chainlesschain 0.163.3 → 0.163.5

package/src/commands/routine.js

@@ -18,6 +18,11 @@ import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import { executionBroker } from "../lib/process-execution-broker/index.js";
+import { openSchedulerStore } from "../lib/scheduler-kernel/store.js";
+import {
+  RoutineSchedulerBridge,
+  routineBridgeRunId,
+} from "../lib/scheduler-kernel/routine-adapter.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
@@ -281,14 +286,24 @@ export function registerRoutineCommand(program) {
     .description("Fire a routine NOW (the webhook/API entry point)")
     .option("--json", "Output as JSON")
     .action(async (id, options) => {
+      let schedulerStore;
       try {
         const store = await loadStore();
         const r = store.get(id);
         if (!r) throw new Error(`routine not found: ${id}`);
-        const { fireRoutine } = await import("../lib/routine-store.js");
-        const runId = await fireRoutine(store, r, defaultRunAgent, {
-          trigger: "manual",
+        schedulerStore = openSchedulerStore();
+        const bridge = new RoutineSchedulerBridge({
+          routineStore: store,
+          schedulerStore,
+          runAgent: defaultRunAgent,
         });
+        const fired = await bridge.trigger(r);
+        const runId = routineBridgeRunId(fired);
+        if (!runId) {
+          throw new Error(
+            `routine occurrence did not execute: ${fired.result?.status || "unknown"}`,
+          );
+        }
         const run = store.listRuns({ routineId: r.id, limit: 1 })[0];
         if (options.json) return console.log(JSON.stringify(run, null, 2));
         logger.success(`Fired ${r.id} → ${runId} (${run?.status})`);
@@ -296,6 +311,8 @@ export function registerRoutineCommand(program) {
       } catch (err) {
         logger.error(err.message);
         process.exitCode = 1;
+      } finally {
+        schedulerStore?.close();
       }
     });
 
@@ -304,17 +321,28 @@ export function registerRoutineCommand(program) {
     .description("Driver: fire due cron/once routines and poll github triggers")
     .option("--json", "Output as JSON")
     .action(async (options) => {
+      let schedulerStore;
       try {
         const store = await loadStore();
-        const { fireRoutine, pollGithubRoutine } =
-          await import("../lib/routine-store.js");
+        const { pollGithubRoutine } = await import("../lib/routine-store.js");
+        schedulerStore = openSchedulerStore();
+        const bridge = new RoutineSchedulerBridge({
+          routineStore: store,
+          schedulerStore,
+          runAgent: defaultRunAgent,
+        });
         const fired = [];
-        for (const r of store.due()) {
+        for (const scheduled of await bridge.runDue()) {
+          const runId = routineBridgeRunId(scheduled);
+          if (!runId) {
+            if (scheduled.result?.status === "busy") continue;
+            throw new Error(
+              `routine occurrence did not execute: ${scheduled.routine} (${scheduled.result?.status || "unknown"})`,
+            );
+          }
           fired.push({
-            routine: r.id,
-            runId: await fireRoutine(store, r, defaultRunAgent, {
-              trigger: r.trigger.kind,
-            }),
+            routine: scheduled.routine,
+            runId,
           });
         }
         for (const r of store.githubRoutines()) {
@@ -334,6 +362,8 @@ export function registerRoutineCommand(program) {
       } catch (err) {
         logger.error(err.message);
         process.exitCode = 1;
+      } finally {
+        schedulerStore?.close();
       }
     });
 

package/src/commands/session-mcp-recovery.js

@@ -46,8 +46,8 @@ export async function requireMcpRecoveryTypedChallenge(
       const { input } = await import("@inquirer/prompts");
       return input({
         message:
-          "First stop every active host for this session. " +
-          `Then type this operator attestation exactly:\n${expected}`,
+          "First stop the prior host, drain every already-dispatched MCP request, and verify its external outcome. Revocation fences future dispatches; it does not cancel a request already sent. " +
+          `Type this authorization exactly:\n${expected}`,
       });
     });
   const answer = await readChallenge(challenge);
@@ -171,7 +171,7 @@ export function registerSessionMcpRecoveryCommands(session, dependencies = {}) {
   recovery
     .command("adjudicate")
     .description(
-      "Attest hosts are stopped, then append one TTY-confirmed recovery decision",
+      "After host stop, MCP drain and outcome verification, revoke authority and record a decision",
     )
     .argument("<id>", "JSONL session ID or prefix")
     .requiredOption("--ledger-id <id>", "Started-only MCP ledger ID")
@@ -203,8 +203,8 @@ export function registerSessionMcpRecoveryCommands(session, dependencies = {}) {
           );
         }
         outputLogger.warn(
-          "Recorded authority is not adopted by any host until restart/resume. " +
