agent-tempo 1.7.0 → 2.0.0-beta.2

package/dist/client/core.js

@@ -42,9 +42,9 @@ exports.createTempoClientCore = createTempoClientCore;
  * future SSE event source, and any external SDK consumer that wants a
  * headless surface (no `child_process` dependency).
  *
- * The two spawn methods (`createEnsemble`, `spawnConductor`) and the
- * `runTempoCli` helper live in `./with-spawn.ts`, which composes this
- * factory and adds the TTY-bound surface.
+ * The spawn method (`createEnsemble`) and the `runTempoCli` helper live in
+ * `./with-spawn.ts`, which composes this factory and adds the TTY-bound surface.
+ * (`spawnConductor` was removed in #789 with the Ink TUI.)
  *
  * See `docs/adr/0007-tempoclient-core-withspawn-split.md` and
  * `docs/design/tempoclient-core-spawn-split.md`.
@@ -207,10 +207,10 @@ function createTempoClientCore(client, opts = {}) {
                         continue;
                     const entry = ensembleMap.get(name) || { count: 0, hasConductor: false };
                     entry.count++;
-                    // Preferred: memo `AgentTempoIsConductor` (v1.8 SA diet) with
-                    // legacy-SA fallback via the dual-read helper. Final fallback:
-                    // workflow ID convention — covers the brief window after a
-                    // conductor spawn before visibility propagates.
+                    // Preferred: memo `AgentTempoIsConductor` (memo-only after the #788
+                    // legacy-SA prune). Final fallback: workflow ID convention — covers
+                    // the brief window after a conductor spawn before visibility
+                    // propagates.
                     const isConductorFromSA = (0, search_attributes_1.getIsConductor)(wf) === true;
                     const isConductorFromId = wf.workflowId?.endsWith('-conductor') ?? false;
                     if (isConductorFromSA || isConductorFromId) {
@@ -257,10 +257,9 @@ function createTempoClientCore(client, opts = {}) {
                     // agent — counting it produced confusing "(2 players)" rows on
                     // a fresh ensemble with one real player. Mirrors the
                     // `filterRealPlayers` rule used in StatusBar (cf6becd). Detect
-                    // via the `AgentTempoPlayerType` memo (v1.8 SA diet; legacy-SA
-                    // fallback via the dual-read helper), with a workflow-id-suffix
-                    // fallback for the brief post-start window before visibility
-                    // propagates.
+                    // via the `AgentTempoPlayerType` memo (memo-only after the #788
+                    // legacy-SA prune), with a workflow-id-suffix fallback for the
+                    // brief post-start window before visibility propagates.
                     const playerType = (0, search_attributes_1.getPlayerType)(wf);
                     const isMaestroSession = playerType === 'maestro'
                         || (wf.workflowId?.endsWith('-maestro') ?? false);
@@ -379,10 +378,9 @@ function createTempoClientCore(client, opts = {}) {
                 for await (const wf of listWorkflows({ query })) {
                     const sa = wf.searchAttributes || {};
                     const playerId = Array.isArray(sa.AgentTempoPlayerId) ? String(sa.AgentTempoPlayerId[0]) : wf.workflowId;
-                    // Preferred: memo (v1.8 SA diet) with legacy-SA fallback via the
-                    // dual-read helper. Final fallback: workflow ID convention —
-                    // covers the brief window after a conductor spawn before
-                    // visibility propagates.
+                    // Preferred: memo (memo-only after the #788 legacy-SA prune). Final
+                    // fallback: workflow ID convention — covers the brief window after a
+                    // conductor spawn before visibility propagates.
                     const isConductorFromSA = (0, search_attributes_1.getIsConductor)(wf) === true;
                     const isConductorFromId = wf.workflowId?.endsWith('-conductor') ?? false;
                     players.push({

package/dist/client/index.d.ts

@@ -7,7 +7,8 @@
  * - {@link createTempoClientCore} — pure Temporal RPC, headless-safe
  *   (daemon, MCP server, SSE event source, future SDK consumers).
  * - {@link createTempoClientWithSpawn} — the TTY-bound superset adding
- *   `createEnsemble` and `spawnConductor`. Use from the TUI/CLI only.
+ *   `createEnsemble` (the CLI `up` path + the command-center board's
+ *   `/ensemble-up`). `spawnConductor` was removed in #789 with the Ink TUI.
  *
  * `createTempoClient` is preserved as a permanent alias for
  * `createTempoClientWithSpawn` so every existing call site keeps the same

