@sigrun/sigrun 0.2.1 → 0.3.0

package/dist/extension.d.ts

@@ -139,7 +139,13 @@ export type ExtensionLifecyclePayload = {
 export type ExtensionRunSettledHandler = (event: RunSettledEvent, api: MemoryEventApi, context: HandlerContext) => void | Promise<void>;
 /** A factory-result lifecycle handler for one event, deadline-bounded. */
 export type ExtensionLifecycleHandler<K extends keyof ExtensionLifecyclePayload> = (event: ExtensionLifecyclePayload[K], api: MemoryEventApi, context: HandlerContext) => void | Promise<void>;
-/** A factory-result `harnessShutdown` handler (no event payload — shutdown is conversation-less). */
+/**
+ * A factory-result `harnessShutdown` handler (no event payload — shutdown is
+ * conversation-less). All extension handlers run CONCURRENTLY under one
+ * shared hook deadline, in no guaranteed relative execution or commit order.
+ * Handlers may still commit; a wedged handler is abandoned without undoing
+ * other handlers' durable commits.
+ */
 export type ExtensionHarnessShutdownHandler = (api: MemoryEventApi, context: HandlerContext) => void | Promise<void>;
 /**
  * The `userDeleted` payload (core hardening W1): which directory user

package/dist/harness/ambient.js

@@ -42,6 +42,7 @@ export const AmbientDoc = defineDocFamily({
     kind: "sigrun.ambient",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     family: true,
@@ -57,6 +58,7 @@ export const AmbientOwnersDoc = defineDoc({
     kind: "sigrun.ambient.owners",
     version: 1,
     scope: "session",
+    checkpointWhen: () => false,
     initial: () => ({ owners: {} }),
 });
 const PLACES = new Set(["status", "footer", "panel"]);

package/dist/harness/blocks/state.js

@@ -28,6 +28,7 @@ export const BlocksStateDoc = defineDocFamily({
     kind: "sigrun.blocks.state",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     family: true,

