@usine/executor 0.2.1 → 0.3.0

package/dist/exe-dev/preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/exe-dev/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EACL,sBAAsB,EAEtB,KAAK,cAAc,EACnB,qBAAqB,EAEtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAA4B,KAAK,qBAAqB,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAoBhG,eAAO,MAAM,YAAY;;;gBA2JvB,CAAC"}
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/exe-dev/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EAEtB,qBAAqB,EAEtB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAY,KAAK,qBAAqB,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAkBhF,eAAO,MAAM,YAAY;;;0BASM,WAAW;oEAyHxC,CAAC"}

package/dist/exe-dev/preflight.js

@@ -1,10 +1,11 @@
-import * as AttemptChannel from "@usine/core/attempt/channel";
-import { WorkerName } from "@usine/core/worker";
+import { ClaudeLoginLock } from "@usine/agents/runtime";
+import { SshDestination, WorkerName } from "@usine/core/worker";
 import { Effect, Ref, Schema } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
 import { ExecutorOperationError, logPreflightFailure, WorkerCapabilityError, } from "../executor.js";
-import { verifyHarnesses } from "../harness-preflight.js";
-import { HomePath, SshDestination } from "./model.js";
-const MINIMUM_NODE_MAJOR = 22;
+import { agentsHarnessProbe, verifyHarnessReadiness } from "../harness-preflight.js";
+import { verifyLinuxMemory } from "../memory-preflight.js";
+import { HomePath } from "./model.js";
 const Vm = Schema.Struct({
     vmName: Schema.NonEmptyString,
     sshDest: SshDestination,
@@ -14,45 +15,38 @@ const VmList = Schema.Struct({ vms: Schema.Array(Vm) });
 const decodeVmList = Schema.decodeUnknownEffect(Schema.fromJsonString(VmList));
 const decodeHome = Schema.decodeUnknownEffect(HomePath);
 const capabilityError = (worker, capability, message, cause) => new WorkerCapabilityError({ worker, capability, message, cause });
-export const preflightFor = Effect.fn("ExeDevExecutor.preflightFor")(function* (options, commands, runHost) {
+export const preflightFor = Effect.fn("ExeDevExecutor.preflightFor")(function* (options, commands) {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const logins = yield* ClaudeLoginLock;
     const workers = yield* Ref.make(new Map());
+    /** Returns a harness probe that runs on the VM with no extra environment variables. */
+    const harnessProbe = (shell) => agentsHarnessProbe(spawner, shell, {});
     const resolveVm = Effect.fn("ExeDevExecutor.resolveVm")(function* (worker) {
         const response = yield* commands.lobbyJson("preflight", ["ls", worker]);
-        const decoded = yield* decodeVmList(response).pipe(Effect.mapError((cause) => capabilityError(worker, "machine", `exe.dev returned invalid machine metadata for Worker ${worker}`, cause)));
+        const decoded = yield* decodeVmList(response).pipe(Effect.mapError((cause) => capabilityError(worker, "machine", `exe.dev returned invalid machine metadata for worker "${worker}"`, cause)));
         const vm = decoded.vms.find(({ vmName }) => vmName === worker);
         if (vm === undefined) {
-            return yield* capabilityError(worker, "machine", `exe.dev has no VM named ${worker}`, new Error("worker VM missing"));
+            return yield* capabilityError(worker, "machine", `exe.dev has no VM named "${worker}"`, new Error("worker VM missing"));
         }
         if (vm.status !== "running") {
-            return yield* capabilityError(worker, "machine", `exe.dev VM ${worker} is ${vm.status}, not running`, new Error(`VM status: ${vm.status}`));
+            return yield* capabilityError(worker, "machine", `exe.dev VM "${worker}" is ${vm.status}, not running`, new Error(`VM status: ${vm.status}`));
         }
         const reported = (yield* commands.remote("preflight", vm.sshDest, "printenv", ["HOME"])).trim();
-        const home = yield* decodeHome(reported).pipe(Effect.mapError((cause) => capabilityError(worker, "toolchain", `exe.dev VM ${worker} returned an invalid home directory`, cause)));
+        const home = yield* decodeHome(reported).pipe(Effect.mapError((cause) => capabilityError(worker, "toolchain", `exe.dev VM "${worker}" returned an invalid home directory`, cause)));
         return { home, sshDest: vm.sshDest };
     });
     const asCapability = (worker, capability, message, effect) => effect.pipe(Effect.mapError((cause) => capabilityError(worker, capability, message, cause)));
-    const preflight = Effect.fn("ExeDevExecutor.preflight")(function* (worker, brains) {
-        const vm = yield* resolveVm(worker).pipe(Effect.catchTag("ExecutorOperationError", (cause) => capabilityError(worker, "machine", `Could not reach exe.dev Worker ${worker}`, cause)));
+    const preflight = Effect.fn("ExeDevExecutor.preflight")(function* (worker, brains, maxConcurrentAttempts) {
+        const vm = yield* resolveVm(worker).pipe(Effect.catchTag("ExecutorOperationError", (cause) => capabilityError(worker, "machine", `Can't reach exe.dev worker "${worker}"`, cause)));
         yield* Effect.annotateCurrentSpan({ worker, host: vm.sshDest });
-        const gitVersion = (yield* asCapability(worker, "toolchain", `Worker ${worker} cannot run Git`, commands.remote("preflight", vm.sshDest, "git", ["--version"]))).trim();
+        const gitVersion = (yield* asCapability(worker, "toolchain", `Worker "${worker}" can't run Git`, commands.remote("preflight", vm.sshDest, "git", ["--version"]))).trim();
         if (!gitVersion.startsWith("git version ")) {
-            return yield* capabilityError(worker, "toolchain", `Worker ${worker} returned an unrecognized Git version`, new Error(gitVersion));
+            return yield* capabilityError(worker, "toolchain", `Worker "${worker}" returned an unrecognized Git version`, new Error(gitVersion));
         }
