agentwrangler 0.1.1-next.8be2eb0 → 0.1.1-next.adabfa3

package/dist/apply/jobs.js

@@ -302,7 +302,10 @@ function completeApplyPhase(db, job, rec, result, rt) {
     let runId = null;
     const completedAt = rt.now();
     try {
-        adoptRecommendation(job.rec_id, completedAt.getTime());
+        adoptRecommendation(job.rec_id, completedAt.getTime(), {
+            machineConfirmed: true,
+            actionRevision: job.job_id,
+        });
         runId = randomUUID();
         const evidencePackHash = createHash("sha256")
             .update(JSON.stringify(rec.evidence))
@@ -417,6 +420,9 @@ export function rollbackApplyJob(jobId) {
     if (row.status !== "APPLIED" && row.status !== "CONFIRMING") {
         throw new Error("job cannot be rolled back from this state");
     }
+    if (db.prepare("SELECT 1 FROM effect_cycles WHERE rec_id=? LIMIT 1").get(row.rec_id)) {
+        throw new Error("Whole-file backup rollback is not a supported effect inverse. Revert manually and attest the rollback in the effect ledger.");
+    }
     if (row.backup_path === null)
         throw new Error("no backup available");
     fs.copyFileSync(row.backup_path, row.file_ref);

package/dist/daemon/effect-pass.js

@@ -0,0 +1,24 @@
+import { runMeasurementPass } from "../detector/measurement.js";
+import { ESF_EFFECT_WRITER_ENABLED } from "../effects/gate.js";
+import { effectEngineForDb } from "../query/api/effect-service.js";
+const INTERVAL_MS = 60 * 60 * 1000;
+const lastPass = new WeakMap();
+/** Probe-clock scheduling; restarting can safely replay the bounded, idempotent engine pass. */
+export function runEffectMeasurementPass(db, now) {
+    if (!ESF_EFFECT_WRITER_ENABLED) {
+        runMeasurementPass(db, now);
+        return;
+    }
+    const previous = lastPass.get(db);
+    const current = now.getTime();
+    if (previous !== undefined && current >= previous && current - previous < INTERVAL_MS)
+        return;
+    lastPass.set(db, current);
+    try {
+        effectEngineForDb(db).runPass(now);
+    }
+    catch {
+        // Never expose source identities or DB contents in a background error.
+        console.warn("Effect measurement pass failed; retrying on the next scheduled pass.");
+    }
+}

package/dist/daemon/http.js

@@ -138,6 +138,16 @@ function requiresSessionToken(pathname) {
         return true;
     if (/^\/api\/recommendations\/jobs\/[^/]+\/(confirm|rollback)$/.test(pathname))
         return true;
+    if (/^\/api\/esf\/effects\/(track|stop|close|rollback|attest-rollback)$/.test(pathname))
+        return true;
+    if (pathname === "/api/work-records" || pathname === "/api/work-records/ids")
+        return true;
+    if (/^\/api\/work-records\/[^/]+\/(edit|closeout|archive|reopen|sessions|contexts|delete)$/.test(pathname))
+        return true;
+    if (/^\/api\/work-records\/[^/]+\/(sessions|contexts)\/[^/]+\/detach$/.test(pathname))
+        return true;
+    if (pathname === "/api/work-records/allocations/recompute")
+        return true;
     return false;
 }
 /**