-            "Keep every prior host stopped; if one remained active, stop it and inspect the transcript before any MCP call.",
+          "Prior host authority is durably revoked, fencing future MCP dispatches. " +
+            "Revocation does not cancel calls that were already dispatched; retain the stopped/drained/outcome evidence and restart/resume before new MCP calls.",
         );
       } catch (error) {
         outputLogger.error(

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.5",
+      "cliVersions": ["0.163.4", "0.163.5"],
+      "date": "2026-08-11",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.5: durable scheduler runtime and recovery",
+          "body": "> `chainlesschain` **0.163.4 → 0.163.5** (candidate; not yet published,\n> 2026-08-11).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Unified scheduler runtime**: the versioned scheduler store now has a shared\n  runtime with adapter registration, snapshot-bound authorization, durable\n  owner/fence claims, lease renewal, bounded retry, dead-letter settlement,\n  history, and adapter-kind isolation.\n- **Routine scheduling migration**: manual triggers and `routine run` cron/once\n  executions use canonical logical occurrences, revision-CAS job snapshots,\n  deterministic run evidence, dual-driver fencing, and crash recovery that\n  settles terminal evidence without replaying the agent.\n- **Agenda wakeup/cron migration**: production Agenda wakeup and cron entries\n  preserve their full permission/worktree/turn/token/cost/time run policy while\n  executing through the shared kernel. New and legacy drivers coordinate with\n  durable leases; known failures retry, while start-only outcomes fail closed.\n- **Cowork Cron migration**: production `cowork cron run` uses definition-only\n  snapshots, workspace-scoped recovery claims, cross-version JSONL delivery\n  fences, terminal-evidence recovery, and automatic one-second polling for\n  six-field cron expressions.\n- **Durable compaction recovery**: micro-compaction strips transient runtime\n  markers before persistence, records checkpoint state durably, restores it in\n  REPL/agent flows, and preserves trace propagation across Process Broker\n  execution boundaries.\n- **Honest execution boundary**: durable terminal evidence prevents duplicate\n  automatic replay after a scheduler process crash. Start-only evidence or a\n  post-side-effect persistence failure remains outcome-unknown and requires\n  explicit handling; this release does not claim global exactly-once behavior.\n- **Known residuals**: Agenda monitor, Automation, Loop, Routine GitHub,\n  standalone scheduler daemon/liveness, shared permission/budget resolution,\n  IANA timezone/DST/missed-run semantics, migration/rollback, disk-fault and\n  long-soak closure remain outside this release. Signed native distribution and\n  representative alias-removal telemetry also remain open.\n- **Release status**: final tag, source SHA, workflow run IDs, package digest,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.5` merge commit passes Linux, Windows, and macOS `CLI CI` and `CLI\n  Strict Sandbox`, followed by the dedicated npm release and independent public\n  readback workflows."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.4",
+      "cliVersions": ["0.163.3", "0.163.4"],
+      "date": "2026-08-11",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.4: immutable MCP capsules and durable scheduler storage",
+          "body": "> `chainlesschain` **0.163.3 → 0.163.4** (candidate; not yet published,\n> 2026-08-11).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Immutable MCP capsule build inputs**: the capsule builder now executes in a\n  bounded worker against an in-memory WASM virtual filesystem populated from\n  verified bytes. Package sources and native builder assets are canonicalized,\n  identity-bound, and no longer reopened from mutable host paths during the\n  build.\n- **Platform-bound live capsule evidence**: materialized stdio MCP capsules are\n  exercised through the production Process Broker and child contract on Linux,\n  Windows, and macOS. Framed reports, exact asset identity, deferred host-path\n  resolution, and shared CJS/ESM trace context prevent warning or path-alias\n  drift from weakening the evidence chain.\n- **Bounded failure behavior**: worker memory, output, timeout, and cleanup are\n  bounded; partial or malformed child evidence, post-verification replacement,\n  unapproved effects, and unsupported strict boundaries fail closed.\n- **Command lifecycle evidence and alias decision**: report v2 binds exact\n  coverage, approval, scope, and repository evidence and summarizes command\n  telemetry without silently accepting zero-data input. All 25 deprecated\n  aliases remain retained until representative opt-in telemetry exists and the\n  documented `0.164.0` removal floor is reached.\n- **Scheduler kernel storage foundation**: a versioned SQLite store adds strict\n  schema verification, expected-revision CAS, logical-occurrence deduplication,\n  durable claims, and two-handle race coverage. This is the first P2-4 storage\n  milestone, not completion of the scheduling kernel or orchestration runtime.