agent-tempo 1.7.0 → 2.0.0-beta.1

package/dist/cli/sa-preflight.d.ts

@@ -15,20 +15,6 @@ export declare const REQUIRED_SEARCH_ATTRIBUTES: ReadonlyArray<{
     name: string;
     type: 'Keyword' | 'Bool';
 }>;
-/**
- * T0.5 (#747) — legacy attributes that pre-v1.8 deployments registered and
- * pre-v1.8 workflow runs still carry. NEVER auto-unregistered (dropping a
- * search attribute is a privileged, operator-only action — see
- * `docs/ops/sa-diet-migration.md`); fresh namespaces simply don't register
- * them. Kept here so tooling can name them in diagnostics and so the
- * dual-read fallback window (memo preferred, SA fallback in
- * `utils/search-attributes.ts`) is documented next to the list it falls
- * back to. Dual-read fallback may be removed at the next major.
- */
-export declare const LEGACY_SEARCH_ATTRIBUTES: ReadonlyArray<{
-    name: string;
-    type: 'Keyword' | 'Bool';
-}>;
 export interface SearchAttributePreflightOpts {
     temporalAddress: string;
     temporalNamespace: string;

package/dist/cli/sa-preflight.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LEGACY_SEARCH_ATTRIBUTES = exports.REQUIRED_SEARCH_ATTRIBUTES = void 0;
+exports.REQUIRED_SEARCH_ATTRIBUTES = void 0;
 exports.defaultProbeRegisteredAttributes = defaultProbeRegisteredAttributes;
 exports.isTemporalCloud = isTemporalCloud;
 exports.sdkProbeRegisteredAttributes = sdkProbeRegisteredAttributes;
@@ -97,22 +97,6 @@ exports.REQUIRED_SEARCH_ATTRIBUTES = Object.freeze([
     { name: 'AgentTempoAttachedHost', type: 'Keyword' },
     { name: 'AgentTempoAttachmentState', type: 'Keyword' },
 ]);
-/**
- * T0.5 (#747) — legacy attributes that pre-v1.8 deployments registered and
- * pre-v1.8 workflow runs still carry. NEVER auto-unregistered (dropping a
- * search attribute is a privileged, operator-only action — see
- * `docs/ops/sa-diet-migration.md`); fresh namespaces simply don't register
- * them. Kept here so tooling can name them in diagnostics and so the
- * dual-read fallback window (memo preferred, SA fallback in
- * `utils/search-attributes.ts`) is documented next to the list it falls
- * back to. Dual-read fallback may be removed at the next major.
- */
-exports.LEGACY_SEARCH_ATTRIBUTES = Object.freeze([
-    { name: 'AgentTempoGitRoot', type: 'Keyword' },
-    { name: 'AgentTempoPlayerType', type: 'Keyword' },
-    { name: 'AgentTempoIsConductor', type: 'Bool' },
-    { name: 'AgentTempoAttachmentId', type: 'Keyword' },
-]);
 /**
  * Default probe — shells out to `temporal operator search-attribute list`.
  * Returns an empty set on any error so callers fall through to the

package/dist/cli/startup.d.ts

@@ -1,6 +1,6 @@
 import { Config } from '../config';
 import type { EnsembleSummary } from '../client/interface';
-export type StepName = 'legacyHomeMigration' | 'preflight' | 'mcpConfig' | 'temporalReach' | 'searchAttrs' | 'daemonBoot' | 'badgeCollection';
+export type StepName = 'preflight' | 'mcpConfig' | 'temporalReach' | 'searchAttrs' | 'daemonBoot' | 'badgeCollection';
 /** Structured per-step result. `ok` = ran successfully; `skipped` = cache hit;
  *  `action-taken` = needed repair (e.g. started daemon, registered MCP);
  *  `failed` = non-fatal failure recorded for the TUI to surface. */
@@ -55,15 +55,6 @@ export interface BootstrapArgs {
      * simulates a successful start; `'failed'` + `detail` simulates failure.
      */
     daemonBoot?: (config: Config) => Promise<StepOutcome>;
-    /**
-     * PR-2 of the v1.0 rebrand — one-shot copy of `~/.agent-tempo/` →
-     * `~/.agent-tempo/`. Runs once on first boot of the new binary; idempotent
-     * thereafter. Tests should override to avoid touching real $HOME.
-     *
-     * Failure here MUST NOT block the boot path — record `'failed'` with a
-     * detail string and let the rest of bootstrap proceed.
-     */
-    legacyHomeMigration?: () => Promise<StepOutcome>;
     /**
      * Inject the Temporal reachability probe (steps 3 + 6). Tests override
      * to avoid real network I/O — default performs `createTemporalConnection`

