claude-code-session-manager 0.97.0 → 0.100.0

package/src/main/lib/promptSessionSchema.cjs

@@ -14,7 +14,7 @@
 'use strict';
 
 const { z } = require('zod');
-const { WorkTypeSchema } = require('./workTypeLibrary.cjs');
+const { WorkTypeSchema, LEGACY_WORK_TYPES } = require('./workTypeLibrary.cjs');
 
 // Mirrors EpicTag (src/renderer/lib/tagLibrary.ts:10) — the Epic-level
 // mission tag. Epic tag and PRD tag (ipcSchemas.cjs's scheduleRetagPrd `tag`
@@ -23,6 +23,14 @@ const { WorkTypeSchema } = require('./workTypeLibrary.cjs');
 // own enum literal.
 const EpicTagSchema = WorkTypeSchema;
 
+// A legacy tag value (e.g. the retired 'bilko-host-publisher') must keep
+// loading on an old on-disk Epic — dropped silently (treated as absent),
+// never thrown. Any other unknown value still fails via EpicTagSchema.
+const LegacyAwareEpicTagSchema = z.preprocess(
+  (v) => (typeof v === 'string' && LEGACY_WORK_TYPES.includes(v) ? undefined : v),
+  EpicTagSchema.optional(),
+);
+
 // Mirrors EpicSource (src/renderer/state/promptSessions.ts:22-27).
 const EpicSourceSchema = z.object({
   producer: z.enum(['new-epic-ui', 'scheduler-dispatch', 'cross-project-feedback']),
@@ -69,7 +77,7 @@ const PromptSessionSchema = z.object({
   createdAt: z.string(),
   completedAt: z.string().nullable(),
   resumedFromId: z.string().nullable().optional(),
-  tag: EpicTagSchema.optional(),
+  tag: LegacyAwareEpicTagSchema,
   openingPrompt: z.string().nullable().optional(),
   source: EpicSourceSchema.optional(),
   agentType: z.string().optional(),

package/src/main/lib/rcaReport.cjs

@@ -35,6 +35,7 @@ const path = require('node:path');
 const { splitFrontmatter } = require('./prdFrontmatter.cjs');
 const { readTail } = require('./fileTail.cjs');
 const { resolvePrdWriteDir } = require('./prdLocations.cjs');
+const atomicFs = require('./atomicFs.cjs');
 
 // ─── VERDICT_LABELS — deliberate duplicate ──────────────────────────────────
 // Mirrors src/renderer/components/tabs/scheduler/sched-primitives.tsx:123-131.
@@ -396,15 +397,12 @@ async function writeRcaReport({ job, runDir, verdict, annotations, investigation
       job, verdict, meta, logTail, acText, failureClass, investigationText, annotations,
     });
 
-    // Raw fs (not config.cjs's writeTextAtomic) for the same reason the rest
-    // of this lib uses it: the run directory lives under
+    // atomicFs.cjs (not config.cjs's writeTextAtomic) for the same reason the
+    // rest of this lib uses it: the run directory lives under
     // ~/.claude/session-manager/scheduled-plans/runs/, which is Session-Manager
     // runtime state, not an OWNERS namespace under a project's operations root.
     const reportPath = path.join(runDir, `root-cause-${job.slug}.md`);
-    fs.mkdirSync(runDir, { recursive: true });
-    const tmp = `${reportPath}.tmp-${process.pid}`;
-    fs.writeFileSync(tmp, markdown);
-    fs.renameSync(tmp, reportPath);
+    atomicFs.writeTextAtomicSync(reportPath, markdown);
 
     const summary = rcaSummaryLine(job, verdict);
     const recoveryAction = recoveryActionFor(failureClass);

package/src/main/lib/reaperHelpers.cjs

@@ -11,6 +11,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { readTail } = require('./fileTail.cjs');
 const { detectRateLimitInLog } = require('./rateLimitDetect.cjs');
+const { pidAlive } = require('./pidAlive.cjs');
 
 /**
  * Return true if pid is alive AND its cmdline looks like a claude process.
@@ -20,12 +21,18 @@ const { detectRateLimitInLog } = require('./rateLimitDetect.cjs');
  * cmdline, so we conservatively return true — never false-reap a live PID
  * just because we can't verify its identity.
  *
+ * Existence check now delegates to the shared pidAlive() (pidAlive.cjs) so
+ * EPERM (pid exists, owned by another user) counts as alive here too — the
+ * previous bare `process.kill(pid, 0)` + catch-all-false treated EPERM the
+ * same as ESRCH (no such process), silently false-reaping a live-but-
+ * unsignalable pid.
+ *
  * Conservative by design: a false negative (live process treated as dead) is
  * far worse than a late reap.
  */
 function claudePidAlive(pid) {
   if (!pid || typeof pid !== 'number' || pid <= 1) return false;
-  try { process.kill(pid, 0); } catch { return false; }
+  if (!pidAlive(pid)) return false;
   try {
     const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
     return /\bclaude\b/.test(cmd);

package/src/main/lib/reservationExpiry.cjs

@@ -9,10 +9,15 @@
  */
 'use strict';
 
