agents-city 0.3.0-beta.21

package/bin/test-domains.py

@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Domain-first onboarding and transparent built-in knowledge packs."""
+
+import os
+import shutil
+import sys
+import tempfile
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+
+import domains  # noqa: E402
+import roles  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def catalogo():
+    print("  domain catalogue")
+    packs = domains.catalogo()
+    ids = [p["id"] for p in packs]
+    comprueba("· domain comes before role, with software first", ids[0], "software")
+    for requerido in (
+        "software",
+        "healthcare",
+        "legal",
+        "finance",
+        "marketing",
+        "sales",
+        "research",
+        "operations",
+        "custom",
+    ):
+        afirma(f"· {requerido} is a built-in work domain", requerido in ids, str(ids))
+    comprueba("· old product cities resolve to software", domains.canonico("product"), "software")
+    comprueba("· old blank cities resolve to custom", domains.canonico("blank"), "custom")
+
+    software = domains.obtiene("software")
+    comprueba(
+        "· software adds data engineering and blank to its eight established roles",
+        len(software["roles"]),
+        10,
+    )
+    afirma(
+        "· data engineering is distinct from analytics leadership",
+        {"data-engineer", "data"} <= {r for r, _ in software["roles"]},
+        repr(software["roles"]),
+    )
+    healthcare = domains.obtiene("healthcare")
+    afirma(
+        "· medicine has clinical roles rather than the software list",
+        healthcare["roles"][0][0] == "clinical-director"
+        and not any(r == "dev" for r, _ in healthcare["roles"]),
+        repr(healthcare["roles"]),
+    )
+
+    conocidos = {r for r, _, _, _ in roles.CATALOGO}
+    for pack in packs:
+        afirma(
+            f"· {pack['id']} has a substantive knowledge pack",
+            "# " in pack["text"] and len(pack["text"]) > 500,
+            f"{len(pack['text'])} chars",
+        )
+        afirma(
+            f"· {pack['id']} offers the explicit blank role",
+            any(rol == "blank" for rol, _ in pack["roles"]),
+            repr(pack["roles"]),
+        )
+        for rol, _ in pack["roles"]:
+            afirma(f"· {pack['id']}/{rol} has catalogue metadata", rol in conocidos, rol)
+            ruta = os.path.join(RAIZ, "plugin", "roles", "examples", f"{rol}.md")
+            texto = open(ruta, encoding="utf-8").read() if os.path.isfile(ruta) else ""
+            if rol == "blank":
+                afirma(
+                    f"· {pack['id']}/blank deliberately ships no knowledge pack",
+                    not os.path.exists(ruta),
+                    ruta,
+                )
+            else:
+                afirma(
+                    f"· {pack['id']}/{rol} has transparent role knowledge",
+                    "## Domain" in texto and "## What you ask others" in texto,
+                    ruta,
+                )
+
+
+def ciudad():
+    print("  city-owned knowledge")
+    datos = tempfile.mkdtemp()
+    try:
+        city_yml = os.path.join(datos, "city.yml")
+        open(city_yml, "w").write("id: city_keep\nowner: ana\nkind: product\n")
+        comprueba("· a legacy city reads its work domain", domains.de_ciudad(datos), "software")
+        domains.selecciona(datos, "healthcare")
+        texto = open(city_yml).read()
+        afirma(
+            "· selecting a domain preserves stable identity metadata",
+            "id: city_keep" in texto and "owner: ana" in texto,
+            texto,
+        )
+        afirma("· and writes the explicit canonical field", "domain: healthcare" in texto, texto)
+
+        hechos = domains.materializa(datos, "healthcare", "clinical-director")
+        for relativo in ("domains/healthcare.md", "roles/clinical-director.md", "AGENTS.md"):
+            afirma(
+                f"· materialises {relativo} inside the city",
+                relativo in hechos and os.path.isfile(os.path.join(datos, relativo)),
+                repr(hechos),
+            )
+        instrucciones = open(os.path.join(datos, "AGENTS.md")).read()
+        afirma(
+            "· runtime instructions keep repo skills outside the pack",
+            "Skills remain installed in the referenced repos" in instrucciones,
+            instrucciones[:200],
+        )
+
+        rol = os.path.join(datos, "roles", "clinical-director.md")
+        open(rol, "w").write("my local clinical policy\n")
+        comprueba(
+            "· selecting the same pack never overwrites city edits",
+            domains.materializa(datos, "healthcare", "clinical-director"),
+            [],
+        )
+        comprueba(
+            "· the edited role stays exactly as written",
+            open(rol).read(),
+            "my local clinical policy\n",
+        )
+        comprueba(
+            "· selecting blank adds no hidden role knowledge",
+            domains.materializa(datos, "healthcare", "blank"),
+            [],
+        )
+        afirma(
+            "· and roles/blank.md truly does not exist",
+            not os.path.exists(os.path.join(datos, "roles", "blank.md")),
+        )
+    finally:
+        shutil.rmtree(datos)
+
+
+def main():
+    print()
+    catalogo()
+    ciudad()
+    return resumen("domains")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/bin/test-evidencia.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""The evidence vocabulary: what authorises, and what never does.