package/dist/cli/startup.js

@@ -73,7 +73,6 @@ const orphans_1 = require("../reconcile/orphans");
 const client_2 = require("../client");
 const os_1 = require("os");
 const git_info_1 = require("../git-info");
-const legacy_migration_1 = require("./legacy-migration");
 // ─────────────────────────────────────────────────────────────────────────
 // Cache (schema v1)
 // ─────────────────────────────────────────────────────────────────────────
@@ -241,38 +240,6 @@ function daemonLogErrorTail(logPath) {
 // ─────────────────────────────────────────────────────────────────────────
 // Individual steps
 // ─────────────────────────────────────────────────────────────────────────
-/**
- * Default step-0 implementation — invokes the one-shot legacy home migration
- * (`~/.agent-tempo/` → `~/.agent-tempo/`). Idempotent: re-runs are
- * `'skipped'` once the marker is in place. Failure is recorded but never
- * blocks bootstrap (PR-2 brief).
- */
-async function defaultLegacyHomeMigrationStep() {
-    const t0 = perf_hooks_1.performance.now();
-    try {
-        const result = await (0, legacy_migration_1.migrateLegacyHome)();
-        const durationMs = perf_hooks_1.performance.now() - t0;
-        const detail = (0, legacy_migration_1.formatMigrationResult)(result);
-        switch (result.status) {
-            case 'no-legacy':
-            case 'already-migrated':
-                return { status: 'skipped', durationMs, detail };
-            case 'migrated':
-                return { status: 'action-taken', durationMs, detail };
-            case 'skipped':
-                return { status: 'skipped', durationMs, detail };
-            case 'failed':
-                return { status: 'failed', durationMs, detail };
-        }
-    }
-    catch (err) {
-        return {
-            status: 'failed',
-            durationMs: perf_hooks_1.performance.now() - t0,
-            detail: `legacy-migration crashed: ${err.message}`,
-        };
-    }
-}
 async function stepPreflight(cache, now) {
     if (isCacheFresh(cache.steps.preflight, TTL_24H, now)) {
         return { status: 'skipped', durationMs: 0 };
@@ -622,12 +589,6 @@ async function bootstrap(args) {
     const fetchLatest = args.fetchLatestVersion ?? defaultFetchLatestVersion;
     const cache = readCache(cacheDir, binaryVersion);
     const reachableProbe = args.isTemporalReachable ?? ((c) => isTemporalReachable(c, 3000));
-    // Step 0: legacy home migration (`~/.agent-tempo/` → `~/.agent-tempo/`)
-    // — PR-2 of the v1.0 rebrand. Runs before preflight so subsequent steps
-    // (cache read, MCP config write, daemon boot) all see the new home.
-    // MUST NOT block bootstrap — failure becomes a `'failed'` step with
-    // `detail`, and we keep going.
-    const legacyHomeMigration = await (args.legacyHomeMigration ?? defaultLegacyHomeMigrationStep)();
     // Steps 1–5: fail-fast on step 1 so we don't try to register MCP on an
     // incompatible Node. Each step mutates the cache in-place.
     const preflight = await stepPreflight(cache, now);
@@ -668,7 +629,6 @@ async function bootstrap(args) {
     return {
         durationMs: perf_hooks_1.performance.now() - start,
         steps: {
-            legacyHomeMigration,
             preflight,
             mcpConfig,
             temporalReach,

