@zq-silk/yui 0.6.7 → 0.6.9

package/dist/core/controllerServer.js

@@ -6,6 +6,10 @@ import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CONTROLLER_DISCOVERY_PATH, FILE_TASK_CONTROLLER_PROTOCOL_VERSION, MAX_CONTROLLER_MESSAGE_BYTES, ControllerProtocolError, controllerFailure, encodeControllerResponse, isEmptyParams, parseControllerRequest } from "./protocol.js";
 import { controllerSocketPath } from "./controllerEndpoint.js";
+import { readHomeFilesystemId } from "./homeFilesystemIdentity.js";
+import { findLiveControllerProcessForHome } from "./controllerProcessIdentity.js";
+import { validateHomeId } from "../repository/homeIdentity.js";
+import { readCompatibleHomeIdentity } from "../storage/compatibleTaskStore.js";
 import { YUI_VERSION, yuiVersionIdentity } from "../version.js";
 import { resolveStoreWorkerEnabledForHome } from "../storage/storeRpc.js";
 import { resolveTaskStoreBackendForHome } from "../storage/sqliteStore.js";
@@ -32,7 +36,14 @@ export async function startControllerServer(home, dispatcher, beforeDiscoveryRem
 }
 async function startControllerServerLocked(home, dispatcher, beforeDiscoveryRemoval, options = {}) {
     const discoveryPath = join(home, CONTROLLER_DISCOVERY_PATH);
-    const socketPath = controllerSocketPath(home);
+    const homeId = validateHomeId(readCompatibleHomeIdentity(home).homeId);
+    const homeFilesystemId = readHomeFilesystemId(home);
+    await assertExistingDiscoveryReplaceable(discoveryPath);
+    if (findLiveControllerProcessForHome(homeFilesystemId) !== undefined) {
+        throw controllerAlreadyRunning();
+    }
+    const controllerInstanceId = randomBytes(16).toString("hex");
+    const socketPath = controllerSocketPath(homeId);
     const runtimeDirectory = dirname(discoveryPath);
     const socketDirectory = dirname(socketPath);
     await mkdir(runtimeDirectory, { recursive: true, mode: 0o700 });
@@ -66,7 +77,7 @@ async function startControllerServerLocked(home, dispatcher, beforeDiscoveryRemo
     // the live primary, so its startup identity is still truthful.
     let primaryIdentity = null;
     const netServer = createServer((socket) => {
-        receiveRequest(socket, token, dispatcher, () => closeRunning(), options.status, telemetry, handover, home, () => primaryIdentity);
+        receiveRequest(socket, token, dispatcher, () => closeRunning(), options.status, telemetry, handover, home, homeId, homeFilesystemId, controllerInstanceId, () => primaryIdentity);
     });
     try {
         await listen(netServer, socketPath);
@@ -91,6 +102,11 @@ async function startControllerServerLocked(home, dispatcher, beforeDiscoveryRemo
         await chmod(socketPath, 0o600);
         const processStartIdentity = await readLinuxProcessStartIdentity(process.pid);
         const discovery = Object.freeze({
+            schemaVersion: 1,
+            protocolVersion: FILE_TASK_CONTROLLER_PROTOCOL_VERSION,
+            homeId,
+            homeFilesystemId,
+            controllerInstanceId,
             pid: process.pid,
             processStartIdentity,
             socketPath,
@@ -125,7 +141,7 @@ async function startControllerServerLocked(home, dispatcher, beforeDiscoveryRemo
                 eventLoopDelay.stop();
                 await beforeDiscoveryRemoval?.();
                 await closeNetServer(netServer);
-                await removeOwnedDiscovery(discoveryPath, token);
+                await removeOwnedDiscovery(discoveryPath, token, controllerInstanceId);