+
+Pure and tiny, but load-bearing: the whole point is that `unknown` and
+`ambiguous` can never be read as consent, so those invariants get a test each.
+"""
+
+import os
+import sys
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+sys.path.insert(0, AQUI)
+
+import evidencia as ev  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def autorizacion():
+    afirma("only enforced authorises", ev.autoriza(ev.Evidencia.IMPUESTO))
+    afirma("attribution-only does NOT authorise (knowing who != permitted)",
+           not ev.autoriza(ev.Evidencia.ATRIBUIDO))
+    for estado in (ev.Evidencia.DESCONOCIDO, ev.Evidencia.AMBIGUO,
+                   ev.Evidencia.NO_SOPORTADO, ev.Evidencia.NO_IMPUESTO):
+        afirma(f"{estado} never authorises", not ev.autoriza(estado))
+
+
+def normalizacion():
+    comprueba("a known wire value round-trips",
+              ev.normaliza("enforced"), ev.Evidencia.IMPUESTO)
+    comprueba("garbage fails safe to unknown, not to a permissive state",
+              ev.normaliza("whatever-the-producer-sent"), ev.Evidencia.DESCONOCIDO)
+    afirma("and that fail-safe default never authorises",
+           not ev.autoriza(ev.normaliza("garbage")))
+    # autoriza must fail CLOSED on a raw unknown string, not raise.
+    afirma("autoriza on an unknown wire string returns False, never raises",
+           ev.autoriza("not-a-real-state") is False)
+    comprueba("an Evidencia passes through unchanged",
+              ev.normaliza(ev.Evidencia.AMBIGUO), ev.Evidencia.AMBIGUO)
+
+
+def serializacion():
+    comprueba("str() gives the stable wire value", str(ev.Evidencia.IMPUESTO), "enforced")
+
+
+autorizacion()
+normalizacion()
+serializacion()
+sys.exit(resumen("evidencia"))

package/bin/test-exit.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""The exit: closes what the city started, and nothing else.
+
+    ./bin/test-exit.py
+
+The dangerous half of a teardown command is not what it closes — it is what it
+might close by accident: your own tmux session from before lunch, some other
+project's dev server, the very Claude conversation asking for the shutdown. So
+most of this suite asserts survival.
+"""
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, 'plugin', 'scripts'))
+sys.path.insert(0, AQUI)
+from testlib import comprueba, afirma, resumen  # noqa: E402
+import apaga  # noqa: E402
+import cities  # noqa: E402
+
+
+def tmux(*args):
+    return subprocess.run(['tmux', *args], capture_output=True, text=True).stdout
+
+
+def vivas():
+    return {l.strip() for l in tmux('ls', '-F', '#{session_name}').splitlines() if l.strip()}
+
+
+def main():
+    print()
+    if not shutil.which('tmux'):
+        print('  (tmux not here — skipped)\n  exit ok — 0 checks\n')
+        return 0
+
+    casa = tempfile.mkdtemp()
+    # Two fake cities with one card each, and one session per city — plus an
+    # unrelated session that must survive everything.
