agents-relay 2.0.169 → 2.0.171

package/skills/agents-relay/SKILL.md

@@ -104,29 +104,29 @@ The ChatGPT adapter uses Relay's `chatgpt-worker` agent contract and Browser Wor
 
 ChatGPT thread identity is diagnostic only. It is not persisted as a resumable task handle, and Relay does not poll, resume, retrieve a result from, or delete a ChatGPT conversation as part of task lifecycle.
 
-## Autonomous planner
+## Objective-driven Planner
 
 Direct orchestrator-created Tasks do not require a Plan. The orchestrator may create the initial batch with `task create`; those Tasks remain top-level unless the orchestrator explicitly gives them normal task parentage. When planner-driven decomposition is desired instead, use `agents-relay plan --repo OWNER/REPO --pr N --id JOB_ID [--prompt TEXT | --prompt-file PATH|-]`.
 
-For explicit `plan` and autonomous continuation, Relay invokes the same planner agent as a pure decision function. The planner receives durable Job/Task state, previous planner rounds, and resolved execution context, then returns structured `{ objective_status, assessment, next_tasks }` output. The planner does not call Relay CLI and does not persist Tasks itself.
+For explicit `plan` and automatic continuation, Relay invokes the same planner agent as a pure decision function. The planner receives durable Job/Task state, previous planner rounds, and resolved execution context, then returns structured `{ objective_status, assessment, next_tasks }` output. The planner does not call Relay CLI and does not persist Tasks itself.
 
 Each successful planner invocation is one real `plan-N` planning round. Relay persists that planner result, then creates returned work Tasks with provenance back to that planning round. `parentTaskId` expresses semantic ownership among work Tasks; it is not inherited from the Plan and must never point to a `plan-N` record. `dependencies` independently express execution prerequisites. Historical `planner-N` records remain readable. Only planner execution creates planner rounds; Relay never manufactures synthetic `plan-*` records for direct Task creation. In the dashboard, planner rounds remain provenance/grouping metadata, not semantic parents.
 
-A zero-task autonomous Job remains idle. After a direct orchestrator-created initial batch completes, Relay may start the first real planner round. Fixed Jobs do not automatically create planner rounds.
+A zero-task DRAFT Job remains idle until explicit first planning or direct Task creation. After initial work settles, every Job automatically replans until the latest successful Plan is `satisfied`; there is no fixed/autonomous mode or Job scheduler.
 
 Planner-created child Tasks remain descriptive agent work and must include the output contract and `storySize`; worker requirements are optional soft routing facts unless an explicit runtime constraint is known. Execution Router chooses the complete runtime route afterward.
 
 ## Durable truth
 
-GitHub PR/job/task markers remain durable workflow state. Events are the authoritative execution-state transition signal for model-backed tasks. Runtime events, process exits, browser submission receipts, and conversation text are evidence only.
+SQLite is the sole local durable lifecycle authority. GitHub PR/Job/Task markers are collaboration projections. Correlated model-worker events are inputs to Graph-selected, SQLite-committed transitions; runtime events, process exits, browser receipts, and conversation text are not themselves completion proof.
 
 Keep secrets, credentials, private prompts, and large private payloads out of durable markers and events.
 
