@sigrun/sigrun 0.4.2 → 0.6.0

package/dist/harness/boot.js

@@ -30,16 +30,41 @@ import { openIdentityStores, ensureSetupCode, } from "./identity/index.js";
 import { MEMORY_SECTION_KEY, noopMemoryExtension } from "./memory-default.js";
 import { createSeamHost, } from "./seam-host.js";
 import { contextFilesExtension } from "./sections/context-files.js";
+import { createJobStateExtension } from "./sections/job-state.js";
 import { modelGuidanceExtension } from "./sections/model-guidance.js";
-import { createSkillsExtension } from "../skills/index.js";
+import { createSkillsExtension, scanFsRoot } from "../skills/index.js";
 import { SLASH_COMMANDS } from "../server/commands.js";
 import { packagePromptRootsOf } from "../commands/templates.js";
 import { blocksToolsExtension } from "./blocks/tools.js";
-import { codingToolsExtension, searchToolsExtension } from "./tools.js";
+import { createCodingToolsExtension, searchToolsExtension } from "./tools.js";
 import { collectProviders, createProviderMergeSink, } from "./providers/index.js";
 import { EventHub } from "../server/events/hub.js";
-import { providerAuthStatus } from "../server/helpers.js";
+import { providerAuthStatus, storeAgentChange } from "../server/helpers.js";
 import { bootRefresh, DEFAULT_REFRESH_TIMEOUT_MS, refreshProvider, } from "./providers/refresh.js";
+/**
+ * The default per-request stream deadline (curator-eval hardening): the
+ * OpenAI SDK waits up to 10 minutes for response HEADERS by default, and
+ * a request that never reaches the provider never gets headers — the
+ * generation task wedges in phase=request. Five minutes covers long
+ * first tokens on slow providers (observed 40-60s on the eval models;
+ * reasoning models can run far longer once streaming) because the SDK's
+ * timer clears at headers arrival, not stream end.
+ */
+export const DEFAULT_STREAM_TIMEOUT_MS = 300_000;
+/**
+ * The boot `stream` getter's merge, factored out for the harness-open
+ * test: caller seam over file over the default `timeoutMs`, field-wise.
+ * Returns `undefined` when nothing is set (the honest empty shape).
+ */
+export function mergeStreamSettings(caller, file) {
+    const merged = {
+        ...(caller ?? file),
+        ...(caller === undefined && file?.timeoutMs === undefined
+            ? { timeoutMs: DEFAULT_STREAM_TIMEOUT_MS }
+            : {}),
+    };
+    return Object.keys(merged).length > 0 ? merged : undefined;
+}
 import { startProviderRefresh } from "./providers/scheduler.js";
 import { fileModelsStore } from "./providers/models-store.js";
 import { packagesDirOf, selfPackageRoot } from "./packages.js";
@@ -54,7 +79,16 @@ import { IsolationState } from "../sandbox/isolation.js";
 import { probeOsUsers } from "../sandbox/availability.js";
 import { createAdmissionGuard } from "./identity/users.js";
 import { sweepAccountLinks } from "./identity/link-sweep.js";
+import { effectiveOwner as resolveEffectiveOwner } from "./identity/primary-admin.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
+import { learnedSkillsDir } from "../curation/paths.js";
+import { SkillStore } from "../curation/store.js";
+import { OverlayStore } from "../curation/overlays.js";
+import { UsageCounters } from "../curation/usage.js";
+import { buildCurationRegistry } from "../curation/targets.js";
+import { createCurationHost } from "../curation/host.js";
+import { createCurationToolFeed, wrapExtensionCurationTools, } from "../curation/wrap.js";
+import { createCurationGateExtension, CURATION_GATE_EXTENSION } from "../curation/gate.js";
 import { probeIsolation, runHelperProbe, selfTestHelper, } from "../sandbox/availability.js";
 import { resolveBuiltins, } from "./builtins.js";
 import { createRegistry } from "./registry.js";
@@ -88,6 +122,7 @@ export const RESERVED_CORE_SECTION_OWNERS = {
     skills: "sigrun.skills",
     "tool-guidance": "sigrun.model-guidance",
     "execution-guidance": "sigrun.model-guidance",
+    "job-state": "sigrun.job-state",
 };
 /**
  * Open (or reopen) the durable harness at `config.storagePath`.
