction(conversationId: ConversationId, callId: string, context: HandlerContext): Promise<Readonly<InteractionRecord> | undefined>;
+    /**
+     * The OWNING extension's delivery read: the first applicable read of
+     * an answered secret record merges its raw secret values back ONCE;
+     * subsequent reads see the stored mask. Inspection-only callers must
+     * use {@link SigrunHost.peekInteraction} instead — a consuming read
+     * by a non-owner silently destroys the owner's one-shot delivery.
+     */
     snapshotInteraction(conversationId: ConversationId, callId: string, context: HandlerContext): Promise<Readonly<InteractionRecord> | undefined>;
     /** Fully replace one ambient surface's state (write = replacement); the key must be unowned or yours. */
     setAmbient(conversationId: ConversationId, record: {

package/dist/harness/ambient.js

@@ -42,6 +42,7 @@ export const AmbientDoc = defineDocFamily({
     kind: "sigrun.ambient",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     family: true,
@@ -57,6 +58,7 @@ export const AmbientOwnersDoc = defineDoc({
     kind: "sigrun.ambient.owners",
     version: 1,
     scope: "session",
+    checkpointWhen: () => false,
     initial: () => ({ owners: {} }),
 });
 const PLACES = new Set(["status", "footer", "panel"]);

package/dist/harness/blocks/state.js

@@ -28,6 +28,7 @@ export const BlocksStateDoc = defineDocFamily({
     kind: "sigrun.blocks.state",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     family: true,