 ### Automatic task troubleshooting
 
-When an ACTIVE Job contains a current-run `FAILED` task, reconciliation may create one P0-priority `troubleshooter` recovery task for that exact failed attempt. `BLOCKED` is resolved only through authoritative unblock, which records evidence and transitions the Task to `UNBLOCKED`. The recovery task is routed to a local Codex-capable worker with repository/tool access and runs under the bundled Troubleshooter agent contract. Autonomous `UNBLOCKED` Tasks are historical and feed the next Planner round instead of being retried or sent through Troubleshooter. Each Planner round is durably represented by an `agents-relay:plan:v1` PR comment created before generated Task comments and updated in place with its assessment and generated Task IDs. Troubleshooter diagnosis is event-first: it must inspect the failed task's task-scoped lifecycle event history (including ordering, duplicate/missing/late events, source and phase data) before classifying root cause or retrying.
+When an ACTIVE Job contains a current-run `FAILED` task, reconciliation may create one P0-priority `troubleshooter` recovery task for that exact failed attempt. `BLOCKED` is resolved only through authoritative unblock, which records evidence and transitions the Task to `UNBLOCKED`. The recovery task is routed to a local Codex-capable worker with repository/tool access and runs under the bundled Troubleshooter agent contract. Historical ordinary unblock evidence is Planner recovery context; only an effectively blocked Troubleshooter can be authoritatively resumed. Each Planner round is durably represented by an `agents-relay:plan:v1` PR comment created before generated Task comments and updated in place with its assessment and generated Task IDs. Troubleshooter diagnosis is event-first: it must inspect the failed task's task-scoped lifecycle event history (including ordering, duplicate/missing/late events, source and phase data) before classifying root cause or retrying.
 
-The Troubleshooter diagnoses before retrying. A task-local or transient blocker is repaired narrowly; a shared worker/runtime/tool defect is repaired through the owning repository's P0/self-job workflow. Only after the blocker is removed does it retry the original task and verify durable progress. Historical failures from older scheduled autonomous runs do not spawn recovery work, and deterministic reconciliation does not duplicate a Troubleshooter task for the same failed attempt.
+The Troubleshooter diagnoses before retrying. A task-local or transient blocker is repaired narrowly; a shared worker/runtime/tool defect is repaired through the owning repository's P0/self-job workflow. Only after the blocker is removed does it retry the original task and verify durable progress. Historical resolved failures do not spawn duplicate recovery work, and deterministic reconciliation does not duplicate a Troubleshooter task for the same failed attempt.
 
 ## Persistent service bootstrap
 

package/skills/agents-relay/agents/planner.agent.md

@@ -1,6 +1,6 @@
 # Planner Agent
 
-You are the default objective planner for Agents Relay autonomous jobs.
+You are the default objective planner for all Agents Relay Jobs.
 
 Before producing tasks, read and follow `../contracts/task-job-contract.md`.
 
@@ -25,10 +25,10 @@ For every non-satisfied objective:
 
 ### Objective decomposition and convergence
 
-- **Never bundle independently testable acceptance layers into one giant Task.** Break objectives into separately verifiable deliverables (for example, contract tests, real-provider compliance, scheduler-driven end-to-end scenarios, and integration evidence). Give each Task concrete acceptance checks and an observable output.
+- **Never bundle independently testable acceptance layers into one giant Task.** Break objectives into separately verifiable deliverables (for example, contract tests, real-provider compliance, L1 Graph branches, L2 role evidence, and L3 production-ingress SQLite replay, and integration evidence). Give each Task concrete acceptance checks and an observable output.
 - Split a large Task when its remaining work spans distinct implementation areas, independently testable failure paths, or more than one meaningful review/recovery cycle. Put shared prerequisites in earlier Tasks and express true dependencies explicitly; independent work may run in parallel.
 - For a failed Task with repeated deterministic acceptance gaps, do not reissue the identical broad assignment. Identify the *missing acceptance cases*, create focused same-Job repair Tasks with valid `same_job_dependency` resolutions, and specify how their evidence unblocks the original Task. Preserve the original failed Task and failure history.
-- For event-driven workflows, separate basic ingress/persistence checks from real scheduler-driven multi-stage scenarios. Require negative-path, multi-failure recovery and no-false-completion evidence before claiming full objective coverage.
+- For event-driven workflows, separate basic ingress/persistence checks from L3 production Reconciler/Graph/SQLite multi-stage replay scenarios. Require negative-path, multi-failure recovery and no-false-completion evidence before claiming full objective coverage.
 - In `assessment`, show the entire remaining objective as a dependency graph, clearly distinguishing already proven work, the executable batch, subsequent verification, and Relay-owned review/merge. Never report overall `satisfied` merely because one batch has passed.
 