package/dist/cli.js

@@ -60,7 +60,6 @@ const out = __importStar(require("./cli/output"));
 const dev_banner_1 = require("./cli/dev-banner");
 const types_1 = require("./types");
 const config_1 = require("./config");
-const legacy_migration_1 = require("./cli/legacy-migration");
 const global_wrapper_1 = require("./cli/global-wrapper");
 const resolve_ensemble_1 = require("./cli/resolve-ensemble");
 const grpc_shutdown_guard_1 = require("./utils/grpc-shutdown-guard");
@@ -68,7 +67,9 @@ const grpc_shutdown_guard_1 = require("./utils/grpc-shutdown-guard");
 const PACKAGE_ROOT = (0, path_1.resolve)(__dirname, '..');
 function parseArgs(argv) {
     const result = {
-        command: 'tui',
+        // #789 — the TUI is deleted; a bare `agent-tempo` now resolves to the
+        // `home` command (bootstrap + status + hints), NOT a terminal UI launch.
+        command: 'home',
         positional: [],
         dir: process.cwd(),
         skipPreflight: false,
@@ -145,6 +146,11 @@ function parseArgs(argv) {
         else if (arg === '--no-hold') {
             result.noHold = true;
         }
+        else if (arg === '--from-upgrade') {
+            // `up --from-upgrade` (#786) — recreate protocol-2 workflows from the
+            // upgrade snapshot left by `upgrade-to-2`.
+            result.fromUpgrade = true;
+        }
         else if (arg === '--destroy') {
             result.destroy = true;
         }
@@ -168,12 +174,10 @@ function parseArgs(argv) {
             result.host = argv[++i];
         }
         else if (arg === '--force') {
-            // Consumed by `daemon start --force` (bypass stale-PID guard) and by
-            // `migrate-from-claude-tempo --force` (bypass conflict + volatile-state guards).
+            // Consumed by `daemon start --force` (bypass stale-PID guard).
             result.force = true;
         }
         else if (arg === '--dry-run') {
-            // `migrate-from-claude-tempo --dry-run` — print the plan, write nothing.
             // `upgrade-to-2 --dry-run` — print snapshot + destroy list, change nothing.
             result.dryRun = true;
         }
@@ -302,39 +306,6 @@ function cliOverrides(args) {
         temporalTlsKeyPath: args.temporalTlsKeyPath,
     };
 }
-/**
- * Format + print a {@link LegacyMigrationResult} from
- * `migrate-from-claude-tempo`. Extracted to module scope (an if/else cascade
- * rather than a nested switch) so the body doesn't trip the CLI surface-drift
- * detector, which scans top-level `case '...':` labels in this file.
- */
-function reportMigrationResult(result) {
-    const msg = (0, legacy_migration_1.formatMigrationResult)(result);
-    if (result.status === 'no-legacy' || result.status === 'already-migrated') {
-        out.success(msg);
-        return;
-    }
-    if (result.status === 'migrated') {
-        out.success(msg);
-        if (result.copiedFiles?.length) {
-            for (const f of result.copiedFiles)
-                out.log(`  ${out.dim('+')} ${f}`);
-        }
-        if (result.errors?.length) {
-            for (const e of result.errors)
-                out.warn(e);
-        }
-        return;
-    }
-    if (result.status === 'skipped') {
-        out.warn(msg);
-        process.exitCode = 1;
-        return;
-    }
-    // 'failed'
-    out.error(msg);
-    process.exitCode = 1;
-}
 async function main() {
     // Neutralize the Temporal/grpc-js "Channel has been shut down" retry-after-
     // close race before any Temporal-touching command runs. See
@@ -519,6 +490,7 @@ async function main() {
                 noHold: args.noHold,
                 agent: resolvedAgent(),
                 ...(args.scenario ? { scenario: args.scenario } : {}),
+                ...(args.fromUpgrade ? { fromUpgrade: true } : {}),
                 ...overrides,
             });
             break;
@@ -687,20 +659,6 @@ async function main() {
             out.log(out.dim('  A bare `pi` stays a plain coding session (neither extension activates).'));
             break;
         }
-        case 'migrate-from-claude-tempo': {
-            // PR-2 of the v1.0 rebrand — one-shot copy of `~/.agent-tempo/` →
-            // `~/.agent-tempo/`. Crash-proof (no Temporal deps). The `--dev`
-            // top-level flag selects the dev profile (`~/.agent-tempo-dev/` →
-            // `~/.agent-tempo-dev/`) via {@link isDevMode}.