@@ -329,6 +364,10 @@ export async function openHarness(config, options = {}) {
     // reads it at RENDER time, long after the assignment — the skills cap
     // is a live setting (`skills.sectionMaxBytes`, default 4KB).
     let skillsSettings;
+    // The job-state section resolves its services only when a job run renders;
+    // both are constructed after the core registry installs.
+    let workspaceService;
+    let jobs;
     // Context-file sections (SOUL.md persona, AGENTS.md instructions), the
     // skills convention, and the core tool surface (plan Task 1: coding
     // tools read/write/edit/bash + search tools find/grep/ls) are all
@@ -346,9 +385,106 @@ export async function openHarness(config, options = {}) {
     // ones, which `listSkills` includes by design).
     const skillsOptions = {
         userDir: join(roots.configDir, "skills"),
+        // Curator A9 (P6): the canonical workspace ROOT for overlay keys —
+        // the configured default workspace (a conversation with a
+        // sub-cwd still matches the root-keyed overlay; the accessor
+        // stays live for the config's sake).
+        workspaceRoot: () => config.workspace.path,
+        // Curator A3 (P2): the conversation owner's learned root —
+        // `<dataDir>/users/<owner>/skills`, undefined for ownerless
+        // conversations. Discovery resolves the owner per render.
+        learnedRoot: (owner) => owner === undefined
+            ? undefined
+            : learnedSkillsDir(managedPaths.userAreas(owner)),
         packageRoots: () => collectedSkillRoots,
         sectionMaxBytes: () => skillsSettings?.read().skills?.sectionMaxBytes ?? 4096,
     };
+    // Curator A6 (P3/P4): the per-user curation wiring — one skill store,
+    // one overlay store and one usage counter set per EXISTING user,
+    // created lazily on first use and cached. `userExists` is the LIVE
+    // directory read (a removed user's factories stop resolving), and
+    // `nameTakenElsewhere` scans the host-side roots the harness owns
+    // (the user dir and the collected package roots; a conversation's
+    // workspace can only be checked through its env, which the store
+    // cannot see — the create-refusal there is the A4 store's own).
+    const skillStores = new Map();
+    const overlayStores = new Map();
+    const usageCounters = new Map();
+    const curationOf = (user) => {
+        if (user === undefined)
+            return undefined;
+        // Curator A10: cache-FIRST resolution — a store set captured before
+        // a user's deletion stays resolvable, so its own `userExists` gate
+        // fails every later op with "user removed" (the A4/A5 fail-closed
+        // property: an in-flight run's late write never recreates the
+        // roots). A never-seen user still needs the live directory read.
+        if (skillStores.get(user) === undefined &&
+            identity.users.get(user) === undefined) {
+            return undefined;
+        }
+        const userArea = managedPaths.userAreas(user);
+        let store = skillStores.get(user);
+        if (store === undefined) {
+            store = new SkillStore({
+                userArea,
+                user,
+                now: () => clockNow(),
+                nameTakenElsewhere: async (name) => {
+                    for (const skill of scanFsRoot(join(roots.configDir, "skills"), "user dir")) {
+                        if (skill.name === name)
+                            return "user dir";
+                    }
+                    for (const root of collectedSkillRoots) {
+                        if (scanFsRoot(root.dir, "package").some((skill) => skill.name === name))
+                            return root.extension;
+                    }
+                    return undefined;
+                },
+                userExists: () => identity.users.get(user) !== undefined,
+            });
+            skillStores.set(user, store);
+        }
+        let overlays = overlayStores.get(user);
+        if (overlays === undefined) {
+            overlays = new OverlayStore({
+                userArea,
+                user,
+                userExists: () => identity.users.get(user) !== undefined,
+                feed: store,
+            });
+            overlayStores.set(user, overlays);
+        }
+        let usage = usageCounters.get(user);
+        if (usage === undefined) {
+            usage = new UsageCounters({
+                userArea,
+                user,
+                now: () => clockNow(),
+                // The A4 gate, but silent: the cached counters outlive the user
+                // (cache-first resolution), and telemetry is void-and-forget —
+                // a removed user's flush drops instead of recreating the
+                // deleted curation directory (deletion's fail-closed claim).