                 if (options.domainIdentity !== undefined) {
                     // Keep the exact target fence while detached Role panes survive a
                     // Controller stop/restart. The owning test teardown or an expired
@@ -156,6 +172,54 @@ async function startControllerServerLocked(home, dispatcher, beforeDiscoveryRemo
         throw error;
     }
 }
+/**
+ * Fence an older Controller whose socket name was derived by another protocol.
+ * A dead or PID-reused owner is stale and may be replaced; an unverifiable
+ * live owner fails closed so an endpoint migration can never create dual
+ * writers for one durable Home.
+ */
+async function assertExistingDiscoveryReplaceable(discoveryPath) {
+    let value;
+    try {
+        value = JSON.parse(await readFile(discoveryPath, "utf8"));
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+            return;
+        throw unsafeExistingDiscovery(discoveryPath, error);
+    }
+    if (typeof value !== "object"
+        || value === null
+        || Array.isArray(value)
+        || !("pid" in value)
+        || !Number.isSafeInteger(value.pid)
+        || value.pid < 1) {
+        throw unsafeExistingDiscovery(discoveryPath);
+    }
+    const pid = value.pid;
+    if (!isProcessAlive(pid))
+        return;
+    if (!("processStartIdentity" in value)
+        || typeof value.processStartIdentity !== "string"
+        || !/^[0-9]{1,32}$/u.test(value.processStartIdentity)) {
+        throw unsafeExistingDiscovery(discoveryPath);
+    }
+    let currentIdentity;
+    try {
+        currentIdentity = await readLinuxProcessStartIdentity(pid);
+    }
+    catch (error) {
+        if (!isProcessAlive(pid))
+            return;
+        throw unsafeExistingDiscovery(discoveryPath, error);
+    }
+    if (currentIdentity === value.processStartIdentity) {
+        throw controllerAlreadyRunning();
+    }
+}
+function unsafeExistingDiscovery(discoveryPath, cause) {
+    return new Error(`Cannot safely replace existing Controller discovery: ${discoveryPath}.`, cause === undefined ? undefined : { cause });
+}
 async function writeDiscoveryAtomically(discoveryPath, discovery) {
     const temporaryPath = `${discoveryPath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
     try {
@@ -171,7 +235,7 @@ async function writeDiscoveryAtomically(discoveryPath, discovery) {
         throw error;
     }
 }
-function receiveRequest(socket, token, dispatcher, stop, status, telemetry, handover, home, getPrimaryIdentity) {
+function receiveRequest(socket, token, dispatcher, stop, status, telemetry, handover, home, homeId, homeFilesystemId, controllerInstanceId, getPrimaryIdentity) {
     let buffer = Buffer.alloc(0);
     let complete = false;
     const fail = (code, message, id = "invalid") => {
@@ -200,7 +264,7 @@ function receiveRequest(socket, token, dispatcher, stop, status, telemetry, hand
             return;
         }
         complete = true;
-        void routeRequest(socket, buffer.subarray(0, newline).toString("utf8"), token, dispatcher, stop, status, telemetry, handover, home, getPrimaryIdentity);
+        void routeRequest(socket, buffer.subarray(0, newline).toString("utf8"), token, dispatcher, stop, status, telemetry, handover, home, homeId, homeFilesystemId, controllerInstanceId, getPrimaryIdentity);
     });
     socket.on("end", () => {
         if (!complete)
@@ -208,7 +272,7 @@ function receiveRequest(socket, token, dispatcher, stop, status, telemetry, hand
