agent-tempo 2.0.0-beta.1 → 2.0.0-beta.2

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "2.0.0-beta.1",
+  "version": "2.0.0-beta.2",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/activities/maestro.js

@@ -30,6 +30,9 @@ function createMaestroActivities(client, opts = {}) {
         // tempo bucket can diff across refreshes.
         activityCount: s.activityCount,
         lastActivityAt: s.lastActivityAt,
+        // #886 slice 2 — carry the degraded flag through to the wire so the
+        // dashboard/board can render an uncertain row instead of dropping it.
+        ...(s.degraded ? { degraded: true } : {}),
     });
     // #753 — attribute every Temporal call made by these activities (however
     // deep, e.g. scanEnsembleSessions → queryHandleWithTimeout) to the maestro.

package/dist/activities/outbox.js

@@ -292,6 +292,18 @@ function createOutboxActivities(client, config, ingestTokens, doorbells) {
                         // session workflow and dispatch path can resolve the adapter descriptor
                         // from the registry without falling back to the legacy agentType field.
                         adapterId: adapters_1.registry.resolveFromAgentType(agent),
+                        // #704 — resolve the adapter descriptor's dialog-blocking property at
+                        // spawn time and thread it onto durable metadata so the session workflow
+                        // can ARM/DISARM the booting watchdog structurally (no agentType
+                        // hardcode). Headless adapters omit it ⇒ falsy ⇒ ARMED; interactive
+                        // `claude-code` sets it true ⇒ disarmed until #890.
+                        canBlockOnDialog: adapters_1.registry.get(adapters_1.registry.resolveFromAgentType(agent))?.canBlockOnDialog === true,
+                        // #704 — optional env override for the booting deadline (workflows
+                        // can't read env). Only set when a valid positive integer is provided.
+                        ...(() => {
+                            const ms = Number(process.env[config_2.ENV.BOOTING_DEADLINE_MS]);
+                            return Number.isFinite(ms) && ms > 0 ? { bootingDeadlineMs: ms } : {};
+                        })(),
                         sessionId,
                         // #131 / #449 Phase C — persist the claude-api / opencode model
                         // on durable metadata so restart can recover the original choice

package/dist/activities/resolve.d.ts

@@ -87,6 +87,17 @@ export interface EnsembleSessionInfo {
      * session. Undefined when the session predates W2 or the query failed.
      */
     lastActivityAt?: string;
+    /**
+     * #886 slice 2 — `true` when this row was produced from a DEGRADED scan:
+     * the visibility list returned the workflow, but extracting its observation
+     * fields threw, so the rich metadata (part/workDir/hostname/…) is a
+     * best-effort blank rather than authoritative. The row's IDENTITY
+     * (`workflowId` + best-effort `playerId`) is preserved so the player stays
+     * in the roster marked uncertain — instead of being silently dropped, which
+     * reads as "player absent" and causes roster flapping (contra #777). Absent
+     * / `false` on every healthy row.
+     */
+    degraded?: boolean;
 }
 /**
  * T0.1 (#748) — cloud-profile ensemble scan. Observation path ONLY (see the
@@ -96,13 +107,13 @@ export interface EnsembleSessionInfo {
  *   - The visibility query is **ensemble-scoped** via the `AgentTempoEnsemble`
  *     filter SA — no more cluster-wide list + per-session `getMetadata`
  *     pre-filtering (the unfiltered scan was the dominant idle-burn driver).
- *   - For v1.8+ runs (memo-complete: `AgentTempoWorkDir` present), the entire
- *     player row is read from the list result (SAs + memo) — **zero**
- *     per-player queries except the BPM `getActivityState` query, which is
- *     intentionally kept per the architect's ruling (deriving BPM from phase
- *     transitions would change the metric's meaning).
- *   - Pre-v1.8 runs (no observation memo) fall back to the legacy per-player
- *     `getMetadata` + `getPart` queries — cost shrinks as old runs cycle out.
+ *   - The entire player row is read from the list result (SAs + memo) —
+ *     **zero** per-player queries except the BPM `getActivityState` query,
+ *     which is intentionally kept per the architect's ruling (deriving BPM
+ *     from phase transitions would change the metric's meaning). Every 2.0
+ *     session seeds the observation memo at workflow start (T0.5 #747 /
+ *     #757), so `AgentTempoWorkDir` is always present; the pre-v1.8 memo-
+ *     absent per-player `getMetadata`/`getPart` fallback was removed in #874.
  *
  * Staleness: SA/memo reads are eventually consistent (tens of seconds worst
  * case under backlog) — acceptable for the observation path per the design