package/dist/client/interface.d.ts

@@ -1,8 +1,11 @@
 /**
  * TempoClient — public interface and related types.
  *
- * Extracted from `src/tui/client.ts` so that non-TUI consumers (CLI, tests,
- * external integrations) can depend on the interface without pulling in Ink/React.
+ * Originally extracted from the former `src/tui/client.ts` so that headless
+ * consumers (CLI, tests, external integrations) could depend on the interface
+ * without pulling in Ink/React. (The Ink TUI was deleted in #789; the interface
+ * remains the shared contract for the CLI, daemon, command-center board, and
+ * external integrations.)
  */
 import type { AgentType, MaestroPlayerInfo, MaestroRelayMessage, HistoryEntry, Message, SentMessage, SessionMetadata, ScheduleEntry, QualityGate, StageEntry, WorktreeEntry, EnsembleChatResult, AttachmentInfo, HostInfo, AnswerEntry, CoatCheckEntry } from '../types';
 import type { CoatCheckPutInput, CoatCheckPutResult, CoatCheckGetInput } from '../workflows/maestro-signals';
@@ -515,18 +518,6 @@ export interface TempoClientWithSpawn extends TempoClientCore {
      * daemon, or other headless processes.
      */
     createEnsemble(opts: CreateEnsembleOpts): Promise<void>;
-    /**
-     * Spawn a conductor terminal for an existing ensemble — the restore-
-     * after-shutdown path. Shells out to `agent-tempo up <name>` which is
-     * idempotent at the workflow layer. Semantically distinct from
-     * {@link TempoClientWithSpawn.createEnsemble}: this fires on an ensemble
-     * that already exists; a "create" contradiction would mislead future
-     * readers. **Requires a TTY context.**
-     */
-    spawnConductor(opts: {
-        ensemble: string;
-        workDir?: string;
-    }): Promise<void>;
 }
 /**
  * Backwards-compatible alias preserved indefinitely (per ADR 0007's

package/dist/client/with-spawn.d.ts

@@ -7,8 +7,12 @@
  * no TTY and a stray spawn would launch a terminal nothing can render.
  *
  * The boundary is enforced by the type system: headless callers depend on
- * `TempoClientCore`; only the TUI (and its `ensure-conductor-spawned`
- * helper) opts into the spawn surface.
+ * `TempoClientCore`; the spawn surface is opt-in.
+ *
+ * NOTE (#789): `spawnConductor` was removed with the Ink TUI (its only caller
+ * was the TUI's `ensure-conductor-spawned` helper). WithSpawn's only distinct
+ * method is now `createEnsemble` — still live (CLI `up`, command-center board).
+ * The Core-vs-WithSpawn split STAYS (WithSpawn is the universal client alias).
  *
  * See `docs/adr/0007-tempoclient-core-withspawn-split.md`.
  */
@@ -18,8 +22,9 @@ import type { TempoClientWithSpawn } from './interface';
 export type { CreateTempoClientOpts } from './core';
 /**
  * Build a `TempoClientWithSpawn` over a configured Temporal `Client`.
- * Composes {@link createTempoClientCore} and adds the two TTY-bound
- * spawn methods. Use this for TUI-side consumers; headless callers
+ * Composes {@link createTempoClientCore} and adds the TTY-bound
+ * `createEnsemble` spawn method. Use this for spawn-capable consumers (the CLI
+ * `up` path, the command-center board's `/ensemble-up`); pure-headless callers
  * should use {@link createTempoClientCore} directly.
  *
  * `opts` (e.g. `subscribeDeps`) is forwarded to the Core factory.