-        const nodeVersion = (yield* asCapability(worker, "toolchain", `Worker ${worker} cannot run Node.js`, commands.remote("preflight", vm.sshDest, "node", ["--version"]))).trim();
-        const nodeMajor = Number(/^v(?<major>\d+)/u.exec(nodeVersion)?.groups?.major ?? Number.NaN);
-        if (!Number.isSafeInteger(nodeMajor) || nodeMajor < MINIMUM_NODE_MAJOR) {
-            return yield* capabilityError(worker, "toolchain", `Worker ${worker} has Node.js ${nodeVersion || "unknown"}; expected ${MINIMUM_NODE_MAJOR}+`, new Error("Node.js version mismatch"));
-        }
-        const protocol = (yield* asCapability(worker, "run-host", `Worker ${worker} cannot run ${runHost.command}`, commands.remote("preflight", vm.sshDest, runHost.command, [
-            ...runHost.args,
-            "--protocol-version",
-        ]))).trim();
-        if (protocol !== String(AttemptChannel.PROTOCOL_VERSION)) {
-            return yield* capabilityError(worker, "run-host", `Worker ${worker} has run-host protocol ${protocol || "unknown"}; expected ${AttemptChannel.PROTOCOL_VERSION}`, new Error("run-host protocol mismatch"));
-        }
-        yield* verifyHarnesses(worker, brains, runHost, (command, args) => commands.remote("preflight", vm.sshDest, command, args));
+        yield* verifyLinuxMemory(worker, maxConcurrentAttempts, commands.remote("preflight", vm.sshDest, "cat", ["/proc/meminfo"]));
+        yield* verifyHarnessReadiness(worker, brains, harnessProbe(commands.childHost(vm.sshDest)), logins);
         for (const integration of options.githubIntegrations) {
-            yield* asCapability(worker, "credentials", `exe.dev GitHub integration ${integration.name} is not ready for ${integration.repository}`, commands.lobby("preflight", ["integrations", "test", integration.name]));
+            yield* asCapability(worker, "credentials", `exe.dev GitHub integration "${integration.name}" isn't ready for ${integration.repository}`, commands.lobby("preflight", ["integrations", "test", integration.name]));
         }
         yield* Ref.update(workers, (current) => {
             const next = new Map(current);
@@ -63,20 +57,16 @@ export const preflightFor = Effect.fn("ExeDevExecutor.preflightFor")(function* (
             worker,
             host: vm.sshDest,
             gitVersion,
-            nodeVersion,
-            protocolVersion: AttemptChannel.PROTOCOL_VERSION,
             harnesses: [...new Set(brains.map(({ harness }) => harness))].join(","),
             integrations: options.githubIntegrations.length,
         });
     }, logPreflightFailure);
-    // Both resolveVm failures are members of the ExecutorError union prepare
-    // reports, so a stopped VM keeps its typed capability shape.
     const vmFor = Effect.fn("ExeDevExecutor.vmFor")(function* (worker) {
         const cached = (yield* Ref.get(workers)).get(worker);
         if (cached !== undefined)
             return cached;
         return yield* resolveVm(worker);
     });
-    return { preflight, vmFor };
+    return { preflight, vmFor, harnessProbe };
 });
 //# sourceMappingURL=preflight.js.map

package/dist/exe-dev/preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/exe-dev/preflight.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,cAAc,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EAEnB,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAA4C,MAAM,YAAY,CAAC;AAEhG,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC,cAAc;IAC7B,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,MAAM,CAAC,cAAc;CAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAExD,MAAM,eAAe,GAAG,CACtB,MAAkB,EAClB,UAA4B,EAC5B,OAAe,EACf,KAAc,EACS,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAC5E,OAA8B,EAC9B,QAAwB,EACxB,OAAuB;IAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAuB,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAkB;QACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CACb,MAAM,EACN,SAAS,EACT,wDAAwD,MAAM,EAAE,EAChE,KAAK,CACN,CACF,CACF,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,SAAS,EACT,2BAA2B,MAAM,EAAE,EACnC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,SAAS,EACT,cAAc,MAAM,OAAO,EAAE,CAAC,MAAM,eAAe,EACnD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CACb,MAAM,EACN,WAAW,EACX,cAAc,MAAM,qCAAqC,EACzD,KAAK,CACN,CACF,CACF,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAoB,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,CACnB,MAAkB,EAClB,UAA4B,EAC5B,OAAe,EACf,MAAgD,EACP,EAAE,CAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC/D,MAAkB,EAClB,MAAgC;QAEhC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClD,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,kCAAkC,MAAM,EAAE,EAAE,KAAK,CAAC,CACtF,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CACrC,MAAM,EACN,WAAW,EACX,UAAU,MAAM,iBAAiB,EACjC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAC/D,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,WAAW,EACX,UAAU,MAAM,uCAAuC,EACvD,IAAI,KAAK,CAAC,UAAU,CAAC,CACtB,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CACtC,MAAM,EACN,WAAW,EACX,UAAU,MAAM,qBAAqB,EACrC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAChE,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,kBAAkB,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,WAAW,EACX,UAAU,MAAM,gBAAgB,WAAW,IAAI,SAAS,cAAc,kBAAkB,GAAG,EAC3F,IAAI,KAAK,CAAC,0BAA0B,CAAC,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CACnC,MAAM,EACN,UAAU,EACV,UAAU,MAAM,eAAe,OAAO,CAAC,OAAO,EAAE,EAChD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;YACxD,GAAG,OAAO,CAAC,IAAI;YACf,oBAAoB;SACrB,CAAC,CACH,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,QAAQ,KAAK,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,UAAU,EACV,UAAU,MAAM,0BAA0B,QAAQ,IAAI,SAAS,cAAc,cAAc,CAAC,gBAAgB,EAAE,EAC9G,IAAI,KAAK,CAAC,4BAA4B,CAAC,CACxC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAChE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CACxD,CAAC;QAEF,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrD,KAAK,CAAC,CAAC,YAAY,CACjB,MAAM,EACN,aAAa,EACb,8BAA8B,WAAW,CAAC,IAAI,qBAAqB,WAAW,CAAC,UAAU,EAAE,EAC3F,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE;YACzD,MAAM;YACN,IAAI,EAAE,EAAE,CAAC,OAAO;YAChB,UAAU;YACV,WAAW;YACX,eAAe,EAAE,cAAc,CAAC,gBAAgB;YAChD,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,YAAY,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM;SAChD,CAAC,CAAC;IACL,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAExB,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAkB;QAC3E,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/exe-dev/preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,QAAQ,EAA4C,MAAM,YAAY,CAAC;AAEhF,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC,cAAc;IAC7B,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,MAAM,CAAC,cAAc;CAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAExD,MAAM,eAAe,GAAG,CACtB,MAAkB,EAClB,UAA4B,EAC5B,OAAe,EACf,KAAc,EACS,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAC5E,OAA8B,EAC9B,QAAwB;IAExB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAuB,CAAC,CAAC;IAEhE,uFAAuF;IACvF,MAAM,YAAY,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAEpF,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAkB;QACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CACb,MAAM,EACN,SAAS,EACT,yDAAyD,MAAM,GAAG,EAClE,KAAK,CACN,CACF,CACF,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,SAAS,EACT,4BAA4B,MAAM,GAAG,EACrC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,SAAS,EACT,eAAe,MAAM,QAAQ,EAAE,CAAC,MAAM,eAAe,EACrD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CACb,MAAM,EACN,WAAW,EACX,eAAe,MAAM,sCAAsC,EAC3D,KAAK,CACN,CACF,CACF,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAoB,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,CACnB,MAAkB,EAClB,UAA4B,EAC5B,OAAe,EACf,MAAgD,EACP,EAAE,CAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAC/D,MAAkB,EAClB,MAAgC,EAChC,qBAA6B;QAE7B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClD,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,+BAA+B,MAAM,GAAG,EAAE,KAAK,CAAC,CACpF,CACF,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CACrC,MAAM,EACN,WAAW,EACX,WAAW,MAAM,iBAAiB,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAC/D,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,MAAM,EACN,WAAW,EACX,WAAW,MAAM,wCAAwC,EACzD,IAAI,KAAK,CAAC,UAAU,CAAC,CACtB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,CAAC,iBAAiB,CACtB,MAAM,EACN,qBAAqB,EACrB,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,CAAC,CACnE,CAAC;QAEF,KAAK,CAAC,CAAC,sBAAsB,CAC3B,MAAM,EACN,MAAM,EACN,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAC5C,MAAM,CACP,CAAC;QAEF,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrD,KAAK,CAAC,CAAC,YAAY,CACjB,MAAM,EACN,aAAa,EACb,+BAA+B,WAAW,CAAC,IAAI,qBAAqB,WAAW,CAAC,UAAU,EAAE,EAC5F,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE;YACzD,MAAM;YACN,IAAI,EAAE,EAAE,CAAC,OAAO;YAChB,UAAU;YACV,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,YAAY,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM;SAChD,CAAC,CAAC;IACL,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAkB;QAC3E,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC"}

package/dist/executor.d.ts

@@ -1,122 +1,221 @@
+import type { AttemptRecovery, RecoverySink } from "@usine/core/attempt/salvage";
 import { Agent } from "@usine/core/agent";
 import { BrainSpec } from "@usine/core/agent/brain";
 import { AttemptId } from "@usine/core/attempt";
 import * as AttemptChannel from "@usine/core/attempt/channel";
 import { AttemptFailure } from "@usine/core/attempt/failure";
+import { LoopPermissions } from "@usine/core/loop";
+import { SalvagePushed } from "@usine/core/attempt/salvage";
 import { RepositoryName } from "@usine/core/repository";
 import { WorkerName, WorkerKind } from "@usine/core/worker";
 import { StepResult } from "@usine/core/step/result";
-import { Context, Effect, Redacted, Schema, Scope } from "effect";
-/** The Worker operation that failed during readiness checks or an Attempt's lifecycle. */
+import { Context, Effect, Option, type Result, Schema, Scope } from "effect";
 export declare const ExecutorOperation: Schema.Literals<readonly ["preflight", "prepare", "launch", "cancel", "cleanup"]>;
 export type ExecutorOperation = typeof ExecutorOperation.Type;
-/** A prerequisite a Worker must satisfy before it can accept Attempts. */
-export declare const WorkerCapability: Schema.Literals<readonly ["machine", "toolchain", "run-host", "harness-login", "credentials"]>;
+export declare const WorkerCapability: Schema.Literals<readonly ["machine", "toolchain", "memory", "harness-login", "credentials", "gateway"]>;
 export type WorkerCapability = typeof WorkerCapability.Type;
 declare const ExecutorOperationError_base: Schema.Class<ExecutorOperationError, Schema.TaggedStruct<"ExecutorOperationError", {
+    /** `cleanup` includes removing a checkout, its credential, or credentials left by an earlier process. */
     readonly operation: Schema.Literals<readonly ["preflight", "prepare", "launch", "cancel", "cleanup"]>;
+    /** An operator-facing summary without the Worker name. Not part of the contract; branch on `operation`. */
     readonly message: Schema.NonEmptyString;
+    /** The underlying failure, for example an `Error` with the command's stderr, or a timeout. */
     readonly cause: Schema.Defect;
 }>, import("effect/Cause").YieldableError>;
-/** A Worker operation failed before its requested work completed. */
 export declare class ExecutorOperationError extends ExecutorOperationError_base {
 }
+/**
+ * `refused` if a retry gets the same result: the installation doesn't cover the repository,
+ * lacks a permission, or is suspended, or an exe.dev Worker has no integration for it.
+ * `unreachable` if a retry can succeed: a GitHub outage or rate limit, or no response from a
+ * Gateway or exe.dev command.