package/dist/activities/resolve.js

@@ -160,13 +160,13 @@ async function resolveByDerivedId(client, ensemble, playerName) {
  *   - The visibility query is **ensemble-scoped** via the `AgentTempoEnsemble`
  *     filter SA — no more cluster-wide list + per-session `getMetadata`
  *     pre-filtering (the unfiltered scan was the dominant idle-burn driver).
- *   - For v1.8+ runs (memo-complete: `AgentTempoWorkDir` present), the entire
- *     player row is read from the list result (SAs + memo) — **zero**
- *     per-player queries except the BPM `getActivityState` query, which is
- *     intentionally kept per the architect's ruling (deriving BPM from phase
- *     transitions would change the metric's meaning).
- *   - Pre-v1.8 runs (no observation memo) fall back to the legacy per-player
- *     `getMetadata` + `getPart` queries — cost shrinks as old runs cycle out.
+ *   - The entire player row is read from the list result (SAs + memo) —
+ *     **zero** per-player queries except the BPM `getActivityState` query,
+ *     which is intentionally kept per the architect's ruling (deriving BPM
+ *     from phase transitions would change the metric's meaning). Every 2.0
+ *     session seeds the observation memo at workflow start (T0.5 #747 /
+ *     #757), so `AgentTempoWorkDir` is always present; the pre-v1.8 memo-
+ *     absent per-player `getMetadata`/`getPart` fallback was removed in #874.
  *
  * Staleness: SA/memo reads are eventually consistent (tens of seconds worst
  * case under backlog) — acceptable for the observation path per the design
@@ -179,52 +179,64 @@ async function scanEnsembleSessionsCloud(client, ensemble, log = () => { }) {
     try {
         for await (const workflow of (0, visibility_deadline_1.iterateWithDeadline)(client.workflow.list({ query }), visibility_deadline_1.VISIBILITY_DEADLINES_MS.scanEnsembleSessions, 'scanEnsembleSessionsCloud')) {
             try {
-                const handle = client.workflow.getHandle(workflow.workflowId);
                 const phase = (0, search_attributes_1.getAttachmentPhase)(workflow);
                 const playerId = (0, search_attributes_1.getSearchAttrString)(workflow, 'AgentTempoPlayerId') ?? workflow.workflowId;
                 const hostname = (0, search_attributes_1.getSearchAttrString)(workflow, 'AgentTempoHostname') ?? '';
-                // v1.8-memo-observation-fields runs carry workDir on the memo — use
-                // its presence as the "memo-complete row" discriminator.
-                const workDir = (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.workDir);
-                let row;
-                if (workDir !== undefined) {
-                    row = {
-                        playerId,
-                        part: (0, search_attributes_1.getPart)(workflow) ?? '',
-                        hostname,
-                        workDir,
-                        gitRoot: (0, search_attributes_1.getWorkflowMetaString)(workflow, search_attributes_1.MEMO_KEYS.gitRoot),
-                        gitBranch: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.gitBranch),
-                        isConductor: (0, search_attributes_1.getIsConductor)(workflow)
-                            ?? (workflow.workflowId?.endsWith('-conductor') ?? false),
-                        agentType: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.agentType) || 'claude',
-                        playerType: (0, search_attributes_1.getPlayerType)(workflow),
-                    };
-                }
-                else {
-                    // Legacy run (pre-v1.8 memo) — per-player query fallback, bounded
-                    // (#433). Same two queries the legacy scan used.
-                    const metadata = await (0, query_timeout_1.queryHandleWithTimeout)(handle, 'getMetadata');
-                    const part = await (0, query_timeout_1.queryHandleWithTimeout)(handle, 'getPart');
-                    row = {
-                        playerId: metadata.playerId,
-                        part,
-                        hostname: metadata.hostname,
-                        workDir: metadata.workDir,