+    ciudades = {}
+    for nombre in ('zzacme', 'zzbeta'):
+        d = os.path.join(casa, f'{nombre}-data')
+        os.makedirs(d)
+        open(os.path.join(d, 'city.yml'), 'w').write(
+            f'kind: product\nname: {nombre}\nslug: {nombre}\nowner: zzfulano\n')
+        open(os.path.join(d, 'units.yml'), 'w').write('units:\n')
+        open(os.path.join(d, 'zzfulano.md'), 'w').write(
+            '---\nuser: zzfulano\nrole: dev\nagent: zzfulano/dev\nrepos: []\n'
+            'goals_defined: false\n---\n')
+        ciudades[nombre] = d
+    sesA = cities.sesion('zzfulano', ciudades['zzacme'])
+    sesB = cities.sesion('zzfulano', ciudades['zzbeta'])
+    comprueba('· the two cities mint different sessions', sesA != sesB, True)
+
+    for s in (sesA, sesB, 'zzajena'):
+        subprocess.run(['tmux', 'new-session', '-d', '-s', s], capture_output=True)
+    # A fake map: a process holding one city's state slice open.
+    estadoA = os.path.join(apaga.ESTADO, cities.slug(ciudades['zzacme']))
+    os.makedirs(estadoA, exist_ok=True)
+    rehen = subprocess.Popen(
+        [sys.executable, '-c',
+         f'f = open({os.path.join(estadoA, "db")!r}, "w"); import time; time.sleep(300)'])
+    fake_hub = os.path.join(casa, 'local-hub.js')
+    open(fake_hub, 'w').write('setInterval(() => {}, 1000);\n')
+    orphan_a = subprocess.Popen(['node', fake_hub, '--data', ciudades['zzacme']])
+    orphan_b = subprocess.Popen(['node', fake_hub, '--data', ciudades['zzbeta']])
+    time.sleep(0.8)
+
+    print('  what a selective exit closes')
+    comprueba('· its session', apaga.sesiones_de_la_ciudad(ciudades['zzacme']), [sesA])
+    comprueba('· its map-holder', apaga.mapas(ciudades['zzacme']), [rehen.pid])
+    afirma('· an unmarked orphan hub is found only by its exact city argv',
+           any(row['pid'] == orphan_a.pid
+               for row in apaga.runtime_processes.procesos(ciudades['zzacme']))
+           and all(row['pid'] != orphan_b.pid
+                   for row in apaga.runtime_processes.procesos(ciudades['zzacme'])))
+
+    r = subprocess.run([os.path.join(AQUI, 'exit'), ciudades['zzacme'], '--dry-run'],
+                       capture_output=True, text=True)
+    afirma('· dry-run says, and closes nothing',
+           sesA in r.stdout and sesA in vivas() and rehen.poll() is None,
+           r.stdout[:200])
+
+    r = subprocess.run([os.path.join(AQUI, 'exit'), ciudades['zzacme']],
+                       capture_output=True, text=True)
+    time.sleep(0.5)
+    quedan = vivas()
+    afirma('· closing one city ends its session', sesA not in quedan, str(quedan))
+    afirma("· and kills that city's map-holder", rehen.poll() is not None)
+    afirma("· and kills that city's unmarked orphan hub", orphan_a.poll() is not None)
+
+    print('  what must survive it')
+    afirma("· the OTHER city's session", sesB in quedan)
+    afirma("· the OTHER city's exact hub", orphan_b.poll() is None)
+    afirma('· an unrelated tmux session', 'zzajena' in quedan)
+    afirma('· and this very test process', True)
+
+    print('  the edges')
+    r = subprocess.run([os.path.join(AQUI, 'exit'), 'no-such-city-xyz'],
+                       capture_output=True, text=True)
+    afirma('· an unknown city refuses and lists the known ones',
+           r.returncode == 1 and 'Known here' in r.stderr, r.stderr[:150])
+    # Nothing running for that city any more: honest message, exit 0.