package/dist/client/with-spawn.js

@@ -59,8 +59,9 @@ async function runTempoCli(args, workDir) {
 }
 /**
  * Build a `TempoClientWithSpawn` over a configured Temporal `Client`.
- * Composes {@link createTempoClientCore} and adds the two TTY-bound
- * spawn methods. Use this for TUI-side consumers; headless callers
+ * Composes {@link createTempoClientCore} and adds the TTY-bound
+ * `createEnsemble` spawn method. Use this for spawn-capable consumers (the CLI
+ * `up` path, the command-center board's `/ensemble-up`); pure-headless callers
  * should use {@link createTempoClientCore} directly.
  *
  * `opts` (e.g. `subscribeDeps`) is forwarded to the Core factory.
@@ -75,13 +76,9 @@ function createTempoClientWithSpawn(client, opts = {}) {
                 : ['up', opts.ensemble];
             await runTempoCli(args, opts.workDir);
         },
-        async spawnConductor(opts) {
-            // `agent-tempo up <ensemble>` is idempotent at the workflow layer —
-            // re-invoking it on a live ensemble reuses the existing conductor
-            // workflow (deterministic workflow ID). Distinct from
-            // `createEnsemble` so call sites read as "make sure the conductor
-            // terminal is running", not "create a new ensemble".
-            await runTempoCli(['up', opts.ensemble], opts.workDir);
-        },
+        // #789: `spawnConductor` removed with the Ink TUI — its only caller was the
+        // TUI's `ensure-conductor-spawned` helper (also deleted). WithSpawn's only
+        // distinct method is now `createEnsemble` (still used by the command-center
+        // board's `/ensemble-up` + the CLI `up` path).
     };
 }

package/dist/config.d.ts

@@ -18,6 +18,20 @@ export declare const ENV: {
     readonly DEFAULT_AGENT: "AGENT_TEMPO_DEFAULT_AGENT";
     readonly PLAYER_TYPE: "AGENT_TEMPO_PLAYER_TYPE";
     readonly CLAUDE_BIN: "AGENT_TEMPO_CLAUDE_BIN";
+    /**
+     * #704 — override (ms) for the booting attach-timeout watchdog deadline. Read
+     * at spawn time (`startRecruitedSession`) and threaded onto durable metadata
+     * (`SessionMetadata.bootingDeadlineMs`) because workflows can't read env.
+     * Default 180s. For tests/tuning.
+     */
+    readonly BOOTING_DEADLINE_MS: "AGENT_TEMPO_BOOTING_DEADLINE_MS";
+    /**
+     * #704 — override (ms) for how long a destroyed / boot-timed-out run's
+     * close-reason tombstone is honored by the bootstrap orphan-guard
+     * (`server.ts`). A late-launching orphan within this window self-exits.
+     * Default 6h (the observed orphan spawn delay was ~100min). For tuning.
+     */
+    readonly ORPHAN_TOMBSTONE_TTL_MS: "AGENT_TEMPO_ORPHAN_TOMBSTONE_TTL_MS";
     /**
      * #753 — cadence (ms) of the periodic `[agent-tempo:action-counters]` log
      * line each instrumented process emits. Default 5 minutes; `0` disables.
@@ -257,19 +271,6 @@ export interface PersistedConfig {
     temporalTlsKeyPath?: string;
     defaultAgent?: AgentType;
     claudeBin?: string;
-    /**
-     * Bearer token for the daemon's HTTP/SSE event source (#94, #95,
-     * SSE-PROTOCOL.md §3.1). Auto-generated on first daemon boot when
-     * bearer mode is required (`AGENT_TEMPO_HTTP_BIND` non-loopback OR
-     * a request with a non-loopback `Origin`) and no token is set:
-     * `crypto.randomBytes(32).toString('base64url')`, 0600 on POSIX.
-     * Rotation = delete this field; next daemon boot regenerates.
-     *
-     * 3e: this LEGACY single token is migrated to the READ tier (T1) — a daemon
-     * with only `httpToken` set keeps read access and emits a one-time startup
-     * warning to set an admin token for writes/gate/inner. Prefer `readToken`.
-     */
-    httpToken?: string;
     /**
      * 3e RBAC — the READ-tier (T1) bearer token. Env `AGENT_TEMPO_HTTP_READ_TOKEN`
      * takes precedence over this; auto-generated here on first bearer-mode boot if