-            const { migrateLegacyHome } = await Promise.resolve().then(() => __importStar(require('./cli/legacy-migration')));
-            const result = await migrateLegacyHome({
-                dryRun: !!args.dryRun,
-                force: !!args.force,
-                profile: (0, config_1.isDevMode)() ? 'dev' : 'prod',
-            });
-            reportMigrationResult(result);
-            break;
-        }
         case 'preflight': {
             // Preflight legitimately requires Temporal (that's what it tests), so
             // it's NOT in the crash-proof module set. Dynamic-imported here so its
@@ -721,35 +679,31 @@ async function main() {
             out.success('All checks passed');
             break;
         }
-        case 'tui': {
+        case 'home': {
+            // E.8 / D2 (#789) — bare `agent-tempo`: the #289 six-step auto-provisioning
+            // bootstrap (MCP registration, Temporal reachability, daemon boot,
+            // badges + ensembles prefetch), then a status snapshot + next-step hints.
+            // One-shot; the live operator surfaces are mission-control
+            // (`command-center`, when the Pi seat is installed) and the web dashboard.
+            // `--skip-preflight` renders the degraded no-result home. The rich,
+            // unit-tested render lives in the crash-proof `home-command` module.
             const config = (0, config_1.getConfig)(overrides);
-            // If --ensemble or positional arg given, start in single-ensemble view.
-            // Otherwise, start in multi-ensemble home view.
-            const tuiEnsemble = args.ensemble || args.positional[1] || undefined;
-            // #289 / S7: run the auto-provisioning bootstrap before handing off
-            // to the TUI. Steps 1–6 register MCP, ensure Temporal reachability,
-            // boot the daemon, and prefetch badges + ensembles so the TUI home
-            // view renders instantly. `skipPreflight` bypass: power users can
-            // opt out if the cache / disk-probe cost ever regresses (no current
-            // way to trigger, but the flag is already on the parser).
-            let bootstrapResult;
-            if (!args.skipPreflight) {
-                const { bootstrap } = await Promise.resolve().then(() => __importStar(require('./cli/startup')));
-                try {
-                    bootstrapResult = await bootstrap({ config });
-                }
-                catch (err) {
-                    // Bootstrap is best-effort — per-step failures degrade into
-                    // `StepOutcome.status: 'failed'` and a usable result. A thrown
-                    // error means something outside the step boundaries broke
-                    // (e.g. cache-dir creation). Log + continue with an undefined
-                    // bootstrap payload so the TUI still launches.
-                    out.warn(`Bootstrap hit an unexpected error: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-            // Dynamic import — TUI module uses ESM ink
-            const { run: runTui } = await Promise.resolve().then(() => __importStar(require('./tui/index')));
-            await runTui({ config, ensemble: tuiEnsemble, ...(bootstrapResult ? { bootstrap: bootstrapResult } : {}) });
+            const { runHome } = await Promise.resolve().then(() => __importStar(require('./cli/home-command')));
+            const { probePi, checkPiNodeFloor } = await Promise.resolve().then(() => __importStar(require('./pi/probe')));
+            const pkgVersion = require('../package.json').version;
+            await runHome({
+                bootstrap: args.skipPreflight
+                    ? null
+                    : async () => {
+                        const { bootstrap } = await Promise.resolve().then(() => __importStar(require('./cli/startup')));
+                        return bootstrap({ config });
+                    },
+                // The command-center seat needs BOTH the Pi package and the Node floor
+                // (the same pair command-center-command itself enforces) — suggesting
+                // it on an old Node would dead-end the user.
+                piAvailable: probePi().available && checkPiNodeFloor().ok,
+                version: pkgVersion,
+            });
             break;
         }
         // `version`, `help`, `upgrade`, `config`, `daemon`, and removed-verb