+    r = subprocess.run([os.path.join(AQUI, 'exit'), ciudades['zzacme']],
+                       capture_output=True, text=True)
+    afirma('· closing an already-closed city says so and succeeds',
+           r.returncode == 0 and 'Nothing of the city is running' in r.stdout,
+           r.stdout[:150])
+
+    for s in (sesB, 'zzajena'):
+        subprocess.run(['tmux', 'kill-session', '-t', s], capture_output=True)
+    if rehen.poll() is None:
+        rehen.kill()
+    if orphan_a.poll() is None:
+        orphan_a.kill()
+    if orphan_b.poll() is None:
+        orphan_b.kill()
+    shutil.rmtree(casa)
+    shutil.rmtree(estadoA, ignore_errors=True)
+    return resumen('exit')
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/bin/test-hall-protocol.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""The Hall protocol contract: frames, sequence gaps, the closed method set.
+
+Pure. The load-bearing cases: an unknown method and a malformed write are
+refused at validation; a response carries exactly one of payload/error; the
+per-connection sequence is monotonic and a gap is detectable.
+"""
+
+import os
+import sys
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+sys.path.insert(0, AQUI)
+
+import hall_protocol as hp  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def req_valido():
+    ok, _ = hp.valida_req({"type": "req", "id": "r1", "method": "cities.snapshot", "params": {}})
+    afirma("a well-formed snapshot request validates", ok)
+    ok, _ = hp.valida_req(
+        {"type": "req", "id": "r2", "method": "seat.write",
+         "params": {"mode": "steer", "text": "status?"}})
+    afirma("a steer write with text validates", ok)
+    ok, _ = hp.valida_req(
+        {"type": "req", "id": "r3", "method": "seat.write", "params": {"mode": "note", "text": ""}})
+    afirma("a note may be empty (it does not wake the seat)", ok)
+
+
+def req_rechazado():
+    ok, err = hp.valida_req({"type": "req", "id": "r", "method": "os.system", "params": {}})
+    afirma("an unknown method is refused", not ok)
+    comprueba("with a structured code", err["code"], "unknown_method")
+    ok, err = hp.valida_req({"type": "req", "id": "r", "method": "seat.write",
+                             "params": {"mode": "steer", "text": "  "}})
+    afirma("a steer write without text is refused", not ok and err["code"] == "bad_frame")
+    ok, err = hp.valida_req({"type": "req", "id": "r", "method": "seat.write",
+                             "params": {"mode": "teleport", "text": "x"}})
+    afirma("an unknown write mode is refused", not ok)
+    ok, _ = hp.valida_req({"type": "event", "id": "r", "method": "cities.snapshot"})
+    afirma("a non-req type is refused by valida_req", not ok)
+    ok, _ = hp.valida_req({"type": "req", "method": "cities.snapshot", "params": {}})
+    afirma("a request without an id is refused", not ok)
+    ok, err = hp.valida_req({"type": "req", "id": "r", "method": "seat.write",
+                             "params": {"mode": "start", "text": {"x": 1}}})
+    afirma("a non-string text is refused, not silently stringified",
+           not ok and err["code"] == "bad_frame")
+
+
+def respuestas():
+    r = hp.respuesta("r1", payload={"cities": []})
+    afirma("a payload response is ok", r["ok"] and "payload" in r and "error" not in r)
+    r = hp.respuesta("r1", err=hp.error("seat_busy", "turn in progress", reintentable=True))
+    afirma("an error response is not ok and is retryable",
+           not r["ok"] and r["error"]["retryable"])
+    try:
+        hp.respuesta("r1", payload={}, err=hp.error("bad_frame", "x"))
+        afirma("a response cannot carry both payload and error", False)
+    except ValueError:
+        afirma("a response cannot carry both payload and error", True)
+    try:
+        hp.error("not_a_code", "x")
+        afirma("an error code outside the closed set is refused", False)
+    except ValueError:
+        afirma("an error code outside the closed set is refused", True)
+
+
+def secuencia():
+    seq = hp.Secuencia()
+    e1 = seq.evento("presence", {})
+    e2 = seq.evento("cities.changed", {})
+    comprueba("the sequence starts at 1", e1["seq"], 1)
+    comprueba("and increments monotonically", e2["seq"], 2)
+    afirma("consecutive seqs show no gap", not hp.Secuencia.hay_hueco(1, 2))
+    afirma("a jump is a detectable gap", hp.Secuencia.hay_hueco(1, 5))
+
+
+def wire():
+    frame, err = hp.descodifica(hp.codifica({"type": "event", "seq": 1}))
+    afirma("codifica/descodifica round-trip", err is None and frame["seq"] == 1)
+    frame, err = hp.descodifica("{not json")
+    afirma("malformed wire input fails closed", frame is None and err["code"] == "bad_frame")
+
+
+req_valido()
+req_rechazado()
+respuestas()
+secuencia()
+wire()
+sys.exit(resumen("hall-protocol"))

package/bin/test-launch.py

@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""Real tmux E2E for short launchers: full command and visible failure."""
