chainlesschain 0.163.6 → 0.163.7

package/src/commands/session.js

@@ -65,6 +65,7 @@ import {
 import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
 import { registerSessionShowSubcommand } from "./session-show.js";
+import { registerSessionObservabilitySubcommand } from "./session-observability.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -1839,6 +1840,43 @@ export function registerSessionCommand(program) {
       }
     });
 
+  registerSessionObservabilitySubcommand(session);
+
+  session
+    .command("observability-authority <id>")
+    .description(
+      "Print the verified headHash/eventCount/scope binding for a delivery flow",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action(async (id) => {
+      try {
+        const { getVerifiedSessionObservabilityAuthority } =
+          await import("../harness/jsonl-session-store.js");
+        const authority = getVerifiedSessionObservabilityAuthority(id);
+        console.log(
+          JSON.stringify(
+            {
+              causality: {
+                scope: authority.observabilityScope,
+                sessions: [
+                  {
+                    sessionId: authority.sessionId,
+                    headHash: authority.headHash,
+                    eventCount: authority.eventCount,
+                  },
+                ],
+              },
+            },
+            null,
+            2,
+          ),
+        );
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
   // session workflow — inspect canonical coding workflow state
   // Reads .chainlesschain/sessions/<id>/{intent.md,plan.md,progress.log,mode.json}
   // written by the 4 workflow skills ($deep-interview/$ralplan/$ralph/$team).