package/dist/harness/boot.js

@@ -12,10 +12,14 @@ import { join } from "node:path";
 import { Harness, } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
 import { effectiveMethods } from "../config.js";
+import { requiresProxyVouch } from "../server/auth/proxy-only.js";
 import { wireActivity } from "./activity.js";
+import { snapshotBeforeMigration } from "./migration-snapshot.js";
 import { createScheduleTask } from "../jobs/task.js";
 import { createJobsService, jobWireOf } from "../jobs/index.js";
 import { reconcileJobs } from "../jobs/reconcile.js";
+import { applyParkedJobs } from "../jobs/parked.js";
+import { createDurableReports } from "./reports.js";
 import { registerJobObservers } from "../jobs/observe.js";
 import { JobDoc, JobRunDoc, listRevisions } from "../jobs/docs.js";
 import { EventBus } from "./event-bus.js";
@@ -49,6 +53,7 @@ import { resolveWorkerEntry, sandboxLauncher, WorkerPool } from "../sandbox/pool
 import { IsolationState } from "../sandbox/isolation.js";
 import { probeOsUsers } from "../sandbox/availability.js";
 import { createAdmissionGuard } from "./identity/users.js";
+import { sweepAccountLinks } from "./identity/link-sweep.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
 import { probeIsolation, runHelperProbe, selfTestHelper, } from "../sandbox/availability.js";
 import { resolveBuiltins, } from "./builtins.js";
@@ -169,6 +174,25 @@ export async function openHarness(config, options = {}) {
     // I/O here (each file materializes on its first write), so this is
     // pure construction over paths boot already owns.
     const identity = options.identity ?? openIdentityStores(roots);
+    // The account-link sweep (username-derivation Task 8): once at boot,
+    // before serving — dangling links are removed, proxy-source crash
+    // orphans are logged with their repair command (never auto-repaired:
+    // the original proxy username is not derivable from the key).
+    // BEST-EFFORT posture: a sweep failure (e.g. a corrupt accounts.json)
+    // must not crash-loop a serving deployment; the stores' own readers
+    // still fail loud on the request paths if the file is truly corrupt.
+    try {
+        const linkSweep = await sweepAccountLinks(identity.users, identity.accounts);
+        if (linkSweep.removedDangling > 0) {
+            console.log(`identity: removed ${linkSweep.removedDangling} dangling account link(s)`);
+        }
+        for (const orphan of linkSweep.orphans) {
+            console.log(`identity: proxy user "${orphan}" has no proxy link; repair with: sigrun user link ${orphan} --proxy <username>`);
+        }
+    }
+    catch (error) {
+        console.warn(`identity: account-link sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
     // The caller-supplied host wins (serving spec §1: `serve()` resolves
     // the ONE effective host — options.host → SIGRUN_LISTEN_HOST →
     // DEFAULT_LISTEN_HOST — and passes it here). The env read below is
@@ -209,8 +233,10 @@ export async function openHarness(config, options = {}) {
     // is 0600 + atomic, and the cache root is never a backup section).
     // `SIGRUN_SETUP_CODE` pins the value instead (the k8s Secret shape).
     // Claimed boots (every identity-seeded test, every post-onboarding
-    // deploy) write nothing.
-    if (!identity.users.isClaimed()) {
+    // deploy) write nothing. A proxy-only non-loopback boot writes and
+    // logs NOTHING either (C2): account creation there is vouch-only, so
+    // a setup code would be an unvouched account-creation path.
+    if (!identity.users.isClaimed() && !requiresProxyVouch(methods, listenHost)) {
         // `identity.cacheDir`, not `roots.cacheDir`: the claim route reads
         // `readSetupCode(identity.cacheDir)`, and an injected identity
         // bundle (the test seam) may root elsewhere than the resolved
@@ -269,7 +295,18 @@ export async function openHarness(config, options = {}) {
         now: () => Date.now(),
         managed: managedPaths,
     });
-    const storage = await openNodeSqliteStorage(config.storagePath);
+    const storage = await (async () => {
+        // D4: preserve the last schema the previous release can read BEFORE
+        // openNodeSqliteStorage applies its one-way durable migration. The
+        // injected clock keeps snapshots deterministic in tests; a needed
+        // snapshot failure aborts boot here, before any migration write.
+        await snapshotBeforeMigration(config.storagePath, {
+            env,
+            now: options.now ?? (() => new Date()),
+            log: (line) => console.log(line),
+        });
+        return await openNodeSqliteStorage(config.storagePath);
+    })();
     const registry = createRegistry();
     // Late-filled by the loader: factories publish through the same registry
     // instance, and selection rewrites read the declared set LIVE.
@@ -660,6 +697,25 @@ export async function openHarness(config, options = {}) {
         onReadinessChange: observeReadiness,
         snapshotReadiness,
     });
+    // Per-model compaction overrides (D9): after the boot refresh the