     });
     socket.on("error", () => undefined);
 }
-async function routeRequest(socket, line, token, dispatcher, stop, status, telemetry, handover, home, getPrimaryIdentity) {
+async function routeRequest(socket, line, token, dispatcher, stop, status, telemetry, handover, home, homeId, homeFilesystemId, controllerInstanceId, getPrimaryIdentity) {
     let request;
     try {
         request = parseControllerRequest(line);
@@ -224,6 +288,16 @@ async function routeRequest(socket, line, token, dispatcher, stop, status, telem
         sendResponse(socket, controllerFailure(request.id, "UNAUTHORIZED", "Controller authentication failed."));
         return;
     }
+    if (request.protocolVersion !== FILE_TASK_CONTROLLER_PROTOCOL_VERSION) {
+        sendResponse(socket, controllerFailure(request.id, "CONTROLLER_PROTOCOL_MISMATCH", "Controller protocol version does not match the running Controller."));
+        return;
+    }
+    if (request.homeId !== homeId
+        || request.homeFilesystemId !== homeFilesystemId
+        || request.controllerInstanceId !== controllerInstanceId) {
+        sendResponse(socket, controllerFailure(request.id, "CONTROLLER_IDENTITY_MISMATCH", "Controller request identity does not match the running Controller."));
+        return;
+    }
     // Every authenticated request is observed once at the routing layer. The
     // observation completes when the response is handed to the socket, so a
     // later status snapshot sees prior built-in completions and the dispatcher
@@ -290,6 +364,9 @@ async function routeRequest(socket, line, token, dispatcher, stop, status, telem
                 cliRealpath: controllerCliRealpath(),
                 controllerRealpath: realpathSync(fileURLToPath(import.meta.url)),
                 controllerProtocolVersion: FILE_TASK_CONTROLLER_PROTOCOL_VERSION,
+                homeId,
+                homeFilesystemId,
+                controllerInstanceId,
                 storageBackend: resolveTaskStoreBackendForHome(home, process.env),
                 workerEnabled: resolveStoreWorkerEnabledForHome(home, process.env),
                 mode: "primary",
@@ -322,6 +399,9 @@ async function routeRequest(socket, line, token, dispatcher, stop, status, telem
                 uptimeMs: Math.round(process.uptime() * 1000),
                 rssBytes: process.memoryUsage().rss,
                 protocolVersion: FILE_TASK_CONTROLLER_PROTOCOL_VERSION,
+                homeId,
+                homeFilesystemId,
+                controllerInstanceId,
                 version: YUI_VERSION,
                 storageLayoutVersion: yuiVersionIdentity().storageLayoutVersion,
                 aggregateSchemaVersion: yuiVersionIdentity().aggregateSchemaVersion,
@@ -688,13 +768,15 @@ function closeNetServer(server) {
         server.close((error) => error === undefined ? resolve() : reject(error));
     });
 }
-async function removeOwnedDiscovery(path, token) {
+async function removeOwnedDiscovery(path, token, controllerInstanceId) {
     try {
         const value = JSON.parse(await readFile(path, "utf8"));
         if (typeof value === "object"
             && value !== null
             && "token" in value
-            && value.token === token) {
+            && value.token === token
+            && "controllerInstanceId" in value
+            && value.controllerInstanceId === controllerInstanceId) {
             await rm(path, { force: true });
         }
     }