-                        gitRoot: metadata.gitRoot,
-                        gitBranch: metadata.gitBranch,
-                        isConductor: metadata.isConductor,
-                        agentType: metadata.agentType || 'claude',
-                        playerType: metadata.playerType,
-                    };
-                }
+                // Every 2.0 session seeds the observation memo at workflow start
+                // (T0.5 #747 / #757), so the entire player row is read straight from
+                // the visibility list result — SAs + memo, zero per-player queries
+                // (the parallel BPM `getActivityState` query below aside). The
+                // pre-v1.8 memo-absent `getMetadata`/`getPart` fallback was removed
+                // in #874 (dead under the 2.0 clean cutover).
+                const row = {
+                    playerId,
+                    part: (0, search_attributes_1.getPart)(workflow) ?? '',
+                    hostname,
+                    workDir: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.workDir) ?? '',
+                    gitRoot: (0, search_attributes_1.getWorkflowMetaString)(workflow, search_attributes_1.MEMO_KEYS.gitRoot),
+                    gitBranch: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.gitBranch),
+                    isConductor: (0, search_attributes_1.getIsConductor)(workflow)
+                        ?? (workflow.workflowId?.endsWith('-conductor') ?? false),
+                    agentType: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.agentType) || 'claude',
+                    playerType: (0, search_attributes_1.getPlayerType)(workflow),
+                };
                 // BPM fields filled in below — kept out of the enumeration loop so
                 // per-player query latency can't eat the visibility deadline.
                 sessions.push({ workflowId: workflow.workflowId, ...row, phase });
             }
-            catch {
-                // Workflow may have just completed, or a legacy-fallback query timed
-                // out (#433) — skip this row; the next tick fills it in.
+            catch (rowErr) {
+                // #886 slice 2 — observation extraction threw for this workflow. The
+                // OLD behaviour silently dropped the row, which makes a transient
+                // failure read as "player absent" → roster flapping (contra #777). The
+                // workflow IS in the visibility list, so the player exists; emit a
+                // DEGRADED row that preserves identity (workflowId + best-effort
+                // playerId) and flags `degraded: true`, instead of dropping it.
+                //
+                // playerId is salvaged in its own guard so a throwing getter can't
+                // escape to the outer (visibility-timeout-only) catch and fail the
+                // whole scan; it falls back to the workflowId. Identity preservation
+                // is the point — a row keyed on the real playerId avoids the
+                // remove+add churn that dropping (or re-keying on workflowId) causes.
+                let salvagedPlayerId = workflow.workflowId;
+                try {
+                    salvagedPlayerId =
+                        (0, search_attributes_1.getSearchAttrString)(workflow, 'AgentTempoPlayerId') ?? workflow.workflowId;
+                }
+                catch {
+                    /* keep workflowId */
+                }
+                sessions.push({
+                    workflowId: workflow.workflowId,
+                    playerId: salvagedPlayerId,
+                    part: '',
+                    hostname: '',
+                    workDir: '',
+                    isConductor: workflow.workflowId.endsWith('-conductor'),
+                    agentType: 'claude',
+                    degraded: true,
+                });
+                log(`scanEnsembleSessionsCloud: degraded row for ${workflow.workflowId} ` +
+                    `(observation extraction failed: ${rowErr instanceof Error ? rowErr.message : String(rowErr)})`);
             }
         }
     }