+                userExists: () => identity.users.get(user) !== undefined,
+            });
+            usageCounters.set(user, usage);
+        }
+        return { store, overlays, usage };
+    };
+    const curationSkillsOptions = {
+        ...skillsOptions,
+        skillStore: (user) => curationOf(user)?.store,
+        overlays: (owner) => curationOf(owner)?.overlays,
+        usage: (owner) => curationOf(owner)?.usage,
+    };
+    // Curator A6 (P4): the read tool counts learned-root reads through the
+    // same per-user wiring (load_skill and /skill: count through the
+    // skills options above).
+    const codingWithUsage = createCodingToolsExtension({
+        countersOf: (owner) => curationOf(owner)?.usage,
+        learnedRootOf: (owner) => owner === undefined
+            ? undefined
+            : learnedSkillsDir(managedPaths.userAreas(owner)),
+    });
     const templateOptions = {
         userDir: join(roots.configDir, "prompts"),
         packageRoots: () => collectedTemplateRoots,
@@ -371,8 +507,29 @@ export async function openHarness(config, options = {}) {
         },
     };
     registry.install(contextFilesExtension);
-    registry.install(createSkillsExtension(skillsOptions));
-    registry.install(codingToolsExtension);
+    // Escalations A2: the core-owned job-state prompt section names the run's
+    // state folder (WorkspaceService.jobsRoot, A1); deps late-bind like
+    // skillsSettings — services are created further down.
+    registry.install(createJobStateExtension({
+        jobsRoot: (owner) => workspaceService?.jobsRoot(owner),
+        job: async (id) => await jobs?.get(id),
+    }));
+    // Curator A8 (P9): the wrap feed — the mutable set of curation tool
+    // names, seeded with the core set and grown by the loader as each
+    // extension's curationTargets validate. The skills extension's
+    // install below wraps through it (its OWN tools: `skill_manage`);
+    // the loader wraps every extension-declared target tool at its
+    // install. `isCurationTool` on the built registry (A7) stays the
+    // read-side API — the feed is only the write-side wrap oracle.
+    const curationFeed = createCurationToolFeed();
+    // Curator A6: the skills extension carries the curation wiring
+    // (skill_manage + usage counting), and the coding tools count
+    // learned-root reads — the same extension NAMES as before, so
+    // nothing downstream observes the swap. A8: the install WRAPS the
+    // curation tools (skill_manage's registration carries the hint
+    // interception; load_skill and the section are untouched).
+    registry.install(wrapExtensionCurationTools(createSkillsExtension(curationSkillsOptions), curationFeed));
+    registry.install(codingWithUsage);
     registry.install(searchToolsExtension);
     // The chat-blocks tools (UI-blocks U5 Task 1, spec §8.1): every agent
     // can show and update interactive block surfaces in chat — the same
@@ -466,8 +623,11 @@ export async function openHarness(config, options = {}) {
     const sharedStores = sharedExtensionStores(roots, env, identity.users);
     const seamHosts = new Map();
     const seamKinds = new Map();
-    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
+    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, curationBindings, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
         packagesDir,
+        // Curator A8 (P9): the wrap feed — the loader grows it with each
+        // validated target tool and wraps those tools at their install.
+        curationFeed,
         hostContextFactory: (extensionName, kinds, priorHost) => {
             // Two-phase, revised for the provisional identity (provider
             // plugins Task 9 P1): the loader's PRE-import call passes the
@@ -505,6 +665,11 @@ export async function openHarness(config, options = {}) {
         },
     });
     perUserSlugs.push(...loadedPerUserSlugs);
+    // The curation-target registry (curator P7): the loader's validated,
+    // slug-attributed bindings folded into the ONE registry — the A8
+    // wrapping feed (isCurationTool) and the A9 host.curation surface
+    // read it. An empty fold is the no-declarer deploy.