+ */
+export declare const CredentialUnavailableReason: Schema.Literals<readonly ["refused", "unreachable"]>;
+export type CredentialUnavailableReason = typeof CredentialUnavailableReason.Type;
 declare const CredentialUnavailableError_base: Schema.Class<CredentialUnavailableError, Schema.TaggedStruct<"CredentialUnavailableError", {
     readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    readonly reason: Schema.Literals<readonly ["refused", "unreachable"]>;
+    /** An operator-facing summary, including GitHub's reason for a refusal. */
     readonly message: Schema.NonEmptyString;
+    /** The underlying failure, for example the GitHub API error from minting the token. */
     readonly cause: Schema.Defect;
 }>, import("effect/Cause").YieldableError>;
-/** A Worker could not obtain access to the repository assigned to an Attempt. */
 export declare class CredentialUnavailableError extends CredentialUnavailableError_base {
 }
 declare const WorkerCapabilityError_base: Schema.Class<WorkerCapabilityError, Schema.TaggedStruct<"WorkerCapabilityError", {
     readonly worker: Schema.brand<Schema.String, "WorkerName">;
-    readonly capability: Schema.Literals<readonly ["machine", "toolchain", "run-host", "harness-login", "credentials"]>;
+    /**
+     * - `machine`: the machine or VM is absent, stopped, or unreachable, or its Worker directory
+     *   isn't writable.
+     * - `toolchain`: Git or a brain's harness doesn't run.
+     * - `memory`: less than 1.5 GiB per concurrent Attempt, no swap for more than one, or memory
+     *   not reported.
+     * - `harness-login`: a brain's harness isn't logged in.
+     * - `credentials`: an exe.dev integration isn't ready, or the Worker kind can't issue a
+     *   read-only credential for a `permissions: read` Loop.
+     * - `gateway`: the Gateway doesn't respond or isn't reachable from the machine.
+     */
+    readonly capability: Schema.Literals<readonly ["machine", "toolchain", "memory", "harness-login", "credentials", "gateway"]>;
     readonly message: Schema.NonEmptyString;
+    /** The observed value, for example unrecognized `git --version` output or the harness readiness report. */
     readonly cause: Schema.Defect;
 }>, import("effect/Cause").YieldableError>;
-/** A verify-only preflight found a Worker capability missing or incompatible. */
+/** The error when preflight finds a Worker capability missing or incompatible. */
 export declare class WorkerCapabilityError extends WorkerCapabilityError_base {
 }
-/** A readiness, access, or lifecycle failure reported by a Worker operation. */
 export declare const ExecutorError: Schema.Union<readonly [typeof ExecutorOperationError, typeof CredentialUnavailableError, typeof WorkerCapabilityError]>;
 export type ExecutorError = typeof ExecutorError.Type;
-/** Logs every preflight refusal so a missing capability is explainable from logs alone. */
+/** Logs each preflight failure at error level. */
 export declare const logPreflightFailure: <A, R>(effect: Effect.Effect<A, ExecutorError, R>) => Effect.Effect<A, ExecutorError, R>;
-/** Process command for a one-shot run host or a preflight capability probe. */
-export interface RunHostCommand {
-    readonly command: string;
-    readonly args: ReadonlyArray<string>;
-}
 declare const CheckoutRequest_base: Schema.Class<CheckoutRequest, Schema.Struct<{
+    /** The checkout directory name, and the key for `cancel`, `intervene`, `isLive`, and `outcome`. */
     readonly attemptId: Schema.brand<Schema.NonEmptyString, "AttemptId">;
     readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    /** The only repository the Attempt's credential can access (ADR 0011). */
     readonly repository: Schema.brand<Schema.String, "RepositoryName">;
+    /** The Loop of the Attempt's Run, shown in a `read` checkout's pre-push hook message. */
+    readonly loop: Schema.brand<Schema.NonEmptyString, "LoopName">;
+    /**
+     * The Attempt's access to `repository` (ADR 0011). With `read`, the credential can't push, a
+     * pre-push hook explains rejected pushes, and an unsuccessful Attempt's checkout is removed
+     * without salvage. A Worker kind that can't issue such a credential fails `prepare` with a
+     * `credentials` capability error.
+     */
+    readonly permissions: Schema.Literals<readonly ["write", "read"]>;
+    /** The revision to fetch, resolved to a commit during preparation and stored as the RunSpec's `baseCommit`. */
     readonly revision: Schema.brand<Schema.String, "RepositoryRevision">;
+    /** The payload of the event that triggered the Run, included as JSON in the parent's prompt. */
     readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    /** The parent's task text, after Loop interpolation or operator amendment. */
     readonly task: Schema.brand<Schema.String, "AttemptTask">;
+    /**
+     * The Agent whose persona and name go in the parent's prompt and whose brain runs the
+     * children. Preparation verifies the brain on the Worker.
+     */
     readonly agent: typeof Agent;
+    /**
+     * The Pi parent's model. If `None`, uses the configured default model, then the first model
+     * with a credential. A model unknown to Pi fails the launch.
+     */
     readonly parentModel: Schema.Option<Schema.brand<Schema.String, "ModelId">>;
+    /** The maximum child sessions per Attempt. One more fails the Attempt with `ChildSessionBudgetFailure`. */
     readonly maxChildren: Schema.brand<Schema.Int, "ChildSessionBudget">;
-    /** Maximum minutes of live run-host execution; preparation and resource cleanup are outside this budget. */
-    readonly maxAttemptMinutes: Schema.Int;
-    /** Maximum reported tokens across the parent and every child; operator Holds never pause this ceiling. */
-    readonly maxAttemptTokens: Schema.Int;
+    /** The maximum minutes of Attempt execution, excluding preparation and cleanup, or `None` for no limit. */
+    readonly maxAttemptMinutes: Schema.Option<Schema.Int>;
+    /** The maximum tokens consumed by the parent and all children, or `None` for no limit. Holds don't pause it. */
+    readonly maxAttemptTokens: Schema.Option<Schema.Int>;
+    /** The Pi parent's reasoning effort. The launch fails if the model doesn't support it. */
     readonly parentEffort: Schema.Literals<readonly ["off", "minimal", "low", "medium", "high", "xhigh", "max"]>;
+    /** The ref that unfinished work is pushed to if the Attempt doesn't succeed. */
+    readonly salvageRef: Schema.brand<Schema.NonEmptyString, "SalvageRef">;
+    /** The previous Attempt's pushed salvage, checked out instead of `revision`. */
+    readonly resume: Schema.Option<typeof SalvagePushed>;
+    /**
+     * Whether the parent task is still live after an orchestrator restart. If true, preparation
+     * reuses the existing checkout and launch reattaches to the parent.