package/dist/adapters/claude-code/adapter.js

@@ -22,6 +22,13 @@ exports.claudeCodeDescriptor = {
     // Interactive class — 60s cadence per design §4.3. The base class drives the
     // heartbeat loop at this interval when the V2 lifecycle path is active.
     heartbeatMs: 60_000,
+    // #704 — the interactive spawn passes `--dangerously-load-development-channels`,
+    // which shows a BLOCKING dev-channels dialog that requires a human click and
+    // can park the session pre-attach. So the booting attach-timeout watchdog must
+    // NOT arm for this adapter (an operator-away false-kill is worse than the hang).
+    // The 6 headless adapters omit this (⇒ falsy ⇒ armed). Flip to remove once #890
+    // dissolves the dialog. See docs/design/704-is-demo-companion-brief.md §2.
+    canBlockOnDialog: true,
 };
 // #749: one family of backoff curves across the codebase — this poller's
 // error backoff shares the SDK idle-backoff constants (values unchanged:

package/dist/cli/command-center-command.js

@@ -55,6 +55,7 @@ const config_1 = require("../config");
 const spawn_1 = require("../spawn");
 const probe_1 = require("../pi/probe");
 const install_1 = require("../pi/install");
+const constants_1 = require("../constants");
 const out = __importStar(require("./output"));
 /**
  * Public entry point — invoked by the CLI dispatcher. Launches the board in a
@@ -95,6 +96,14 @@ async function commandCenterCommand(args) {
             process.exit(1);
         }
     }
+    // #791 — surface the three access tiers up front so the subscription-friendly
+    // posture is discoverable: the board + operator controls need NO auth on a
+    // local daemon; only the LLM planner needs a Claude subscription (`/login`,
+    // zero API key) or an API key. Wording is the single source of truth in
+    // constants.ts (mirrored into docs/cli.md, drift-guarded).
+    out.log(out.dim('  Access tiers (the board works with no auth — only the LLM planner needs a key/login):'));
+    for (const line of (0, constants_1.commandCenterAccessTierLines)())
+        out.log(out.dim(line));
     // Admin (T3) token — mission-control's operator write/gate surface reads it.
     // #54: a LOCAL (loopback) daemon grants full trust tokenless, so a tokenless
     // board is fully functional locally; only a REMOTE / 0.0.0.0 daemon requires the
@@ -105,8 +114,13 @@ async function commandCenterCommand(args) {
         out.log(out.dim(`  ${config_1.ENV.HTTP_ADMIN_TOKEN} not set — fine for a local (loopback) daemon (full trust). ` +
             'Set it only if this board drives a remote / 0.0.0.0 daemon.'));
     }
+    // #791 — NOT a warning: a missing API key is an expected, fully-supported
+    // state. The board + operator controls work regardless; point at the `/login`
+    // zero-API-key planner path (Claude Pro/Max OAuth) rather than implying a
+    // degraded fallback.
     if (!process.env.ANTHROPIC_API_KEY) {
-        out.warn('ANTHROPIC_API_KEY is not set — the Pi command-center will fall back to Pi\'s own auth/default model.');
+        out.log(out.dim('  ANTHROPIC_API_KEY not set — the board + operator controls still work. ' +
+            'Run /login inside the board to enable the LLM planner on your Claude subscription (zero API key).'));
     }
     const temporalEnvVars = {
         [config_1.ENV.TEMPORAL_ADDRESS]: config.temporalAddress,

package/dist/cli/help-text.js

@@ -69,6 +69,7 @@ ${out.bold('Usage:')}
   agent-tempo <command> [options]
 
 ${out.bold('Commands:')}
+  ${out.cyan('home')}                     Bare landing (default): auto-provision, show status, print operator hints
   ${out.cyan('up')}                       Start infrastructure only — Temporal, daemon, MCP registration
   ${out.cyan('down')}                     Stop infrastructure; workflows stay parked for the next ${out.dim('up')}
   ${out.cyan('down --destroy [-y]')}      Terminate every workflow across every ensemble, then stop infrastructure
@@ -93,6 +94,7 @@ ${out.bold('Commands:')}
   ${out.cyan('init')}                     Register MCP server globally (or --project for .mcp.json)
   ${out.cyan('install-pi')}               Install the Pi extensions into Pi settings (or --project for .pi/settings.json)
   ${out.cyan('preflight')}                Run preflight checks only
+  ${out.cyan('version')}                  Print the installed version (alias: --version, -v)
   ${out.cyan('help')}                     Show this help message
 