package/dist/client/core.js

@@ -42,9 +42,9 @@ exports.createTempoClientCore = createTempoClientCore;
  * future SSE event source, and any external SDK consumer that wants a
  * headless surface (no `child_process` dependency).
  *
- * The two spawn methods (`createEnsemble`, `spawnConductor`) and the
- * `runTempoCli` helper live in `./with-spawn.ts`, which composes this
- * factory and adds the TTY-bound surface.
+ * The spawn method (`createEnsemble`) and the `runTempoCli` helper live in
+ * `./with-spawn.ts`, which composes this factory and adds the TTY-bound surface.
+ * (`spawnConductor` was removed in #789 with the Ink TUI.)
  *
  * See `docs/adr/0007-tempoclient-core-withspawn-split.md` and
  * `docs/design/tempoclient-core-spawn-split.md`.
@@ -207,10 +207,10 @@ function createTempoClientCore(client, opts = {}) {
                         continue;
                     const entry = ensembleMap.get(name) || { count: 0, hasConductor: false };
                     entry.count++;
-                    // Preferred: memo `AgentTempoIsConductor` (v1.8 SA diet) with
-                    // legacy-SA fallback via the dual-read helper. Final fallback:
-                    // workflow ID convention — covers the brief window after a
-                    // conductor spawn before visibility propagates.
+                    // Preferred: memo `AgentTempoIsConductor` (memo-only after the #788
+                    // legacy-SA prune). Final fallback: workflow ID convention — covers
+                    // the brief window after a conductor spawn before visibility
+                    // propagates.
                     const isConductorFromSA = (0, search_attributes_1.getIsConductor)(wf) === true;
                     const isConductorFromId = wf.workflowId?.endsWith('-conductor') ?? false;
                     if (isConductorFromSA || isConductorFromId) {
@@ -257,10 +257,9 @@ function createTempoClientCore(client, opts = {}) {
                     // agent — counting it produced confusing "(2 players)" rows on
                     // a fresh ensemble with one real player. Mirrors the
                     // `filterRealPlayers` rule used in StatusBar (cf6becd). Detect
-                    // via the `AgentTempoPlayerType` memo (v1.8 SA diet; legacy-SA
-                    // fallback via the dual-read helper), with a workflow-id-suffix
-                    // fallback for the brief post-start window before visibility
-                    // propagates.
+                    // via the `AgentTempoPlayerType` memo (memo-only after the #788
+                    // legacy-SA prune), with a workflow-id-suffix fallback for the
+                    // brief post-start window before visibility propagates.
                     const playerType = (0, search_attributes_1.getPlayerType)(wf);
                     const isMaestroSession = playerType === 'maestro'
                         || (wf.workflowId?.endsWith('-maestro') ?? false);
@@ -379,10 +378,9 @@ function createTempoClientCore(client, opts = {}) {
                 for await (const wf of listWorkflows({ query })) {
                     const sa = wf.searchAttributes || {};
                     const playerId = Array.isArray(sa.AgentTempoPlayerId) ? String(sa.AgentTempoPlayerId[0]) : wf.workflowId;
-                    // Preferred: memo (v1.8 SA diet) with legacy-SA fallback via the
-                    // dual-read helper. Final fallback: workflow ID convention —
-                    // covers the brief window after a conductor spawn before
-                    // visibility propagates.
+                    // Preferred: memo (memo-only after the #788 legacy-SA prune). Final
+                    // fallback: workflow ID convention — covers the brief window after a
+                    // conductor spawn before visibility propagates.
                     const isConductorFromSA = (0, search_attributes_1.getIsConductor)(wf) === true;
                     const isConductorFromId = wf.workflowId?.endsWith('-conductor') ?? false;
                     players.push({

package/dist/client/index.d.ts

@@ -7,7 +7,8 @@
  * - {@link createTempoClientCore} — pure Temporal RPC, headless-safe
  *   (daemon, MCP server, SSE event source, future SDK consumers).
  * - {@link createTempoClientWithSpawn} — the TTY-bound superset adding
- *   `createEnsemble` and `spawnConductor`. Use from the TUI/CLI only.
+ *   `createEnsemble` (the CLI `up` path + the command-center board's
+ *   `/ensemble-up`). `spawnConductor` was removed in #789 with the Ink TUI.
  *
  * `createTempoClient` is preserved as a permanent alias for
  * `createTempoClientWithSpawn` so every existing call site keeps the same