 

package/skills/agents-relay/contracts/event-contract.md

@@ -2,6 +2,16 @@
 
 **Scope:** Relay-specific event meaning and validation. This does **not** define Events Bus transport. The bus only handles generic event identity, type, timestamp, routing as needed, and opaque `data`. No Events Bus change is required when Relay adds agent roles or payload fields.
 
+## Execution event source
+
+Every Task lifecycle event must identify the exact current Relay execution with:
+
+```text
+source.id = job/<job-id>/task/<task-id>/execution/<execution-id>
+```
+
+Relay supplies this complete identity in the managed Task context. Agents must copy it unchanged; they must not infer a Job/Task ID, generate an execution ID, or reuse an identity from a previous attempt. The Neo `events.publish` tool accepts this value as its string `source` argument; the Events Bus event envelope represents it as `source.id`. Transport acceptance alone does not establish that Relay accepted the event for the current execution.
+
 ## Producer contract
 
 Every Implementation, Reviewer, and Troubleshooter execution publishes `task.started`, optional `task.progress`, then **exactly one** agent terminal event:

package/skills/agents-relay/contracts/orchestrator-workflows.md

@@ -20,7 +20,7 @@ job create --initial-plan
 
 Without `--initial-plan`, `job create` remains create-only and establishes durable Job/PR state without execution. `agents-relay plan` remains available for an existing create-only/adopted Job. Unless the user explicitly requested **create-only / no execution**, the orchestrator should use `job create --initial-plan` rather than issuing two separate commands.
 
-The initial decomposition belongs to that durable Planner round. The orchestrator must not hand-author the initial child Task batch as a substitute. If initial planning fails, the create command fails visibly after preserving the durable Job/Plan evidence; the orchestrator must not silently invent Tasks. This applies regardless of whether the Job uses `fixed` or `autonomous` execution mode. Later replanning continues to follow Relay's normal Planner/reconciliation rules.
+The initial decomposition belongs to that durable Planner round. The orchestrator must not hand-author the initial child Task batch as a substitute. If initial planning fails, the create command fails visibly after preserving the durable Job/Plan evidence; the orchestrator must not silently invent Tasks. Every Job follows this same objective-driven lifecycle. After a completed implementation batch, Relay automatically creates subsequent Plan rounds until the latest successful Plan reports `objective_status: satisfied`; there is no fixed/autonomous execution mode or Job scheduling.
 
 ## P0 / self job workflow
 
@@ -48,7 +48,7 @@ state and hand subsequent execution to Relay.
 
 ## Merge completion vs deployment evidence
 
-For a normal one-shot managed Job, the canonical Job lifecycle graph owns completion: a durable `pr.merged` fact transitions the Job to `COMPLETED`. Reconciler and deployment code must not invent a second completion gate after merge.
+For a managed Job, the canonical Job lifecycle Graph owns completion. A satisfied Plan, successful implementation evidence, applicable SHA-bound review, and a verified local merge/delivery receipt are required. Remote GitHub `pr.merged` facts are audit-only and never independently complete a local Job. Deployment code must not invent another completion gate after durable Job completion.
 
 Post-merge publication and deployment activity is separate from Job lifecycle. Events or evidence such as `package.published`, published version metadata, service restart, and deployment verification may be attached after the Job is already `COMPLETED`; they must not hold the Job open, reopen it, or redefine completion. If post-merge deployment needs remediation, record that as separate deployment/recovery work rather than mutating the completed implementation Job lifecycle.
 

