@sigrun/sigrun 0.2.1 → 0.3.0

package/dist/server/routes/admin.js

@@ -18,12 +18,24 @@
  * graceful-shutdown + `process.exit(0)`) owns the exit — the route
  * never calls exit itself.
  *
+ * D5 parked-task recovery (pi-durable 1.4.0, Task B6):
+ * `GET /v1/admin/tasks?state=blocked` lists blocked tasks from
+ * `harness.inspect()` (id, kind, reason, conversationId, owner from the
+ * conversation's SessionMeta when present); `POST /v1/admin/tasks/:id/retry`
+ * returns 404 unknown_task / 409 not_parked unless the task is blocked
+ * with reason restart_limit, else calls `harness.retryTask(id)` → 204.
+ * The inspect-first check is load-bearing: retryTask rejects an unknown
+ * id but SILENTLY no-ops for a task that isn't parked. Both endpoints
+ * are admin-only (403 forbidden).
+ *
  * Durability (Review Focus 4): the restart rides the SAME ordered
  * shutdown as the SIGTERM path — the event bus drains pending settles
  * and the harness close seals storage, so a run in flight at restart
  * has its submission durable before exit; pi-durable resumes it after
  * the supervisor brings the process back.
  */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { SessionMetaDoc } from "../session-meta.js";
 /** Register the `/v1/admin` routes. */
 export function registerAdminRoutes(app, ctx) {
     app.post("/v1/admin/restart", async (request, reply) => {
@@ -55,4 +67,89 @@ export function registerAdminRoutes(app, ctx) {
         });
         return await reply.code(202).send({ restarting: true });
     });
+    // D5 parked-task recovery. `GET /v1/admin/tasks?state=blocked` lists
+    // blocked tasks from `harness.inspect()`; `POST /v1/admin/tasks/:id/retry`
+    // re-runs a restart-parked task. Both admin-only (403 before any
+    // inspection, so a non-admin learns nothing about the task graph).
+    app.get("/v1/admin/tasks", async (request, reply) => {
+        if (!request.principal.admin) {
+            return await reply.code(403).send({ error: "forbidden" });
+        }
+        const query = request.query;
+        // Only the blocked projection exists (the recovery surface); any
+        // other state filter is a fail-loud 400, same posture as the
+        // conversations list's strict booleans.
+        if (query.state !== undefined && query.state !== "blocked") {
+            return await reply.code(400).send({ error: "invalid_field", field: "state" });
+        }
+        const inspection = await ctx.opened.harness.inspect(BACKGROUND_CONTEXT);
+        const blocked = inspection.tasks.filter((task) => task.state.kind === "blocked");
+        // Owner: the conversation's SessionMeta.owner when it has one.
+        // Reads are snapshots (never materialize the doc); a raced read
+        // degrades to an omitted owner, not a failed list.
+        const owners = new Map();
+        for (const task of blocked) {
+            const conversationId = Number(task.record.conversationId);
+            if (owners.has(conversationId))
+                continue;
+            try {
+                const meta = await ctx.opened.harness.snapshot(SessionMetaDoc, task.record.conversationId, BACKGROUND_CONTEXT);
+                owners.set(conversationId, meta?.owner);
+            }
+            catch (error) {
+                console.error("admin tasks: SessionMeta snapshot failed:", error);
+                owners.set(conversationId, undefined);
+            }
+        }
+        // Extension: task names are unique across installed extensions, so
+        // ONE registry snapshot resolves the owning extension. Built-in
+        // generation/tool/compaction tasks have no installed extension and
+        // correctly omit the field.
+        const extensionsByTask = new Map();
+        for (const extension of ctx.opened.registry.snapshot().installed()) {
+            for (const task of extension.tasks ?? []) {
+                extensionsByTask.set(task.definition.name, extension.name);
+            }
+        }
+        const tasks = blocked.map((task) => {
+            const conversationId = Number(task.record.conversationId);
+            const owner = owners.get(conversationId);
+            const extension = extensionsByTask.get(task.record.kind);
+            return {
+                id: Number(task.record.id),
+                kind: task.record.kind,
+                reason: task.state.reason,
+                conversationId,
+                ...(owner === undefined ? {} : { owner }),
+                ...(extension === undefined ? {} : { extension }),
+            };
+        });
+        return await reply.send({ tasks });
+    });
+    app.post("/v1/admin/tasks/:id/retry", async (request, reply) => {
+        if (!request.principal.admin) {
+            return await reply.code(403).send({ error: "forbidden" });
+        }
+        const { id } = request.params;
+        const taskId = Number(id);
+        if (!Number.isInteger(taskId) || taskId < 0 || String(taskId) !== id) {
+            return await reply.code(404).send({ error: "unknown_task" });
+        }
+        // Check inspect() FIRST: pi-durable's retryTask rejects an unknown
+        // id but SILENTLY no-ops for a task that isn't parked — the 409
+        // must come from the inspection, not from retryTask.
+        const inspection = await ctx.opened.harness.inspect(BACKGROUND_CONTEXT);
+        const task = inspection.tasks.find((candidate) => String(candidate.record.id) === id);
+        if (task === undefined) {
+            return await reply.code(404).send({ error: "unknown_task" });
+        }
+        if (task.state.kind !== "blocked" || task.state.reason !== "restart_limit") {
+            return await reply.code(409).send({ error: "not_parked" });
+        }
+        // For a schedule task the job's status fields return to `waiting`
+        // on the task's next committed state (the task's own phases patch
+        // the record) — the route deliberately does NOT hand-patch the job.
+        await ctx.opened.harness.retryTask(task.record.id, BACKGROUND_CONTEXT);
+        return await reply.code(204).send();
+    });
 }