package/dist/harness/boot.js

@@ -12,10 +12,14 @@ import { join } from "node:path";
 import { Harness, } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
 import { effectiveMethods } from "../config.js";
+import { requiresProxyVouch } from "../server/auth/proxy-only.js";
 import { wireActivity } from "./activity.js";
+import { snapshotBeforeMigration } from "./migration-snapshot.js";
 import { createScheduleTask } from "../jobs/task.js";
 import { createJobsService, jobWireOf } from "../jobs/index.js";
 import { reconcileJobs } from "../jobs/reconcile.js";
+import { applyParkedJobs } from "../jobs/parked.js";
+import { createDurableReports } from "./reports.js";
 import { registerJobObservers } from "../jobs/observe.js";
 import { JobDoc, JobRunDoc, listRevisions } from "../jobs/docs.js";
 import { EventBus } from "./event-bus.js";
@@ -49,6 +53,7 @@ import { resolveWorkerEntry, sandboxLauncher, WorkerPool } from "../sandbox/pool
 import { IsolationState } from "../sandbox/isolation.js";
 import { probeOsUsers } from "../sandbox/availability.js";
 import { createAdmissionGuard } from "./identity/users.js";
+import { sweepAccountLinks } from "./identity/link-sweep.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
 import { probeIsolation, runHelperProbe, selfTestHelper, } from "../sandbox/availability.js";
 import { resolveBuiltins, } from "./builtins.js";
@@ -169,6 +174,31 @@ export async function openHarness(config, options = {}) {
     // I/O here (each file materializes on its first write), so this is
     // pure construction over paths boot already owns.
     const identity = options.identity ?? openIdentityStores(roots);
+    // The account-link sweep (username-derivation Task 8): once at boot,
+    // before serving — dangling links are removed, proxy-source crash
+    // orphans are logged with their repair command (never auto-repaired:
+    // the original proxy username is not derivable from the key).
+    // BEST-EFFORT posture: a sweep failure (e.g. a corrupt accounts.json)
+    // must not crash-loop a serving deployment; the stores' own readers
+    // still fail loud on the request paths if the file is truly corrupt.
+    try {
+        const linkSweep = await sweepAccountLinks(identity.users, identity.accounts);
+        if (linkSweep.removedDangling > 0) {
+            console.log(`identity: removed ${linkSweep.removedDangling} dangling account link(s)`);
+        }
+        for (const orphan of linkSweep.orphans) {
+            console.log(`identity: proxy user "${orphan}" has no proxy link; repair with: sigrun user link ${orphan} --proxy <username>`);
+        }
+    }
+    catch (error) {
+        console.warn(`identity: account-link sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // The caller-supplied host wins (serving spec §1: `serve()` resolves
+    // the ONE effective host — options.host → SIGRUN_LISTEN_HOST →
+    // DEFAULT_LISTEN_HOST — and passes it here). The env read below is
+    // NOT a second source on the serve path (the option is always set
+    // there); it remains for direct `openHarness` callers that never
+    // bind a listener (tests) and must derive the same auth posture.
     const listenHost = options.listenHost ?? env.SIGRUN_LISTEN_HOST ?? "0.0.0.0";
     const methods = effectiveMethods(config.auth, listenHost);
     const isolationState = new IsolationState({
@@ -203,8 +233,10 @@ export async function openHarness(config, options = {}) {
     // is 0600 + atomic, and the cache root is never a backup section).
     // `SIGRUN_SETUP_CODE` pins the value instead (the k8s Secret shape).
     // Claimed boots (every identity-seeded test, every post-onboarding
-    // deploy) write nothing.
-    if (!identity.users.isClaimed()) {
+    // deploy) write nothing. A proxy-only non-loopback boot writes and
+    // logs NOTHING either (C2): account creation there is vouch-only, so
+    // a setup code would be an unvouched account-creation path.
+    if (!identity.users.isClaimed() && !requiresProxyVouch(methods, listenHost)) {
         // `identity.cacheDir`, not `roots.cacheDir`: the claim route reads
         // `readSetupCode(identity.cacheDir)`, and an injected identity
         // bundle (the test seam) may root elsewhere than the resolved
@@ -263,7 +295,18 @@ export async function openHarness(config, options = {}) {
         now: () => Date.now(),
         managed: managedPaths,
     });
-    const storage = await openNodeSqliteStorage(config.storagePath);
+    const storage = await (async () => {
+        // D4: preserve the last schema the previous release can read BEFORE
+        // openNodeSqliteStorage applies its one-way durable migration. The
+        // injected clock keeps snapshots deterministic in tests; a needed
+        // snapshot failure aborts boot here, before any migration write.
+        await snapshotBeforeMigration(config.storagePath, {
+            env,
+            now: options.now ?? (() => new Date()),
+            log: (line) => console.log(line),
+        });
+        return await openNodeSqliteStorage(config.storagePath);
+    })();
     const registry = createRegistry();
     // Late-filled by the loader: factories publish through the same registry
     // instance, and selection rewrites read the declared set LIVE.
@@ -654,6 +697,25 @@ export async function openHarness(config, options = {}) {