package/skills/agents-relay/contracts/task-job-contract.md

@@ -77,7 +77,7 @@ The Job owns the meaning of the tag. Its trusted Job marker declares a human-rea
 ```json
 {
   "tag": {
-    "description": "Deterministic E2E outcome. Set pass when the fixed E2E exits 0; set fail when it still fails after the required retry.",
+    "description": "L3 verification outcome. Set pass only after authoritative SQLite replay checks pass; set fail when a required check fails.",
     "values": {
       "pass": "✅",
       "fail": "❌"
@@ -109,9 +109,9 @@ Relay validates `data.tag` against `Job.tag.values`. If the value is allowed, Re
 
 The dashboard always keeps the normal lifecycle badge. When a valid Task tag is present, it additionally renders the display string from `Job.tag.values` after the lifecycle status. For the example above this appears as `SUCCEEDED ✅`.
 
-A tag must describe something specific to the Job contract, not Relay lifecycle. Examples include an E2E result (`pass` / `fail`), publication result, validation classification, or another small Job-defined outcome. The Job description must tell the worker when to set the tag and what each allowed value means. Jobs without a `tag` declaration behave exactly as before.
+A tag must describe something specific to the Job contract, not Relay lifecycle. Examples include a verified L3 result (`pass` / `fail`), publication result, validation classification, or another small Job-defined outcome. The Job description must tell the worker when to set the tag and what each allowed value means. Jobs without a `tag` declaration behave exactly as before.
 
-For the ChatGPT Browser Worker guardian, for example, the Job defines `pass -> ✅` and `fail -> ❌`; each hourly E2E child Task reports `data.tag` after running the fixed deterministic E2E, while the Task lifecycle independently records whether Relay execution itself completed, failed, or became blocked.
+For a validation Job, for example, the Job defines `pass -> ✅` and `fail -> ❌`; each L3 verification Task reports `data.tag` after the isolated replay and evidence checks, while Task lifecycle independently records the worker outcome.
 
 
 ### Task resolution classifications
@@ -139,9 +139,9 @@ SHA-bound final reviewer. For example, `video-director + market + style ->
 review-chair -> unified revision plan` is a project pattern, not a hard-coded
 Relay reviewer list.
 
-A scheduled autonomous job adds cron/timezone/next-run and missed-run/concurrency policy to the trusted job marker. The always-on `agents-relayd` process is the sole heartbeat for repositories it manages: on startup and every ten minutes it evaluates cached managed Jobs and reconciles due work through the local worker pool. There is no GitHub Actions scheduler fallback. Unscheduled autonomous Jobs and fixed Jobs do not use the scheduler heartbeat.
+Every Job is objective-driven. After a direct initial Task batch or a Planner-produced batch settles, reconciliation evaluates the canonical Planner Graph and creates the next durable `plan-N` round until the latest successful Plan returns `objective_status: satisfied`. There is no fixed/autonomous mode, no Job schedule, no cron slot, and no Scheduler entity. The daemon performs startup recovery and wake-driven reconciliation from SQLite. A satisfied Plan alone does not complete a Job: successful implementation evidence, SHA-bound review when enabled, and verified local merge/delivery remain mandatory.
 
-The scheduler heartbeat filters cached managed Jobs, reloads each due Job to validate the marker's exact `nextRunAt`, claims the slot idempotently, advances the durable next run, and reconciles planner/worker execution locally. While the schedule is active, the durable Job remains `ACTIVE`; between runs its derived runtime status is `WAITING`. Scheduled recurring Jobs do not enter one-shot final-review/auto-merge after each satisfied run; older-cycle failures are historical evidence and do not block a later slot.