+    // catalog is as complete as boot gets, so an override key matching no
+    // known model is almost always a typo (or a stale chain name). Warn
+    // once per unmatched key — never an error: catalogs move and an
+    // unmatched override is simply inert. pi-durable's own key composition
+    // is `${provider}/${modelId}`, so a chain-shaped model id yields a
+    // doubled prefix (e.g. "bifrost/bifrost/<chain>").
+    void bootRefreshDone.then(() => {
+        const overrides = config.compaction.modelOverrides ??
+            bootSettings.server?.compaction?.modelOverrides;
+        if (overrides === undefined)
+            return;
+        const known = new Set(models.getModels().map((model) => `${model.provider}/${model.id}`));
+        for (const key of Object.keys(overrides)) {
+            if (!known.has(key)) {
+                console.warn(`compaction override "${key}" matches no known model`);
+            }
+        }
+    });
     // The boot-wired single-provider refresh (W3 Task 6): the route
     // surface's refresh — the same bound policy `resolveServedModelRefreshing`
     // runs on a miss, with the same readiness observation so a provider a
@@ -724,15 +780,23 @@ export async function openHarness(config, options = {}) {
     const fileSettings = settingsStore.harnessSettings();
     const callerSettings = options.settings;
     // The ONE boot clock (options.now ?? real): the activity stamper AND
-    // the harness clock share it (the schedule task's `runtime.sleep`
-    // reads the harness clock; pinning the seam pins both — the jobs
-    // tests' time-injection lever).
+    // the harness clock share it (the schedule task's `sleepUntil`
+    // deadlines live on the harness clock; pinning the seam pins both —
+    // the jobs tests' time-injection lever).
     const clockNow = options.now ?? (() => new Date());
+    // D5: reports may arrive inside Harness.open. The collector logs/counts
+    // synchronously and queues parks; job patches drain after binding below.
+    const reports = createDurableReports({
+        log: (line) => console.error(line),
+        onReport: options.onReport,
+    });
     const harness = await Harness.open(storage, {
         models,
         registry,
         env: envBuilder,
         now: () => clockNow().getTime(),
+        setTimer: options.setTimer,
+        onReport: reports.onReport,
         // Context-management policy (Task 8): config's `SIGRUN_COMPACTION_*`
         // tuning, with any caller-set field winning over it. Upstream merges
         // the result over `DEFAULT_COMPACTION_POLICY` per field. Task 8a: the
@@ -744,6 +808,14 @@ export async function openHarness(config, options = {}) {
         // snapshots the file's boot-time values, silently freezing the
         // queue modes and clobbering the caller seam (the round-1 defects).
         // `extensions`/`toolExecution` have no file backing — plain passthrough.
+        // Compaction (D9): ONLY `modelOverrides` comes from the file here —
+        // it has no env spelling, so this adds a file tier without touching
+        // the four env-backed knobs' precedence (env over file, resolved by
+        // loadConfig). serve already folds the file into config; the
+        // conditional spread keeps a config-resolved map authoritative and
+        // covers direct `openHarness` boots. Read ONCE (boot-time), so a
+        // PATCH is restart-pending exactly like the other compaction keys.
+        // Order: caller seam > config (env over file) > this file fallback.
         settings: {
             get steeringMode() {
                 return callerSettings?.steeringMode ?? fileSettings.steeringMode;
@@ -767,6 +839,10 @@ export async function openHarness(config, options = {}) {
             toolExecution: callerSettings?.toolExecution,
             compaction: {
                 ...config.compaction,
+                ...(config.compaction.modelOverrides === undefined &&
+                    bootSettings.server?.compaction?.modelOverrides !== undefined
+                    ? { modelOverrides: bootSettings.server.compaction.modelOverrides }
+                    : {}),
                 ...callerSettings?.compaction,
             },
         },
@@ -786,6 +862,9 @@ export async function openHarness(config, options = {}) {
     // JobsService — happens after this point.
     jobRuntimeDeps.harness = harness;
     jobRuntimeDeps.storage = storage;
+    // Drain the restart-limit parks reported during open before scheduling
+    // resumes. A failed status patch is logged and dropped by applyParkedJobs.
+    await applyParkedJobs(harness, reports.takeParked(), BACKGROUND_CONTEXT);
     // The memory-seam event bus (Tasks 2-4): subscribe BEFORE `resume()` so
     // recovery settles (faulted/orphaned submissions the scheduler drains)
     // are observed like any other commit. Extension handlers register under
@@ -1063,6 +1142,7 @@ export async function openHarness(config, options = {}) {
         userToolSweep,
         models,
         jobs,
+        reports,
         jobRunTotals: () => jobRunTotals,
         defaultModel,
         providerCollisions: sink.collisions,