\n- **Delivery and recovery hardening**: production delivery adapters, durable\n  provider-backed compaction, MCP recovery admission, session ownership fences,\n  and exact Windows write checks close additional internal consistency gaps.\n- **Native release readback hardening**: release evidence now verifies public\n  bytes, checksums, manifests, signatures, and provenance contracts more\n  strictly. Signed native distribution is still blocked until real signed\n  artifacts and public package-manager readback are available.\n- **Known residuals**: full P2-4 scheduling orchestration, signed native\n  distribution, representative alias telemetry, and the remaining documented\n  long-soak/host-boundary follow-ups are not claimed by this release.\n- **Release status**: final tag, exact source SHA, workflow run IDs, package\n  digest, provenance, and public registry readback are intentionally omitted\n  until the exact `0.163.4` release commit passes the Linux, Windows, and macOS\n  `CLI CI` and `CLI Strict Sandbox` gates and the npm release/readback workflows\n  complete successfully."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.3",
@@ -10,7 +36,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.3: isolated background agents and policy-bound runtimes",
-          "body": "> `chainlesschain` **0.163.2 → 0.163.3** (candidate; not yet published,\n> 2026-08-10).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Git background isolation by default**: `cc agent --bg` runs started from a\n  clean Git checkout and not using `--input-format stream-json` now create a\n  worktree at committed `HEAD`; `--worktree` requests the same path and only\n  `--no-worktree` opts into the shared checkout. Foreground runs, runs using\n  `--input-format stream-json`, and non-Git runs retain their prior behavior,\n  while a dirty Git source is rejected instead of silently omitting uncommitted\n  changes.\n- **Generation- and token-fenced ownership**: locked atomic state, immutable\n  worktree/profile identity, worker-generation claims, terminal-absorbing\n  updates, durable turn intents, and stop/cleanup fences prevent stale\n  cooperative workers from reviving or deleting live work. Versioned,\n  secret-free launch profiles preserve compatible resume settings.\n- **Grammar-safe detached arguments**: new background launches preserve option\n  values and `--` literals, pass prompts as one `--print=<text>` token,\n  canonicalize resume/continue/fork to one session, and remap repository\n  `--add-dir` roots into the worktree. Canonical external roots remain shared\n  and produce a warning.\n- **Policy-bearing stdio MCP sources**: explicit `--mcp-config`, managed and\n  registered local/project/user sources, trusted project configuration, Skill,\n  and Cowork definitions propagate normalized `filesystem`/`network`\n  requirements plus separately validated working-directory/workspace authority\n  to the Process Broker. Unprovable requirements fail closed, and invalid named\n  higher-precedence entries do not fall through to a weaker source.\n- **Sealed Linux plugin file sets**: strict direct Plugin Node and supported\n  narrow native ELF launches snapshot every pinned regular plugin file into\n  sealed anonymous data-bind mounts. Dynamic native evidence covers only\n  `PT_INTERP` and direct `DT_NEEDED`; tree attestation remains per-file rather\n  than one atomic filesystem snapshot.\n- **Contained Windows adapter artifacts**: helper, cache, and test artifacts use\n  an attested non-reparse local temporary root, identity/content rechecks,\n  randomized materialization, and bounded retirement. Unknown or unverifiable\n  leftovers are preserved and make cleanup fail closed.\n- **Fail-closed CI routing**: the generic selector routes the defined Windows\n  helper-support paths to their CLI contract tests, supports multi-suite\n  execution, and cannot turn selected-test or primary-run failure into a\n  fallback/diagnostic pass. Full-suite workflows provision their required\n  dependencies explicitly; this routing does not replace the exact-SHA release\n  matrices.\n- **Known residuals**: non-Git, `--input-format stream-json`, `--no-worktree`,\n  and external `add-dir` roots are not worktree-isolated. Spawn-to-PID\n  hard-crash recovery and long-soak closure remain open; Linux native\n  dependency evidence is non-transitive and has no `dlopen` closure; Windows\n  path operations are\n  re-attested but not handle-atomic. macOS atomic runtime execution, arbitrary\n  shared-library closure, remote revocation, signed native distribution, and\n  alias telemetry/removal remain out of scope, so this release does not claim\n  complete P1-2 closure.\n- **Release status**: final tag, exact source SHA, workflow run IDs, package\n  digest, provenance, and public registry readback are intentionally omitted\n  until the exact `0.163.3` release commit passes the required Linux, Windows,\n  and macOS `CLI CI` and `CLI Strict Sandbox` gates and the npm release/readback\n  workflows complete successfully."