+const { pidAlive } = require('./pidAlive.cjs');
+
 const DEFAULT_GRACE_MS = 10 * 60 * 1000;
 
+// Thin alias over pidAlive.cjs's shared pidAlive() — kept as its own named
+// export (rather than inlining the require at every call site) so existing
+// imports of `defaultPidAlive` from this module keep working unchanged.
 function defaultPidAlive(pid) {
-  try { process.kill(pid, 0); return true; } catch (e) { return e?.code === 'EPERM'; }
+  return pidAlive(pid);
 }
 
 /**

package/src/main/lib/reviewNotice.cjs

@@ -0,0 +1,263 @@
+'use strict';
+
+/**
+ * reviewNotice.cjs — pure helpers behind the quiet, grouped needs_review
+ * notice (this PRD).
+ *
+ * Before this module, a park into `needs_review` told the authoring Epic
+ * immediately (scheduler.cjs's notifyNeedsReview), BEFORE the scheduler's own
+ * recovery ladder (mechanical re-integration, resume, quarantine, auto-fix,
+ * gate re-run, bounded auto-resolve) ever got a chance to run. Most parks
+ * heal on their own, so that immediate message was usually a false alarm.
+ *
+ * The new rule: record a notice at park time (buildReviewNotice) and send
+ * nothing yet. Send ONE message, grouped by (cwd, Epic, cause), only once the
+ * ladder gives up on a row (an auto-resolve skip) or the row has sat
+ * `needs_review` past a hold window (selectDueReviewNotices + holdMsFromEnv).
+ * scheduler.cjs's flushDueReviewNotices is the only caller that actually
+ * sends — this module stays fs/network-free so it is unit-testable without
+ * touching queue.json or the Epic event store.
+ *
+ * Each park is one episode with one hold clock. scheduler.cjs's
+ * resetJobFields deletes `job.reviewNotice` outright, so a human reset always
+ * starts the next park's clock fresh — it never inherits a stale
+ * `firstParkedAt` from days earlier. A rung-6 ladder requeue goes through
+ * `transitionJob` directly, not `resetJobFields`, so that requeue keeps the
+ * same clock on purpose (it is still the same unresolved episode).
+ *
+ * The sent message also says plainly whether the group still blocks other
+ * work: formatReviewNotice names any `pending` row whose `dependsOn` names a
+ * still-`needs_review` row in the group, instead of always claiming nothing
+ * is waiting. And a row that is not yet due on its own only joins a due
+ * group — "sweeps in" — once it has sat for SWEEP_MIN_AGE_MINUTES, so a row
+ * that parked seconds ago is never announced before the ladder's early rungs
+ * get a chance to run.
+ */
+
+// Default hold before an un-resolved needs_review park gets its own grouped
+// notice, in minutes. Overridable via SM_REVIEW_NOTICE_HOLD_MINUTES.
+const DEFAULT_HOLD_MINUTES = 240;
+
+// Same dependsOn slug-matching rule schedulerBatch.cjs's findBlockingDep uses
+// at run time (exact slug first, else bare-name after stripping one leading
+// `NN-`) — reused here, not reimplemented, so formatReviewNotice's "blocks"
+// wording can never disagree with what actually holds a dependent `pending`
+// row in the real queue.
+const { bareSlug } = require('./depSlugResolve.cjs');
+
+/**
+ * buildReviewNotice({ job, report, epicId, now, prior }) → ReviewNotice
+ *
+ * Stamped onto a job row (`job.reviewNotice`) the moment it parks
+ * `needs_review`, in the SAME mutate that classifies the RCA report
+ * (scheduler.cjs's park path). `report` is rcaReport.cjs's writeRcaReport()
+ * result — `null`, or `{ filed: false, ... }` when the report was skipped
+ * (SM_RCA_DISABLE, no verdict, etc.) — in which case a deterministic fallback
+ * summary stands in for the one the RCA report would have carried.
+ *
+ * `firstParkedAt` is the anchor selectDueReviewNotices measures the hold
+ * window from. It is carried forward from `prior` (the job's existing
+ * reviewNotice, if any) as long as that prior notice is still unsent — a
+ * re-park of the SAME unresolved episode (e.g. one more ladder attempt that
+ * also fails) must not restart the hold clock. Once a notice has been sent,
+ * a later park starts a fresh clock — and so does a later park after a human
+ * reset, because resetJobFields deletes the notice outright, so `prior` is
+ * `undefined` and this falls to the same `now` default.
+ */
+function buildReviewNotice({ job, report, epicId, now, prior } = {}) {
+  const cause = `${job?.verifierVerdict || 'unknown'}${job?.integrationFailureKind ? `:${job.integrationFailureKind}` : ''}`;
+  const filed = Boolean(report && report.filed);
+  const summary = filed ? report.summary : `${job?.slug ?? 'unknown job'} stopped (${cause})`;