+    const curation = buildCurationRegistry(curationBindings);
     for (const binding of userServiceBindings) {
         userServices.register(binding.extension, binding.services, binding.packageDir);
     }
@@ -614,6 +779,9 @@ export async function openHarness(config, options = {}) {
     // deps object is shared with `fireJob`'s run-now and the JobsService
     // below (one clock, one tz, one models store).
     const jobRuntimeDeps = {
+        // Resolve declared-job owners against the live directory at each use
+        // (§6.5); no cache and no rewrite of the source's stored record.
+        effectiveOwner: (owner) => resolveEffectiveOwner(identity.users.list(), owner),
         // SAFETY: harness + storage are assigned right after `Harness.open`
         // returns below (the open needs the task registered, so the deps
         // object is created first with placeholders). Every read — task
@@ -640,6 +808,11 @@ export async function openHarness(config, options = {}) {
         name: "sigrun.jobs",
         tasks: [createScheduleTask(jobRuntimeDeps)],
     });
+    // Curator A8 (P6 gate): the hooks-only curator-run gate — installed
+    // in the registry but NEVER in the host default selection (the
+    // settings getter below filters it like a per-user entry): only A9's
+    // producer selects it, in the internal run conversations it creates.
+    registry.install(createCurationGateExtension());
     // The host event hub (W3 Task 4, spec §7.4): ONE per opened harness.
     // The event bus's commit-derived events subscribe below (after the bus
     // opens); the provider refresh paths observe readiness here — each
@@ -756,7 +929,7 @@ export async function openHarness(config, options = {}) {
         stopProviderRefresh();
     };
     // Every tool/file/upload/job env resolves through this one decision seam.
-    const workspaceService = createWorkspaceService({
+    workspaceService = createWorkspaceService({
         isolation: isolationState,
         osUsers,
         pool: sandboxPool,
@@ -828,14 +1001,26 @@ export async function openHarness(config, options = {}) {
                 return callerSettings?.retry ?? fileSettings.retry;
             },
             get stream() {
-                return callerSettings?.stream ?? fileSettings.stream;
+                // The stream-request default (curator-eval hardening): a
+                // model request with no explicit timeout can wedge forever —
+                // the OpenAI SDK's `timeout` is a headers-arrival deadline and
+                // defaults to 10 minutes, but a request that never reaches the
+                // provider (undici socket-pool class) never gets headers to
+                // time out against, so pi-durable's generation task sits in
+                // phase=request indefinitely. `mergeStreamSettings` bounds
+                // every request with a default `timeoutMs`; the caller seam
+                // and the file each override field-wise.
+                return mergeStreamSettings(callerSettings?.stream, fileSettings.stream);
             },
             get extensions() {
                 // Per-user entries are core-computed from SessionMeta.owner,
                 // never part of a host default — including an operator-supplied
-                // caller list (controller ruling: filter BOTH sources).
+                // caller list (controller ruling: filter BOTH sources). The
+                // curator-run gate (A8) is filtered the same way: it is selected
+                // ONLY in the internal run conversations A9's producer creates.
                 const selected = callerSettings?.extensions ?? registry.snapshot().installed();
-                return selected.filter((entry) => !isUserEntryName(entry.name));
+                return selected.filter((entry) => !isUserEntryName(entry.name) &&
+                    entry.name !== CURATION_GATE_EXTENSION);
             },
             toolExecution: callerSettings?.toolExecution,
             compaction: {
@@ -920,6 +1105,36 @@ export async function openHarness(config, options = {}) {
     // order). The bus's close stops delivery; the unsubscribe is unused.
     const now = clockNow;
     wireActivity(eventBus, harness, now);
+    // Curator A9 (P6): the ONE curation host — the `host.curation`
+    // surface over the per-user stores (curationOf), the curation
+    // registry, the jobs records and the run driver. The server's host
+    // bridge and every seam host expose the SAME instance (the bridge
+    // carries it; the seam hosts delegate). The digest producer's
+    // default agent is the create op's own store-default change (what
+    // every server-created conversation starts from): the structural
+    // `{settings, registry, providerEnv}` subset `storeAgentChange`
+    // reads, closed over the LIVE references so a settings PATCH
+    // reaches later digests without a restart.
+    // SAFETY: the cast — `storeAgentChange` reads exactly these three
+    // members (settings.read, registry.snapshot, providerEnv) and
+    // nothing else of OpenedHarness; the live closure satisfies them.