 ${out.bold('Removed — use the command-center board')} ${out.dim('(agent-tempo command-center)')}:

package/dist/config.d.ts

@@ -18,6 +18,20 @@ export declare const ENV: {
     readonly DEFAULT_AGENT: "AGENT_TEMPO_DEFAULT_AGENT";
     readonly PLAYER_TYPE: "AGENT_TEMPO_PLAYER_TYPE";
     readonly CLAUDE_BIN: "AGENT_TEMPO_CLAUDE_BIN";
+    /**
+     * #704 — override (ms) for the booting attach-timeout watchdog deadline. Read
+     * at spawn time (`startRecruitedSession`) and threaded onto durable metadata
+     * (`SessionMetadata.bootingDeadlineMs`) because workflows can't read env.
+     * Default 180s. For tests/tuning.
+     */
+    readonly BOOTING_DEADLINE_MS: "AGENT_TEMPO_BOOTING_DEADLINE_MS";
+    /**
+     * #704 — override (ms) for how long a destroyed / boot-timed-out run's
+     * close-reason tombstone is honored by the bootstrap orphan-guard
+     * (`server.ts`). A late-launching orphan within this window self-exits.
+     * Default 6h (the observed orphan spawn delay was ~100min). For tuning.
+     */
+    readonly ORPHAN_TOMBSTONE_TTL_MS: "AGENT_TEMPO_ORPHAN_TOMBSTONE_TTL_MS";
     /**
      * #753 — cadence (ms) of the periodic `[agent-tempo:action-counters]` log
      * line each instrumented process emits. Default 5 minutes; `0` disables.

package/dist/config.js

@@ -47,6 +47,20 @@ exports.ENV = {
     DEFAULT_AGENT: 'AGENT_TEMPO_DEFAULT_AGENT',
     PLAYER_TYPE: 'AGENT_TEMPO_PLAYER_TYPE',
     CLAUDE_BIN: 'AGENT_TEMPO_CLAUDE_BIN',
+    /**
+     * #704 — override (ms) for the booting attach-timeout watchdog deadline. Read
+     * at spawn time (`startRecruitedSession`) and threaded onto durable metadata
+     * (`SessionMetadata.bootingDeadlineMs`) because workflows can't read env.
+     * Default 180s. For tests/tuning.
+     */
+    BOOTING_DEADLINE_MS: 'AGENT_TEMPO_BOOTING_DEADLINE_MS',
+    /**
+     * #704 — override (ms) for how long a destroyed / boot-timed-out run's
+     * close-reason tombstone is honored by the bootstrap orphan-guard
+     * (`server.ts`). A late-launching orphan within this window self-exits.
+     * Default 6h (the observed orphan spawn delay was ~100min). For tuning.
+     */
+    ORPHAN_TOMBSTONE_TTL_MS: 'AGENT_TEMPO_ORPHAN_TOMBSTONE_TTL_MS',
     /**
      * #753 — cadence (ms) of the periodic `[agent-tempo:action-counters]` log
      * line each instrumented process emits. Default 5 minutes; `0` disables.