package/dist/server/routes/login.js

@@ -1,4 +1,5 @@
 import { ipAllowed } from "../auth/ip.js";
+import { requiresProxyVouch } from "../auth/proxy-only.js";
 import { bearerOf, resolveToken, sessionCookieOf } from "../auth/pipeline.js";
 import { LoginFlows } from "../login/flows.js";
 import { clearSetupCode, readSetupCode } from "../../harness/identity/setup-code.js";
@@ -191,6 +192,13 @@ export function registerLoginRoutes(app, ctx, options = {}) {
         // The webui client requests JSON so fetch never follows a redirect
         // into an HTML document. Existing form callers keep the 302 contract.
         const asJson = request.headers.accept?.includes("application/json") === true;
+        // C2: this route creates an account from a parked external-identity
+        // flow plus a setup/invite code — it carries NO proxy identity, so
+        // on a proxy-only non-loopback bind it ALWAYS refuses, before any
+        // code evaluation or account provisioning.
+        if (requiresProxyVouch(ctx.methods, ctx.listenHost)) {
+            return browserError(reply, 403, "proxy_identity_required", asJson);
+        }
         const pending = flows.takePending(record.key);
         if (pending === undefined)
             return browserError(reply, 400, "login_expired", asJson);

package/dist/server/routes/metrics.js

@@ -55,12 +55,14 @@
  * type is `text/plain; version=0.0.4; charset=utf-8`.
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { REPORT_TYPES } from "../../harness/reports.js";
 import { readBackupMarker } from "../../backup/marker.js";
 import { scanJobs } from "../../jobs/docs.js";
 import { providerAuthStatus } from "../helpers.js";
 import { checkStorage } from "../readiness.js";
 /** The exposition content type (spec §6.9's format rule). */
 const EXPOSITION_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+const BLOCKED_REASONS = ["missing_task", "task_too_old", "migration_failed", "restart_limit"];
 /** Escape one label value per the exposition format: `\` → `\\`,
  *  `"` → `\"`, newline → `\n`. */
 function escapeLabelValue(value) {
@@ -121,18 +123,28 @@ export function registerMetricsRoutes(app, ctx) {
             // run is live — the alert's `> 1800` must not key on absence).
             const oldestMs = opened.eventBus.oldestLiveAdmissionMs();
             family("sigrun_inflight_submission_oldest_seconds", "Age of the oldest in-flight submission's admission (0 when none; in-process clock — a pre-restart run is invisible until it settles)", [{ labels: {}, value: Math.round((oldestMs ?? 0) / 1000) }]);
-            // Live tasks by scheduler state kind. The full five-kind
-            // vocabulary is emitted (0s included) for label stability.
+            // Live tasks by scheduler state kind. The full six-kind
+            // vocabulary is emitted (0s included) for label stability
+            // (1.4.0 adds `sleeping` — the durable-sleep state).
             const taskStatuses = {
                 running: 0,
                 ready: 0,
                 waiting: 0,
+                sleeping: 0,
                 completing: 0,
                 blocked: 0,
             };
+            const blockedReasons = Object.fromEntries(BLOCKED_REASONS.map((reason) => [reason, 0]));
             for (const task of inspection.tasks) {
                 taskStatuses[task.state.kind] = (taskStatuses[task.state.kind] ?? 0) + 1;
+                if (task.state.kind === "blocked") {
+                    blockedReasons[task.state.reason] = (blockedReasons[task.state.reason] ?? 0) + 1;
+                }
             }
+            family("sigrun_tasks_blocked", "Live tasks blocked by scheduler reason", Object.entries(blockedReasons).map(([reason, count]) => ({
+                labels: { reason },
+                value: count,
+            })));
             family("sigrun_tasks_live", "Live tasks by scheduler state", Object.entries(taskStatuses).map(([status, count]) => ({
                 labels: { status },
                 value: count,
@@ -173,6 +185,10 @@ export function registerMetricsRoutes(app, ctx) {
         // failure even while inspection (and the whole scrape) stays green.
         const storage = await checkStorage(ctx);
         family("sigrun_ready", "1 when the readiness storage check (the /readyz root-conversation read) succeeds", [{ labels: {}, value: storage === "ok" ? 1 : 0 }]);
+        // D5: process-local durable failure reports. Every known type is
+        // emitted, including zeros, for scrape-stable alert expressions.
+        const reportCounts = opened.reports.counts();
+        family("sigrun_durable_reports_total", "Durable failure reports since process start", REPORT_TYPES.map((type) => ({ labels: { type }, value: reportCounts[type] })), "counter");
         // Provider readiness: the shared derivation (`GET /v1/auth/check`'s
         // exact chain), one 1-valued sample per (provider, current status).
         const producersByName = new Map(opened.providerHealth.map((producer) => [producer.name, producer]));