package/dist/harness/context.js

@@ -0,0 +1,25 @@
+/**
+ * Normalize the extension contract's structural invocation context to the
+ * full chord Context required by pi-durable 1.4.0.
+ *
+ * Extensions deliberately depend only on HandlerContext (`abortSignal`), so
+ * they may pass a plain object. Durable publishes read telemetry and other
+ * context values, however; forwarding that literal would make the first
+ * entry/submission write fail at the host boundary. Deriving from
+ * BACKGROUND_CONTEXT supplies the runtime defaults while preserving caller
+ * cancellation. A real Context passes through BY IDENTITY so its telemetry
+ * parent and application values are never discarded.
+ */
+import { BACKGROUND_CONTEXT, withAbortSignal, } from "@earendil-works/chord/context";
+/** Upgrade a structural handler context, or retain an existing chord context. */
+export function toDurableContext(context) {
+    const candidate = context;
+    if (typeof candidate.telemetry === "object" &&
+        candidate.telemetry !== null &&
+        typeof candidate.value === "function") {
+        return context;
+    }
+    return context.abortSignal === undefined
+        ? BACKGROUND_CONTEXT
+        : withAbortSignal(context.abortSignal, BACKGROUND_CONTEXT);
+}

package/dist/harness/event-bus.js

@@ -64,6 +64,7 @@ import { SessionMetaDoc } from "../server/session-meta.js";
 import { EXPANDED_ENTRY_KIND } from "../commands/expand.js";
 import { InteractionDoc, TERMINAL as INTERACTION_TERMINAL } from "./interactions.js";
 import { AmbientDoc } from "./ambient.js";
+import { toDurableContext } from "./context.js";
 import { beginUserDeletion } from "./stores.js";
 /** Project a SessionMeta doc value into the tracked basis. */
 function metaBasisOf(value) {
@@ -84,9 +85,9 @@ function metaBasisOf(value) {
     return basis;
 }
 /** How long shutdown waits for in-flight worker runs before abandoning (spec §3). */
-const WORKER_SHUTDOWN_AWAIT_MS = 30_000;
+export const WORKER_SHUTDOWN_AWAIT_MS = 30_000;
 /** The default last-admission window (gateway spec §8.13). */
-const SHUTDOWN_SETTLE_WAIT_MS = 10_000;
+export const SHUTDOWN_SETTLE_WAIT_MS = 10_000;
 /** Short pause between live-run checks while the commit side lane works. */
 const SHUTDOWN_SETTLE_POLL_MS = 10;
 /**
@@ -398,10 +399,13 @@ export class EventBus {
      * 3. drain pending settles and wait (bounded) for placed live runs —
      *    a run settling during this last admission window delivers before
      *    the shutdown flush; a wedged run logs its conversation ids;
-     * 4. deliver `harnessShutdown` to every extension in install order,
-     *    each deadline-bounded. Handlers may commit — admission is still
-     *    open in this window (the seal is `Harness.close`, the caller's
-     *    next step), which is exactly the flush window the spec promises;
+     * 4. deliver `harnessShutdown` to every extension CONCURRENTLY under
+     *    ONE shared hook deadline (D6). Handlers may commit — admission is
+     *    still open in this window (the seal is `Harness.close`, the
+     *    caller's next step), which is exactly the flush window the spec
+     *    promises — but their relative execution and commit order is not
+     *    guaranteed. A wedged handler is abandoned at the shared deadline;
+     *    other handlers' completed commits remain durable;
      * 5. close the bus (idempotent; boot's `subscribeClose` wiring makes a
      *    later `harness.close` a no-op here).
      */
@@ -418,11 +422,18 @@ export class EventBus {
         // harnessShutdown carries no conversation: the conversation-scoped
         // reads resolve empty and `document` serves any conversation.
         const api = this.#apiFor(undefined);
-        for (const [name, handlers] of this.#extensions) {
-            const handler = handlers.harnessShutdown;
-            if (handler === undefined)
-                continue;
-            await this.#bounded(`extension ${name} harnessShutdown`, () => handler(api, context));
+        const registered = [...this.#extensions.entries()].filter(([, handlers]) => handlers.harnessShutdown !== undefined);
+        const calls = registered.map(([name, handlers]) => this.#bounded(`extension ${name} harnessShutdown`, () => handlers.harnessShutdown(api, context)));
+        let timer;
+        const sharedDeadline = new Promise((resolve) => {
+            timer = setTimeout(resolve, Math.max(0, this.#hookDeadlineMs));
+        });
+        try {
+            await Promise.race([Promise.allSettled(calls), sharedDeadline]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
         }
         this.close();
     }
@@ -1266,15 +1277,15 @@ export class EventBus {
             return {
                 entry: async () => undefined,
                 entries: async () => ({ items: [] }),
-                document: ((token, id, context) => harness.snapshot(token, id, context)),
+                document: ((token, id, context) => harness.snapshot(token, id, toDurableContext(context))),
             };
         }
         return {
             entry: (id, context) => this.#readEntry(conversationId, id, context),
             entries: (query, limit, cursor, context) => this.#entriesOf(conversationId, query, limit, cursor, context),
             // The snapshot overloads are generic per call; the narrowed shape
-            // carries one conversation-doc read, forwarded verbatim.
-            document: ((token, id, context) => harness.snapshot(token, id, context)),
+            // carries one conversation-doc read with the D1 context upgrade.
+            document: ((token, id, context) => harness.snapshot(token, id, toDurableContext(context))),
         };
     }
     /** `Conversation.entries` over the settled conversation (read failures resolve empty). */