+    const curationHost = createCurationHost({
+        harness,
+        registry,
+        storage,
+        curation,
+        defaultModel,
+        stores: curationOf,
+        skillsOptions: {
+            userDir: join(roots.configDir, "skills"),
+            packageRoots: () => collectedSkillRoots,
+        },
+        defaultAgent: () => storeAgentChange({
+            settings: { read: () => settingsStore.read() },
+            registry,
+            providerEnv: effectiveEnv,
+        }, defaultModel),
+    });
     const handlersByName = new Map();
     for (const binding of runSettledBindings) {
         handlersByName.set(binding.extension.name, {
@@ -1007,6 +1222,7 @@ export async function openHarness(config, options = {}) {
     // (an extension's declaration is its boot-time declaration).
     const fileJobs = () => settingsStore.read().jobs ?? [];
     const jobsSources = () => ({ file: fileJobs(), extensions: jobBindings });
+    const jobEffectiveOwner = (owner) => resolveEffectiveOwner(identity.users.list(), owner);
     // The root conversation — the schedule tasks' owner (spec §8.1).
     // `Harness.root` is idempotent (creates with `agent` on first call,
     // returns the reserved root thereafter), so the server's own
@@ -1035,7 +1251,7 @@ export async function openHarness(config, options = {}) {
                 // SSE stream computes `accessOf` per principal and adds it. A
                 // future in-process hub subscriber must never read a fabricated
                 // access off the hub's copy.
-                const { access: _dropped, ...row } = jobWireOf(jobId, record);
+                const { access: _dropped, ...row } = jobWireOf(jobId, record, jobEffectiveOwner(record.owner));
                 events.publish({
                     type: "job.changed",
                     job: row,
@@ -1051,7 +1267,9 @@ export async function openHarness(config, options = {}) {
                     id: jobId,
                     name: newest.spec.name,
                     source: newest.source,
-                    ...(newest.owner === undefined ? {} : { owner: newest.owner }),
+                    ...(jobEffectiveOwner(newest.owner) === undefined
+                        ? {}
+                        : { owner: jobEffectiveOwner(newest.owner) }),
                     ...(newest.sharing === undefined ? {} : { sharing: newest.sharing }),
                     schedule: newest.spec.schedule,
                     action: newest.spec.action,
@@ -1087,12 +1305,14 @@ export async function openHarness(config, options = {}) {
             jobRunTotals.set(outcome, (jobRunTotals.get(outcome) ?? 0) + 1);
         }
     });
-    const jobs = createJobsService({
+    jobs = createJobsService({
         harness,
         storage,
         runtime: jobRuntimeDeps,
+        effectiveOwner: jobEffectiveOwner,
         rootId: rootConversationId,
         sources: jobsSources,
+        jobsRoot: (owner) => workspaceService?.jobsRoot(owner),
         settings: () => settingsStore.read(),
         onChange: (jobId) => {
             void publishJobChanged(jobId);
@@ -1113,6 +1333,7 @@ export async function openHarness(config, options = {}) {
         runtime: jobRuntimeDeps,
         rootId: rootConversationId,
         sources: jobsSources,
+        jobsRoot: (owner) => workspaceService?.jobsRoot(owner),
     }, BACKGROUND_CONTEXT);
     // The deleted-owner warning (§8.3): a declared job whose `owner` names
     // a user no longer in the directory runs OWNERLESS until its source is
@@ -1176,6 +1397,8 @@ export async function openHarness(config, options = {}) {
         channelBindings,
         gatewayEngine,
         skillRoots: extensionSkillRoots,
+        curation,
+        curationHost,
         commandExpansion,
         eventBus,
         events,

package/dist/harness/builtins.js

@@ -1,10 +1,13 @@
 /**
- * Built-in extensions: codemode, MCP, tool search and OAuth ship WITH
- * core — present by default, disableable via settings `builtinExtensions`,
- * replaceable by a same-named configured extension.
+ * Built-in extensions: codemode, MCP, tool search, the gateway, OAuth and
+ * the curator ship WITH core — present by default, disableable via settings
+ * `builtinExtensions`, replaceable by a same-named configured extension.