         onReadinessChange: observeReadiness,
         snapshotReadiness,
     });
+    // Per-model compaction overrides (D9): after the boot refresh the
+    // catalog is as complete as boot gets, so an override key matching no
+    // known model is almost always a typo (or a stale chain name). Warn
+    // once per unmatched key — never an error: catalogs move and an
+    // unmatched override is simply inert. pi-durable's own key composition
+    // is `${provider}/${modelId}`, so a chain-shaped model id yields a
+    // doubled prefix (e.g. "bifrost/bifrost/<chain>").
+    void bootRefreshDone.then(() => {
+        const overrides = config.compaction.modelOverrides ??
+            bootSettings.server?.compaction?.modelOverrides;
+        if (overrides === undefined)
+            return;
+        const known = new Set(models.getModels().map((model) => `${model.provider}/${model.id}`));
+        for (const key of Object.keys(overrides)) {
+            if (!known.has(key)) {
+                console.warn(`compaction override "${key}" matches no known model`);
+            }
+        }
+    });
     // The boot-wired single-provider refresh (W3 Task 6): the route
     // surface's refresh — the same bound policy `resolveServedModelRefreshing`
     // runs on a miss, with the same readiness observation so a provider a
@@ -718,15 +780,23 @@ export async function openHarness(config, options = {}) {
     const fileSettings = settingsStore.harnessSettings();
     const callerSettings = options.settings;
     // The ONE boot clock (options.now ?? real): the activity stamper AND
-    // the harness clock share it (the schedule task's `runtime.sleep`
-    // reads the harness clock; pinning the seam pins both — the jobs
-    // tests' time-injection lever).
+    // the harness clock share it (the schedule task's `sleepUntil`
+    // deadlines live on the harness clock; pinning the seam pins both —
+    // the jobs tests' time-injection lever).
     const clockNow = options.now ?? (() => new Date());
+    // D5: reports may arrive inside Harness.open. The collector logs/counts
+    // synchronously and queues parks; job patches drain after binding below.
+    const reports = createDurableReports({
+        log: (line) => console.error(line),
+        onReport: options.onReport,
+    });
     const harness = await Harness.open(storage, {
         models,
         registry,
         env: envBuilder,
         now: () => clockNow().getTime(),
+        setTimer: options.setTimer,
+        onReport: reports.onReport,
         // Context-management policy (Task 8): config's `SIGRUN_COMPACTION_*`
         // tuning, with any caller-set field winning over it. Upstream merges
         // the result over `DEFAULT_COMPACTION_POLICY` per field. Task 8a: the
@@ -738,6 +808,14 @@ export async function openHarness(config, options = {}) {
         // snapshots the file's boot-time values, silently freezing the
         // queue modes and clobbering the caller seam (the round-1 defects).
         // `extensions`/`toolExecution` have no file backing — plain passthrough.
+        // Compaction (D9): ONLY `modelOverrides` comes from the file here —
+        // it has no env spelling, so this adds a file tier without touching
+        // the four env-backed knobs' precedence (env over file, resolved by
+        // loadConfig). serve already folds the file into config; the
+        // conditional spread keeps a config-resolved map authoritative and
+        // covers direct `openHarness` boots. Read ONCE (boot-time), so a
+        // PATCH is restart-pending exactly like the other compaction keys.
+        // Order: caller seam > config (env over file) > this file fallback.
         settings: {
             get steeringMode() {
                 return callerSettings?.steeringMode ?? fileSettings.steeringMode;
@@ -761,6 +839,10 @@ export async function openHarness(config, options = {}) {
             toolExecution: callerSettings?.toolExecution,
             compaction: {
                 ...config.compaction,
+                ...(config.compaction.modelOverrides === undefined &&
+                    bootSettings.server?.compaction?.modelOverrides !== undefined
+                    ? { modelOverrides: bootSettings.server.compaction.modelOverrides }
+                    : {}),
                 ...callerSettings?.compaction,
             },
         },
@@ -780,6 +862,9 @@ export async function openHarness(config, options = {}) {
     // JobsService — happens after this point.
     jobRuntimeDeps.harness = harness;
     jobRuntimeDeps.storage = storage;
+    // Drain the restart-limit parks reported during open before scheduling
+    // resumes. A failed status patch is logged and dropped by applyParkedJobs.
+    await applyParkedJobs(harness, reports.takeParked(), BACKGROUND_CONTEXT);
     // The memory-seam event bus (Tasks 2-4): subscribe BEFORE `resume()` so
     // recovery settles (faulted/orphaned submissions the scheduler drains)
     // are observed like any other commit. Extension handlers register under
@@ -1057,6 +1142,7 @@ export async function openHarness(config, options = {}) {
         userToolSweep,
         models,
         jobs,
+        reports,
         jobRunTotals: () => jobRunTotals,
         defaultModel,
         providerCollisions: sink.collisions,