+     */
+    readonly reattach: Schema.withConstructorDefault<Schema.Boolean>;
+    /**
+     * The GitHub login the Attempt writes as, copied into the RunSpec; harvesting collects comments
+     * by this author. If `None`, harvesting asks GitHub for the credential's login.
+     */
+    readonly botLogin: Schema.withConstructorDefault<Schema.Option<Schema.brand<Schema.String, "BotLogin">>>;
 }>, {}>;
-/** The repository, revision, and Agent task assigned to a Worker for one fresh Attempt checkout. */
 export declare class CheckoutRequest extends CheckoutRequest_base {
 }
-/** One Attempt's disposable checkout directory. */
 export declare const WorktreePath: Schema.brand<Schema.NonEmptyString, "WorktreePath">;
 export type WorktreePath = typeof WorktreePath.Type;
 declare const AttemptWorkspace_base: Schema.Class<AttemptWorkspace, Schema.Struct<{
     readonly worker: Schema.brand<Schema.String, "WorkerName">;
+    /** The request's fields plus the commit that `revision` resolved to. */
     readonly spec: typeof AttemptChannel.RunSpec;
+    /** The checkout path on the Worker's machine, where the children run. */
     readonly worktree: Schema.brand<Schema.NonEmptyString, "WorktreePath">;
 }>, {}>;
-/** The serializable location and RunSpec of an Attempt checkout. Owning this record does not grant access to live resources or credentials. */
+/** A serializable checkout location and RunSpec, without credentials or live resources. */
 export declare class AttemptWorkspace extends AttemptWorkspace_base {
 }
 /**
- * One prepared Attempt with a scoped checkout and repository access. Use it within
- * the scope that prepared it. Closing that scope stops any active run host before
- * removing the checkout and releasing credentials, including when launch never starts.
+ * An Attempt prepared in the caller's scope and valid only within it. Closing that scope stops
+ * any active session, removes the checkout, and releases credentials, whether or not `launch`
+ * ran.
  */
 export interface PreparedAttempt {
-    /** Checkout metadata suitable for inspection or serialization; contains no credentials. */
     readonly workspace: AttemptWorkspace;
     /**
-     * Runs this Attempt once, recording channel activity through `io`. Completion,
-     * failure, or interruption releases its resources before returning. Cleanup
-     * failures are logged without replacing the agent's outcome or retrying its work.
-     * Reusing an Attempt after launch or release fails with an infrastructure error.
+     * Runs the Attempt once, writing channel activity to `io`, and releases its resources before
+     * returning. Cleanup failures are logged without changing the result. Fails with an
+     * infrastructure `AttemptFailure` if called again or after release.
      */
     readonly launch: (io: AttemptChannel.Sink) => Effect.Effect<StepResult, AttemptFailure>;
 }
+declare const WorkerCredential_base: Schema.Class<WorkerCredential, Schema.Struct<{
+    /**
+     * The token for git and gh, never written inside the checkout. Wiped when the Attempt's scope
+     * closes; `Redacted.value` then throws.
+     */
+    readonly value: Schema.Redacted<Schema.String>;
+    /** A new credential is requested when five minutes or less remain. */
+    readonly expiresAt: Schema.DateTimeUtc;
+}>, {}>;
+export declare class WorkerCredential extends WorkerCredential_base {
+}
 declare const CredentialProvider_base: Context.ServiceClass<CredentialProvider, "@usine/executor/CredentialProvider", {
-    readonly issue: (repository: RepositoryName, attemptId: AttemptId) => Effect.Effect<Redacted.Redacted<string>, CredentialUnavailableError>;
+    /**
+     * Returns a credential for `repository` only, with `permissions` (`read` can't push). The local
+     * and SSH executors call it during `prepare` and again before each expiry until the Attempt's
+     * resources are released; a failed renewal is logged and retried after 30 seconds.
+     */
+    readonly issue: (repository: RepositoryName, attemptId: AttemptId, permissions: LoopPermissions) => Effect.Effect<WorkerCredential, CredentialUnavailableError>;
 }>;
-/** Mints exactly one repository-scoped credential for each prepared Attempt. */
 export declare class CredentialProvider extends CredentialProvider_base {
 }
 declare const Executor_base: Context.ServiceClass<Executor, "@usine/executor/Executor", {
+    /**
+     * Reconciles the checkout of an Attempt that no Run reattaches, recording its salvage before
+     * releasing any work, even if `isLive` returns true. First stops the parent task if durable
+     * storage marks it live; if the task can't be confirmed stopped, fails with a `cancel`
+     * `ExecutorOperationError` and leaves the checkout. For an open Attempt whose parent task
+     * failed before the orchestrator stopped, first records the comments it posted on the Run's
+     * Item.
+     */
+    readonly recover: <E>(attempt: AttemptRecovery, record: RecoverySink<E>) => Effect.Effect<void, E | ExecutorError>;
+    /** The orchestrator doesn't start if a configured Worker has a different kind. */
     readonly kind: WorkerKind;
-    /** Verifies Git, the run host, and each rostered brain in the Worker environment; never installs tools or logs in. */
-    readonly preflight: (worker: WorkerName, brains: ReadonlyArray<BrainSpec>) => Effect.Effect<void, ExecutorError>;
     /**
-     * Verifies the assigned brain before acquiring a fresh Attempt in the caller's scope. Clone, fetch, and lock waits
-     * remain interruptible; partial preparation releases everything already acquired
-     * before reporting failure. Each request must identify a fresh Attempt.