package/dist/core/homeFilesystemIdentity.js

@@ -0,0 +1,24 @@
+import { statSync } from "node:fs";
+const HOME_FILESYSTEM_ID_PATTERN = /^[0-9]{1,32}:[0-9]{1,32}$/u;
+/**
+ * Runtime-only identity of the physical Home directory.
+ *
+ * Durable `homeId` names the logical Home. Device + inode distinguishes an
+ * accidental filesystem copy while allowing symlink aliases of the same
+ * directory to share one Controller. It is deliberately not persisted in the
+ * Home aggregate because replacing or copying the directory must change this
+ * runtime fence.
+ */
+export function readHomeFilesystemId(home) {
+    const metadata = statSync(home, { bigint: true });
+    if (!metadata.isDirectory()) {
+        throw new Error("YUI_HOME is not a directory.");
+    }
+    return `${metadata.dev}:${metadata.ino}`;
+}
+export function validateHomeFilesystemId(value) {
+    if (typeof value !== "string" || !HOME_FILESYSTEM_ID_PATTERN.test(value)) {
+        throw new Error("Home filesystem identity is invalid.");
+    }
+    return value;
+}

package/dist/core/protocol.js

@@ -1,7 +1,9 @@
+import { validateHomeId } from "../repository/homeIdentity.js";
+import { validateHomeFilesystemId } from "./homeFilesystemIdentity.js";
 export const MAX_CONTROLLER_MESSAGE_BYTES = 1_048_576;
 export const CONTROLLER_DISCOVERY_PATH = "runtime/controller.json";
 /** Bump when a running Controller cannot safely share one YUI_HOME with this CLI. */
-export const FILE_TASK_CONTROLLER_PROTOCOL_VERSION = 3;
+export const FILE_TASK_CONTROLLER_PROTOCOL_VERSION = 4;
 export class ControllerProtocolError extends Error {
     code;
     id;
@@ -18,12 +20,27 @@ export function parseControllerRequest(line) {
     }
     try {
         const value = JSON.parse(line);
-        if (!isRecord(value) || !hasExactKeys(value, ["id", "token", "method", "params"])) {
+        if (!isRecord(value) || !hasExactKeys(value, [
+            "id",
+            "token",
+            "protocolVersion",
+            "homeId",
+            "homeFilesystemId",
+            "controllerInstanceId",
+            "method",
+            "params"
+        ])) {
             throw new Error("shape");
         }
         if (!isIdentifier(value.id)
             || typeof value.token !== "string"
             || !/^[a-f0-9]{64}$/u.test(value.token)
+            || !Number.isSafeInteger(value.protocolVersion)
+            || value.protocolVersion < 1
+            || !isHomeId(value.homeId)
+            || !isHomeFilesystemId(value.homeFilesystemId)
+            || typeof value.controllerInstanceId !== "string"
+            || !/^[a-f0-9]{32}$/u.test(value.controllerInstanceId)
             || typeof value.method !== "string"
             || value.method.length > 128
             || !/^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*$/u.test(value.method)
@@ -33,6 +50,10 @@ export function parseControllerRequest(line) {
         return Object.freeze({
             id: value.id,
             token: value.token,
+            protocolVersion: value.protocolVersion,
+            homeId: value.homeId,
+            homeFilesystemId: value.homeFilesystemId,
+            controllerInstanceId: value.controllerInstanceId,
             method: value.method,
             params: value.params
         });
@@ -96,19 +117,41 @@ export function controllerFailure(id, code, message) {
         error: Object.freeze({ code, message })
     });
 }
-export function parseControllerDiscovery(value, expectedSocketPath) {
+export function parseControllerDiscovery(value, expected) {
     if (!isRecord(value)
-        || !hasExactKeys(value, ["pid", "processStartIdentity", "socketPath", "token"])
+        || !hasExactKeys(value, [
+            "schemaVersion",
+            "protocolVersion",
+            "homeId",
+            "homeFilesystemId",
+            "controllerInstanceId",
+            "pid",
+            "processStartIdentity",
+            "socketPath",
+            "token"
+        ])
+        || value.schemaVersion !== 1
+        || value.protocolVersion !== FILE_TASK_CONTROLLER_PROTOCOL_VERSION
+        || !isHomeId(value.homeId)
+        || value.homeFilesystemId !== expected.homeFilesystemId
+        || !isHomeFilesystemId(value.homeFilesystemId)
+        || typeof value.controllerInstanceId !== "string"
+        || !/^[a-f0-9]{32}$/u.test(value.controllerInstanceId)
         || !Number.isSafeInteger(value.pid)
         || value.pid < 1
         || typeof value.processStartIdentity !== "string"
         || !/^[0-9]{1,32}$/u.test(value.processStartIdentity)
-        || value.socketPath !== expectedSocketPath
+        || value.socketPath !== expected.socketPath
         || typeof value.token !== "string"
         || !/^[a-f0-9]{64}$/u.test(value.token)) {
         throw new ControllerProtocolError("CONTROLLER_DISCOVERY_INVALID", "Controller discovery is invalid.");
     }
     return Object.freeze({
+        schemaVersion: 1,
+        protocolVersion: value.protocolVersion,
+        homeId: value.homeId,
+        homeFilesystemId: value.homeFilesystemId,
+        controllerInstanceId: value.controllerInstanceId,
         pid: value.pid,
         processStartIdentity: value.processStartIdentity,
         socketPath: value.socketPath,
@@ -131,6 +174,26 @@ function isIdentifier(value) {
     return typeof value === "string"
         && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
+function isHomeId(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        validateHomeId(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isHomeFilesystemId(value) {
+    try {
+        validateHomeFilesystemId(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/integration/gitIntegrationService.js