package/dist/config.js

@@ -47,6 +47,20 @@ exports.ENV = {
     DEFAULT_AGENT: 'AGENT_TEMPO_DEFAULT_AGENT',
     PLAYER_TYPE: 'AGENT_TEMPO_PLAYER_TYPE',
     CLAUDE_BIN: 'AGENT_TEMPO_CLAUDE_BIN',
+    /**
+     * #704 — override (ms) for the booting attach-timeout watchdog deadline. Read
+     * at spawn time (`startRecruitedSession`) and threaded onto durable metadata
+     * (`SessionMetadata.bootingDeadlineMs`) because workflows can't read env.
+     * Default 180s. For tests/tuning.
+     */
+    BOOTING_DEADLINE_MS: 'AGENT_TEMPO_BOOTING_DEADLINE_MS',
+    /**
+     * #704 — override (ms) for how long a destroyed / boot-timed-out run's
+     * close-reason tombstone is honored by the bootstrap orphan-guard
+     * (`server.ts`). A late-launching orphan within this window self-exits.
+     * Default 6h (the observed orphan spawn delay was ~100min). For tuning.
+     */
+    ORPHAN_TOMBSTONE_TTL_MS: 'AGENT_TEMPO_ORPHAN_TOMBSTONE_TTL_MS',
     /**
      * #753 — cadence (ms) of the periodic `[agent-tempo:action-counters]` log
      * line each instrumented process emits. Default 5 minutes; `0` disables.

package/dist/constants.d.ts

@@ -16,6 +16,28 @@
  * for the kill regex to match.
  */
 export declare const ENSEMBLE_SENTINEL_FLAG = "--remote-control-session-name-prefix";
+/**
+ * 2.0 wire-protocol version (#786 — the cutover keystone). Single source of truth
+ * for the protocol stamp, the boot guard, and the `claimAttachment` adapter
+ * handshake.
+ *
+ * - **Stamp:** every 2.0-created workflow records `protocol: PROTOCOL_VERSION` on
+ *   its START input (so it's in history from run 1 and survives `continueAsNew`
+ *   via the input spread) and upserts the memo key {@link
+ *   MEMO_KEYS.protocol | `AgentTempoProtocol`} = PROTOCOL_VERSION.
+ * - **Boot guard:** a 2.0 daemon refuses to register workers if visibility shows
+ *   any Running agent-tempo workflow lacking the stamp — a 2.0 worker can never
+ *   deterministically replay a 1.x-recorded history, so we fail LOUD at boot
+ *   (printing `agent-tempo upgrade-to-2`) instead of non-determinism-faulting
+ *   deep in a workflow task later.
+ * - **claimAttachment:** the adapter sends `protocolVersion`; a 2.0 workflow
+ *   rejects any value `!== PROTOCOL_VERSION` (incl. a v1 adapter that omits it).
+ *
+ * This module is runtime-free, so the constant is safe to import from BOTH the
+ * sandboxed workflow bundle (the stamp + claim validator) AND the daemon guard /
+ * CLI (the check). Bumping it is a hard cutover — see `docs/design/v2-scoping.md`.
+ */
+export declare const PROTOCOL_VERSION: 2;
 /**
  * Escape the two regex metacharacters that can appear in validated player/ensemble
  * names (which are constrained to `[A-Za-z0-9._-]+`). Safe to interpolate the
@@ -48,3 +70,31 @@ export declare function ensembleReadyBanner(name: string, playerCount: number):
  * actually stops other players from acting while the conductor waits.
  */
 export declare function ensembleReadyDirective(name: string, playerCount: number): string;
+/** One command-center access tier — its short label + the source-of-truth wording. */
+export interface CommandCenterAccessTier {
+    /** Short label shown at the head of the line (e.g. `No auth`, `/login`, `API key`). */
+    label: string;
+    /** Tier wording — mirrored VERBATIM into docs/cli.md (drift-guarded). */
+    description: string;
+}
+/**
+ * #791 — command-center access tiers. THE SINGLE SOURCE OF TRUTH for the three
+ * access levels the `command-center` board offers, shared between the launch
+ * banner (`src/cli/command-center-command.ts`) and `docs/cli.md`.
+ *
+ * The tiers are independent, NOT a strict ladder: tier 1 (board + operator
+ * controls) needs NO auth on a local loopback daemon; tiers 2/3 only add the
+ * LLM PLANNER (ask / handoff / recruit), which needs either a Claude
+ * subscription via in-session `/login` (zero API key) or an `ANTHROPIC_API_KEY`.
+ *
+ * `tests/cli/command-center-access-tiers.test.ts` asserts the banner renders
+ * every tier AND that `docs/cli.md` carries each tier's label + description
+ * verbatim — so the launch text and the docs can never drift.
+ */
+export declare const COMMAND_CENTER_ACCESS_TIERS: readonly CommandCenterAccessTier[];
+/**
+ * Render {@link COMMAND_CENTER_ACCESS_TIERS} as plain indented `  • label — description`
+ * lines for the `command-center` launch banner. One string per tier; the caller
+ * styles them and prints a heading. Runtime-free, so it stays importable anywhere.
+ */
+export declare function commandCenterAccessTierLines(): string[];