+     * Returns whether the parent task is still running, or reported success before its checkout
+     * was harvested. If true, the orchestrator reattaches after a restart.
+     */
+    readonly isLive: (attemptId: AttemptId) => Effect.Effect<boolean, AttemptFailure>;
+    /**
+     * Returns the result a finished parent task stored before an orchestrator restart: the
+     * harvested result or the parent's failure. Returns `None` if nothing is stored or `isLive` is
+     * true.
+     */
+    readonly outcome: (attemptId: AttemptId) => Effect.Effect<Option.Option<Result.Result<StepResult, AttemptFailure>>, AttemptFailure>;
+    /**
+     * Verifies Git, enough memory for `maxConcurrentAttempts` concurrent Attempts, and each brain
+     * in `brains`. Never installs tools or logs in.
+     */
+    readonly preflight: (worker: WorkerName, brains: ReadonlyArray<BrainSpec>, maxConcurrentAttempts: number) => Effect.Effect<void, ExecutorError>;
+    /**
+     * Verifies the Agent's brain, then acquires the checkout and credential in the caller's scope.
+     * Clone, fetch, and lock waits are interruptible; on failure, releases everything acquired so
+     * far. `attemptId` must be new unless `reattach` is set.
      */
     readonly prepare: (request: CheckoutRequest) => Effect.Effect<PreparedAttempt, ExecutorError, Scope.Scope>;
-    /** Requests an active Attempt to stop, allowing a grace period before forcing termination. */
+    /**
+     * Stops preparation and releases partial resources, or cancels the live parent task with a
+     * grace period before forced termination, including one not reattached after a restart. Fails
+     * if the parent task can't be confirmed stopped. A canceled Attempt can't launch; after
+     * release, does nothing.
+     */
     readonly cancel: (attemptId: AttemptId) => Effect.Effect<void, ExecutorError>;
-    /** Delivers an attributed operator action through the active Attempt's channel. */
+    /** Sends an operator intervention to the Attempt's live session. */
     readonly intervene: (attemptId: AttemptId, intervention: AttemptChannel.Intervention) => Effect.Effect<void, AttemptFailure>;
 }>;
-/** Prepares isolated checkouts, runs Attempts on a Worker, and releases their resources (ADR 0006). */
+/** The service that prepares checkouts, runs Attempts on a Worker, and releases their resources (ADR 0006). */
 export declare class Executor extends Executor_base {
 }
-export {};
+export { claudeLoginLockLayer } from "./claude-login-lock.ts";
 //# sourceMappingURL=executor.d.ts.map

package/dist/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAmB,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,cAAc,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAElE,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,mFAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAE9D,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,gGAM3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;;;;;;AAE5D,qEAAqE;AACrE,qBAAa,sBAAuB,SAAQ,2BAM1C;CAAG;;;;;;AAEL,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,+BAM9C;CAAG;;;;;;;AAEL,iFAAiF;AACjF,qBAAa,qBAAsB,SAAQ,0BAOzC;CAAG;AAEL,gFAAgF;AAChF,eAAO,MAAM,aAAa,yHAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,GAAI,CAAC,EAAE,CAAC,UAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAajC,CAAC;AAEJ,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;;;;;;;;;;;IAeC,4GAA4G;;IAE5G,0GAA0G;;;;AAf5G,oGAAoG;AACpG,qBAAa,eAAgB,SAAQ,oBAiBnC;CAAG;AAEL,mDAAmD;AACnD,eAAO,MAAM,YAAY,qDAA2D,CAAC;AACrF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;;;;;;AAEpD,+IAA+I;AAC/I,qBAAa,gBAAiB,SAAQ,qBAMpC;CAAG;AAEL;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,cAAc,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;CACzF;;oBAMmB,CACd,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,SAAS,KACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAC;;AAP7E,gFAAgF;AAChF,qBAAa,kBAAmB,SAAQ,uBAQC;CAAG;;mBAMzB,UAAU;IACzB,sHAAsH;wBAClG,CAClB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;IACvC;;;;OAIG;sBACe,CAChB,OAAO,EAAE,eAAe,KACrB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC;IAC/D,8FAA8F;qBAC7E,CAAC,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7E,mFAAmF;wBAC/D,CAClB,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,cAAc,CAAC,YAAY,KACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;;AAxB5C,uGAAuG;AACvG,qBAAa,QAAS,SAAQ,aAyBC;CAAG"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAmB,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,cAAc,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAY,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAsB,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAY,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE7E,eAAO,MAAM,iBAAiB,mFAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAE9D,eAAO,MAAM,gBAAgB,yGAO3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;;IAK1D,yGAAyG;;IAEzG,2GAA2G;;IAE3G,8FAA8F;;;AAPhG,qBAAa,sBAAuB,SAAQ,2BAS1C;CAAG;AAEL;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,sDAA8C,CAAC;AACvF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAC;;;;IAOhF,2EAA2E;;IAE3E,uFAAuF;;;AAPzF,qBAAa,0BAA2B,SAAQ,+BAS9C;CAAG;;;IAOH;;;;;;;;;;OAUG;;;IAGH,2GAA2G;;;AAlB7G,kFAAkF;AAClF,qBAAa,qBAAsB,SAAQ,0BAmBzC;CAAG;AAEL,eAAO,MAAM,aAAa,yHAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,GAAI,CAAC,EAAE,CAAC,UAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAajC,CAAC;;IAKF,mGAAmG;;;IAGnG,0EAA0E;;IAE1E,yFAAyF;;IAEzF;;;;;OAKG;;IAEH,+GAA+G;;IAE/G,gGAAgG;;