package/dist/server/routes/onboarding.js

@@ -17,7 +17,12 @@ import { timingSafeEqual } from "node:crypto";
 import { withClaimLock } from "../auth/claim-lock.js";
 import { ipAllowed } from "../auth/ip.js";
 import { isLoopbackHost } from "../auth/loopback.js";
+import { ownHostPeerPermitted } from "../auth/own-host.js";
+import { previewProxyUser, provisionProxyUser } from "../auth/proxy-identity.js";
+import { ProxyRejectReason, warnProxyRejected, } from "../auth/proxy-diagnostic.js";
+import { requiresProxyVouch } from "../auth/proxy-only.js";
 import { readSetupCode, clearSetupCode } from "../../harness/identity/index.js";
+import { normalizeTypedUsername } from "../../harness/identity/typed-username.js";
 import { setupCodeMatches } from "../../harness/identity/setup-code-check.js";
 import { AdmissionRefusedError } from "../../harness/identity/users.js";
 import { stampSessionOwner } from "../helpers.js";
@@ -28,8 +33,6 @@ function headerOf(request, name) {
     const single = Array.isArray(value) ? value[0] : value;
     return single?.trim() || undefined;
 }
-/** The username rule (spec §5.8, shared with the directory's own check). */
-const USERNAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 /** Constant-time string equality (the pipeline's discipline). */
 function timingSafeStringEqual(a, b) {
     const left = Buffer.from(a, "utf8");
@@ -52,8 +55,24 @@ function timingSafeStringEqual(a, b) {
 function resolveProxyIdentity(request, ctx) {
     if (!ctx.methods.includes("proxy"))
         return undefined;
+    // The rejection diagnostic (proxy-trust C1): while the instance is
+    // UNCLAIMED, every rejection branch reports WHY via the shared,
+    // throttled warn — these routes sit on the public path the pipeline
+    // never visits, so without this their proxy rejections are silent.
+    // Once claimed the onboarding surface no longer needs the signal.
+    const diagnose = !ctx.opened.identity.users.isClaimed();
     const { proxy } = ctx.config.auth;
     if (!ipAllowed(request.socket.remoteAddress, proxy.trustedProxies)) {
+        if (diagnose)
+            warnProxyRejected(request, ProxyRejectReason.UNTRUSTED);
+        return undefined;
+    }
+    // C5: the same own-host discipline as the pipeline — an own-host
+    // peer reached through a range without the shared secret never
+    // vouches (any local process could claim the first admin).
+    if (!ownHostPeerPermitted(request.socket.remoteAddress, proxy.trustedProxies, proxy.secret !== undefined && proxy.secretHeader !== undefined)) {
+        if (diagnose)
+            warnProxyRejected(request, ProxyRejectReason.OWN_HOST);
         return undefined;
     }
     if (proxy.secret !== undefined && proxy.secretHeader !== undefined) {
@@ -62,16 +81,32 @@ function resolveProxyIdentity(request, ctx) {
         delete request.headers[name];
         if (presented === undefined ||
             !timingSafeStringEqual(presented, proxy.secret)) {
+            if (diagnose) {
+                warnProxyRejected(request, ProxyRejectReason.secretReason(proxy.secretHeader));
+            }
             return undefined;
         }
     }
     const user = headerOf(request, proxy.userHeader);
-    if (user === undefined || !USERNAME_PATTERN.test(user))
+    // An absent OR EMPTY (headerOf trims to undefined) user header is the
+    // missing-header reason; a present-but-unrepresentable claim is the
+    // unusable-claim reason. Neither line carries the claimed VALUE.
+    if (user === undefined) {
+        if (diagnose) {
+            warnProxyRejected(request, ProxyRejectReason.missingHeaderReason(proxy.userHeader.toLowerCase()));
+        }
         return undefined;
+    }
+    const preview = previewProxyUser(ctx.opened.identity, user);
+    if (preview === undefined) {
+        if (diagnose)
+            warnProxyRejected(request, ProxyRejectReason.UNUSABLE);
+        return undefined;
+    }
     const name = headerOf(request, proxy.nameHeader);
     const email = headerOf(request, proxy.emailHeader);
     return {
-        user,
+        ...preview,
         ...(name === undefined ? {} : { name }),
         ...(email === undefined ? {} : { email }),
     };
@@ -132,6 +167,15 @@ export function registerOnboardingRoutes(app, ctx) {
         }
         const proxyIdentity = resolveProxyIdentity(request, ctx);
         const loopback = isLoopbackHost(ctx.listenHost);
+        // C2: a proxy-only non-loopback server creates accounts ONLY
+        // through a proxy vouch — refuse BEFORE code evaluation, so even
+        // a valid setup code or invite code cannot mint an account
+        // unvouched on this posture. Mixed [proxy, token] and loopback
+        // binds keep the code paths.
+        if (requiresProxyVouch(ctx.methods, ctx.listenHost) &&
+            proxyIdentity === undefined) {
+            return await reply.code(403).send({ error: "proxy_identity_required" });
+        }
         // The code's validity is evaluated ONCE, BEFORE the mutex: the winner
         // clears the setup-code file inside its critical section, so a claim
         // that loses the race must still be recognizable as having held a
@@ -149,25 +193,29 @@ export function registerOnboardingRoutes(app, ctx) {
                     // code ("the first invite" — same shape, admin grant).
                     let grant;
                     if (proxyIdentity !== undefined) {
-                        // Proxy claims take identity from the headers, verbatim
-                        // (body identity fields are ignored — the proxy vouched).
-                        grant = { ...proxyIdentity, source: "proxy" };
+                        // Body identity fields are ignored — the proxy vouched. This
+                        // route already holds the claim lock, so call the lock-free
+                        // resolver body, never the pipeline entry.
+                        const resolved = await provisionProxyUser(identity, proxyIdentity.subject, {
+                            ...(proxyIdentity.name === undefined ? {} : { name: proxyIdentity.name }),
+                            ...(proxyIdentity.email === undefined ? {} : { email: proxyIdentity.email }),
+                        }, { provision: true, admin: true });
+                        if (resolved.kind === "invalid") {