package/dist/harness/builtins.js

@@ -38,7 +38,7 @@ import { basename, dirname, isAbsolute, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parsePackageSpecifier, readPackageName } from "./packages.js";
 /**
- * The four built-ins, in load order (codemode before tool-search: both
+ * The five built-ins, in load order (codemode before tool-search: both
  * wrap pi-durable's own extensions and neither depends on the other, but
  * the order pins the tool-collision story should names ever overlap).
  * Specifiers are the published package names (Task 3) — npm keys a file:

package/dist/harness/context.js

@@ -0,0 +1,25 @@
+/**
+ * Normalize the extension contract's structural invocation context to the
+ * full chord Context required by pi-durable 1.4.0.
+ *
+ * Extensions deliberately depend only on HandlerContext (`abortSignal`), so
+ * they may pass a plain object. Durable publishes read telemetry and other
+ * context values, however; forwarding that literal would make the first
+ * entry/submission write fail at the host boundary. Deriving from
+ * BACKGROUND_CONTEXT supplies the runtime defaults while preserving caller
+ * cancellation. A real Context passes through BY IDENTITY so its telemetry
+ * parent and application values are never discarded.
+ */
+import { BACKGROUND_CONTEXT, withAbortSignal, } from "@earendil-works/chord/context";
+/** Upgrade a structural handler context, or retain an existing chord context. */
+export function toDurableContext(context) {
+    const candidate = context;
+    if (typeof candidate.telemetry === "object" &&
+        candidate.telemetry !== null &&
+        typeof candidate.value === "function") {
+        return context;
+    }
+    return context.abortSignal === undefined
+        ? BACKGROUND_CONTEXT
+        : withAbortSignal(context.abortSignal, BACKGROUND_CONTEXT);
+}

package/dist/harness/event-bus.js

@@ -64,6 +64,7 @@ import { SessionMetaDoc } from "../server/session-meta.js";
 import { EXPANDED_ENTRY_KIND } from "../commands/expand.js";
 import { InteractionDoc, TERMINAL as INTERACTION_TERMINAL } from "./interactions.js";
 import { AmbientDoc } from "./ambient.js";
+import { toDurableContext } from "./context.js";
 import { beginUserDeletion } from "./stores.js";
 /** Project a SessionMeta doc value into the tracked basis. */
 function metaBasisOf(value) {
@@ -84,9 +85,9 @@ function metaBasisOf(value) {
     return basis;
 }
 /** How long shutdown waits for in-flight worker runs before abandoning (spec §3). */
-const WORKER_SHUTDOWN_AWAIT_MS = 30_000;
+export const WORKER_SHUTDOWN_AWAIT_MS = 30_000;
 /** The default last-admission window (gateway spec §8.13). */
-const SHUTDOWN_SETTLE_WAIT_MS = 10_000;
+export const SHUTDOWN_SETTLE_WAIT_MS = 10_000;
 /** Short pause between live-run checks while the commit side lane works. */
 const SHUTDOWN_SETTLE_POLL_MS = 10;
 /**
@@ -398,10 +399,13 @@ export class EventBus {
      * 3. drain pending settles and wait (bounded) for placed live runs —
      *    a run settling during this last admission window delivers before
      *    the shutdown flush; a wedged run logs its conversation ids;
-     * 4. deliver `harnessShutdown` to every extension in install order,
-     *    each deadline-bounded. Handlers may commit — admission is still
-     *    open in this window (the seal is `Harness.close`, the caller's
-     *    next step), which is exactly the flush window the spec promises;
+     * 4. deliver `harnessShutdown` to every extension CONCURRENTLY under
+     *    ONE shared hook deadline (D6). Handlers may commit — admission is
+     *    still open in this window (the seal is `Harness.close`, the
+     *    caller's next step), which is exactly the flush window the spec
+     *    promises — but their relative execution and commit order is not
+     *    guaranteed. A wedged handler is abandoned at the shared deadline;
+     *    other handlers' completed commits remain durable;
      * 5. close the bus (idempotent; boot's `subscribeClose` wiring makes a
      *    later `harness.close` a no-op here).
      */
@@ -418,11 +422,18 @@ export class EventBus {
         // harnessShutdown carries no conversation: the conversation-scoped
         // reads resolve empty and `document` serves any conversation.
         const api = this.#apiFor(undefined);
-        for (const [name, handlers] of this.#extensions) {
-            const handler = handlers.harnessShutdown;
-            if (handler === undefined)
-                continue;
-            await this.#bounded(`extension ${name} harnessShutdown`, () => handler(api, context));
+        const registered = [...this.#extensions.entries()].filter(([, handlers]) => handlers.harnessShutdown !== undefined);
+        const calls = registered.map(([name, handlers]) => this.#bounded(`extension ${name} harnessShutdown`, () => handlers.harnessShutdown(api, context)));
+        let timer;
+        const sharedDeadline = new Promise((resolve) => {
+            timer = setTimeout(resolve, Math.max(0, this.#hookDeadlineMs));
+        });
+        try {
+            await Promise.race([Promise.allSettled(calls), sharedDeadline]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
         }
         this.close();
     }
@@ -1266,15 +1277,15 @@ export class EventBus {
             return {
                 entry: async () => undefined,
                 entries: async () => ({ items: [] }),
-                document: ((token, id, context) => harness.snapshot(token, id, context)),
+                document: ((token, id, context) => harness.snapshot(token, id, toDurableContext(context))),
             };
         }
         return {
             entry: (id, context) => this.#readEntry(conversationId, id, context),
             entries: (query, limit, cursor, context) => this.#entriesOf(conversationId, query, limit, cursor, context),
             // The snapshot overloads are generic per call; the narrowed shape
-            // carries one conversation-doc read, forwarded verbatim.
-            document: ((token, id, context) => harness.snapshot(token, id, context)),
+            // carries one conversation-doc read with the D1 context upgrade.
+            document: ((token, id, context) => harness.snapshot(token, id, toDurableContext(context))),
         };
     }
     /** `Conversation.entries` over the settled conversation (read failures resolve empty). */