package/dist/constants.js

@@ -6,10 +6,11 @@
  * code without dragging Node-only modules into the sandboxed bundle.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENSEMBLE_SENTINEL_FLAG = void 0;
+exports.COMMAND_CENTER_ACCESS_TIERS = exports.PROTOCOL_VERSION = exports.ENSEMBLE_SENTINEL_FLAG = void 0;
 exports.escapeNameForRegex = escapeNameForRegex;
 exports.ensembleReadyBanner = ensembleReadyBanner;
 exports.ensembleReadyDirective = ensembleReadyDirective;
+exports.commandCenterAccessTierLines = commandCenterAccessTierLines;
 /**
  * CLI flag injected into every Claude Code spawn to carry the ensemble name as a
  * sentinel in the process's CommandLine. `src/activities/hard-terminate.ts`
@@ -22,6 +23,28 @@ exports.ensembleReadyDirective = ensembleReadyDirective;
  * for the kill regex to match.
  */
 exports.ENSEMBLE_SENTINEL_FLAG = '--remote-control-session-name-prefix';
+/**
+ * 2.0 wire-protocol version (#786 — the cutover keystone). Single source of truth
+ * for the protocol stamp, the boot guard, and the `claimAttachment` adapter
+ * handshake.
+ *
+ * - **Stamp:** every 2.0-created workflow records `protocol: PROTOCOL_VERSION` on
+ *   its START input (so it's in history from run 1 and survives `continueAsNew`
+ *   via the input spread) and upserts the memo key {@link
+ *   MEMO_KEYS.protocol | `AgentTempoProtocol`} = PROTOCOL_VERSION.
+ * - **Boot guard:** a 2.0 daemon refuses to register workers if visibility shows
+ *   any Running agent-tempo workflow lacking the stamp — a 2.0 worker can never
+ *   deterministically replay a 1.x-recorded history, so we fail LOUD at boot
+ *   (printing `agent-tempo upgrade-to-2`) instead of non-determinism-faulting
+ *   deep in a workflow task later.
+ * - **claimAttachment:** the adapter sends `protocolVersion`; a 2.0 workflow
+ *   rejects any value `!== PROTOCOL_VERSION` (incl. a v1 adapter that omits it).
+ *
+ * This module is runtime-free, so the constant is safe to import from BOTH the
+ * sandboxed workflow bundle (the stamp + claim validator) AND the daemon guard /
+ * CLI (the check). Bumping it is a hard cutover — see `docs/design/v2-scoping.md`.
+ */
+exports.PROTOCOL_VERSION = 2;
 /**
  * Escape the two regex metacharacters that can appear in validated player/ensemble
  * names (which are constrained to `[A-Za-z0-9._-]+`). Safe to interpolate the
@@ -72,3 +95,39 @@ function ensembleReadyDirective(name, playerCount) {
         'If the user has not spoken yet, wait silently.',
     ].join('\n');
 }
+/**
+ * #791 — command-center access tiers. THE SINGLE SOURCE OF TRUTH for the three
+ * access levels the `command-center` board offers, shared between the launch
+ * banner (`src/cli/command-center-command.ts`) and `docs/cli.md`.
+ *
+ * The tiers are independent, NOT a strict ladder: tier 1 (board + operator
+ * controls) needs NO auth on a local loopback daemon; tiers 2/3 only add the
+ * LLM PLANNER (ask / handoff / recruit), which needs either a Claude
+ * subscription via in-session `/login` (zero API key) or an `ANTHROPIC_API_KEY`.
+ *
+ * `tests/cli/command-center-access-tiers.test.ts` asserts the banner renders
+ * every tier AND that `docs/cli.md` carries each tier's label + description
+ * verbatim — so the launch text and the docs can never drift.
+ */
+exports.COMMAND_CENTER_ACCESS_TIERS = [
+    {
+        label: 'No auth',
+        description: 'board + operator controls (cue, pause, play, restart, destroy) — works out of the box on a local (loopback) daemon; no token or login required.',
+    },
+    {
+        label: '/login',
+        description: 'LLM planner on your Claude Pro/Max subscription — run /login inside the board to enable the planner (ask, handoff, recruit) with zero API key.',
+    },
+    {
+        label: 'API key',
+        description: 'LLM planner on an API key — set ANTHROPIC_API_KEY before launch to run the planner against the Anthropic API.',
+    },
+];
+/**
+ * Render {@link COMMAND_CENTER_ACCESS_TIERS} as plain indented `  • label — description`
+ * lines for the `command-center` launch banner. One string per tier; the caller
+ * styles them and prints a heading. Runtime-free, so it stays importable anywhere.
+ */
+function commandCenterAccessTierLines() {
+    return exports.COMMAND_CENTER_ACCESS_TIERS.map((t) => `  • ${t.label} — ${t.description}`);
+}