package/dist/daemon/index.js

@@ -22,7 +22,6 @@ import { openDb } from "../db/open.js";
 import { configGet as bptConfigGet, calibrateBytesPerToken } from "../detector/calibration.js";
 import { runContextProbe } from "../detector/context-probe.js";
 import { runDetectors } from "../detector/index.js";
-import { runMeasurementPass } from "../detector/measurement.js";
 import { installHook, uninstallHook } from "../hook/install.js";
 import { collectSessionChurn } from "../ingest/churn-collector.js";
 import { runPostProbeHook, setPostIngestHook, setPostProbeHook } from "../ingest/detector-hook.js";
@@ -37,7 +36,9 @@ import { generateWeeklyReport } from "../query/api/reports.js";
 import { setQueryDb } from "../query/db-context.js";
 import { getSettingsData, setHealthInstance, setRuntimeResetHook, } from "../query/settings-store.js";
 import { loadConfig } from "./config.js";
+import { runEffectMeasurementPass } from "./effect-pass.js";
 import { createServer } from "./http.js";
+import { createDaemonLifecycle } from "./lifecycle.js";
 import { createOutcomesPassRunner } from "./outcomes-pass.js";
 import { setReady, setScanRoots, setScanState } from "./readiness.js";
 const VERSION = "0.1.0";
@@ -107,6 +108,10 @@ if (isSmoke) {
         "review_findings",
         "recommendations",
         "recommendation_effects",
+        "effect_cycles",
+        "effect_guardrail_results",
+        "effect_rollback_operations",
+        "effect_mutation_keys",
         "apply_jobs",
         "analysis_runs",
         "ingest_quarantine",
@@ -150,18 +155,16 @@ function runProbePass(label) {
         const now = new Date();
         const { rows } = runContextProbe(db, now);
         console.log(`ContextProbe[${label}]: ${rows} row(s) upserted`);
-        // W4: measurement pass after each probe (best-effort; the seam never throws
-        // through, and runMeasurementPass itself is guarded/log-not-throw).
+        // Best-effort measurement after each probe, using the same observation clock.
         runPostProbeHook(db, now);
     }
     catch (e) {
         console.log(`ContextProbe[${label}]: skipped — ${e instanceof Error ? e.message : String(e)}`);
     }
 }
-// Wire the W4 Impact Ledger measurement pass onto the post-probe seam. The pass
-// receives the probe's clock (deterministic; NFR-107), is throttled internally.
+// Versioned measurement owns new cycles; W4 history stays read-only under the code gate.
 setPostProbeHook((probeDb, now) => {
-    runMeasurementPass(probeDb, now);
+    runEffectMeasurementPass(probeDb, now);
 });
 runProbePass("boot");
 // ── Outcomes bootstrap (WP5 — best-effort, never crash daemon) ────────────────
@@ -169,10 +172,6 @@ runProbePass("boot");
 // The runner (src/daemon/outcomes-pass.ts) adds a hard 15-min per-pass deadline:
 // a hung pass can no longer wedge the poll cadence forever — the running flag
 // always clears and the next poll resumes.
-let outcomesTimer = null;
-let reportsTimer = null;
-let reportsRunning = false;
-let bptCalibrationTimer = null;
 const outcomesRunner = createOutcomesPassRunner({
     db,
     probe: () => runProbePass("poll"),
@@ -186,29 +185,31 @@ const outcomesRunner = createOutcomesPassRunner({
 function runOutcomesPass() {
     return outcomesRunner.run();
 }
+// R12 bytes→token calibration — best-effort, never crash the daemon.
+// Runs on boot (deferred) and weekly when: opt-in enabled AND ratio is absent
+// or older than 30 days. Mirrors the outcomes bootstrap pattern.
+const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+function runBptCalibrationIfStale() {
+    const enabled = bptConfigGet(db, "bytes_per_token_calibration_enabled");
+    if (enabled !== "true")
+        return;
+    const measuredAt = bptConfigGet(db, "bytes_per_token_measured_at");
+    if (measuredAt !== null && Date.now() - new Date(measuredAt).getTime() < THIRTY_DAYS_MS)
+        return;
+    calibrateBytesPerToken(db).catch((e) => {
+        console.error(`Bytes-per-token calibration failed (non-fatal): ${e instanceof Error ? e.message : String(e)}`);
+    });
+}
 // ── Deferred boot scan (runs AFTER the HTTP port is bound) ───────────────────
 // startTailBatched() performs a yielding initial back-scan (ingestAllKnown +
 // reconcile), then arms the tail/discovery timers. We do NOT
 // also call runBackscan — that would spin up a second Ingestor whose separate
 // Health instance is the one surfaced in Settings. One Ingestor, one Health.
 // Bounded: if ingestion fails to start, still serve the dashboard (degraded).
-let handle = null;
-// One-shot guard: runBootScan executes exactly once regardless of how many
-// requests or timers fire kickBootScan concurrently.
-let scanKicked = false;
-function kickBootScan() {
-    if (scanKicked)
-        return;
-    scanKicked = true;
-    // Use setImmediate so the triggering HTTP response flushes before boot work
-    // starts. The scan itself also yields between bounded batches.
-    setImmediate(() => {
-        runBootScan().catch((e) => {
-            console.error(`Boot scan failed: ${e instanceof Error ? e.message : String(e)}`);
-        });
-    });
-}
+// The one-shot kick guard, the daemon-owned intervals, and shutdown ordering
+// live in the lifecycle harness (src/daemon/lifecycle.ts).