package/dist/constants.d.ts

@@ -70,3 +70,31 @@ export declare function ensembleReadyBanner(name: string, playerCount: number):
  * actually stops other players from acting while the conductor waits.
  */
 export declare function ensembleReadyDirective(name: string, playerCount: number): string;
+/** One command-center access tier — its short label + the source-of-truth wording. */
+export interface CommandCenterAccessTier {
+    /** Short label shown at the head of the line (e.g. `No auth`, `/login`, `API key`). */
+    label: string;
+    /** Tier wording — mirrored VERBATIM into docs/cli.md (drift-guarded). */
+    description: string;
+}
+/**
+ * #791 — command-center access tiers. THE SINGLE SOURCE OF TRUTH for the three
+ * access levels the `command-center` board offers, shared between the launch
+ * banner (`src/cli/command-center-command.ts`) and `docs/cli.md`.
+ *
+ * The tiers are independent, NOT a strict ladder: tier 1 (board + operator
+ * controls) needs NO auth on a local loopback daemon; tiers 2/3 only add the
+ * LLM PLANNER (ask / handoff / recruit), which needs either a Claude
+ * subscription via in-session `/login` (zero API key) or an `ANTHROPIC_API_KEY`.
+ *
+ * `tests/cli/command-center-access-tiers.test.ts` asserts the banner renders
+ * every tier AND that `docs/cli.md` carries each tier's label + description
+ * verbatim — so the launch text and the docs can never drift.
+ */
+export declare const COMMAND_CENTER_ACCESS_TIERS: readonly CommandCenterAccessTier[];
+/**
+ * Render {@link COMMAND_CENTER_ACCESS_TIERS} as plain indented `  • label — description`
+ * lines for the `command-center` launch banner. One string per tier; the caller
+ * styles them and prints a heading. Runtime-free, so it stays importable anywhere.
+ */
+export declare function commandCenterAccessTierLines(): string[];

package/dist/constants.js

@@ -6,10 +6,11 @@
  * code without dragging Node-only modules into the sandboxed bundle.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROTOCOL_VERSION = exports.ENSEMBLE_SENTINEL_FLAG = void 0;
+exports.COMMAND_CENTER_ACCESS_TIERS = exports.PROTOCOL_VERSION = exports.ENSEMBLE_SENTINEL_FLAG = void 0;
 exports.escapeNameForRegex = escapeNameForRegex;
 exports.ensembleReadyBanner = ensembleReadyBanner;
 exports.ensembleReadyDirective = ensembleReadyDirective;
+exports.commandCenterAccessTierLines = commandCenterAccessTierLines;
 /**
  * CLI flag injected into every Claude Code spawn to carry the ensemble name as a
  * sentinel in the process's CommandLine. `src/activities/hard-terminate.ts`
@@ -94,3 +95,39 @@ function ensembleReadyDirective(name, playerCount) {
         'If the user has not spoken yet, wait silently.',
     ].join('\n');
 }
+/**
+ * #791 — command-center access tiers. THE SINGLE SOURCE OF TRUTH for the three
+ * access levels the `command-center` board offers, shared between the launch
+ * banner (`src/cli/command-center-command.ts`) and `docs/cli.md`.
+ *
+ * The tiers are independent, NOT a strict ladder: tier 1 (board + operator
+ * controls) needs NO auth on a local loopback daemon; tiers 2/3 only add the
+ * LLM PLANNER (ask / handoff / recruit), which needs either a Claude
+ * subscription via in-session `/login` (zero API key) or an `ANTHROPIC_API_KEY`.
+ *
+ * `tests/cli/command-center-access-tiers.test.ts` asserts the banner renders
+ * every tier AND that `docs/cli.md` carries each tier's label + description
+ * verbatim — so the launch text and the docs can never drift.
+ */
+exports.COMMAND_CENTER_ACCESS_TIERS = [
+    {
+        label: 'No auth',
+        description: 'board + operator controls (cue, pause, play, restart, destroy) — works out of the box on a local (loopback) daemon; no token or login required.',
+    },
+    {
+        label: '/login',
+        description: 'LLM planner on your Claude Pro/Max subscription — run /login inside the board to enable the planner (ask, handoff, recruit) with zero API key.',
+    },
+    {
+        label: 'API key',
+        description: 'LLM planner on an API key — set ANTHROPIC_API_KEY before launch to run the planner against the Anthropic API.',
+    },
+];
+/**
+ * Render {@link COMMAND_CENTER_ACCESS_TIERS} as plain indented `  • label — description`
+ * lines for the `command-center` launch banner. One string per tier; the caller
+ * styles them and prints a heading. Runtime-free, so it stays importable anywhere.
+ */
+function commandCenterAccessTierLines() {
+    return exports.COMMAND_CENTER_ACCESS_TIERS.map((t) => `  • ${t.label} — ${t.description}`);
+}