package/dist/daemon.js

@@ -75,6 +75,8 @@ const inner_loop_1 = require("./http/inner-loop");
 const doorbell_1 = require("./http/doorbell");
 const ingest_registry_1 = require("./http/ingest-registry");
 const grpc_shutdown_guard_1 = require("./utils/grpc-shutdown-guard");
+const worker_2 = require("@temporalio/worker");
+const nondeterminism_alarm_1 = require("./observability/nondeterminism-alarm");
 const action_counters_1 = require("./utils/action-counters");
 const daemon_1 = require("./cli/daemon");
 const client_3 = require("./client");
@@ -847,6 +849,33 @@ async function main() {
     // close race so a stray retry timer can't kill the long-lived daemon. See
     // src/utils/grpc-shutdown-guard.ts.
     (0, grpc_shutdown_guard_1.installGrpcShutdownGuard)();
+    // #886 slice 1 — install the nondeterminism alarm BEFORE any Worker.create.
+    // Wraps Temporal's Runtime logger so a nondeterminism / determinism-violation
+    // flap (the #801 incident: 57 workflow-task failures in 3min with ZERO
+    // operator signal) is NAMED instantly — a prominent `[agent-tempo:ALARM]`
+    // line with a running count — and surfaced on `GET /v1/health`
+    // (`HealthV1.nondeterminism`). Runtime.install must precede worker creation
+    // and can only run once per process; both hold here (daemon entry point).
+    {
+        const alarm = new nondeterminism_alarm_1.NondeterminismAlarm({
+            onHit: (count, sample) => {
+                // Prominent + greppable (`ALARM`), distinct from normal daemon chatter.
+                log(`[agent-tempo:ALARM] nondeterminism #${count} — ${sample.detail}`);
+            },
+        });
+        (0, nondeterminism_alarm_1.setGlobalNondeterminismAlarm)(alarm);
+        try {
+            // Match the SDK default logger level ('INFO') so verbosity is unchanged;
+            // the wrapper only ADDS alarm detection on WARN/ERROR records.
+            worker_2.Runtime.install({ logger: (0, nondeterminism_alarm_1.wrapLoggerWithAlarm)(new worker_2.DefaultLogger('INFO'), alarm) });
+        }
+        catch (err) {
+            // Runtime.install throws if a Runtime already exists this process. Non-
+            // fatal: the alarm singleton still backs /v1/health; we just couldn't
+            // intercept Core logs. (Shouldn't happen — this is the daemon entry.)
+            log('nondeterminism alarm: Runtime.install skipped (runtime already initialized):', err instanceof Error ? err.message : err);
+        }
+    }
     // ADR 0014 §5.4 / gate 4 — dev daemon log self-identifies. Banner fires
     // first so it lands at the top of `~/.agent-tempo-dev/daemon.log` for
     // grep-friendly identification regardless of subsequent log volume.
@@ -952,6 +981,58 @@ async function main() {
             log('search-attribute preflight probe failed (non-fatal — createWorkers will surface the real error):', result.probeError);
         }
     }
+    // #786 — 2.0 cutover BOOT GUARD. Runs AFTER the search-attribute preflight
+    // and BEFORE createWorkers(): a 2.0 worker cannot deterministically replay a
+    // 1.x-recorded history, so refuse to register workers if visibility still
+    // shows ANY Running agent-tempo workflow lacking the protocol-2 stamp (a
+    // pre-cutover 1.x run). FAIL-CLOSED — a timed-out/errored scan, or a failure
+    // to even run the scan, refuses too (we couldn't PROVE the cutover is clean;
+    // see the #845 partial-scan lesson). Namespace-scoped via the client below.
+    // See src/upgrade/boot-guard.ts.
+    {
+        const { checkProtocolGuard } = await Promise.resolve().then(() => __importStar(require('./upgrade/boot-guard')));
+        let result;
+        let guardConn = null;
+        try {
+            guardConn = await (0, connection_1.createTemporalConnection)(config);
+            const guardClient = new client_1.Client({
+                connection: guardConn,
+                namespace: config.temporalNamespace,
+                interceptors: (0, action_counters_1.actionCountingInterceptors)(),
+            });
+            result = await checkProtocolGuard(guardClient, { log });
+        }
+        catch (err) {
+            // FAIL-CLOSED — couldn't even run the scan (e.g. connection failure).
+            // Without a completed scan we can't prove a clean cutover, so refuse
+            // rather than risk a 2.0 worker replaying a 1.x history.
+            result = {
+                ok: false,
+                reason: 'scan-incomplete',
+                message: `agent-tempo 2.0 boot guard could not run the protocol scan ` +
+                    `(${err instanceof Error ? err.message : String(err)}). Refusing to boot ` +
+                    `(fail-closed). Verify Temporal at ${config.temporalAddress} ` +
+                    `(namespace ${config.temporalNamespace}) is reachable, then retry.`,
+            };
+        }
+        finally {
+            if (guardConn)
+                await guardConn.close().catch(() => { });
+        }
+        if (!result.ok) {
+            process.stderr.write('ERROR: ' + result.message + '\n');
+            log(`Daemon refused to boot — ${result.reason} (#786 protocol guard)`);
+            try {
+                fs.unlinkSync(daemon_1.DAEMON_PID_PATH);
+            }
+            catch { /* ignore */ }
+            try {
+                fs.unlinkSync(daemon_1.DAEMON_HEARTBEAT_PATH);
+            }
+            catch { /* ignore */ }
+            process.exit(1);
+        }
+    }
     // Use mutable refs so signal handlers can be registered before workers
     // are created — closes the narrow window where a SIGTERM during
     // createWorkers() would be missed.