 async function runBootScan() {
+    let handle = null;
     try {
         const scanRoots = getSettingsData(db).scan_roots;
         setScanRoots(scanRoots);
@@ -261,21 +262,8 @@ async function runBootScan() {
             console.error(`Self-churn collection failed (non-fatal): ${e instanceof Error ? e.message : String(e)}`);
         }
     });
-    // R12 bytes→token calibration — best-effort, never crash the daemon.
-    // Runs on boot (deferred) and weekly when: opt-in enabled AND ratio is absent
-    // or older than 30 days. Mirrors the outcomes bootstrap pattern.
-    const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
-    function runBptCalibrationIfStale() {
-        const enabled = bptConfigGet(db, "bytes_per_token_calibration_enabled");
-        if (enabled !== "true")
-            return;
-        const measuredAt = bptConfigGet(db, "bytes_per_token_measured_at");
-        if (measuredAt !== null && Date.now() - new Date(measuredAt).getTime() < THIRTY_DAYS_MS)
-            return;
-        calibrateBytesPerToken(db).catch((e) => {
-            console.error(`Bytes-per-token calibration failed (non-fatal): ${e instanceof Error ? e.message : String(e)}`);
-        });
-    }
+    // Deferred boot calibration check (the weekly interval is armed by the
+    // lifecycle harness after this scan resolves).
     setImmediate(() => {
         try {
             runBptCalibrationIfStale();
@@ -284,42 +272,31 @@ async function runBootScan() {
             console.error(`Bytes-per-token calibration boot failed (non-fatal): ${e instanceof Error ? e.message : String(e)}`);
         }
     });
-    bptCalibrationTimer = setInterval(() => {
-        try {
-            runBptCalibrationIfStale();
-        }
-        catch (e) {
-            console.error(`Bytes-per-token calibration poll failed (non-fatal): ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }, 7 * 24 * 60 * 60 * 1000);
-    // 10-minute poll — guarded by outcomesRunning to prevent overlap
-    outcomesTimer = setInterval(() => {
+    return handle;
+}
+// ── Lifecycle harness: boot-kick guard, daemon intervals, shutdown ordering ──
+// closeServer closes over `server` (declared below); shutdown only ever runs
+// after listen, so the reference is initialized by then.
+const lifecycle = createDaemonLifecycle({
+    bootScan: runBootScan,
+    calibrationTick: runBptCalibrationIfStale,
+    outcomesTick: () => {
         runOutcomesPass().catch((e) => {
             console.error(`Outcomes poll failed: ${e instanceof Error ? e.message : String(e)}`);
         });
-    }, 10 * 60 * 1000);
-    reportsTimer = setInterval(async () => {
-        if (reportsRunning)
-            return;
-        reportsRunning = true;
-        try {
-            await Promise.resolve(generateWeeklyReport(db, new Date()));
-        }
-        catch (e) {
-            console.error(`Weekly report poll failed: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        finally {
-            reportsRunning = false;
-        }
-    }, 7 * 24 * 60 * 60 * 1000);
-}
+    },
+    reportsTick: () => generateWeeklyReport(db, new Date()),
+    closeServer: (onClosed) => server.close(onClosed),
+    closeDb: () => db.close(),
+    onClosed: () => process.exit(0),
+});
 // ── 4. Start HTTP server ──────────────────────────────────────────────────────
 // Bind the port BEFORE the back-scan so the loading page is delivered
 // immediately while the initial scan yields between file batches.
 // Generate a random in-memory session token for the CSRF token gate.
 // NEVER log it, NEVER persist it — it lives only in process memory.
 const sessionToken = randomUUID();
-const server = createServer(db, config.port, config.uiRoot, sessionToken, kickBootScan);
+const server = createServer(db, config.port, config.uiRoot, sessionToken, lifecycle.kickBootScan);
 server.listen(config.port, "127.0.0.1", () => {
     const url = `http://127.0.0.1:${config.port}`;
     console.log(`Listening on ${url}`);
@@ -332,7 +309,7 @@ server.listen(config.port, "127.0.0.1", () => {
     // Fallback: kick the back-scan after 3 s even if no browser request arrives
     // (headless mode, --no-open, CI). The one-shot guard in kickBootScan() makes
     // whichever trigger fires first the only one that runs the scan.
-    setTimeout(kickBootScan, 3000);
+    lifecycle.armBootFallback();
 });
 /** Open `url` in the system default browser (best-effort; never crashes the daemon). */
 function openBrowser(url) {
@@ -355,24 +332,8 @@ function openBrowser(url) {
 // ── Graceful shutdown ─────────────────────────────────────────────────────────
 process.on("SIGINT", () => {
     console.log("Shutting down…");
-    handle?.stop();
-    if (outcomesTimer !== null)
-        clearInterval(outcomesTimer);
-    if (reportsTimer !== null)
-        clearInterval(reportsTimer);
-    server.close(() => {
-        db.close();
-        process.exit(0);
-    });
+    lifecycle.shutdown();
 });
 process.on("SIGTERM", () => {
-    handle?.stop();
-    if (outcomesTimer !== null)
-        clearInterval(outcomesTimer);
-    if (reportsTimer !== null)
-        clearInterval(reportsTimer);
-    server.close(() => {
-        db.close();
-        process.exit(0);
-    });
+    lifecycle.shutdown();
 });