+ * Every other extension is optional and loads only when configured.
  *
- * The first three mirror pi 1.3.0's built-in tool surface; OAuth adds
- * sigrun's standard OIDC/OAuth2 login providers without extra setup.
+ * The first three mirror pi 1.3.0's built-in tool surface; the gateway is
+ * the channel-adapter engine (hermes/openclaw parity: channels work out of
+ * the box); OAuth adds sigrun's standard OIDC/OAuth2 login providers
+ * without extra setup; the curator runs the per-user learning loops.
  *
  * Resolution root (Ruling 2): built-ins resolve through core's OWN
  * node_modules via `createRequire(import.meta.url)` — they are core
@@ -23,7 +26,8 @@
  * (`readPackageName` for path-shaped entries, `parsePackageSpecifier`
  * otherwise), never by string equality on the raw specifier.
  *
- * Disabled (Ruling 6): `builtinExtensions: {codemode?, mcp?, toolSearch?, oauth?}`
+ * Disabled (Ruling 6): `builtinExtensions: {codemode?, mcp?, toolSearch?,
+ * gateway?, oauth?, curator?}`
  * (each defaulting to `true`, restart-required). A disabled built-in is
  * absent from `/v1/extensions` entirely; one log line records the skip.
  *
@@ -38,13 +42,15 @@ import { basename, dirname, isAbsolute, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parsePackageSpecifier, readPackageName } from "./packages.js";
 /**
- * The five built-ins, in load order (codemode before tool-search: both
+ * The six built-ins, in load order (codemode before tool-search: both
  * wrap pi-durable's own extensions and neither depends on the other, but
- * the order pins the tool-collision story should names ever overlap).
- * Specifiers are the published package names (Task 3) — npm keys a file:
- * dependency by the target's own manifest name, so the key must be the
- * name the packages publish under (the dev shape carries `file:` values
- * under these same keys until Task 8 publishes exact `0.1.0`s).
+ * the order pins the tool-collision story should names ever overlap;
+ * curator loads LAST — its loops observe every earlier built-in's
+ * contributions). Specifiers are the published package names (Task 3)
+ * — npm keys a file: dependency by the target's own manifest name, so
+ * the key must be the name the packages publish under (the dev shape
+ * carries `file:` values under these same keys until Task 8 publishes
+ * exact `0.1.0`s).
  */
 export const BUILTIN_EXTENSIONS = [
     { key: "codemode", specifier: "@sigrun/ext-codemode", slug: "codemode" },
@@ -52,6 +58,7 @@ export const BUILTIN_EXTENSIONS = [
     { key: "toolSearch", specifier: "@sigrun/ext-tool-search", slug: "tool-search" },
     { key: "gateway", specifier: "@sigrun/ext-gateway", slug: "gateway" },
     { key: "oauth", specifier: "@sigrun/oauth", slug: "oauth" },
+    { key: "curator", specifier: "@sigrun/ext-curator", slug: "curator" },
 ];
 /** The core-anchored require (built-ins resolve from core's own node_modules). */
 const coreRequire = createRequire(import.meta.url);

package/dist/harness/event-bus.js

@@ -103,6 +103,22 @@ export class EventBus {
     }
     #unsubscribe;
     #harness;
+    /**
+     * Internal-run detection (curator P5): the SessionMeta `internal` flag,
+     * resolved SYNCHRONOUSLY from the commit stream — every SessionMeta
+     * document change warms the cache (see the pre-pass in `observe`), so
+     * the arms there always find the flag of the conversation the
+     * publication belongs to. The marker is written in the conversation's
+     * CREATING commit and never changes (`markInternal`), so a cached
+     * value never goes stale; `false` is cached too, keeping ordinary
+     * traffic at zero extra reads (the bus's no-blocking-work contract
+     * forbids a snapshot here).