@@ -59,7 +59,7 @@ export class GitIntegrationService {
     environment;
     runtimeIsolation;
     #resourceRegistrarValue;
-    constructor(home, store, git = new NodeGitWorkspace(), now = () => new Date(), environment = process.env, runtimeIsolation = defaultIntegrationRuntimeIsolation(home), jobPort) {
+    constructor(home, store, git = new NodeGitWorkspace(), now = () => new Date(), environment = process.env, runtimeIsolation = defaultIntegrationRuntimeIsolation(home, store.getHomeIdentity().homeId), jobPort) {
         this.store = store;
         this.git = git;
         this.now = now;
@@ -883,14 +883,14 @@ function isNodeCode(error, code) {
         && "code" in error
         && error.code === code;
 }
-function defaultIntegrationRuntimeIsolation(home) {
+function defaultIntegrationRuntimeIsolation(home, homeId) {
     const controlHome = resolve(home);
     return new FileTaskRuntimeIsolation({
         runtimeRoot: integrationRuntimeRoot(),
         pathLayout: "compact",
         controlPlane: {
             yuiHome: controlHome,
-            controllerSocketPath: controllerSocketPath(controlHome),
+            controllerSocketPath: controllerSocketPath(homeId),
             tmuxNamespace: yuiTmuxServerName(controlHome),
             globalInstallPaths: [process.execPath]
         }

package/dist/repository/homeIdentity.js

@@ -1,6 +1,12 @@
 import { randomBytes } from "node:crypto";
 export const HOME_IDENTITY_PATTERN = /^home-[a-f0-9]{16}$/;
 const HOME_ENTROPY_BYTES = 16;
+export function validateHomeId(homeId) {
+    if (typeof homeId !== "string" || !HOME_IDENTITY_PATTERN.test(homeId)) {
+        throw new Error("Home identity id is invalid.");
+    }
+    return homeId;
+}
 export function generateHomeIdentity(now, source = () => randomBytes(HOME_ENTROPY_BYTES)) {
     const entropy = source().toString("hex");
     const homeId = `home-${randomBytes(8).toString("hex")}`;
@@ -15,9 +21,7 @@ export function validateHomeIdentity(identity) {
     if (identity.schemaVersion !== 1) {
         throw new Error("Home identity must use schemaVersion 1.");
     }
-    if (typeof identity.homeId !== "string" || !HOME_IDENTITY_PATTERN.test(identity.homeId)) {
-        throw new Error("Home identity id is invalid.");
-    }
+    validateHomeId(identity.homeId);
     if (typeof identity.entropy !== "string" || !/^[a-f0-9]{32}$/.test(identity.entropy)) {
         throw new Error("Home identity entropy is invalid.");
     }