+A newly created zero-task DRAFT Job waits for explicit initial planning (`plan` or `--initial-plan`) or direct work creation; this is only a start gate, not a distinct execution mode. Failed or blocked Tasks require durable Troubleshooter/owner recovery and never allow a fabricated completion. Duplicate events and daemon restarts must not create duplicate Plan rounds.
 
 
 ## Task evidence and head identity

package/workflow/blocker-resolution.mmd

@@ -6,7 +6,6 @@ flowchart LR
 %% relay: initial waiting
 waiting["state: waiting"]
 checkTarget["state: check_target"]
-checkAutonomous["state: check_autonomous"]
 checkEffective["state: check_effective"]
 checkAlreadyUnblocked["state: check_already_unblocked"]
 checkDraft["state: check_draft"]
@@ -19,7 +18,6 @@ resumed["state: resumed"]
 
 resolutionAllowed["guard: resolutionAllowed"]
 targetMatches["guard: targetMatches"]
-autonomousJob["guard: autonomousJob"]
 effectivelyBlocked["guard: effectivelyBlocked"]
 alreadyUnblocked["guard: alreadyUnblocked"]
 isDraft["guard: isDraft"]
@@ -35,11 +33,7 @@ resolutionAllowed -->|true| checkTarget
 
 checkTarget -->|on: blocker.resolved| targetMatches
 targetMatches -->|false| obsolete
-targetMatches -->|true| checkAutonomous
-
-checkAutonomous -->|on: blocker.resolved| autonomousJob
-autonomousJob -->|true| checkEffective
-autonomousJob -->|false| checkDraft
+targetMatches -->|true| checkEffective
 
 checkEffective -->|on: blocker.resolved| effectivelyBlocked
 effectivelyBlocked -->|true| wait

package/workflow/force-restate-validation.mmd

@@ -8,12 +8,14 @@ idle["state: idle"]
 checkHistoryMode["state: check_history_mode"]
 checkHistory["state: check_history"]
 checkNormalHistory["state: check_normal_history"]
+checkSatisfied["state: check_satisfied"]
 checkForward["state: check_forward"]
 commit["action: plan.apply.commit"]
 rejected["state: rejected"]
 committed["state: committed"]
 forceRestate["guard: forceRestateRequested"]
 historyConsistent["guard: historyConsistencyValid"]
+objectiveSatisfied["guard: objectiveSatisfied"]
 forwardConverged["guard: forwardConvergenceValid"]
 normalHistoryClean["guard: normalHistoryMutationAbsent"]
 rejectHistory["action: plan.apply.rejectHistory"]
@@ -24,12 +26,15 @@ checkHistoryMode -->|on: plan.apply| forceRestate
 forceRestate -->|true| checkHistory
 forceRestate -->|false| checkNormalHistory
 checkNormalHistory -->|on: plan.apply| normalHistoryClean
-normalHistoryClean -->|true| checkForward
+normalHistoryClean -->|true| checkSatisfied
 normalHistoryClean -->|false| rejectHistory
 checkHistory -->|on: plan.apply| historyConsistent
-historyConsistent -->|true| checkForward
+historyConsistent -->|true| checkSatisfied
 historyConsistent -->|false| rejectHistory
 rejectHistory --> rejected
+checkSatisfied -->|on: plan.apply| objectiveSatisfied
+objectiveSatisfied -->|true| commit
+objectiveSatisfied -->|false| checkForward
 checkForward -->|on: plan.apply| forwardConverged
 forwardConverged -->|true| commit
 forwardConverged -->|false| rejectForward

package/workflow/planner-orchestration.mmd

@@ -1,6 +1,6 @@
 ---
 title: Planner Orchestration
-description: Guards autonomous planning rounds, interrupted plans, and planner recovery.
+description: Guards objective-driven planning rounds, interrupted plans, and planner recovery.
 ---
 flowchart LR
 %% relay: initial idle
@@ -21,7 +21,6 @@ wait["state: wait"]
 recovered["state: recovered"]
 created["state: created"]
 
-autonomous["guard: autonomousJob"]
 legacyPending["guard: legacyPlanningPending"]
 recoverablePending["guard: recoverablePendingPlan"]
 terminalFailure["guard: terminalPlanFailure"]