+import json
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+from testlib import afirma, detiene_hubs_de_ciudad, resumen  # noqa: E402
+
+LAUNCH = os.path.join(RAIZ, 'plugin', 'scripts', 'launch.py')
+LOGS = os.path.join(RAIZ, 'bin', 'logs')
+
+
+def espera(condition, seconds=8):
+    deadline = time.monotonic() + seconds
+    while time.monotonic() < deadline:
+        if condition():
+            return True
+        time.sleep(.05)
+    return False
+
+
+def read(path):
+    try:
+        with open(path, encoding='utf-8') as stream:
+            return stream.read()
+    except OSError:
+        return ''
+
+
+def json_lines(path):
+    try:
+        with open(path, encoding='utf-8') as stream:
+            return [json.loads(line) for line in stream if line.strip()]
+    except (OSError, ValueError):
+        return []
+
+
+def create_launcher(env, city, actor, cwd, command):
+    result = subprocess.run(
+        [sys.executable, LAUNCH, 'create', '--data', city, '--actor', actor,
+         '--cwd', cwd, '--client', os.path.join(RAIZ, 'plugin', 'channel', 'client.js'),
+         '--command', command],
+        capture_output=True, text=True, env=env, timeout=10)
+    return result, result.stdout.strip()
+
+
+def tmux_run(session, cwd, launcher):
+    subprocess.run(['tmux', 'new-session', '-d', '-s', session, '-c', cwd],
+                   check=True, capture_output=True)
+    # This is the production contract: one short literal path, then Enter.
+    typed = shlex.quote(launcher)
+    subprocess.run(['tmux', 'send-keys', '-t', session, '-l', '--', typed], check=True)
+    subprocess.run(['tmux', 'send-keys', '-t', session, 'C-m'], check=True)
+    return typed
+
+
+def main():
+    print('\n  short audited launchers through real tmux')
+    if not shutil.which('tmux'):
+        afirma('· tmux is available', False, 'tmux missing')
+        return resumen('launch')
+    base = tempfile.mkdtemp(prefix='agents-city-launch-')
+    app = os.path.join(base, 'app')
+    city = os.path.join(app, 'alice', 'home')
+    repo = os.path.join(base, 'repo')
+    os.makedirs(city)
+    os.makedirs(repo)
+    open(os.path.join(city, 'city.yml'), 'w', encoding='utf-8').write(
+        'id: city_launcher\nname: Home\nslug: home\nowner: alice\n')
+    open(os.path.join(city, 'roads.json'), 'w', encoding='utf-8').write(
+        '{"version": 1, "roads": []}\n')
+    open(os.path.join(city, 'alice.md'), 'w', encoding='utf-8').write(
+        '---\nuser: alice\nagent: alice/ceo\nrepos: [repo]\nrole.repo: engineer\n---\n')
+    env = dict(os.environ, AGENTS_CITY_HOME=app, AGENTS_CITY_DATA=city,
+               AGENTS_CITY_USER='alice')
+    for key in ('CITY_BUS_URL', 'CITY_BUS_TOKEN', 'CITY_DIR'):
+        env.pop(key, None)
+    session = 'agents-city-test-launch-' + uuid.uuid4().hex[:10]
+    capture = os.path.join(base, 'capture.json')
+    fake = os.path.join(base, 'fake-agent.py')
+    open(fake, 'w', encoding='utf-8').write(
+        '#!/usr/bin/env python3\n'
+        'import json, os, sys\n'
+        'open(os.environ["CAPTURE"], "w").write(json.dumps({'
+        '"args": sys.argv[1:], "actor": os.environ.get("CITY_BUS_ACTOR"), '
+        '"role": os.environ.get("CITY_AGENT_ROLE")}))\n')
+    os.chmod(fake, 0o755)
+    runtime_dir = os.path.join(app, '.runtime', 'bus', 'city-launcher')
+    diagnostics = os.path.join(runtime_dir, 'diagnostics.jsonl')
+    activity = os.path.join(runtime_dir, 'activity.jsonl')
+    try:
+        padding = ''.join(': "padding-%04d-%s"; ' % (n, 'x' * 60) for n in range(120))
+        command = (
+            padding + f'CAPTURE={shlex.quote(capture)} CITY_BUS_ACTOR=repo '
+            f'CITY_AGENT_ROLE=engineer {shlex.quote(fake)} --name alice-home-repo '