package/dist/daemon.js

@@ -75,6 +75,8 @@ const inner_loop_1 = require("./http/inner-loop");
 const doorbell_1 = require("./http/doorbell");
 const ingest_registry_1 = require("./http/ingest-registry");
 const grpc_shutdown_guard_1 = require("./utils/grpc-shutdown-guard");
+const worker_2 = require("@temporalio/worker");
+const nondeterminism_alarm_1 = require("./observability/nondeterminism-alarm");
 const action_counters_1 = require("./utils/action-counters");
 const daemon_1 = require("./cli/daemon");
 const client_3 = require("./client");
@@ -847,6 +849,33 @@ async function main() {
     // close race so a stray retry timer can't kill the long-lived daemon. See
     // src/utils/grpc-shutdown-guard.ts.
     (0, grpc_shutdown_guard_1.installGrpcShutdownGuard)();
+    // #886 slice 1 — install the nondeterminism alarm BEFORE any Worker.create.
+    // Wraps Temporal's Runtime logger so a nondeterminism / determinism-violation
+    // flap (the #801 incident: 57 workflow-task failures in 3min with ZERO
+    // operator signal) is NAMED instantly — a prominent `[agent-tempo:ALARM]`
+    // line with a running count — and surfaced on `GET /v1/health`
+    // (`HealthV1.nondeterminism`). Runtime.install must precede worker creation
+    // and can only run once per process; both hold here (daemon entry point).
+    {
+        const alarm = new nondeterminism_alarm_1.NondeterminismAlarm({
+            onHit: (count, sample) => {
+                // Prominent + greppable (`ALARM`), distinct from normal daemon chatter.
+                log(`[agent-tempo:ALARM] nondeterminism #${count} — ${sample.detail}`);
+            },
+        });
+        (0, nondeterminism_alarm_1.setGlobalNondeterminismAlarm)(alarm);
+        try {
+            // Match the SDK default logger level ('INFO') so verbosity is unchanged;
+            // the wrapper only ADDS alarm detection on WARN/ERROR records.
+            worker_2.Runtime.install({ logger: (0, nondeterminism_alarm_1.wrapLoggerWithAlarm)(new worker_2.DefaultLogger('INFO'), alarm) });
+        }
+        catch (err) {
+            // Runtime.install throws if a Runtime already exists this process. Non-
+            // fatal: the alarm singleton still backs /v1/health; we just couldn't
+            // intercept Core logs. (Shouldn't happen — this is the daemon entry.)
+            log('nondeterminism alarm: Runtime.install skipped (runtime already initialized):', err instanceof Error ? err.message : err);
+        }
+    }
     // ADR 0014 §5.4 / gate 4 — dev daemon log self-identifies. Banner fires
     // first so it lands at the top of `~/.agent-tempo-dev/daemon.log` for
     // grep-friendly identification regardless of subsequent log volume.