@@ -39,9 +38,7 @@ recoverAction["action: planner.recoverPending"]
 createRecovery["action: planner.createRecovery"]
 createAction["action: planner.createRound"]
 
-idle -->|on: planner.reconcile| autonomous
-autonomous -->|false| wait
-autonomous -->|true| checkLegacy
+idle -->|on: planner.reconcile| checkLegacy
 
 checkLegacy -->|on: planner.reconcile| legacyPending
 legacyPending -->|true| wait

package/workflow/planner-trigger.mmd

@@ -1,22 +1,19 @@
 ---
 title: Planner Trigger
-description: Classifies planning requests as manual, unblock, scheduled, initial, or continuation.
+description: Classifies planning requests as manual, unblock, initial, or continuation.
 ---
 flowchart LR
 %% relay: initial idle
 idle["state: idle"]
 checkUnblock["state: check_unblock"]
-checkSchedule["state: check_schedule"]
 checkInitial["state: check_initial"]
 manual["state: manual"]
 unblock["state: unblock"]
-schedule["state: schedule"]
 initial["state: initial"]
 continuation["state: continuation"]
 
 manualGuard["guard: manualPlan"]
 unblockGuard["guard: hasUnblock"]
-scheduleGuard["guard: scheduledRun"]
 initialGuard["guard: initialPlan"]
 
 idle -->|on: plan.requested| manualGuard
@@ -25,11 +22,7 @@ manualGuard -->|false| checkUnblock
 
 checkUnblock -->|on: plan.requested| unblockGuard
 unblockGuard -->|true| unblock
-unblockGuard -->|false| checkSchedule
-
-checkSchedule -->|on: plan.requested| scheduleGuard
-scheduleGuard -->|true| schedule
-scheduleGuard -->|false| checkInitial
+unblockGuard -->|false| checkInitial
 
 checkInitial -->|on: plan.requested| initialGuard
 initialGuard -->|true| initial

package/workflow/review-lifecycle.mmd

@@ -13,7 +13,6 @@ changes["state: CHANGES_REQUIRED"]
 blocked["state: BLOCKED"]
 stale["state: STALE"]
 
-unscheduledNone["guard: unscheduled"]
 reviewEnabledNone["guard: reviewEnabled"]
 jobActiveNone["guard: jobActive"]
 implementationCompleteNone["guard: implementationComplete"]
@@ -21,7 +20,6 @@ headAvailableNone["guard: headAvailable"]
 completionGateNone["guard: completionGateSatisfied"]
 noActiveReviewNone["guard: noActiveReviewTask"]
 noApprovedReviewNone["guard: noApprovedCurrentReview"]
-unscheduledStale["guard: unscheduled"]
 reviewEnabledStale["guard: reviewEnabled"]
 jobActiveStale["guard: jobActive"]
 implementationCompleteStale["guard: implementationComplete"]
@@ -49,9 +47,7 @@ fixChanges["action: review.createFix"]
 mergePending["action: review.requestMerge"]
 mergeStarted["action: review.requestMerge"]
 
-none -->|on: reconcile| unscheduledNone
-unscheduledNone -->|true| reviewEnabledNone
-unscheduledNone -->|false| none
+none -->|on: reconcile| reviewEnabledNone
 reviewEnabledNone -->|true| jobActiveNone
 reviewEnabledNone -->|false| none
 jobActiveNone -->|true| implementationCompleteNone
@@ -68,9 +64,7 @@ noApprovedReviewNone -->|true| createNone
 noApprovedReviewNone -->|false| none
 createNone --> pending
 
-stale -->|on: reconcile| unscheduledStale
-unscheduledStale -->|true| reviewEnabledStale
-unscheduledStale -->|false| stale
+stale -->|on: reconcile| reviewEnabledStale
 reviewEnabledStale -->|true| jobActiveStale
 reviewEnabledStale -->|false| stale
 jobActiveStale -->|true| implementationCompleteStale

package/dist/e2e-injection.js

@@ -1,76 +0,0 @@
-const legacy = {
-    quota_exceeded: { method: 'worker.codex.launch', action: 'return', execution: 'skip', mock: 'worker_quota' },
-    model_not_found: { method: 'worker.codex.launch', action: 'return', execution: 'skip', mock: 'worker_model_not_found' },
-    provider_unavailable: { method: 'worker.codex.launch', action: 'return', execution: 'skip', mock: 'worker_provider_unavailable' },
-    github_projection_failure: { method: 'github.projectLocalMerge', action: 'throw', execution: 'skip', error: { code: 'SERVICE_UNAVAILABLE', message: 'E2E transient GitHub projection transport failure', status: 503 } },