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.7",
+      "cliVersions": ["0.163.6", "0.163.7"],
+      "date": "2026-08-14",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.7: governed scheduler migration and causal observability",
+          "body": "> `chainlesschain` **0.163.6 → 0.163.7** (candidate; not yet published,\n> 2026-08-14).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Five-domain migration journal**: Agenda, Cowork Cron, Routine, Automation,\n  and Loop migrations use the scheduler store schema-v5 journal with\n  domain-typed source locators, immutable source/target digest bindings,\n  idempotent recovery, and fail-closed rejection of conflicting or ambiguous\n  legacy entries.\n- **Governed rollback controls**: the new scheduler migration `list`, `show`,\n  and `rollback` commands expose redacted migration status and blockers.\n  Rollback requires the latest evidence digest, an interactive TTY, and the\n  exact typed challenge before reopening any legacy source.\n- **Target-first recovery and CAS fencing**: rollback stops or restores the\n  scheduler target before restoring the legacy source, validates target\n  revision, definition and execution evidence, and makes terminal source\n  restoration retry-safe across process crashes. This is not a claim of one\n  atomic transaction across independent stores or filesystems.\n- **Fail-closed source identity**: Windows drive and UNC paths are canonicalized\n  while relative, incomplete and device-namespace paths are rejected.\n  Automation migration requires an existing native SQLite database and refuses\n  the non-durable sql.js fallback; Loop restoration remains bound to its durable\n  retirement fence, marker and original source digest.\n- **Windows persistence hardening**: team adjudication atomic replacement\n  retries only transient Windows `EACCES`, `EBUSY`, and `EPERM` sharing\n  failures with bounded backoff and authority-path revalidation. Exhausted,\n  non-transient, and non-Windows replacement failures continue to fail closed.\n- **Cross-platform CI hardening**: migration fixtures verify retirement fences\n  and canonical source identities consistently across operating systems, while\n  distributed-queue and authority test workers use bounded lifetimes and attach\n  result observers before short-lived children can exit. Terminal Skill\n  authority fixtures now use an explicit parent acknowledgement before clean\n  exit, removing Windows IPC exit-before-message ordering ambiguity without\n  weakening concurrent revocation assertions.\n- **Verified causal delivery reports**: scoped sessions can be bound by exact\n  transcript head and event count to digest-protected delivery states. The new\n  session observability commands export a redacted session-to-delivery graph\n  spanning diffs, gates, artifacts, pull requests, and merges, with exact\n  workspace, team, and policy filters.\n- **Fail-closed call-ledger budgets**: `call-ledger@1` brackets model, retry,\n  compaction, subagent, isolated-skill, and tool calls with known or unknown\n  settlements. Strict budget mode rejects exceeded and unevaluable results\n  instead of treating missing token, cost, retry, or tool-latency evidence as\n  zero.\n- **Background recovery authority hardening**: verified transcript CAS,\n  delegated recovery leases, IPC sender/nonce binding, bootstrap guards, exact\n  process-group termination checks, and terminal cleanup prevent uncertain or\n  still-live descendants from authorizing recovery or worktree deletion.\n- **Causal evidence boundary**: report bindings prove exact verified revisions,\n  not that a model call semantically caused a source hunk. Scope labels are not\n  identity or membership proofs, digests are not signatures, anti-rollback is\n  machine-local, and incomplete or legacy ledgers remain partial or unknown.\n- **Known residuals**: scheduler ENOSPC/partial-write/fsync/rename/SQLite fault\n  closure and the Linux, Windows, and macOS long-soak matrix remain open.\n  Signed native distribution and representative alias-removal telemetry also\n  remain outside this candidate.\n- **Release status**: final tag, source SHA, workflow run IDs, package digest,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.7` release merge commit passes both required workflow matrices on\n  Linux, Windows, and macOS, followed by the dedicated npm release and\n  independent public readback workflows."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.6",
@@ -10,7 +23,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.6: unified scheduler authority and automation control",
-          "body": "> `chainlesschain` **0.163.5 → 0.163.6** (candidate; not yet published,\n> 2026-08-12).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Complete scheduler adapter migration**: Agenda monitors, Loop iterations,\n  Automation cron flows, Routine GitHub polling, channel automation events,\n  and the standalone daemon now execute through the shared scheduler service\n  with durable claims, definition snapshots, recovery fences, and bounded\n  retry/dead-letter behavior.\n- **Timezone and missed-run consistency**: Agenda and Cowork cron definitions\n  persist canonical IANA timezones, handle DST gaps and repeated civil times,\n  and collapse downtime to one latest due occurrence without replay storms.\n- **Shared scheduler permission and budget authority**: Agenda, Routine,\n  Cowork, Automation, and Loop bind exact capability policies to durable\n  revisions and use one transactional reservation/settlement path. Missing,\n  stale, disabled, exhausted, or inconsistent policy state fails closed;\n  retries reuse the original reservation instead of charging twice.\n- **Layered Automation enforcement**: the shared scheduler authority composes\n  with Automation's creator identity, connector permissions, live revocation,\n  and per-flow run/action budgets. Domain evidence and the scheduler policy\n  revision remain independently validated.\n- **Governed management surfaces**: scheduler policy inspection/update commands\n  require exact capabilities and revision CAS, while the Automation Center\n  exposes governed flow and Routine controls without bypassing backend\n  permission or budget checks.\n- **Known residuals**: durable outcome-unknown adjudication, complete mixed-\n  version migration/rollback, scheduler disk-fault closure, and the three-OS\n  long-soak matrix remain open. Signed native distribution and representative\n  alias-removal telemetry also remain outside this release.\n- **Release status**: final tag, source SHA, workflow run IDs, package digest,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.6` release commit passes the complete `CLI CI` and `CLI Strict Sandbox`\n  Linux, Windows, and macOS matrices, followed by the dedicated npm release and\n  independent public readback workflows."
+          "body": "> `chainlesschain` **0.163.5 → 0.163.6** (published from exact SHA\n> `85c3577c887003fea98d0a159603cd359506f09b`, 2026-08-12).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Complete scheduler adapter migration**: Agenda monitors, Loop iterations,\n  Automation cron flows, Routine GitHub polling, channel automation events,\n  and the standalone daemon now execute through the shared scheduler service\n  with durable claims, definition snapshots, recovery fences, and bounded\n  retry/dead-letter behavior.\n- **Timezone and missed-run consistency**: Agenda and Cowork cron definitions\n  persist canonical IANA timezones, handle DST gaps and repeated civil times,\n  and collapse downtime to one latest due occurrence without replay storms.\n- **Shared scheduler permission and budget authority**: Agenda, Routine,\n  Cowork, Automation, and Loop bind exact capability policies to durable\n  revisions and use one transactional reservation/settlement path. Missing,\n  stale, disabled, exhausted, or inconsistent policy state fails closed;\n  retries reuse the original reservation instead of charging twice.\n- **Layered Automation enforcement**: the shared scheduler authority composes\n  with Automation's creator identity, connector permissions, live revocation,\n  and per-flow run/action budgets. Domain evidence and the scheduler policy\n  revision remain independently validated.\n- **Governed management surfaces**: scheduler policy inspection/update commands\n  require exact capabilities and revision CAS, while the Automation Center\n  exposes governed flow and Routine controls without bypassing backend\n  permission or budget checks.\n- **Known residuals**: durable outcome-unknown adjudication, complete mixed-\n  version migration/rollback, scheduler disk-fault closure, and the three-OS\n  long-soak matrix remain open. Signed native distribution and representative\n  alias-removal telemetry also remain outside this release.\n- **Published release evidence**: immutable tag `v-npm-0-163-6` resolves to\n  exact source commit `85c3577c887003fea98d0a159603cd359506f09b`. Its Linux,\n  Windows, and macOS `CLI CI` (`31595865423`) and `CLI Strict Sandbox`\n  (`31595865206`) matrices passed; the dedicated npm release (`31595865181`)\n  completed its exact-SHA gate, immutable package, Trusted Publishing, and\n  signed provenance, and the independent public readback (`31597577056`)\n  succeeded. npm reports `latest=0.163.6`; the public tarball SHA-1 is\n  `18bb9d807a4a35a36cf9049dcc15f67eb47bbfa6`."
         }
       ]
     },