package/dist/harness/identity/accounts.js

@@ -35,6 +35,7 @@ const VIAS = new Set([
     "self",
     "pairing",
     "admin",
+    "proxy",
 ]);
 /**
  * A `(provider, subject)` already linked to a different user. The
@@ -52,8 +53,8 @@ export class AccountLinkConflictError extends Error {
         this.subject = subject;
     }
 }
-/** `chat:<channel>` / `login:<slug>:<id>` — lowercase, no spaces. */
-const PROVIDER_PATTERN = /^(login|chat):[a-z0-9][a-z0-9._:-]*$/;
+/** `proxy` / `chat:<channel>` / `login:<slug>:<id>` — lowercase, no spaces. */
+const PROVIDER_PATTERN = /^(proxy|(login|chat):[a-z0-9][a-z0-9._:-]*)$/;
 /** A subject is opaque, non-empty, and bounded. */
 const SUBJECT_MAX_LENGTH = 512;
 /**

package/dist/harness/identity/index.js

@@ -21,7 +21,8 @@ import { AccountStore, AccountLinkConflictError, } from "./accounts.js";
 import { TokenStore, generateToken, hashToken, } from "./tokens.js";
 import { InviteStore, DEFAULT_INVITE_EXPIRY_MS, } from "./invites.js";
 import { ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, } from "./setup-code.js";
-export { UserDirectory, effectiveAdmin, storedGroups, AccountStore, AccountLinkConflictError, TokenStore, generateToken, hashToken, InviteStore, DEFAULT_INVITE_EXPIRY_MS, ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, };
+import { sweepAccountLinks, } from "./link-sweep.js";
+export { UserDirectory, effectiveAdmin, storedGroups, AccountStore, AccountLinkConflictError, TokenStore, generateToken, hashToken, InviteStore, DEFAULT_INVITE_EXPIRY_MS, ensureSetupCode, readSetupCode, clearSetupCode, generateCode, setupCodePath, CODE_ALPHABET, sweepAccountLinks, };
 /** The file names each store owns under its root. */
 const USERS_FILE = "users.json";
 const TOKENS_FILE = "api-tokens.json";

package/dist/harness/identity/invites.js

@@ -33,8 +33,17 @@ function matchesCode(record, digest) {
         return false;
     return timingSafeEqual(Buffer.from(record.sha256, "hex"), Buffer.from(digest, "hex"));
 }
+/** Locate the valid, unused row for one code, or undefined without effects. */
+function validInviteIndex(records, code, now) {
+    const digest = hashToken(code);
+    const index = records.findIndex((record) => matchesCode(record, digest));
+    if (index === -1)
+        return -1;
+    const record = records[index];
+    return record.usedBy === undefined && now <= record.expiresAt ? index : -1;
+}
 /**
- * The file-backed invite store. `redeem` is the single mutator; both
+ * The file-backed invite store. `redeem` is the single mutator; all three
  * methods serialize on the store's {@link MutationQueue}.
  */
 export class InviteStore {
@@ -66,6 +75,19 @@ export class InviteStore {
             return { id: record.id, code, expiresAt: record.expiresAt };
         });
     }
+    /**
+     * Validate a code without consuming it: the same digest, single-use, and
+     * expiry rules as {@link redeem}, returning its grant while leaving the row
+     * untouched. Callers must still redeem last; this is a preflight, not a
+     * reservation against another writer.
+     */
+    peek(code, now = Date.now()) {
+        return this.mutations.run(async () => {
+            const records = this.list();
+            const index = validInviteIndex(records, code, now);
+            return index === -1 ? undefined : { admin: records[index].admin };
+        });
+    }
     /**
      * Redeem one code for `user`: undefined when no record matches the
      * digest, when the row is already used (single-use, forever), or
@@ -77,15 +99,10 @@ export class InviteStore {
     redeem(code, user, now = Date.now()) {
         return this.mutations.run(async () => {
             const records = this.list();
-            const digest = hashToken(code);
-            const index = records.findIndex((record) => matchesCode(record, digest));
-            const record = index === -1 ? undefined : records[index];
-            if (record === undefined)
-                return undefined;
-            if (record.usedBy !== undefined)
-                return undefined;
-            if (now > record.expiresAt)
+            const index = validInviteIndex(records, code, now);
+            if (index === -1)
                 return undefined;
+            const record = records[index];
             records[index] = { ...record, usedBy: user };
             await writeJson(this.path, records);
             return { admin: record.admin };