-};
-export function parseTestInjection(value) {
-    if (typeof value === 'string')
-        return legacy[value];
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return undefined;
-    const v = value;
-    if (v.method !== 'worker.codex.launch' && v.method !== 'github.projectLocalMerge' && v.method !== 'browserWorkspace.command')
-        return undefined;
-    if (v.action !== 'throw' && v.action !== 'return' && v.action !== 'pass')
-        return undefined;
-    if (v.execution !== 'skip' && v.execution !== 'after' && v.execution !== 'run')
-        return undefined;
-    const error = v.error;
-    if (v.action === 'throw' && (!error || typeof error !== 'object' || typeof error.message !== 'string' || typeof error.code !== 'string'))
-        return undefined;
-    const mock = v.mock;
-    if (v.action === 'return' && (v.method !== 'worker.codex.launch' || !['worker_quota', 'worker_model_not_found', 'worker_provider_unavailable'].includes(String(mock))))
-        return undefined;
-    if (v.method === 'worker.codex.launch' && v.action !== 'pass' && (v.action !== 'return' || v.execution !== 'skip'))
-        return undefined;
-    if (v.action === 'pass' && v.execution !== 'run')
-        return undefined;
-    if (v.action !== 'pass' && v.execution === 'run')
-        return undefined;
-    return { method: v.method, action: v.action, execution: v.execution, error: error, mock: mock };
-}
-export function authorizedInjection(repository, raw, env = process.env) {
-    return env.E2E_REPO && repository === env.E2E_REPO ? parseTestInjection(raw) : undefined;
-}
-function mockWorker(name) {
-    const message = name === 'worker_quota' ? 'rate_limit_exceeded: usage limit reached' : name === 'worker_model_not_found' ? 'model_not_found: model is unavailable' : 'provider_unavailable: provider refused the request';
-    const promise = Promise.reject(new Error(message));
-    promise.catch(() => { });
-    return { id: 'e2e-injected', launched: Promise.resolve(), promise, cancel: () => { }, processExit: { exitCode: 1, signal: null, stderr: message, terminationReason: null } };
-}
-/** Caller must supply a configuration already consumed durably before this invocation. */
-export function withTestInjection(method, config, execute) {
-    if (!config || config.method !== method || config.action === 'pass')
-        return execute();
-    const apply = (original) => {
-        if (config.action === 'throw') {
-            const error = Object.assign(new Error(config.error.message), { code: config.error.code, status: config.error.status });
-            throw error;
-        }
-        if (method === 'worker.codex.launch' && config.mock)
-            return mockWorker(config.mock);
-        return original;
-    };
-    return config.execution === 'after' ? Promise.resolve(execute()).then(apply) : apply();
-}
-/** Shared atomic consumer, scoped solely by E2E_REPO and exact method. */
-export async function consumeMethodInjection(relay, repository, jobId, method) {
-    if (!process.env.E2E_REPO || process.env.E2E_REPO !== repository || !relay.mutateJob)
-        return undefined;
-    let config;
-    await relay.mutateJob(jobId, job => {
-        if (job.repository !== repository)
-            return job;
-        const task = job.tasks.find(t => authorizedInjection(job.repository, t.testInjection)?.method === method);
-        if (!task)
-            return job;
-        config = authorizedInjection(job.repository, task.testInjection);
-        delete task.testInjection;
-        task.updatedAt = new Date(Math.max(Date.now(), Date.parse(task.updatedAt) + 1)).toISOString();
-        return job;
-    });