+                            return { status: 400, error: "invalid_username" };
+                        }
+                        if (resolved.kind === "not_provisioned") {
+                            return { status: 409, error: "already_claimed" };
+                        }
+                        grant = resolved.record;
                     }
-                    else if (loopback) {
+                    else if (loopback || codeWasSetup) {
                         if (validated.user === undefined)
                             return { status: 400, error: "invalid_body" };
+                        const typed = normalizeTypedUsername(validated.user, (key) => identity.users.get(key) !== undefined);
+                        if (!typed.ok)
+                            return { status: typed.error === "invalid_username" ? 400 : 409, error: typed.error };
                         grant = {
-                            user: validated.user,
-                            ...(validated.name === undefined ? {} : { name: validated.name }),
-                            ...(validated.email === undefined ? {} : { email: validated.email }),
-                            source: "cli",
-                        };
-                    }
-                    else if (codeWasSetup) {
-                        if (validated.user === undefined)
-                            return { status: 400, error: "invalid_body" };
-                        grant = {
-                            user: validated.user,
+                            user: typed.key,
                             ...(validated.name === undefined ? {} : { name: validated.name }),
                             ...(validated.email === undefined ? {} : { email: validated.email }),
                             source: "cli",
@@ -177,10 +225,8 @@ export function registerOnboardingRoutes(app, ctx) {
                         // Wrong or absent code where one is required.
                         return { status: 403, error: "invalid_code" };
                     }
-                    if (!USERNAME_PATTERN.test(grant.user)) {
-                        return { status: 400, error: "invalid_username" };
-                    }
-                    const record = await identity.users.add({
+                    // The proxy resolver already added and linked its record.
+                    const record = "createdAt" in grant ? grant : await identity.users.add({
                         user: grant.user,
                         ...(grant.name === undefined ? {} : { name: grant.name }),
                         ...(grant.email === undefined ? {} : { email: grant.email }),
@@ -207,17 +253,31 @@ export function registerOnboardingRoutes(app, ctx) {
                     return { status: 409, error: "already_claimed" };
                 }
                 if (validated.code !== undefined) {
-                    const invite = validated.user === undefined
-                        ? undefined
-                        : await identity.invites.redeem(validated.code, validated.user);
+                    if (validated.user === undefined) {
+                        return { status: 403, error: "invalid_code" };
+                    }
+                    const typed = normalizeTypedUsername(validated.user, (key) => identity.users.get(key) !== undefined);
+                    if (!typed.ok && typed.error === "invalid_username") {
+                        return { status: 400, error: typed.error };
+                    }
+                    // Validate before revealing a collision, but never consume
+                    // the invite until every refusal check has passed.
+                    const invite = await identity.invites.peek(validated.code);
                     if (invite === undefined) {
                         return { status: 403, error: "invalid_code" };
                     }
+                    if (!typed.ok)
+                        return { status: 409, error: typed.error };
+                    identity.users.checkAdmission();
+                    const redeemed = await identity.invites.redeem(validated.code, typed.key);
+                    if (redeemed === undefined) {
+                        return { status: 403, error: "invalid_code" };
+                    }
                     const record = await identity.users.add({
-                        user: validated.user,
+                        user: typed.key,
                         ...(validated.name === undefined ? {} : { name: validated.name }),
                         ...(validated.email === undefined ? {} : { email: validated.email }),
-                        admin: invite.admin,
+                        admin: redeemed.admin,
                         source: "invite",
                     });
                     return { status: 200, record };
@@ -228,17 +288,17 @@ export function registerOnboardingRoutes(app, ctx) {
                 if (proxyIdentity === undefined) {
                     return { status: 409, error: "already_claimed" };
                 }
-                const existing = identity.users.get(proxyIdentity.user);
-                if (existing !== undefined)
-                    return { status: 200, record: existing };
-                const record = await identity.users.add({
-                    user: proxyIdentity.user,
+                const resolved = await provisionProxyUser(identity, proxyIdentity.subject, {
                     ...(proxyIdentity.name === undefined ? {} : { name: proxyIdentity.name }),
                     ...(proxyIdentity.email === undefined ? {} : { email: proxyIdentity.email }),
-                    admin: false,
-                    source: "proxy",
-                });
-                return { status: 200, record };
+                }, 
+                // A codeless onboarding claim has always auto-provisioned the
+                // vouched identity, independent of the pipeline's policy.
+                { provision: true, admin: false });
+                if (resolved.kind !== "user") {
+                    return { status: 409, error: "already_claimed" };
+                }
+                return { status: 200, record: resolved.record };
             }
             catch (error) {
                 if (error instanceof AdmissionRefusedError) {