package/dist/harness/identity/accounts.js

@@ -35,6 +35,7 @@ const VIAS = new Set([
     "self",
     "pairing",
     "admin",
+    "proxy",
 ]);
 /**
  * A `(provider, subject)` already linked to a different user. The
@@ -52,8 +53,8 @@ export class AccountLinkConflictError extends Error {
         this.subject = subject;
     }
 }
-/** `chat:<channel>` / `login:<slug>:<id>` — lowercase, no spaces. */
-const PROVIDER_PATTERN = /^(login|chat):[a-z0-9][a-z0-9._:-]*$/;
+/** `proxy` / `chat:<channel>` / `login:<slug>:<id>` — lowercase, no spaces. */
+const PROVIDER_PATTERN = /^(proxy|(login|chat):[a-z0-9][a-z0-9._:-]*)$/;
 /** A subject is opaque, non-empty, and bounded. */
 const SUBJECT_MAX_LENGTH = 512;
 /**

package/dist/harness/identity/index.js

@@ -21,7 +21,8 @@ import { AccountStore, AccountLinkConflictError, } from "./accounts.js";
 import { TokenStore, generateToken, hashToken, } from "./tokens.js";
 import { InviteStore, DEFAULT_INVITE_EXPIRY_MS, } from "./invites.js";
 import { ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, } from "./setup-code.js";
-export { UserDirectory, effectiveAdmin, storedGroups, AccountStore, AccountLinkConflictError, TokenStore, generateToken, hashToken, InviteStore, DEFAULT_INVITE_EXPIRY_MS, ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, };
+import { sweepAccountLinks, } from "./link-sweep.js";
+export { UserDirectory, effectiveAdmin, storedGroups, AccountStore, AccountLinkConflictError, TokenStore, generateToken, hashToken, InviteStore, DEFAULT_INVITE_EXPIRY_MS, ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, sweepAccountLinks, };
 /** The file names each store owns under its root. */
 const USERS_FILE = "users.json";
 const TOKENS_FILE = "api-tokens.json";