package/dist/daemon/lifecycle.js

@@ -0,0 +1,122 @@
+/**
+ * src/daemon/lifecycle.ts — daemon timer registration and graceful shutdown.
+ *
+ * Extracted from daemon/index.ts (PERF5) so the boot-kick guard, the three
+ * daemon-owned intervals (calibration / outcomes / weekly reports), and the
+ * shutdown ordering are deterministically unit-testable without booting the
+ * daemon. The signal handlers in index.ts stay thin: both call shutdown().
+ *
+ * Shutdown contract:
+ *   - idempotent — a second signal is a no-op
+ *   - clears the boot-fallback timeout so a shutdown during the 3 s window
+ *     cannot start a scan afterwards
+ *   - a pending boot-kick setImmediate checks the flag and never starts the
+ *     scan after shutdown
+ *   - when shutdown lands while the boot scan is still in flight, the timers
+ *     are never armed and the tail handle is stopped as soon as the scan
+ *     resolves (previously both leaked past db.close())
+ *   - stopping the tail does NOT drain a suspended tail pass; the Ingestor's
+ *     stopped flag makes it quit at the next file boundary (its contract)
+ */
+const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+export function createDaemonLifecycle(deps) {
+    const error = deps.error ?? ((msg) => console.error(msg));
+    const calibrationIntervalMs = deps.calibrationIntervalMs ?? WEEK_MS;
+    const outcomesIntervalMs = deps.outcomesIntervalMs ?? 10 * 60 * 1000;
+    const reportsIntervalMs = deps.reportsIntervalMs ?? WEEK_MS;
+    const bootFallbackMs = deps.bootFallbackMs ?? 3000;
+    let scanKicked = false;
+    let shutDown = false;
+    let handle = null;
+    let calibrationTimer = null;
+    let outcomesTimer = null;
+    let reportsTimer = null;
+    let fallbackTimer = null;
+    let reportsRunning = false;
+    function armTimers() {
+        calibrationTimer = setInterval(() => {
+            try {
+                deps.calibrationTick();
+            }
+            catch (e) {
+                error(`Bytes-per-token calibration poll failed (non-fatal): ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }, calibrationIntervalMs);
+        outcomesTimer = setInterval(() => {
+            try {
+                deps.outcomesTick();
+            }
+            catch (e) {
+                error(`Outcomes poll failed: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }, outcomesIntervalMs);
+        reportsTimer = setInterval(() => {
+            if (reportsRunning)
+                return;
+            reportsRunning = true;
+            Promise.resolve()
+                .then(() => deps.reportsTick())
+                .catch((e) => {
+                error(`Weekly report poll failed: ${e instanceof Error ? e.message : String(e)}`);
+            })
+                .finally(() => {
+                reportsRunning = false;
+            });
+        }, reportsIntervalMs);
+    }
+    function kickBootScan() {
+        if (scanKicked || shutDown)
+            return;
+        scanKicked = true;
+        // setImmediate so the triggering HTTP response flushes before boot work
+        // starts. The scan itself also yields between bounded batches.
+        setImmediate(() => {
+            if (shutDown)
+                return;
+            deps
+                .bootScan()
+                .then((h) => {
+                handle = h;
+                if (shutDown) {
+                    // Shutdown landed mid-scan: never arm timers; stop the tail now.
+                    handle?.stop();
+                    handle = null;
+                    return;
+                }
+                armTimers();
+            })
+                .catch((e) => {
+                error(`Boot scan failed: ${e instanceof Error ? e.message : String(e)}`);
+            });
+        });
+    }
+    function shutdown() {
+        if (shutDown)
+            return;
+        shutDown = true;
+        if (fallbackTimer !== null)
+            clearTimeout(fallbackTimer);
+        handle?.stop();
+        handle = null;
+        if (calibrationTimer !== null)
+            clearInterval(calibrationTimer);
+        if (outcomesTimer !== null)
+            clearInterval(outcomesTimer);
+        if (reportsTimer !== null)
+            clearInterval(reportsTimer);
+        deps.closeServer(() => {
+            deps.closeDb();
+            deps.onClosed?.();
+        });
+    }
+    return {
+        kickBootScan,
+        armBootFallback() {
+            fallbackTimer = setTimeout(kickBootScan, bootFallbackMs);
+        },
+        shutdown,
+        get isShutDown() {
+            return shutDown;
+        },
+    };
+}