+            '--settings safe --print --input-format stream-json '
+            '--output-format stream-json --replay-user-messages')
+        made, launcher = create_launcher(env, city, 'repo', repo, command)
+        afirma('· happy: a command much longer than the broken tmux input is stored privately',
+               made.returncode == 0 and len(command) > 8_000
+               and os.path.isfile(launcher)
+               and (os.stat(launcher).st_mode & 0o077) == 0,
+               made.stderr or launcher)
+        typed = tmux_run(session, repo, launcher)
+        afirma('· happy: tmux receives only the short launcher path',
+               len(typed) < 300 and len(typed) * 20 < len(command),
+               f'typed={len(typed)} full={len(command)}')
+        afirma('· happy: the complete Claude stream suffix and environment survive',
+               espera(lambda: os.path.exists(capture))
+               and json.loads(read(capture)).get('args', [])[-5:]
+               == ['--input-format', 'stream-json', '--output-format',
+                   'stream-json', '--replay-user-messages']
+               and json.loads(read(capture)).get('actor') == 'repo'
+               and json.loads(read(capture)).get('role') == 'engineer',
+               read(capture))
+        afirma('· happy: launcher start and clean exit are durable diagnostics',
+               espera(lambda: 'launch.exited' in read(diagnostics))
+               and 'launch.started' in read(diagnostics), read(diagnostics))
+
+        subprocess.run(['tmux', 'kill-session', '-t', session], capture_output=True)
+        session += '-failure'
+        failing = os.path.join(base, 'failing-agent.sh')
+        open(failing, 'w', encoding='utf-8').write('#!/bin/sh\nexit 23\n')
+        os.chmod(failing, 0o755)
+        failed_command = (
+            'CITY_BUS_ACTOR=repo CITY_BUS_TOKEN=DO_NOT_LOG_THIS_SECRET '
+            + shlex.quote(failing))
+        made_failure, failure_launcher = create_launcher(
+            env, city, 'repo', repo, failed_command)
+        tmux_run(session, repo, failure_launcher)
+        afirma('· non-happy: exit 23 is recorded and never hides as a half command',
+               made_failure.returncode == 0
+               and espera(lambda: any(row.get('event') == 'launch.failed'
+                                      and row.get('message') == 'exit 23'
+                                      for row in json_lines(diagnostics))),
+               read(diagnostics))
+        afirma('· non-happy: launch failure appears in the same durable live feed',
+               espera(lambda: any(row.get('kind') == 'runtime.launch.failed'
+                                  and row.get('actor') == 'repo'
+                                  for row in json_lines(activity))),
+               read(activity))
+        afirma('· non-happy: diagnostics never persist command credentials',
+               'DO_NOT_LOG_THIS_SECRET' not in read(diagnostics), read(diagnostics))
+
+        logs = subprocess.run([LOGS, '--json', '--lines', '5'], capture_output=True,
+                              text=True, env=env, timeout=10)
+        afirma('· the public logs command exposes both durable streams',
+               logs.returncode == 0
+               and 'agents-city-diagnostic/1' in logs.stdout
+               and 'agents-city-activity/1' in logs.stdout,
+               logs.stderr or logs.stdout)
+    finally:
+        subprocess.run(['tmux', 'kill-session', '-t', session], capture_output=True)
+        detiene_hubs_de_ciudad(city)
+        shutil.rmtree(base, ignore_errors=True)
+    return resumen('launch')
+
+
+if __name__ == '__main__':
+    sys.exit(main())