package/dist/harness/identity/link-sweep.js

@@ -0,0 +1,47 @@
+/**
+ * The boot-time account-link sweep (username-derivation Task 8, spec
+ * §11.3): runs ONCE at boot, after the identity stores open and before
+ * the listener binds — never on the request path, and never inside the
+ * claim lock (boot is single-threaded before serving).
+ *
+ * Two repair classes:
+ *
+ * - DANGLING LINKS: an `accounts.json` row whose `user` no longer
+ *   exists (a hand-edited file, or a crash between a user deletion and
+ *   its link cleanup). The sweep REMOVES them — the link names an
+ *   identity that cannot resolve, so keeping it only preserves a
+ *   conflict block against a future re-add.
+ *
+ * - CRASH ORPHANS: a `source === "proxy"` user with NO proxy link
+ *   (Task 3's crash window: the user row landed, the link write never
+ *   did). The sweep LISTS them, never repairs: the original proxy
+ *   username is not derivable from the directory key (collisions
+ *   suffix it), so the operator repairs with
+ *   `sigrun user link <key> --proxy <username>`.
+ */
+/**
+ * Remove links whose user is gone and list proxy-source users with no
+ * proxy link. After the initial reads and the serialized unlinks, the
+ * orphan pass deliberately RE-READS accounts.json so a removed link
+ * cannot leave stale state in the orphan list.
+ */
+export async function sweepAccountLinks(users, accounts) {
+    const known = new Set(users.list().map((record) => record.user));
+    const links = accounts.list();
+    const dangling = links.filter((link) => !known.has(link.user));
+    let removedDangling = 0;
+    for (const link of dangling) {
+        if (await accounts.unlink(link.provider, link.subject)) {
+            removedDangling += 1;
+        }
+    }
+    const linkedProxyUsers = new Set(accounts
+        .list()
+        .filter((link) => link.provider === "proxy")
+        .map((link) => link.user));
+    const orphans = users
+        .list()
+        .filter((record) => record.source === "proxy" && !linkedProxyUsers.has(record.user))
+        .map((record) => record.user);
+    return { removedDangling, orphans };
+}

package/dist/harness/identity/typed-username.js

@@ -0,0 +1,15 @@
+/**
+ * Resolve an operator-typed username to its canonical key. Typed entry
+ * points refuse collisions rather than silently suffixing them; the caller
+ * owns the surrounding claim/admission locking and supplies `taken`.
+ */
+import { deriveUsername } from "@sigrun/shared/usernames";
+/** Derive a typed username, refusing unusable input and existing keys. */
+export function normalizeTypedUsername(input, taken) {
+    const key = deriveUsername(input);
+    if (key === undefined)
+        return { ok: false, error: "invalid_username" };
+    if (taken(key))
+        return { ok: false, error: "username_taken" };
+    return { ok: true, key };
+}

package/dist/harness/identity/users.js

@@ -11,9 +11,8 @@
  * after the first add (`isClaimed`); `admin` is a property of the USER
  * (tokens carry their user's rights — never their own admin flag).
  */
+import { isUsernameKey } from "@sigrun/shared/usernames";
 import { MutationQueue, readRecords, writeJson } from "./json-store.js";
-/** The username rule (spec §5.8): lowercase-first, then `[a-z0-9._-]`. */
-const USERNAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 /**
  * Strip the retired C8 field at every write boundary. A legacy on-disk
  * value is readable for compatibility, but never survives another write
@@ -61,9 +60,13 @@ export class UserDirectory {
     async writeRecords(records) {
         await writeJson(this.path, records.map(withoutLegacyGroupAdmin));
     }
-    /** Run the same admission guard used by add, before consuming an invite. */
+    /** Run the shared admission guard before consuming an invite. Writes nothing. */
     checkAdmission() {
-        this.options.admit?.(this.list().length);
+        this.checkAdmissionFor(this.list());
+    }
+    checkAdmissionFor(records) {
+        if (records.length >= 1)
+            this.options.admit?.(records.length);
     }
     /** Every user, insertion order (the first add is the onboarding claim). */
     list() {
@@ -88,15 +91,15 @@ export class UserDirectory {
      */
     add(user) {
         return this.mutations.run(async () => {
-            if (!USERNAME_PATTERN.test(user.user)) {
-                throw new Error(`invalid username "${user.user}": must match ^[a-z0-9][a-z0-9._-]*$`);
+            if (!isUsernameKey(user.user)) {
+                throw new Error(`invalid username "${user.user}": must match ^[a-z0-9][a-z0-9._-]*$ and be at most 128 characters`);
             }
             const records = this.list();
             if (records.some((record) => record.user === user.user)) {
                 throw new Error(`user "${user.user}" already exists`);
             }
             if (records.length >= 1) {
-                this.options.admit?.(records.length);
+                this.checkAdmissionFor(records);
                 if (records.length === 1 && records[0].workspace === undefined && this.options.firstWorkspace !== undefined) {
                     records[0] = { ...records[0], workspace: this.options.firstWorkspace };
                 }