+  const reportPath = filed ? (report.path ?? null) : null;
+  const firstParkedAt = prior && !prior.sentAt && prior.firstParkedAt ? prior.firstParkedAt : now;
+  return {
+    summary,
+    reportPath,
+    cause,
+    epicId: epicId ?? null,
+    firstParkedAt,
+    sentAt: null,
+  };
+}
+
+// A not-yet-due row only joins a due group ("sweeps in") once it has sat
+// `needs_review` for at least this long. Why: the self-heal ladder
+// (scheduler-operations.md §4) needs about 30 minutes to work through its
+// early rungs, so sweeping in a row seconds after it parked would announce
+// it before the ladder ever got a chance to self-heal it. A row that is due
+// ON ITS OWN (its own hold expired, or a skipped auto-resolve) is never held
+// back by this rule — see isDue below.
+const SWEEP_MIN_AGE_MINUTES = 30;
+
+// Milliseconds since reviewNotice.firstParkedAt, or 0 for a missing/
+// unparsable timestamp (fail young — never treat a bad timestamp as old
+// enough to sweep in early).
+function parkedAgeMs(j, now) {
+  const firstParkedAt = j.reviewNotice && j.reviewNotice.firstParkedAt;
+  if (!firstParkedAt) return 0;
+  const parkedMs = Date.parse(firstParkedAt);
+  return Number.isFinite(parkedMs) ? now - parkedMs : 0;
+}
+
+/**
+ * selectDueReviewNotices(jobs, { now, holdMs }) → [{ cwd, epicId, cause, jobs }]
+ *
+ * A row is a candidate when it carries an unsent `reviewNotice` and is
+ * either `skipped` with `needsReviewAutoResolvedSkip` (the ladder gave up),
+ * or still `needs_review` with its notice's `firstParkedAt` at least
+ * `holdMs` in the past. completed/pending/running rows, and rows whose
+ * notice is already sent, are never candidates.
+ *
+ * Grouping key is (cwd, reviewNotice.epicId, reviewNotice.cause) — one
+ * message per distinct cause per Epic, not one per PRD. Once any row in a
+ * key is due, every other unsent candidate sharing that same key is swept
+ * into the SAME group even if it individually hasn't reached its own due
+ * condition yet, so a cause that affects several PRDs is reported once —
+ * except a swept-in `needs_review` row must itself be at least
+ * SWEEP_MIN_AGE_MINUTES old (parkedAgeMs); a row due on its own skips that
+ * check entirely.
+ */
+function selectDueReviewNotices(jobs = [], { now = Date.now(), holdMs = DEFAULT_HOLD_MINUTES * 60000 } = {}) {
+  const isCandidate = (j) => Boolean(
+    j
+    && j.reviewNotice
+    && !j.reviewNotice.sentAt
+    && (j.status === 'needs_review' || (j.status === 'skipped' && j.needsReviewAutoResolvedSkip)),
+  );
+  const isDue = (j) => {
+    if (j.status === 'skipped' && j.needsReviewAutoResolvedSkip) return true;
+    if (j.status !== 'needs_review') return false;
+    const firstParkedAt = j.reviewNotice.firstParkedAt;
+    if (!firstParkedAt) return false;
+    const parkedMs = Date.parse(firstParkedAt);
+    if (!Number.isFinite(parkedMs)) return false;
+    return now - parkedMs >= holdMs;
+  };
+  const keyOf = (j) => `${j.cwd ?? ''}\u0000${j.reviewNotice.epicId ?? ''}\u0000${j.reviewNotice.cause ?? ''}`;
+
+  const list = Array.isArray(jobs) ? jobs : [];
+  const dueKeys = new Set();
+  for (const j of list) {
+    if (isCandidate(j) && isDue(j)) dueKeys.add(keyOf(j));
+  }
+  if (dueKeys.size === 0) return [];
+
+  const sweepMinAgeMs = SWEEP_MIN_AGE_MINUTES * 60000;
+  const groupsByKey = new Map();
+  for (const j of list) {
+    if (!isCandidate(j)) continue;
+    const key = keyOf(j);
+    if (!dueKeys.has(key)) continue;
+    // Not due on its own, and too young to sweep in — leave it for a later
+    // pass, once either its own hold expires or it ages past the sweep gate.
+    if (!isDue(j) && parkedAgeMs(j, now) < sweepMinAgeMs) continue;
+    if (!groupsByKey.has(key)) {
+      groupsByKey.set(key, { cwd: j.cwd ?? null, epicId: j.reviewNotice.epicId ?? null, cause: j.reviewNotice.cause ?? null, jobs: [] });
+    }
+    groupsByKey.get(key).jobs.push(j);
+  }
+  return Array.from(groupsByKey.values());
+}
+
+// Plain-language stand-in for the raw verifier/integration cause string.
+// Only causes worth explaining in human terms get an entry — formatReviewNotice
+// falls back to the raw cause for anything not listed here.
+const HUMAN_CAUSE = {
+  'worktree_integration_failed:stray_checkout': 'the main checkout was on a different branch, so the work could not be merged',
+  transcript_errors: "the run's transcript showed error lines, so its pass could not be trusted",