package/dist/client/interface.d.ts

@@ -1,8 +1,11 @@
 /**
  * TempoClient — public interface and related types.
  *
- * Extracted from `src/tui/client.ts` so that non-TUI consumers (CLI, tests,
- * external integrations) can depend on the interface without pulling in Ink/React.
+ * Originally extracted from the former `src/tui/client.ts` so that headless
+ * consumers (CLI, tests, external integrations) could depend on the interface
+ * without pulling in Ink/React. (The Ink TUI was deleted in #789; the interface
+ * remains the shared contract for the CLI, daemon, command-center board, and
+ * external integrations.)
  */
 import type { AgentType, MaestroPlayerInfo, MaestroRelayMessage, HistoryEntry, Message, SentMessage, SessionMetadata, ScheduleEntry, QualityGate, StageEntry, WorktreeEntry, EnsembleChatResult, AttachmentInfo, HostInfo, AnswerEntry, CoatCheckEntry } from '../types';
 import type { CoatCheckPutInput, CoatCheckPutResult, CoatCheckGetInput } from '../workflows/maestro-signals';
@@ -515,18 +518,6 @@ export interface TempoClientWithSpawn extends TempoClientCore {
      * daemon, or other headless processes.
      */
     createEnsemble(opts: CreateEnsembleOpts): Promise<void>;
-    /**
-     * Spawn a conductor terminal for an existing ensemble — the restore-
-     * after-shutdown path. Shells out to `agent-tempo up <name>` which is
-     * idempotent at the workflow layer. Semantically distinct from
-     * {@link TempoClientWithSpawn.createEnsemble}: this fires on an ensemble
-     * that already exists; a "create" contradiction would mislead future
-     * readers. **Requires a TTY context.**
-     */
-    spawnConductor(opts: {
-        ensemble: string;
-        workDir?: string;
-    }): Promise<void>;
 }
 /**
  * Backwards-compatible alias preserved indefinitely (per ADR 0007's

package/dist/client/with-spawn.d.ts

@@ -7,8 +7,12 @@
  * no TTY and a stray spawn would launch a terminal nothing can render.
  *
  * The boundary is enforced by the type system: headless callers depend on
- * `TempoClientCore`; only the TUI (and its `ensure-conductor-spawned`
- * helper) opts into the spawn surface.
+ * `TempoClientCore`; the spawn surface is opt-in.
+ *
+ * NOTE (#789): `spawnConductor` was removed with the Ink TUI (its only caller
+ * was the TUI's `ensure-conductor-spawned` helper). WithSpawn's only distinct
+ * method is now `createEnsemble` — still live (CLI `up`, command-center board).
+ * The Core-vs-WithSpawn split STAYS (WithSpawn is the universal client alias).
  *
  * See `docs/adr/0007-tempoclient-core-withspawn-split.md`.
  */
@@ -18,8 +22,9 @@ import type { TempoClientWithSpawn } from './interface';
 export type { CreateTempoClientOpts } from './core';
 /**
  * Build a `TempoClientWithSpawn` over a configured Temporal `Client`.
- * Composes {@link createTempoClientCore} and adds the two TTY-bound
- * spawn methods. Use this for TUI-side consumers; headless callers
+ * Composes {@link createTempoClientCore} and adds the TTY-bound
+ * `createEnsemble` spawn method. Use this for spawn-capable consumers (the CLI
+ * `up` path, the command-center board's `/ensemble-up`); pure-headless callers
  * should use {@link createTempoClientCore} directly.
  *
  * `opts` (e.g. `subscribeDeps`) is forwarded to the Core factory.

package/dist/client/with-spawn.js

@@ -59,8 +59,9 @@ async function runTempoCli(args, workDir) {
 }
 /**
  * Build a `TempoClientWithSpawn` over a configured Temporal `Client`.
- * Composes {@link createTempoClientCore} and adds the two TTY-bound
- * spawn methods. Use this for TUI-side consumers; headless callers
+ * Composes {@link createTempoClientCore} and adds the TTY-bound
+ * `createEnsemble` spawn method. Use this for spawn-capable consumers (the CLI
+ * `up` path, the command-center board's `/ensemble-up`); pure-headless callers
  * should use {@link createTempoClientCore} directly.
  *
  * `opts` (e.g. `subscribeDeps`) is forwarded to the Core factory.
@@ -75,13 +76,9 @@ function createTempoClientWithSpawn(client, opts = {}) {
                 : ['up', opts.ensemble];
             await runTempoCli(args, opts.workDir);
         },
-        async spawnConductor(opts) {
-            // `agent-tempo up <ensemble>` is idempotent at the workflow layer —
-            // re-invoking it on a live ensemble reuses the existing conductor
-            // workflow (deterministic workflow ID). Distinct from
-            // `createEnsemble` so call sites read as "make sure the conductor
-            // terminal is running", not "create a new ensemble".
-            await runTempoCli(['up', opts.ensemble], opts.workDir);
-        },
+        // #789: `spawnConductor` removed with the Ink TUI — its only caller was the
+        // TUI's `ensure-conductor-spawned` helper (also deleted). WithSpawn's only
+        // distinct method is now `createEnsemble` (still used by the command-center
+        // board's `/ensemble-up` + the CLI `up` path).
     };
 }