package/dist/harness/interactions.js

@@ -62,6 +62,7 @@ export const InteractionDoc = defineDocFamily({
     kind: "sigrun.interaction",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     family: true,
@@ -76,6 +77,7 @@ export const InteractionsIndexDoc = defineDoc({
     kind: "sigrun.interactions.index",
     version: 1,
     scope: "session",
+    checkpointWhen: () => false,
     initial: () => ({ pending: {} }),
 });
 /** Terminal statuses: answering one of these is a no-op (first wins).

package/dist/harness/loader.js

@@ -89,6 +89,7 @@ import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { satisfies, validRange } from "semver";
 import { HOST_RUNTIME_MODULES, hostModuleVersion, readPackageAssetsDir, readPackageName, readPackageVersion, resolveExtensionEntry, } from "./packages.js";
 import { RESERVED_CORE_SECTION_KEYS, RESERVED_EXTENSION_SLUGS, } from "./reserved-sections.js";
 import { slugifyName } from "./stores.js";
@@ -997,6 +998,57 @@ function checkHostModules(moduleDir) {
             `host runs ${hostVersion} (same major, allowed)`);
     }
 }
+/**
+ * The Earendil host modules whose DECLARED peer ranges the loader checks.
+ * Other peers (typebox and @sigrun/sigrun) have different compatibility
+ * contracts and are deliberately outside this guard.
+ */
+const DECLARED_PEER_MODULES = [
+    "@earendil-works/pi-durable",
+    "@earendil-works/chord",
+    "@earendil-works/pi-ai",
+];
+/**
+ * The declared-peer guard (pi-durable 1.4.0 D7): after the resolved-version
+ * guard, reject an Earendil peer range that excludes the running host.
+ * Non-semver specifiers (file:, link:, git:, URLs, workspace:) and wildcards
+ * pass; a missing or unreadable manifest also passes because the guard never
+ * quarantines what it cannot read.
+ *
+ * @param moduleDir the extension ENTRY's directory; the owning package
+ * manifest is the nearest manifest at or above it.
+ * @returns the quarantine reason, or undefined when the declaration admits
+ * the host or cannot be evaluated.
+ */
+function checkDeclaredPeers(moduleDir) {
+    const manifestPath = nearestManifest(moduleDir);
+    if (manifestPath === undefined)
+        return undefined;
+    let peers;
+    try {
+        const parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+        if (typeof parsed.peerDependencies !== "object" ||
+            parsed.peerDependencies === null ||
+            Array.isArray(parsed.peerDependencies)) {
+            return undefined;
+        }
+        peers = parsed.peerDependencies;
+    }
+    catch {
+        return undefined;
+    }
+    for (const name of DECLARED_PEER_MODULES) {
+        const range = peers[name];
+        if (typeof range !== "string" || validRange(range) === null)
+            continue;
+        const hostVersion = hostModuleVersion(name);
+        if (hostVersion !== undefined &&
+            !satisfies(hostVersion, range)) {
+            return `peer ${name} ${range} excludes host ${hostVersion}`;
+        }
+    }
+    return undefined;
+}
 /**
  * The extension module's DIRECTORY — the anchor a contributed bundle's
  * relative `dir` resolves against (build-and-webui Task 6: an
@@ -1497,8 +1549,12 @@ export async function loadExtensions(specifiers, registry, options = {}) {
             // here rides the existing per-extension try (quarantine, boot
             // continues) exactly like the reserved-section check below.
             const moduleDir = extensionModuleDir(loaded);
-            if (moduleDir !== undefined)
+            if (moduleDir !== undefined) {
                 checkHostModules(moduleDir);
+                const peerReason = checkDeclaredPeers(moduleDir);
+                if (peerReason !== undefined)
+                    throw new Error(peerReason);
+            }
             // Two-phase host: the factory receives the host at CALL time, but
             // the extension name and kinds it declares are only known from its
             // RESULT. The loader therefore invokes the host factory TWICE with