package/dist/server/session-meta.js

@@ -49,6 +49,7 @@ export const SessionMetaDoc = defineDoc({
     kind: "sigrun.session-meta",
     version: 1,
     scope: "conversation",
+    checkpointWhen: () => false,
     history: "latest",
     fork: "current",
     // Defensive copy (the alias-free-ownership pattern): the tracker takes

package/dist/server/shutdown.js

@@ -2,8 +2,9 @@
  * The ordered shutdown (gateway C2's extraction of serve.ts's inline
  * `shutdown`): eight steps, each in its own try/catch so a failure never
  * skips the remaining steps, with every failure collected into one
- * `AggregateError("sigrun shutdown failed")` after ALL steps ran (the
- * pre-extraction semantics, byte-for-byte).
+ * `AggregateError("sigrun shutdown failed")` after ALL steps ran. Every
+ * asynchronous stage has a fixed cap; reaching one abandons only that wait,
+ * logs, and continues, so the composed shutdown has a fixed worst case.
  *
  * The order (spec §8.0 — the gateway lifecycle slots between the server
  * drain and the event-bus flush):
@@ -28,6 +29,82 @@
  * Does NOT exit the process — the caller owns exit policy (the deploy
  * entry exits 0/1; the CLI's `run` returns to its exit code).
  */
+import { SHUTDOWN_SETTLE_WAIT_MS, WORKER_SHUTDOWN_AWAIT_MS, } from "../harness/event-bus.js";
+/** Every ordered stage has a bound; these are the bounds used by the budget. */
+export const END_STREAMS_SHUTDOWN_CAP_MS = 0;
+export const CLOSE_APP_SHUTDOWN_CAP_MS = 10_000;
+export const GATEWAY_STOP_INTAKE_SHUTDOWN_CAP_MS = 10_000;
+export const GATEWAY_STOP_SHUTDOWN_CAP_MS = 10_000;
+export const SANDBOX_WORKERS_SHUTDOWN_CAP_MS = 5_000;
+export const PROVIDER_REFRESH_SHUTDOWN_CAP_MS = 2_000;
+/**
+ * Measured against a real 1.4.0 boot over a copy of the durable-v1 fixture
+ * in test/shutdown-order.test.ts (0.6ms on the implementation run). The test
+ * asserts this cap is at least four times that measurement, so a slow but
+ * healthy close never gets converted into a counted restart by a guessed cap.
+ */
+export const CLOSE_HARNESS_SHUTDOWN_CAP_MS = 10_000;
+/**
+ * The event bus's bounded stages: worker stop + the initial drain + the
+ * live-run settle wait AND the final drain that can start just before its
+ * deadline + all extension handlers under one shared deadline. The settle
+ * wait is a per-boot test override; the production budget uses its default.
+ * This bounds each drain WAIT, not work a caller can ride on an already
+ * running side lane: the grace holds when the side lane is idle at shutdown
+ * (the quiet admission window). An outer boundedStage wrap or stopping
+ * enqueue at shutdownSequence entry is a deferred structural option.
+ */
+export function eventBusShutdownCapMs(config) {
+    return (WORKER_SHUTDOWN_AWAIT_MS +
+        config.hookDeadlineMs +
+        SHUTDOWN_SETTLE_WAIT_MS +
+        config.hookDeadlineMs +
+        config.hookDeadlineMs);
+}
+/** The fixed worst case of the complete ordered shutdown, in milliseconds. */
+export function shutdownBudgetMs(config) {
+    return (END_STREAMS_SHUTDOWN_CAP_MS +
+        CLOSE_APP_SHUTDOWN_CAP_MS +
+        GATEWAY_STOP_INTAKE_SHUTDOWN_CAP_MS +
+        eventBusShutdownCapMs(config) +
+        GATEWAY_STOP_SHUTDOWN_CAP_MS +
+        SANDBOX_WORKERS_SHUTDOWN_CAP_MS +
+        PROVIDER_REFRESH_SHUTDOWN_CAP_MS +
+        CLOSE_HARNESS_SHUTDOWN_CAP_MS);
+}
+/**