package/dist/http/auth.d.ts

@@ -50,44 +50,26 @@ export declare function extractBearerToken(authHeader: string | undefined): stri
  * reading "constant-time" doesn't assume length is also blinded.
  */
 export declare function tokensMatch(received: string, expected: string): boolean;
-/**
- * @deprecated 3e — superseded by {@link loadRbacTokens} (read + admin split).
- * Kept only until every caller migrates; do NOT add new callers. Resolves the
- * legacy single `httpToken` (env-less) for back-compat shims.
- */
-export declare function loadOrGenerateHttpToken(opts: {
-    bearerRequired: boolean;
-    load?: () => PersistedConfig;
-    save?: (cfg: PersistedConfig) => void;
-}): string | null;
 /** Resolved RBAC tokens for the daemon HTTP surface (3e). */
 export interface RbacTokens {
     /** T1 read token (env > config.json > auto-gen), or `null` when none + not required. */
     readToken: string | null;
     /** T1+T2+T3 admin token — ENV-VAR-ONLY, or `null` when unset (→ 503 on T≥2). */
     adminToken: string | null;
-    /**
-     * True when a LEGACY `httpToken` (no `readToken`) was adopted as the read token.
-     * The daemon emits a one-time startup warning so the operator sets an admin token.
-     */
-    legacyMigrated: boolean;
 }
 /** Admin token — ENV-VAR-ONLY (never config.json/disk, never auto-generated). */
 export declare function loadAdminToken(env?: NodeJS.ProcessEnv): string | null;
 /**
  * Read token (T1). Priority: env `AGENT_TEMPO_HTTP_READ_TOKEN` > config.json
- * `readToken` > LEGACY config.json `httpToken` (adopted → `legacy:true`) >
- * auto-generate when bearer mode is required (persisted as `readToken`).
+ * `readToken` > auto-generate when bearer mode is required (persisted as
+ * `readToken`).
  */
 export declare function loadReadToken(opts: {
     bearerRequired: boolean;
     env?: NodeJS.ProcessEnv;
     load?: () => PersistedConfig;
     save?: (cfg: PersistedConfig) => void;
-}): {
-    token: string | null;
-    legacy: boolean;
-};
+}): string | null;
 /** Load both RBAC tokens. The daemon calls this once at startup. */
 export declare function loadRbacTokens(opts: {
     bearerRequired: boolean;