-    if (config && (await relay.loadJob(jobId))?.tasks.some(t => authorizedInjection(repository, t.testInjection)?.method === method))
-        throw Error(`E2E injection consumption not committed: ${jobId}`);
-    return config;
-}

package/dist/scheduled-jobs.js

@@ -1,67 +0,0 @@
-import { nextScheduleRun, scheduleBucket } from './scheduler.js';
-import { dispatchScheduledRun } from './workflow/scheduled-run-v2.js';
-/** Local-first schedule entrypoint: immutable Job ID selects the SQLite store. */
-export async function runScheduledBucketFromStore(store, ref, engine, now = new Date()) {
-    // SQLite authority provides an atomic claim. The fallback retains the
-    // existing in-memory test adapter, but cannot be used for production claims.
-    if (store.claimScheduledSlot) {
-        if (!store.finishScheduledSlot)
-            throw new Error('Atomic scheduled completion is required');
-        const claimed = await store.claimScheduledSlot(ref.jobId, ref.bucket, now);
-        if (claimed.status !== 'completed')
-            return claimed;
-        const slot = claimed.job.schedule?.currentRunSlot;
-        if (!slot)
-            throw new Error('Claimed schedule slot missing durable currentRunSlot');
-        await engine.reconcile(ref.jobId);
-        await engine.idle();
-        const job = await store.finishScheduledSlot(ref.jobId, slot, now);
-        return { job, status: 'completed' };
-    }
-    let job = await store.load(ref.jobId);
-    if (!job.schedule)
-        throw new Error('Scheduled job ' + job.id + ' has no schedule metadata');
-    const schedule = job.schedule;
-    const slot = new Date(schedule.nextRunAt);
-    const active = job.tasks.some(task => ['QUEUED', 'RUNNING'].includes(task.state));
-    let claimed = false;
-    let status = 'skipped-idempotent';
-    const decision = await dispatchScheduledRun({
-        slotDue: scheduleBucket(slot) === ref.bucket && slot.getTime() <= now.getTime(),
-        slotUnclaimed: !schedule.lastScheduledSlot || new Date(schedule.lastScheduledSlot).getTime() < slot.getTime(),
-        jobActive: job.state === 'ACTIVE', hasActiveTasks: active,
-        concurrencySkip: schedule.concurrencyPolicy === 'skip', concurrencyQueue: schedule.concurrencyPolicy === 'queue',
-        runMissed: schedule.missedRunPolicy === 'run',
-    }, async (actionId) => {
-        if (actionId === 'schedule.skipActiveAdvance') {
-            schedule.lastScheduledSlot = slot.toISOString();
-            schedule.nextRunAt = nextScheduleRun(schedule, now).toISOString();
-            status = 'skipped-active';
-        }
-        else if (actionId === 'schedule.claimFromSlot' || actionId === 'schedule.claimFromNow') {
-            schedule.lastScheduledSlot = slot.toISOString();
-            schedule.currentRunSlot = slot.toISOString();
-            schedule.nextRunAt = nextScheduleRun(schedule, actionId === 'schedule.claimFromSlot' ? slot : now).toISOString();
-            claimed = true;
-            status = 'completed';
-        }
-        else
-            throw new Error('Unknown local schedule action: ' + actionId);
-        job.updatedAt = now.toISOString();
-        await store.saveJob(job);
-        return {};
-    });
-    if (!decision.accepted || !claimed)
-        return { job, status };
-    await engine.reconcile(job.id);
-    await engine.idle();
-    job = await store.load(job.id);
-    if (!job.schedule)
-        throw new Error('Scheduled job lost schedule metadata');
-    job.schedule.lastRunAt = now.toISOString();
-    // A claim and its completion can share the same wall-clock timestamp.
-    // Advance the snapshot revision to satisfy SQLite's stale-write guard.
-    job.updatedAt = new Date(Math.max(now.getTime(), Date.parse(job.updatedAt) + 1)).toISOString();
-    await store.saveJob(job);
-    return { job, status: 'completed' };
-}