+ * Await one stage without allowing a wedged implementation to outlive its
+ * budget share. Abandonment is logged; the next ordered stage still runs.
+ */
+async function boundedStage(name, capMs, run) {
+    let timer;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            console.error(`sigrun: shutdown stage ${name} exceeded ${capMs}ms — abandoning the wait`);
+            resolve();
+        }, capMs);
+    });
+    let abandoned = false;
+    const stage = Promise.resolve().then(run);
+    // The race can abandon a stage that later rejects. Observe that rejection
+    // here so it is logged rather than becoming an unhandled rejection. An
+    // early rejection already propagated to createShutdown's failure collector,
+    // so it must not also be reported as an abandonment.
+    stage.catch((error) => {
+        if (abandoned) {
+            console.error(`sigrun: shutdown stage ${name} rejected after abandonment:`, error);
+        }
+    });
+    try {
+        await Promise.race([stage, deadline.then(() => {
+                abandoned = true;
+            })]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
 /**
  * Build the ordered shutdown over the eight steps. Failures from ANY step
  * are collected (the remaining steps still run) and thrown together as
@@ -41,52 +118,52 @@ export function createShutdown(steps) {
             steps.endStreams();
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "endStreams", error });
         }
         try {
-            await steps.closeApp();
+            await boundedStage("closeApp", CLOSE_APP_SHUTDOWN_CAP_MS, () => steps.closeApp());
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "closeApp", error });
         }
         try {
-            await steps.gateway.stopIntake();
+            await boundedStage("gateway.stopIntake", GATEWAY_STOP_INTAKE_SHUTDOWN_CAP_MS, () => steps.gateway.stopIntake());
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "gateway.stopIntake", error });
         }
         try {
             await steps.eventBusShutdown();
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "eventBusShutdown", error });
         }
         try {
-            await steps.gateway.stop();
+            await boundedStage("gateway.stop", GATEWAY_STOP_SHUTDOWN_CAP_MS, () => steps.gateway.stop());
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "gateway.stop", error });
         }
         try {
-            await steps.stopSandboxWorkers();
+            await boundedStage("stopSandboxWorkers", SANDBOX_WORKERS_SHUTDOWN_CAP_MS, () => steps.stopSandboxWorkers());
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "stopSandboxWorkers", error });
         }
         try {
             await steps.stopProviderRefresh();
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "stopProviderRefresh", error });
         }
         try {
-            await steps.closeHarness();
+            await boundedStage("closeHarness", CLOSE_HARNESS_SHUTDOWN_CAP_MS, () => steps.closeHarness());
         }
         catch (error) {
-            failures.push(error);
+            failures.push({ stage: "closeHarness", error });
         }
         if (failures.length > 0) {
-            throw new AggregateError(failures, "sigrun shutdown failed");
+            throw new AggregateError(failures.map(({ error }) => error), `sigrun shutdown failed: ${failures.map(({ stage }) => stage).join(", ")}`);
         }
     };
 }