IAEhG,8EAA8E;;IAE9E;;;OAGG;;IAEH;;;OAGG;;IAEH,2GAA2G;;IAE3G,2GAA2G;;IAE3G,gHAAgH;;IAEhH,0FAA0F;;IAE1F,gFAAgF;;IAEhF,gFAAgF;;IAEhF;;;OAGG;;IAEH;;;OAGG;;;AArDL,qBAAa,eAAgB,SAAQ,oBAyDnC;CAAG;AAEL,eAAO,MAAM,YAAY,qDAA2D,CAAC;AACrF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;;;IAOlD,wEAAwE;;IAExE,yEAAyE;;;AAP3E,2FAA2F;AAC3F,qBAAa,gBAAiB,SAAQ,qBAQpC;CAAG;AAEL;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,cAAc,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;CACzF;;IAKC;;;OAGG;;IAEH,sEAAsE;;;AARxE,qBAAa,gBAAiB,SAAQ,qBAUpC;CAAG;;IAKD;;;;OAIG;oBACa,CACd,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,eAAe,KACzB,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;;AAZpE,qBAAa,kBAAmB,SAAQ,uBAcC;CAAG;;IAMxC;;;;;;;OAOG;sBACe,CAAC,CAAC,EAClB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,aAAa,CAAC;IAC3C,kFAAkF;mBACnE,UAAU;IACzB;;;OAGG;qBACc,CAAC,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC;IACjF;;;;OAIG;sBACe,CAChB,SAAS,EAAE,SAAS,KACjB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;IAC5F;;;OAGG;wBACiB,CAClB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,EAChC,qBAAqB,EAAE,MAAM,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;IACvC;;;;OAIG;sBACe,CAChB,OAAO,EAAE,eAAe,KACrB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC;IAC/D;;;;;OAKG;qBACc,CAAC,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7E,oEAAoE;wBAChD,CAClB,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,cAAc,CAAC,YAAY,KACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC;;AA3D5C,+GAA+G;AAC/G,qBAAa,QAAS,SAAQ,aA4DC;CAAG;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/executor.js

@@ -4,11 +4,12 @@ import { ChildSessionBudget } from "@usine/core/agent/session";
 import { AttemptTask, AttemptId } from "@usine/core/attempt";
 import * as AttemptChannel from "@usine/core/attempt/channel";
 import { AttemptFailure } from "@usine/core/attempt/failure";
+import { LoopName, LoopPermissions } from "@usine/core/loop";
+import { SalvagePushed, SalvageRef } from "@usine/core/attempt/salvage";
 import { RepositoryName, RepositoryRevision } from "@usine/core/repository";
-import { WorkerName, WorkerKind } from "@usine/core/worker";
+import { BotLogin, WorkerName, WorkerKind } from "@usine/core/worker";
 import { StepResult } from "@usine/core/step/result";
-import { Context, Effect, Redacted, Schema, Scope } from "effect";
-/** The Worker operation that failed during readiness checks or an Attempt's lifecycle. */
+import { Context, Effect, Option, Schema, Scope } from "effect";
 export const ExecutorOperation = Schema.Literals([
     "preflight",
     "prepare",
@@ -16,43 +17,65 @@ export const ExecutorOperation = Schema.Literals([
     "cancel",
     "cleanup",
 ]);
-/** A prerequisite a Worker must satisfy before it can accept Attempts. */
 export const WorkerCapability = Schema.Literals([
     "machine",
     "toolchain",
-    "run-host",
+    "memory",
     "harness-login",
     "credentials",
+    "gateway",
 ]);
-/** A Worker operation failed before its requested work completed. */
 export class ExecutorOperationError extends Schema.TaggedError("@usine/executor/ExecutorOperationError")("ExecutorOperationError", {
+    /** `cleanup` includes removing a checkout, its credential, or credentials left by an earlier process. */
     operation: ExecutorOperation,
+    /** An operator-facing summary without the Worker name. Not part of the contract; branch on `operation`. */
     message: Schema.NonEmptyString,
+    /** The underlying failure, for example an `Error` with the command's stderr, or a timeout. */
     cause: Schema.Defect(),
 }) {
 }
-/** A Worker could not obtain access to the repository assigned to an Attempt. */
+/**
+ * `refused` if a retry gets the same result: the installation doesn't cover the repository,
+ * lacks a permission, or is suspended, or an exe.dev Worker has no integration for it.
+ * `unreachable` if a retry can succeed: a GitHub outage or rate limit, or no response from a
+ * Gateway or exe.dev command.
+ */
+export const CredentialUnavailableReason = Schema.Literals(["refused", "unreachable"]);
 export class CredentialUnavailableError extends Schema.TaggedError("@usine/executor/CredentialUnavailableError")("CredentialUnavailableError", {
     repository: RepositoryName,
+    reason: CredentialUnavailableReason,
+    /** An operator-facing summary, including GitHub's reason for a refusal. */
     message: Schema.NonEmptyString,
+    /** The underlying failure, for example the GitHub API error from minting the token. */
     cause: Schema.Defect(),
 }) {
 }
-/** A verify-only preflight found a Worker capability missing or incompatible. */
+/** The error when preflight finds a Worker capability missing or incompatible. */
 export class WorkerCapabilityError extends Schema.TaggedError("@usine/executor/WorkerCapabilityError")("WorkerCapabilityError", {
     worker: WorkerName,
+    /**
+     * - `machine`: the machine or VM is absent, stopped, or unreachable, or its Worker directory
+     *   isn't writable.
+     * - `toolchain`: Git or a brain's harness doesn't run.
+     * - `memory`: less than 1.5 GiB per concurrent Attempt, no swap for more than one, or memory
+     *   not reported.
+     * - `harness-login`: a brain's harness isn't logged in.
+     * - `credentials`: an exe.dev integration isn't ready, or the Worker kind can't issue a
+     *   read-only credential for a `permissions: read` Loop.
+     * - `gateway`: the Gateway doesn't respond or isn't reachable from the machine.