package/dist/resources/liveReferences.js

@@ -12,6 +12,9 @@ import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { parseExactTaskRuntimeDescriptor } from "../runtime/exactControlPlane.js";
 import { readRuntimeIdentity, releasesDirectory, resolveActiveRelease } from "../release/runtimeRelease.js";
+import { isControllerSocketPathForHome } from "../core/controllerEndpoint.js";
+import { parseControllerDiscovery } from "../core/protocol.js";
+import { readHomeFilesystemId } from "../core/homeFilesystemIdentity.js";
 const executeFile = promisify(execFile);
 /**
  * Collect every live reference for the given paths. The scan is fail-closed:
@@ -481,7 +484,11 @@ export function readControllerDiscovery(home) {
     }
     let record;
     try {
-        record = JSON.parse(readFileSync(path, "utf8"));
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            throw new Error("controller.json is not an object");
+        }
+        record = value;
     }
     catch (error) {
         return Object.freeze({
@@ -537,9 +544,35 @@ export function readControllerDiscovery(home) {
             }
         });
     }
+    let discovery;
+    try {
+        const homeId = record.homeId;
+        const socketPath = record.socketPath;
+        if (typeof homeId !== "string"
+            || typeof socketPath !== "string"
+            || !isControllerSocketPathForHome(homeId, socketPath)) {
+            throw new Error("Controller endpoint identity is invalid.");
+        }
+        discovery = parseControllerDiscovery(record, {
+            homeFilesystemId: readHomeFilesystemId(home),
+            socketPath
+        });
+    }
+    catch (error) {
+        return Object.freeze({
+            protects: false,
+            token: "",
+            protectedPaths: Object.freeze([]),
+            diagnostic: {
+                source: "controller",
+                severity: "error",
+                message: `controller.json identity is invalid: ${error instanceof Error ? error.message : "unknown error"}`
+            }
+        });
+    }
     return Object.freeze({
         protects: true,
-        token: `controller:${record.pid}`,
+        token: `controller:${discovery.homeId}:${discovery.controllerInstanceId}:${record.pid}`,
         protectedPaths: Object.freeze([path])
     });
 }

package/dist/runtime/runtimeObservation.js

@@ -118,6 +118,28 @@ export function runtimeObservationFenceMatches(expected, actual) {
     }
     return true;
 }
+/**
+ * Matches observations that belong to one durable Run/session generation.
+ * A provider may advance its native Turn while background subagents from an
+ * earlier Turn are still active, so nativeTurnId is intentionally excluded.
+ */
+export function runtimeObservationRunFenceMatches(expected, actual) {
+    for (const field of [
+        "taskId",
+        "roleName",
+        "runId",
+        "agentId",
+        "driverId",
+        "launchId",
+        "sessionGenerationId",
+        "nativeSessionId",
+        "receiptId"
+    ]) {
+        if (expected[field] !== actual[field])
+            return false;
+    }
+    return true;
+}
 /** Compact TaskEvent payload used for durable state-boundary observations. */
 export function runtimeObservationTaskEventPayload(input) {
     const observation = createRuntimeObservation(input);

package/dist/runtime/runtimeProjection.js

@@ -1,4 +1,4 @@
-import { createRuntimeObservation, runtimeObservationFenceMatches, runtimeObservationFromTaskEvent } from "./runtimeObservation.js";
+import { createRuntimeObservation, runtimeObservationFromTaskEvent, runtimeObservationRunFenceMatches } from "./runtimeObservation.js";
 export function createRuntimeProjection(fence, createdAt) {
     const timestamp = requireTimestamp(createdAt);
     return Object.freeze({
@@ -20,7 +20,7 @@ export function createRuntimeProjection(fence, createdAt) {
 export function projectRuntimeTaskEvents(fence, createdAt, events) {
     const observations = events
         .map(runtimeObservationFromTaskEvent)
-        .filter((event) => (event !== null && runtimeObservationFenceMatches(fence, event.fence)))
+        .filter((event) => (event !== null && runtimeObservationRunFenceMatches(fence, event.fence)))
         .sort((left, right) => (left.receivedAt.localeCompare(right.receivedAt)
         || (left.sequence ?? -1) - (right.sequence ?? -1)
         || (left.ordinal ?? -1) - (right.ordinal ?? -1)
@@ -29,7 +29,7 @@ export function projectRuntimeTaskEvents(fence, createdAt, events) {
 }
 export function projectRuntimeObservation(current, raw) {
     const event = createRuntimeObservation(raw);
-    if (!runtimeObservationFenceMatches(current.fence, event.fence)) {
+    if (!runtimeObservationRunFenceMatches(current.fence, event.fence)) {
         throw new Error("Runtime observation fence does not match the projection.");
     }
     const at = event.receivedAt;
@@ -79,7 +79,10 @@ export function projectRuntimeObservation(current, raw) {
                 turn: "completed",
                 waitingReason: undefined,
                 waitId: undefined,
-                operations: Object.freeze({}),
+                // Tool operations belong to the completed native Turn. Provider-owned
+                // background subagents may legitimately outlive it and wake later
+                // native Turns inside the same durable Yui Run.
+                operations: activeSubagentOperations(current.operations),
                 stateSince: at
             }), "provider", at);
         case "turn.failed":
@@ -261,6 +264,9 @@ function dominantOperation(operations) {
         return "model";
     return null;
 }
+function activeSubagentOperations(operations) {
+    return Object.freeze(Object.fromEntries(Object.entries(operations).filter(([, operation]) => operation.kind === "subagent")));
+}
 function terminalTurn(current, fallback = "cancelled") {
     return current === "completed" || current === "failed" || current === "cancelled"
         ? current