+     */
+    #internal = new Map();
+    /** Whether `conversationId` is internal per the commit-warmed cache. */
+    #isInternal(conversationId) {
+        return this.#internal.get(conversationId) === true;
+    }
     #queueMax;
     #hookDeadlineMs;
     #idleThresholdMs;
@@ -663,10 +679,37 @@ export class EventBus {
         try {
             const lifecycle = [];
             const forkParents = new Map();
+            // Curator P5, PRE-PASS: warm the internal-flag cache off every
+            // SessionMeta document change BEFORE any arm below can fire —
+            // change order within a publication is unspecified, so the
+            // conversation/submission arms must never depend on the SessionMeta
+            // change having been seen first (an internal conversation created in
+            // THIS commit emits nothing, its `conversation.created` host event
+            // included). The plain `document` arm alone: a fork's
+            // `document.copy` carries no value to read (and `internal` is never
+            // inherited — the child's own first SessionMeta commit re-warms it).
+            // The marker is written in the creating commit and never changes
+            // (`markInternal`), so a cached value never goes stale; `false` is
+            // cached too, keeping ordinary traffic at zero extra reads (the
+            // bus's no-blocking-work contract forbids a snapshot here).
+            for (const change of publication.changes) {
+                if (change.type !== "document")
+                    continue;
+                if (change.record.kind !== SessionMetaDoc.definition.kind)
+                    continue;
+                if (change.conversationId === undefined)
+                    continue;
+                this.#internal.set(change.conversationId, change.value?.internal === true);
+            }
             for (const change of publication.changes) {
                 if (change.type !== "conversation")
                     continue;
                 const record = change.value;
+                // Curator P5: an internal conversation emits nothing — not the
+                // lifecycle events, not the host event (every owner-keyed path
+                // skips internal; the SSE stream's filtering is belt-and-braces).
+                if (this.#isInternal(record.id))
+                    continue;
                 lifecycle.push({
                     type: "conversationCreated",
                     conversationId: record.id,
@@ -690,6 +733,17 @@ export class EventBus {
                 if (change.type !== "document" && change.type !== "document.copy") {
                     continue;
                 }
+                // Curator P5: an internal conversation emits nothing on ANY
+                // document arm — not the SessionMeta summary diffs, and not the
+                // interaction/ambient seam events either (every conversation.*
+                // host event and every derived lifecycle is withheld; the flag
+                // was warmed by the pre-pass above).
+                if (change.conversationId !== undefined &&
+                    this.#isInternal(change.conversationId)) {
+                    this.#archivedBasis.delete(change.conversationId);
+                    this.#metaBasis.delete(change.conversationId);
+                    continue;
+                }
                 const kind = change.record.kind;
                 if (kind !== SessionMetaDoc.definition.kind) {
                     // W3 Task 4: the interaction + ambient seam doc families feed
@@ -958,6 +1012,16 @@ export class EventBus {
                 const value = change.value;
                 if (value.type !== "input")
                     continue;
+                // Curator P5: an internal conversation's submissions are invisible
+                // on every surface the bus feeds — no idle bookkeeping (the run
+                // never arms the idle clock), no run.admitted/run.settled host
+                // events (the SSE stream and the notifications surface see
+                // nothing), and no settle-group enqueueing (no extension
+                // runSettled delivery — the brief's three bus gates in one skip).
+                // The flag was warmed by the pre-pass; `markInternal` runs in the
+                // creating commit, which always precedes any submission.
+                if (this.#isInternal(value.conversationId))
+                    continue;
                 // Idle bookkeeping (Task 4): a PLACED input both stamps the
                 // admission clock and marks the run live; a terminal input marks
                 // the run end. Write-type submissions never touch either — a

package/dist/harness/identity/primary-admin.js

@@ -0,0 +1,19 @@
+/**
+ * The primary admin is the first stored admin in directory insertion
+ * order. Callers pass the live directory at each use so demotions and
+ * deletions take effect without a cache or a record rewrite.
+ */
+export function primaryAdmin(records) {
+    return records.find((record) => record.admin === true);
+}
+/**
+ * Resolve the effective owner at use time: a live declared owner wins;
+ * an absent or orphaned owner falls back to the primary admin. An empty
+ * directory (single-operator mode) stays ownerless.
+ */
+export function effectiveOwner(records, owner) {
+    if (owner !== undefined && records.some((record) => record.user === owner)) {
+        return owner;
+    }
+    return primaryAdmin(records)?.user;
+}