+     */
     capability: WorkerCapability,
     message: Schema.NonEmptyString,
+    /** The observed value, for example unrecognized `git --version` output or the harness readiness report. */
     cause: Schema.Defect(),
 }) {
 }
-/** A readiness, access, or lifecycle failure reported by a Worker operation. */
 export const ExecutorError = Schema.Union([
     ExecutorOperationError,
     CredentialUnavailableError,
     WorkerCapabilityError,
 ]);
-/** Logs every preflight refusal so a missing capability is explainable from logs alone. */
+/** Logs each preflight failure at error level. */
 export const logPreflightFailure = (effect) => Effect.tapError(effect, (error) => error instanceof WorkerCapabilityError
     ? Effect.logError("Worker preflight failed", {
         error: error._tag,
@@ -64,37 +87,85 @@ export const logPreflightFailure = (effect) => Effect.tapError(effect, (error) =
         error: error._tag,
         message: error.message,
     }));
-/** The repository, revision, and Agent task assigned to a Worker for one fresh Attempt checkout. */
 export class CheckoutRequest extends Schema.Class("@usine/executor/CheckoutRequest")({
+    /** The checkout directory name, and the key for `cancel`, `intervene`, `isLive`, and `outcome`. */
     attemptId: AttemptId,
     worker: WorkerName,
+    /** The only repository the Attempt's credential can access (ADR 0011). */
     repository: RepositoryName,
+    /** The Loop of the Attempt's Run, shown in a `read` checkout's pre-push hook message. */
+    loop: LoopName,
+    /**
+     * The Attempt's access to `repository` (ADR 0011). With `read`, the credential can't push, a
+     * pre-push hook explains rejected pushes, and an unsuccessful Attempt's checkout is removed
+     * without salvage. A Worker kind that can't issue such a credential fails `prepare` with a
+     * `credentials` capability error.
+     */
+    permissions: LoopPermissions,
+    /** The revision to fetch, resolved to a commit during preparation and stored as the RunSpec's `baseCommit`. */
     revision: RepositoryRevision,
+    /** The payload of the event that triggered the Run, included as JSON in the parent's prompt. */
     payload: Schema.Json,
+    /** The parent's task text, after Loop interpolation or operator amendment. */
     task: AttemptTask,
+    /**
+     * The Agent whose persona and name go in the parent's prompt and whose brain runs the
+     * children. Preparation verifies the brain on the Worker.
+     */
     agent: Agent,
+    /**
+     * The Pi parent's model. If `None`, uses the configured default model, then the first model
+     * with a credential. A model unknown to Pi fails the launch.
+     */
     parentModel: Schema.Option(ModelId),
+    /** The maximum child sessions per Attempt. One more fails the Attempt with `ChildSessionBudgetFailure`. */
     maxChildren: ChildSessionBudget,
-    /** Maximum minutes of live run-host execution; preparation and resource cleanup are outside this budget. */
-    maxAttemptMinutes: Schema.Int.check(Schema.isGreaterThan(0)),
-    /** Maximum reported tokens across the parent and every child; operator Holds never pause this ceiling. */
-    maxAttemptTokens: Schema.Int.check(Schema.isGreaterThan(0)),
+    /** The maximum minutes of Attempt execution, excluding preparation and cleanup, or `None` for no limit. */
+    maxAttemptMinutes: Schema.Option(Schema.Int.check(Schema.isGreaterThan(0))),
+    /** The maximum tokens consumed by the parent and all children, or `None` for no limit. Holds don't pause it. */
+    maxAttemptTokens: Schema.Option(Schema.Int.check(Schema.isGreaterThan(0))),
+    /** The Pi parent's reasoning effort. The launch fails if the model doesn't support it. */
     parentEffort: Effort,
+    /** The ref that unfinished work is pushed to if the Attempt doesn't succeed. */
+    salvageRef: SalvageRef,
+    /** The previous Attempt's pushed salvage, checked out instead of `revision`. */
+    resume: Schema.Option(SalvagePushed),
+    /**
+     * Whether the parent task is still live after an orchestrator restart. If true, preparation
+     * reuses the existing checkout and launch reattaches to the parent.
+     */
+    reattach: Schema.Boolean.pipe(Schema.withConstructorDefault(Effect.succeed(false))),
+    /**
+     * The GitHub login the Attempt writes as, copied into the RunSpec; harvesting collects comments
+     * by this author. If `None`, harvesting asks GitHub for the credential's login.
+     */
+    botLogin: Schema.Option(BotLogin).pipe(Schema.withConstructorDefault(Effect.succeed(Option.none()))),
 }) {
 }
-/** One Attempt's disposable checkout directory. */
 export const WorktreePath = Schema.NonEmptyString.pipe(Schema.brand("WorktreePath"));
-/** The serializable location and RunSpec of an Attempt checkout. Owning this record does not grant access to live resources or credentials. */
+/** A serializable checkout location and RunSpec, without credentials or live resources. */
 export class AttemptWorkspace extends Schema.Class("@usine/executor/AttemptWorkspace")({
     worker: WorkerName,
+    /** The request's fields plus the commit that `revision` resolved to. */
     spec: AttemptChannel.RunSpec,
+    /** The checkout path on the Worker's machine, where the children run. */
     worktree: WorktreePath,
 }) {
 }
-/** Mints exactly one repository-scoped credential for each prepared Attempt. */
+export class WorkerCredential extends Schema.Class("@usine/executor/WorkerCredential")({
+    /**
+     * The token for git and gh, never written inside the checkout. Wiped when the Attempt's scope
+     * closes; `Redacted.value` then throws.
+     */
+    value: Schema.Redacted(Schema.String),
+    /** A new credential is requested when five minutes or less remain. */
+    expiresAt: Schema.DateTimeUtc,
+}) {
+}
 export class CredentialProvider extends Context.Service()("@usine/executor/CredentialProvider") {
 }
-/** Prepares isolated checkouts, runs Attempts on a Worker, and releases their resources (ADR 0006). */
+/** The service that prepares checkouts, runs Attempts on a Worker, and releases their resources (ADR 0006). */
 export class Executor extends Context.Service()("@usine/executor/Executor") {
 }
+export { claudeLoginLockLayer } from "./claude-login-lock.js";
 //# sourceMappingURL=executor.js.map