package/dist/scheduler/leaderWakeupProcessor.js

@@ -410,7 +410,8 @@ function leaderWakeupInput(taskId, runId, reasons, projectBindings) {
             : `Project Policy references: ${projectBindings.map((binding) => `${binding.directory} (${binding.projectId})`).join(", ")}. Read each with yui project show <project>, then yui project knowledge list <project> and yui project knowledge show <project> <knowledge>.`,
         "Use narrower Task message, WorkItem, decision, milestone, and input commands only when a specific record needs closer inspection.",
         `When the requested outcome is finished and there are no active Worker Runs or unresolved inputs, complete the Task with yui task complete ${taskId} --summary-file - and a quoted heredoc containing the final outcome and evidence.`,
-        `Before ending this turn, if the Task was not completed and no InputRequest terminalized this Run, release the active fence with yui task run yield ${runId} --summary-file - and a quoted heredoc containing the current result or waiting state. In particular, yield before waiting for Worker results; do not end the native turn while this Run remains active. The yield command must be the final tool action: after it succeeds, stop immediately and do not inspect, poll, accept, or perform further work in the same native turn.`
+        "Provider-native subagents remain inside this Leader AgentRun. Yui observes their structured lifecycle and keeps the Run active across intermediate provider Turn boundaries while children remain active; let the provider deliver completion notifications and continue synthesis without polling or yielding merely for that native wait.",
+        `Before ending this turn, if the Task was not completed, no InputRequest terminalized this Run, and no provider-native child work remains active, release the active fence with yui task run yield ${runId} --summary-file - and a quoted heredoc containing the current result or waiting state. For managed Task Role or Reviewer results, checkpoint and yield before waiting so their durable mailbox can wake a later Leader Run. The yield command must be the final tool action: after it succeeds, stop immediately and do not inspect, poll, accept, or perform further work in the same native turn.`
     ];
     return lines.join("\n");
 }