package/dist/http/event-types.d.ts

@@ -47,6 +47,29 @@ export interface HealthV1 {
      * semantics. Optional so legacy clients ignoring the field don't break.
      */
     memory?: MemoryUsageV1;
+    /**
+     * #886 slice 1 — daemon-side nondeterminism alarm state. Present when the
+     * daemon installed the alarm (always, in 2.0+); a non-zero `count` means a
+     * nondeterminism / determinism-violation flap was observed since boot (e.g.
+     * a 2.0 worker replaying a 1.x history, or a code/bundle skew). Lets external
+     * monitors and the dashboard poll the alarm without scraping `daemon.log`.
+     * Optional so pre-#886 clients (and non-daemon health responders) ignore it.
+     */
+    nondeterminism?: NondeterminismAlarmV1;
+}
+/** #886 — `/v1/health` shape of the nondeterminism alarm snapshot. */
+export interface NondeterminismAlarmV1 {
+    /** Total nondeterminism records seen since daemon boot (0 = healthy). */
+    count: number;
+    /** ISO timestamp of the first hit; absent when `count === 0`. */
+    firstSeenAt?: string;
+    /** ISO timestamp of the most recent hit; absent when `count === 0`. */
+    lastSeenAt?: string;
+    /** Most-recent samples (capped, newest last) — `{ at, detail }`. */
+    recent: Array<{
+        at: string;
+        detail: string;
+    }>;
 }
 /** Snapshot of `process.memoryUsage()` at request time. All values in bytes. */
 export interface MemoryUsageV1 {
@@ -208,6 +231,16 @@ export interface PlayerSummaryV1 {
     contextTokens?: number;
     /** 3c Tier-1 coarse — context usage as a percentage of the model window. Additive. */
     contextPercent?: number;
+    /**
+     * #886 slice 2 — `true` when the daemon's observation scan could only produce
+     * a DEGRADED row for this player: the session workflow was listed but its
+     * metadata extraction failed, so the non-identity fields (part/workDir/phase/…)
+     * are best-effort blanks. Lets the dashboard/board render an "uncertain" badge
+     * instead of dropping the player, which would read as a departure and cause
+     * roster flapping (contra #777). Additive + optional per the §6 stability rule;
+     * absent on every healthy row.
+     */
+    degraded?: boolean;
 }
 /**
  * The eventId token used in the `id:` line of the SSE frame and as the

package/dist/http/server.js

@@ -72,6 +72,10 @@ const action_counters_1 = require("../utils/action-counters");
 const snapshot_1 = require("./snapshot");
 const orphans_1 = require("./orphans");
 const sse_handler_1 = require("./sse-handler");
+// #886 slice 1 — surface the daemon nondeterminism alarm on /v1/health. The
+// alarm core is Temporal-VALUE-free, so this import doesn't pull the worker
+// runtime into the HTTP layer.
+const nondeterminism_alarm_1 = require("../observability/nondeterminism-alarm");
 const log = (...args) => console.error(`[agent-tempo:http ${new Date().toISOString()}]`, ...args);
 /** Default bind addr per SSE-PROTOCOL.md §1. */
 exports.DEFAULT_BIND_ADDR = '127.0.0.1';
@@ -706,6 +710,12 @@ function handleHealth(res, ctx) {
             external: mem.external,
             arrayBuffers: mem.arrayBuffers,
         },
+        // #886 slice 1 — nondeterminism alarm snapshot (present when the daemon
+        // installed the alarm; `count > 0` signals an observed flap since boot).
+        ...(() => {
+            const snap = (0, nondeterminism_alarm_1.getGlobalNondeterminismAlarm)()?.snapshot();
+            return snap ? { nondeterminism: snap } : {};
+        })(),
     };
     // Best-effort ensemble count — soft-fail to 0 rather than 500ing on a
     // healthcheck. `/v1/health` MUST stay reachable even when Temporal is

package/dist/http/snapshot.js

@@ -108,6 +108,9 @@ function toPlayerSummaryV1(p, wireMeta = null) {
         ...(wireMeta?.coarse?.currentTool !== undefined ? { currentTool: wireMeta.coarse.currentTool } : {}),
         ...(wireMeta?.coarse?.contextTokens !== undefined ? { contextTokens: wireMeta.coarse.contextTokens } : {}),
         ...(wireMeta?.coarse?.contextPercent !== undefined ? { contextPercent: wireMeta.coarse.contextPercent } : {}),
+        // #886 slice 2 — carry the degraded/uncertain flag onto the wire so the
+        // dashboard/board can badge the player instead of dropping it (anti-flap).
+        ...(p.degraded ? { degraded: true } : {}),
     };
 }
 /**