package/dist/harness/identity/invites.js

@@ -33,8 +33,17 @@ function matchesCode(record, digest) {
         return false;
     return timingSafeEqual(Buffer.from(record.sha256, "hex"), Buffer.from(digest, "hex"));
 }
+/** Locate the valid, unused row for one code, or undefined without effects. */
+function validInviteIndex(records, code, now) {
+    const digest = hashToken(code);
+    const index = records.findIndex((record) => matchesCode(record, digest));
+    if (index === -1)
+        return -1;
+    const record = records[index];
+    return record.usedBy === undefined && now <= record.expiresAt ? index : -1;
+}
 /**
- * The file-backed invite store. `redeem` is the single mutator; both
+ * The file-backed invite store. `redeem` is the single mutator; all three
  * methods serialize on the store's {@link MutationQueue}.
  */
 export class InviteStore {
@@ -66,6 +75,19 @@ export class InviteStore {
             return { id: record.id, code, expiresAt: record.expiresAt };
         });
     }
+    /**
+     * Validate a code without consuming it: the same digest, single-use, and
+     * expiry rules as {@link redeem}, returning its grant while leaving the row
+     * untouched. Callers must still redeem last; this is a preflight, not a
+     * reservation against another writer.
+     */
+    peek(code, now = Date.now()) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const index = validInviteIndex(records, code, now);
+            return index === -1 ? undefined : { admin: records[index].admin };
+        });
+    }
     /**
      * Redeem one code for `user`: undefined when no record matches the
      * digest, when the row is already used (single-use, forever), or
@@ -77,15 +99,10 @@ export class InviteStore {
     redeem(code, user, now = Date.now()) {
         return this.mutations.run(async () => {
             const records = this.list();
-            const digest = hashToken(code);
-            const index = records.findIndex((record) => matchesCode(record, digest));
-            const record = index === -1 ? undefined : records[index];
-            if (record === undefined)
-                return undefined;
-            if (record.usedBy !== undefined)
-                return undefined;
-            if (now > record.expiresAt)
+            const index = validInviteIndex(records, code, now);
+            if (index === -1)
                 return undefined;
+            const record = records[index];
             records[index] = { ...record, usedBy: user };
             await writeJson(this.path, records);
             return { admin: record.admin };

package/dist/harness/identity/link-sweep.js

@@ -0,0 +1,47 @@
+/**
+ * The boot-time account-link sweep (username-derivation Task 8, spec
+ * §11.3): runs ONCE at boot, after the identity stores open and before
+ * the listener binds — never on the request path, and never inside the
+ * claim lock (boot is single-threaded before serving).
+ *
+ * Two repair classes:
+ *
+ * - DANGLING LINKS: an `accounts.json` row whose `user` no longer
+ *   exists (a hand-edited file, or a crash between a user deletion and
+ *   its link cleanup). The sweep REMOVES them — the link names an
+ *   identity that cannot resolve, so keeping it only preserves a
+ *   conflict block against a future re-add.
+ *
+ * - CRASH ORPHANS: a `source === "proxy"` user with NO proxy link
+ *   (Task 3's crash window: the user row landed, the link write never
+ *   did). The sweep LISTS them, never repairs: the original proxy
+ *   username is not derivable from the directory key (collisions
+ *   suffix it), so the operator repairs with
+ *   `sigrun user link <key> --proxy <username>`.
+ */
+/**
+ * Remove links whose user is gone and list proxy-source users with no
+ * proxy link. After the initial reads and the serialized unlinks, the
+ * orphan pass deliberately RE-READS accounts.json so a removed link
+ * cannot leave stale state in the orphan list.
+ */
+export async function sweepAccountLinks(users, accounts) {
+    const known = new Set(users.list().map((record) => record.user));
+    const links = accounts.list();
+    const dangling = links.filter((link) => !known.has(link.user));
+    let removedDangling = 0;
+    for (const link of dangling) {
+        if (await accounts.unlink(link.provider, link.subject)) {
+            removedDangling += 1;
+        }
+    }
+    const linkedProxyUsers = new Set(accounts
+        .list()
+        .filter((link) => link.provider === "proxy")
+        .map((link) => link.user));
+    const orphans = users
+        .list()
+        .filter((record) => record.source === "proxy" && !linkedProxyUsers.has(record.user))
+        .map((record) => record.user);
+    return { removedDangling, orphans };
+}