+          "body": "> `chainlesschain` **0.163.2 → 0.163.3** (published from exact SHA\n> `17fcf6aa7917dd0fcc83b3ab5204c196bbb81758`, 2026-08-10).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Git background isolation by default**: `cc agent --bg` runs started from a\n  clean Git checkout and not using `--input-format stream-json` now create a\n  worktree at committed `HEAD`; `--worktree` requests the same path and only\n  `--no-worktree` opts into the shared checkout. Foreground runs, runs using\n  `--input-format stream-json`, and non-Git runs retain their prior behavior,\n  while a dirty Git source is rejected instead of silently omitting uncommitted\n  changes.\n- **Generation- and token-fenced ownership**: locked atomic state, immutable\n  worktree/profile identity, worker-generation claims, terminal-absorbing\n  updates, durable turn intents, and stop/cleanup fences prevent stale\n  cooperative workers from reviving or deleting live work. Versioned,\n  secret-free launch profiles preserve compatible resume settings.\n- **Grammar-safe detached arguments**: new background launches preserve option\n  values and `--` literals, pass prompts as one `--print=<text>` token,\n  canonicalize resume/continue/fork to one session, and remap repository\n  `--add-dir` roots into the worktree. Canonical external roots remain shared\n  and produce a warning.\n- **Policy-bearing stdio MCP sources**: explicit `--mcp-config`, managed and\n  registered local/project/user sources, trusted project configuration, Skill,\n  and Cowork definitions propagate normalized `filesystem`/`network`\n  requirements plus separately validated working-directory/workspace authority\n  to the Process Broker. Unprovable requirements fail closed, and invalid named\n  higher-precedence entries do not fall through to a weaker source.\n- **Sealed Linux plugin file sets**: strict direct Plugin Node and supported\n  narrow native ELF launches snapshot every pinned regular plugin file into\n  sealed anonymous data-bind mounts. Dynamic native evidence covers only\n  `PT_INTERP` and direct `DT_NEEDED`; tree attestation remains per-file rather\n  than one atomic filesystem snapshot.\n- **Contained Windows adapter artifacts**: helper, cache, and test artifacts use\n  an attested non-reparse local temporary root, identity/content rechecks,\n  randomized materialization, and bounded retirement. Unknown or unverifiable\n  leftovers are preserved and make cleanup fail closed.\n- **Fail-closed CI routing**: the generic selector routes the defined Windows\n  helper-support paths to their CLI contract tests, supports multi-suite\n  execution, and cannot turn selected-test or primary-run failure into a\n  fallback/diagnostic pass. Full-suite workflows provision their required\n  dependencies explicitly; this routing does not replace the exact-SHA release\n  matrices.\n- **Known residuals**: non-Git, `--input-format stream-json`, `--no-worktree`,\n  and external `add-dir` roots are not worktree-isolated. Spawn-to-PID\n  hard-crash recovery and long-soak closure remain open; Linux native\n  dependency evidence is non-transitive and has no `dlopen` closure; Windows\n  path operations are\n  re-attested but not handle-atomic. macOS atomic runtime execution, arbitrary\n  shared-library closure, remote revocation, signed native distribution, and\n  alias telemetry/removal remain out of scope, so this release does not claim\n  complete P1-2 closure.\n- **Published release evidence**: immutable tag `v-npm-0-163-3` resolves to\n  exact source commit `17fcf6aa7917dd0fcc83b3ab5204c196bbb81758`.\n  Its Linux, Windows, and macOS `CLI CI` (`31329476135`) and `CLI Strict\nSandbox` (`31329476020`) matrices passed; the formal two-hour\n  reliability/malicious-MCP soak (`31329539092`) completed 7/7 jobs with 300\n  host cycles, 900 unapproved effects, 100 Linux races, 100 macOS fail-closed\n  probes, and zero escapes. The npm release (`31335579227`) and independent\n  public readback (`31336362525`) completed the exact-SHA gate, immutable\n  tarball/CycloneDX SBOM, Trusted Publishing, SLSA/Sigstore provenance,\n  registry byte comparison, and npmmirror synchronization. The public tarball\n  SHA-256 is\n  `68396c418029fc314403c9882c92fb9bef5ec6e9a61bb186333209884d410a92`."
         }
       ]
     },