package/dist/http/auth.js

@@ -38,7 +38,6 @@ exports.originHost = originHost;
 exports.bearerRequired = bearerRequired;
 exports.extractBearerToken = extractBearerToken;
 exports.tokensMatch = tokensMatch;
-exports.loadOrGenerateHttpToken = loadOrGenerateHttpToken;
 exports.loadAdminToken = loadAdminToken;
 exports.loadReadToken = loadReadToken;
 exports.loadRbacTokens = loadRbacTokens;
@@ -63,9 +62,10 @@ exports.requireTier = requireTier;
  * by reverse proxies, supervisord, and the TUI bootstrap state machine.
  *
  * **Token storage** (§3.1) — `~/.agent-tempo/config.json` field
- * `httpToken`. Auto-generated on first daemon boot when bearer mode is
+ * `readToken` (T1). Auto-generated on first daemon boot when bearer mode is
  * required and no token is set: `crypto.randomBytes(32).toString('base64url')`,
  * 0600 on POSIX. Rotation = delete the field; next daemon boot regenerates.
+ * The admin token (T2/T3) is env-var-only (`AGENT_TEMPO_HTTP_ADMIN_TOKEN`).
  */
 const crypto = __importStar(require("crypto"));
 const config_1 = require("../config");
@@ -156,24 +156,6 @@ function tokensMatch(received, expected) {
     const b = Buffer.from(expected, 'utf8');
     return crypto.timingSafeEqual(a, b);
 }
-/**
- * @deprecated 3e — superseded by {@link loadRbacTokens} (read + admin split).
- * Kept only until every caller migrates; do NOT add new callers. Resolves the
- * legacy single `httpToken` (env-less) for back-compat shims.
- */
-function loadOrGenerateHttpToken(opts) {
-    const load = opts.load ?? config_1.loadConfigFile;
-    const save = opts.save ?? config_1.saveConfigFile;
-    const cfg = load();
-    if (cfg.httpToken && typeof cfg.httpToken === 'string' && cfg.httpToken.length > 0) {
-        return cfg.httpToken;
-    }
-    if (!opts.bearerRequired)
-        return null;
-    const token = crypto.randomBytes(32).toString('base64url');
-    save({ ...cfg, httpToken: token });
-    return token;
-}
 /** Admin token — ENV-VAR-ONLY (never config.json/disk, never auto-generated). */
 function loadAdminToken(env = process.env) {
     const t = env[config_1.ENV.HTTP_ADMIN_TOKEN];
@@ -181,8 +163,8 @@ function loadAdminToken(env = process.env) {
 }
 /**
  * Read token (T1). Priority: env `AGENT_TEMPO_HTTP_READ_TOKEN` > config.json
- * `readToken` > LEGACY config.json `httpToken` (adopted → `legacy:true`) >
- * auto-generate when bearer mode is required (persisted as `readToken`).
+ * `readToken` > auto-generate when bearer mode is required (persisted as
+ * `readToken`).
  */
 function loadReadToken(opts) {
     const env = opts.env ?? process.env;
@@ -190,24 +172,21 @@ function loadReadToken(opts) {
     const save = opts.save ?? config_1.saveConfigFile;
     const envTok = env[config_1.ENV.HTTP_READ_TOKEN];
     if (envTok && envTok.length > 0)
-        return { token: envTok, legacy: false };
+        return envTok;
     const cfg = load();
     if (cfg.readToken && cfg.readToken.length > 0)
-        return { token: cfg.readToken, legacy: false };
-    // LEGACY: a pre-3e single `httpToken` becomes the READ token (T1) — NOT admin.
-    if (cfg.httpToken && cfg.httpToken.length > 0)
-        return { token: cfg.httpToken, legacy: true };
+        return cfg.readToken;
     if (!opts.bearerRequired)
-        return { token: null, legacy: false };
+        return null;
     const token = crypto.randomBytes(32).toString('base64url');
     save({ ...cfg, readToken: token });
-    return { token, legacy: false };
+    return token;
 }
 /** Load both RBAC tokens. The daemon calls this once at startup. */
 function loadRbacTokens(opts) {
-    const { token: readToken, legacy } = loadReadToken(opts);
+    const readToken = loadReadToken(opts);
     const adminToken = loadAdminToken(opts.env);
-    return { readToken, adminToken, legacyMigrated: legacy };
+    return { readToken, adminToken };
 }
 /**
  * Granted tier for a presented bearer, given the RBAC tokens (timing-safe).