package/dist/harness/identity/typed-username.js

@@ -0,0 +1,15 @@
+/**
+ * Resolve an operator-typed username to its canonical key. Typed entry
+ * points refuse collisions rather than silently suffixing them; the caller
+ * owns the surrounding claim/admission locking and supplies `taken`.
+ */
+import { deriveUsername } from "@sigrun/shared/usernames";
+/** Derive a typed username, refusing unusable input and existing keys. */
+export function normalizeTypedUsername(input, taken) {
+    const key = deriveUsername(input);
+    if (key === undefined)
+        return { ok: false, error: "invalid_username" };
+    if (taken(key))
+        return { ok: false, error: "username_taken" };
+    return { ok: true, key };
+}

package/dist/harness/identity/users.js

@@ -11,9 +11,8 @@
  * after the first add (`isClaimed`); `admin` is a property of the USER
  * (tokens carry their user's rights — never their own admin flag).
  */
+import { isUsernameKey } from "@sigrun/shared/usernames";
 import { MutationQueue, readRecords, writeJson } from "./json-store.js";
-/** The username rule (spec §5.8): lowercase-first, then `[a-z0-9._-]`. */
-const USERNAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 /**
  * Strip the retired C8 field at every write boundary. A legacy on-disk
  * value is readable for compatibility, but never survives another write
@@ -61,9 +60,13 @@ export class UserDirectory {
     async writeRecords(records) {
         await writeJson(this.path, records.map(withoutLegacyGroupAdmin));
     }
-    /** Run the same admission guard used by add, before consuming an invite. */
+    /** Run the shared admission guard before consuming an invite. Writes nothing. */
     checkAdmission() {
-        this.options.admit?.(this.list().length);
+        this.checkAdmissionFor(this.list());
+    }
+    checkAdmissionFor(records) {
+        if (records.length >= 1)
+            this.options.admit?.(records.length);
     }
     /** Every user, insertion order (the first add is the onboarding claim). */
     list() {
@@ -88,15 +91,15 @@ export class UserDirectory {
      */
     add(user) {
         return this.mutations.run(async () => {
-            if (!USERNAME_PATTERN.test(user.user)) {
-                throw new Error(`invalid username "${user.user}": must match ^[a-z0-9][a-z0-9._-]*$`);
+            if (!isUsernameKey(user.user)) {
+                throw new Error(`invalid username "${user.user}": must match ^[a-z0-9][a-z0-9._-]*$ and be at most 128 characters`);
             }
             const records = this.list();
             if (records.some((record) => record.user === user.user)) {
                 throw new Error(`user "${user.user}" already exists`);
             }
             if (records.length >= 1) {
-                this.options.admit?.(records.length);
+                this.checkAdmissionFor(records);
                 if (records.length === 1 && records[0].workspace === undefined && this.options.firstWorkspace !== undefined) {
                     records[0] = { ...records[0], workspace: this.options.firstWorkspace };
                 }

package/dist/harness/interactions.js

@@ -62,6 +62,7 @@ export const InteractionDoc = defineDocFamily({
     kind: "sigrun.interaction",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     family: true,
@@ -76,6 +77,7 @@ export const InteractionsIndexDoc = defineDoc({
     kind: "sigrun.interactions.index",
     version: 1,
     scope: "session",
+    checkpointWhen: () => false,
     initial: () => ({ pending: {} }),
 });
 /** Terminal statuses: answering one of these is a no-op (first wins).