package/dist/storage/compatibleTaskStore.js

@@ -3,8 +3,9 @@ import { join } from "node:path";
 import { StorageCompatibilityError, loadCompatibleSnapshot } from "./migration/index.js";
 import { createProductionStorageRegistry } from "./migration/productionRegistry.js";
 import { FileTaskStore, STORAGE_STATE_FILE, stateFileFingerprint, StorageRecordError, validateCurrentStorageStateSnapshot } from "./taskStore.js";
-import { SqliteTaskStore } from "./sqliteStore.js";
+import { readSqliteHomeIdentity, SqliteTaskStore } from "./sqliteStore.js";
 import { COMMITTED_DATABASE_FILENAME } from "./upgrade/sqliteStateMigration.js";
+import { validateHomeIdentity } from "../repository/homeIdentity.js";
 import { ensureStorageSchema, inspectStorageSchema, readStorageSchemaManifest, STORAGE_SCHEMA_FILE } from "./storageSchema.js";
 import { classifyHome } from "./upgrade/homeClassification.js";
 import { inspectSnapshotVersionState } from "./upgrade/homeMigrationTarget.js";
@@ -81,6 +82,40 @@ export function openCompatibleFileTaskStore(home, options = {}) {
             throw new StorageCompatibilityError(describeUnsupported(classification.classification));
     }
 }
+/**
+ * Read the one authoritative durable Home identity without creating runtime
+ * state. SQLite is opened read-only; file-backed Homes read only the immutable
+ * identity field, so an aggregate that requires offline migration can still
+ * authenticate its already-running Controller before the migration stops it.
+ */
+export function readCompatibleHomeIdentity(home, options = {}) {
+    const schema = inspectStorageSchema(home);
+    if (!options.forceStateSource
+        && (schema.status === "current" || schema.status === "unsupported")
+        && schema.currentLayoutVersion >= 7
+        && existsSync(join(home, COMMITTED_DATABASE_FILENAME))) {
+        return readSqliteHomeIdentity(home, COMMITTED_DATABASE_FILENAME);
+    }
+    if (!existsSync(join(home, STORAGE_STATE_FILE))) {
+        throw new StorageRecordError("Durable Home identity is missing.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(home, STORAGE_STATE_FILE), "utf8"));
+    }
+    catch {
+        throw new StorageRecordError("Durable Home identity state is invalid JSON.");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new StorageRecordError("Durable Home identity state is invalid.");
+    }
+    try {
+        return validateHomeIdentity(parsed.homeIdentity);
+    }
+    catch {
+        throw new StorageRecordError("Durable Home identity is invalid.");
+    }
+}
 /**
  * The one-snapshot open for a Home whose manifest is already current. A single
  * fingerprint-fenced read of `state.json` supplies:

package/dist/storage/sqliteStore.js

@@ -43,7 +43,7 @@ import { mailboxTargetKey } from "../coordination/workMailbox.js";
 import { validatePendingTurnCompletion } from "../executor/turnCompletion.js";
 import { compareRuntimeSessionCandidates, projectRuntimeSessionCandidate } from "../runtime/runtimeSessionCandidate.js";
 import { validateReviewFinding } from "../review/reviewFinding.js";
-import { generateHomeIdentity } from "../repository/homeIdentity.js";
+import { generateHomeIdentity, validateHomeIdentity } from "../repository/homeIdentity.js";
 import { validateIntegrationQueueEntry } from "../integration/integrationQueueEntry.js";
 import { validDurableJobTransition, validateDurableJob } from "../job/durableJob.js";
 import { TASK_RECORD_ID_PREFIXES } from "../task/taskRecordReference.js";
@@ -53,6 +53,30 @@ import { CURRENT_CONFIG_SCHEMA_VERSION, CURRENT_PENDING_WAKEUP_SCHEMA_VERSION, C
 import { gateArtifactKey, validateGateArtifact } from "../verification/gateArtifact.js";
 import { migrateSqliteSchema, SQLITE_AGGREGATE_VERSION, SQLITE_LAYOUT_VERSION, TELEMETRY_KEEP_PER_GENERATION, TELEMETRY_RUN_CAP } from "./sqliteSchema.js";
 import { inspectStorageSchema } from "./storageSchema.js";
+/** Read the immutable Home identity without opening a writable Store connection. */
+export function readSqliteHomeIdentity(rootDir, databaseFilename = "yui.db") {
+    const database = new Database(join(rootDir, databaseFilename), {
+        readonly: true,
+        fileMustExist: true
+    });
+    try {
+        const row = database.prepare("SELECT home_identity FROM home_meta WHERE id = 1").get();
+        if (typeof row?.home_identity !== "string") {
+            throw new StorageRecordError("SQLite Home identity is missing.");
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(row.home_identity);
+        }
+        catch {
+            throw new StorageRecordError("SQLite Home identity is invalid JSON.");
+        }
+        return validateHomeIdentity(parsed);
+    }
+    finally {
+        database.close();
+    }
+}
 const DEFAULT_CONFIG = { schemaVersion: CURRENT_CONFIG_SCHEMA_VERSION };
 function numericCompare(left, right) {
     return left.localeCompare(right, undefined, { numeric: true });