package/dist/config.d.ts

@@ -257,19 +257,6 @@ export interface PersistedConfig {
     temporalTlsKeyPath?: string;
     defaultAgent?: AgentType;
     claudeBin?: string;
-    /**
-     * Bearer token for the daemon's HTTP/SSE event source (#94, #95,
-     * SSE-PROTOCOL.md §3.1). Auto-generated on first daemon boot when
-     * bearer mode is required (`AGENT_TEMPO_HTTP_BIND` non-loopback OR
-     * a request with a non-loopback `Origin`) and no token is set:
-     * `crypto.randomBytes(32).toString('base64url')`, 0600 on POSIX.
-     * Rotation = delete this field; next daemon boot regenerates.
-     *
-     * 3e: this LEGACY single token is migrated to the READ tier (T1) — a daemon
-     * with only `httpToken` set keeps read access and emits a one-time startup
-     * warning to set an admin token for writes/gate/inner. Prefer `readToken`.
-     */
-    httpToken?: string;
     /**
      * 3e RBAC — the READ-tier (T1) bearer token. Env `AGENT_TEMPO_HTTP_READ_TOKEN`
      * takes precedence over this; auto-generated here on first bearer-mode boot if

package/dist/constants.d.ts

@@ -16,6 +16,28 @@
  * for the kill regex to match.
  */
 export declare const ENSEMBLE_SENTINEL_FLAG = "--remote-control-session-name-prefix";
+/**
+ * 2.0 wire-protocol version (#786 — the cutover keystone). Single source of truth
+ * for the protocol stamp, the boot guard, and the `claimAttachment` adapter
+ * handshake.
+ *
+ * - **Stamp:** every 2.0-created workflow records `protocol: PROTOCOL_VERSION` on
+ *   its START input (so it's in history from run 1 and survives `continueAsNew`
+ *   via the input spread) and upserts the memo key {@link
+ *   MEMO_KEYS.protocol | `AgentTempoProtocol`} = PROTOCOL_VERSION.
+ * - **Boot guard:** a 2.0 daemon refuses to register workers if visibility shows
+ *   any Running agent-tempo workflow lacking the stamp — a 2.0 worker can never
+ *   deterministically replay a 1.x-recorded history, so we fail LOUD at boot
+ *   (printing `agent-tempo upgrade-to-2`) instead of non-determinism-faulting
+ *   deep in a workflow task later.
+ * - **claimAttachment:** the adapter sends `protocolVersion`; a 2.0 workflow
+ *   rejects any value `!== PROTOCOL_VERSION` (incl. a v1 adapter that omits it).
+ *
+ * This module is runtime-free, so the constant is safe to import from BOTH the
+ * sandboxed workflow bundle (the stamp + claim validator) AND the daemon guard /
+ * CLI (the check). Bumping it is a hard cutover — see `docs/design/v2-scoping.md`.
+ */
+export declare const PROTOCOL_VERSION: 2;
 /**
  * Escape the two regex metacharacters that can appear in validated player/ensemble
  * names (which are constrained to `[A-Za-z0-9._-]+`). Safe to interpolate the