+  no_verdict_sentinel: 'the run finished without leaving a clear pass or fail signal',
+  abandoned_background_task: 'the run started a background task and then stopped watching it',
+  silent_no_op: 'the run finished clean but made no changes, so there is no evidence it did the work',
+  pass_no_commit: 'the run reported success but did not commit anything',
+};
+
+function humanCauseFor(cause) {
+  return HUMAN_CAUSE[cause] ?? cause;
+}
+
+// One phrase per ladder rung, in the fixed order the ladder itself runs
+// (scheduler-operations.md §4). Checked across every row in the group — the
+// summary is the union of what was tried for ANY of the grouped PRDs, not
+// just one.
+function ladderSummaryFor(jobs) {
+  const some = (pred) => jobs.some(pred);
+  const phrases = [];
+  if (some((j) => j.mechanicalRecoveryAttempted)) phrases.push('re-merged the branch');
+  if (some((j) => j.resumeRecoveryAttempted)) phrases.push('resumed the session');
+  if (some((j) => (j.quarantineResolveAttempts ?? 0) > 0)) phrases.push('set aside stray files');
+  if (some((j) => j.autoFixAttempted)) phrases.push('ran an auto-fix job');
+  if (some((j) => j.gateShadow)) phrases.push('re-ran the gate');
+  if (some((j) => (j.exhaustedResolveAttempts ?? 0) > 0)) phrases.push('re-queued the job');
+  if (some((j) => j.needsReviewAutoResolvedSkip)) phrases.push('gave up and skipped the job');
+  return phrases.length ? phrases.join(', ') : 'nothing yet';
+}
+
+// The pending rows (from the FULL job list, not just this group) that a
+// still-`needs_review` row in the group blocks. A dep slug "names" a group
+// row when it matches that row's slug exactly, or by bare name (same rule as
+// findBlockingDep). Only rows in the group's own cwd are considered — a
+// dependsOn chain never crosses projects. Returns a sorted, de-duplicated
+// list of the blocked rows' slugs.
+function blockedDependents(group, jobs) {
+  const blockingSlugs = (group.jobs ?? [])
+    .filter((j) => j.status === 'needs_review')
+    .map((j) => j.slug)
+    .filter(Boolean);
+  if (!blockingSlugs.length) return [];
+  const namesABlockingSlug = (depSlug) => blockingSlugs.some(
+    (slug) => depSlug === slug || bareSlug(depSlug) === bareSlug(slug),
+  );
+  const blocked = new Set();
+  for (const p of jobs ?? []) {
+    if (p.status !== 'pending' || p.cwd !== group.cwd) continue;
+    if ((p.dependsOn ?? []).some(namesABlockingSlug)) blocked.add(p.slug);
+  }
+  return [...blocked].sort();
+}
+
+/**
+ * formatReviewNotice(group, { jobs }) → plain-text message body for the
+ * authoring Epic's event chain. `group` is one entry from
+ * selectDueReviewNotices(). `jobs` is the FULL live job list (every status,
+ * every project) — needed to find any `pending` row this group still blocks;
+ * omit it (or pass `[]`) to always get the "nothing is waiting" wording,
+ * e.g. from a caller that only has the group itself.
+ */
+function formatReviewNotice(group, { jobs = [] } = {}) {
+  const groupJobs = group.jobs ?? [];
+  const slugs = groupJobs.map((j) => j.slug).filter(Boolean);
+  const reportPaths = groupJobs.map((j) => j.reviewNotice?.reportPath).filter(Boolean);
+  const blocked = blockedDependents(group, jobs);
+  const waitingLine = blocked.length
+    ? `These PRDs block ${blocked.length} other PRD(s) until they are fixed, reset or archived: ${blocked.join(', ')}.`
+    : 'The rest of the plan keeps running. Nothing is waiting on you unless you want to act.';
+  const lines = [
+    `${groupJobs.length} PRD(s) stopped for the same reason: ${humanCauseFor(group.cause)}.`,
+    `The scheduler already tried to fix this on its own: ${ladderSummaryFor(groupJobs)}.`,
+    waitingLine,
+    `PRDs: ${slugs.join(', ')}`,
+  ];
+  if (reportPaths.length) lines.push(`Reports: ${reportPaths.join(', ')}`);
+  return lines.join('\n');
+}
+
+/**
+ * holdMsFromEnv(env) → milliseconds a needs_review park waits, with no
+ * ladder resolution, before it gets a grouped notice on its own (case b in
+ * selectDueReviewNotices). SM_REVIEW_NOTICE_HOLD_MINUTES must be a positive
+ * number; anything else (unset, zero, negative, NaN) falls back to the
+ * DEFAULT_HOLD_MINUTES default.
+ */
+function holdMsFromEnv(env = process.env) {
+  const raw = Number(env.SM_REVIEW_NOTICE_HOLD_MINUTES);
+  const minutes = Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_HOLD_MINUTES;
+  return minutes * 60000;
+}
+
+module.exports = {
+  DEFAULT_HOLD_MINUTES,
+  buildReviewNotice,
+  selectDueReviewNotices,
+  formatReviewNotice,
+  holdMsFromEnv,
+};