package/dist/settings/registry.js

@@ -290,6 +290,12 @@ export const CORE_SETTING_KEYS = [
         section: "advanced",
         reason: "compaction policy resolves into the boot harness settings",
     },
+    {
+        key: "server.compaction.modelOverrides",
+        apply: "restart",
+        section: "advanced",
+        reason: "compaction policy resolves into the boot harness settings",
+    },
     {
         key: "server.memorySeam.hookDeadlineMs",
         apply: "restart",

package/node_modules/@sigrun/shared/CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- The `./usernames` export for shared username derivation and validation.
+
+## [0.3.0] - 2026-10-29
+### Added
+- `ServerSettings.compaction.modelOverrides` declares per-model compaction
+  policy overrides in the shared settings wire type.
 
 ## [0.2.1] - 2026-10-28
 ### Added

package/node_modules/@sigrun/shared/dist/settings.d.ts

@@ -136,6 +136,20 @@ export interface ServerSettings {
         readonly reserveTokens?: number;
         readonly keepRecentTokens?: number;
         readonly backgroundTokens?: number;
+        /**
+         * Per-model compaction policy overrides, keyed by the exact
+         * `provider/modelId` string pi-durable composes — a chain-shaped
+         * model id doubles the prefix (e.g. `bifrost/bifrost/<chain>`).
+         * Each field replaces the harness-wide one for that model, so a
+         * small-window model can sit alongside the large-window default.
+         * Boot-time lifetime, like the rest of compaction.
+         */
+        readonly modelOverrides?: Readonly<Record<string, Partial<{
+            enabled: boolean;
+            reserveTokens: number;
+            keepRecentTokens: number;
+            backgroundTokens: number;
+        }>>>;
     };
     /**
      * The memory-seam bounds (memory-seam Task 6), mirroring the

package/node_modules/@sigrun/shared/dist/usernames.d.ts

@@ -0,0 +1,8 @@
+export declare const MAX_USERNAME_LENGTH = 128;
+export declare const MAX_SUFFIX_ATTEMPTS = 10000;
+export declare class UsernameExhaustedError extends Error {
+}
+export declare function deriveUsername(input: string): string | undefined;
+export declare function isUsernameKey(s: string): boolean;
+export declare function foldSubject(s: string): string;
+export declare function withSuffix(base: string, taken: (key: string) => boolean): string;