package/dist/constants.js

@@ -6,7 +6,7 @@
  * code without dragging Node-only modules into the sandboxed bundle.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENSEMBLE_SENTINEL_FLAG = void 0;
+exports.PROTOCOL_VERSION = exports.ENSEMBLE_SENTINEL_FLAG = void 0;
 exports.escapeNameForRegex = escapeNameForRegex;
 exports.ensembleReadyBanner = ensembleReadyBanner;
 exports.ensembleReadyDirective = ensembleReadyDirective;
@@ -22,6 +22,28 @@ exports.ensembleReadyDirective = ensembleReadyDirective;
  * for the kill regex to match.
  */
 exports.ENSEMBLE_SENTINEL_FLAG = '--remote-control-session-name-prefix';
+/**
+ * 2.0 wire-protocol version (#786 — the cutover keystone). Single source of truth
+ * for the protocol stamp, the boot guard, and the `claimAttachment` adapter
+ * handshake.
+ *
+ * - **Stamp:** every 2.0-created workflow records `protocol: PROTOCOL_VERSION` on
+ *   its START input (so it's in history from run 1 and survives `continueAsNew`
+ *   via the input spread) and upserts the memo key {@link
+ *   MEMO_KEYS.protocol | `AgentTempoProtocol`} = PROTOCOL_VERSION.
+ * - **Boot guard:** a 2.0 daemon refuses to register workers if visibility shows
+ *   any Running agent-tempo workflow lacking the stamp — a 2.0 worker can never
+ *   deterministically replay a 1.x-recorded history, so we fail LOUD at boot
+ *   (printing `agent-tempo upgrade-to-2`) instead of non-determinism-faulting
+ *   deep in a workflow task later.
+ * - **claimAttachment:** the adapter sends `protocolVersion`; a 2.0 workflow
+ *   rejects any value `!== PROTOCOL_VERSION` (incl. a v1 adapter that omits it).
+ *
+ * This module is runtime-free, so the constant is safe to import from BOTH the
+ * sandboxed workflow bundle (the stamp + claim validator) AND the daemon guard /
+ * CLI (the check). Bumping it is a hard cutover — see `docs/design/v2-scoping.md`.
+ */
+exports.PROTOCOL_VERSION = 2;
 /**
  * Escape the two regex metacharacters that can appear in validated player/ensemble
  * names (which are constrained to `[A-Za-z0-9._-]+`). Safe to interpolate the

package/dist/daemon.js

@@ -952,6 +952,58 @@ async function main() {
             log('search-attribute preflight probe failed (non-fatal — createWorkers will surface the real error):', result.probeError);
         }
     }
+    // #786 — 2.0 cutover BOOT GUARD. Runs AFTER the search-attribute preflight
+    // and BEFORE createWorkers(): a 2.0 worker cannot deterministically replay a
+    // 1.x-recorded history, so refuse to register workers if visibility still
+    // shows ANY Running agent-tempo workflow lacking the protocol-2 stamp (a
+    // pre-cutover 1.x run). FAIL-CLOSED — a timed-out/errored scan, or a failure
+    // to even run the scan, refuses too (we couldn't PROVE the cutover is clean;
+    // see the #845 partial-scan lesson). Namespace-scoped via the client below.
+    // See src/upgrade/boot-guard.ts.
+    {
+        const { checkProtocolGuard } = await Promise.resolve().then(() => __importStar(require('./upgrade/boot-guard')));
+        let result;
+        let guardConn = null;
+        try {
+            guardConn = await (0, connection_1.createTemporalConnection)(config);
+            const guardClient = new client_1.Client({
+                connection: guardConn,
+                namespace: config.temporalNamespace,
+                interceptors: (0, action_counters_1.actionCountingInterceptors)(),
+            });
+            result = await checkProtocolGuard(guardClient, { log });
+        }
+        catch (err) {
+            // FAIL-CLOSED — couldn't even run the scan (e.g. connection failure).
+            // Without a completed scan we can't prove a clean cutover, so refuse
+            // rather than risk a 2.0 worker replaying a 1.x history.
+            result = {
+                ok: false,
+                reason: 'scan-incomplete',
+                message: `agent-tempo 2.0 boot guard could not run the protocol scan ` +
+                    `(${err instanceof Error ? err.message : String(err)}). Refusing to boot ` +
+                    `(fail-closed). Verify Temporal at ${config.temporalAddress} ` +
+                    `(namespace ${config.temporalNamespace}) is reachable, then retry.`,
+            };
+        }
+        finally {
+            if (guardConn)
+                await guardConn.close().catch(() => { });
+        }
+        if (!result.ok) {
+            process.stderr.write('ERROR: ' + result.message + '\n');
+            log(`Daemon refused to boot — ${result.reason} (#786 protocol guard)`);
+            try {
+                fs.unlinkSync(daemon_1.DAEMON_PID_PATH);
+            }
+            catch { /* ignore */ }
+            try {
+                fs.unlinkSync(daemon_1.DAEMON_HEARTBEAT_PATH);
+            }
+            catch { /* ignore */ }
+            process.exit(1);
+        }
+    }
     // Use mutable refs so signal handlers can be registered before workers
     // are created — closes the narrow window where a SIGTERM during
     // createWorkers() would be missed.