package/src/main/lib/runClaudeP.cjs

@@ -16,12 +16,14 @@
 
 const { spawn } = require('node:child_process');
 const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
+const { headlessPermissionArgs, ensureCliCapsProbed } = require('./claudeCliCaps.cjs');
 const { withProcRole } = require('./cleanEnv.cjs');
 
 const MAX_OUT_BYTES = 8 * 1024 * 1024;
 
 /** Spawn `claude -p`, capture stdout. Resolves {ok, out, error} — never throws. */
-function runClaudeP(prompt, { model = 'sonnet', timeoutMs = 180_000, systemPrompt = null } = {}) {
+async function runClaudeP(prompt, { model = 'sonnet', timeoutMs = 180_000, systemPrompt = null } = {}) {
+  await ensureCliCapsProbed();
   return new Promise((resolve) => {
     let bin;
     try { bin = resolveClaudeBin(); } catch (e) { resolve({ ok: false, error: `claude not found: ${e?.message}` }); return; }
@@ -29,6 +31,7 @@ function runClaudeP(prompt, { model = 'sonnet', timeoutMs = 180_000, systemPromp
       '-p', prompt,
       '--model', model,
       '--dangerously-skip-permissions',
+      ...headlessPermissionArgs(),
       '--output-format', 'text',
     ];
     if (systemPrompt) args.push('--append-system-prompt', systemPrompt);

package/src/main/lib/schedulerPaths.cjs

@@ -23,8 +23,28 @@ const os = require('node:os');
 const path = require('node:path');
 
 function isUnder(child, parent) {
-  const rel = path.relative(path.resolve(parent), path.resolve(child));
-  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+  const within = (c, p) => {
+    const rel = path.relative(p, c);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+  };
+  const c = path.resolve(child);
+  const p = path.resolve(parent);
+  if (within(c, p)) return true;
+  // Symlinked roots (macOS os.tmpdir() /var -> /private/var): also compare canonical spellings.
+  return within(realpathDeepest(c), realpathDeepest(p));
+}
+
+/** realpath of the deepest existing ancestor + the not-yet-existing tail. Never throws. */
+function realpathDeepest(abs) {
+  let head = abs;
+  const tail = [];
+  for (;;) {
+    try { return path.join(fs.realpathSync(head), ...tail.reverse()); } catch { /* walk up */ }
+    const up = path.dirname(head);
+    if (up === head) return abs;
+    tail.push(path.basename(head));
+    head = up;
+  }
 }
 
 /**

package/src/main/lib/sessionSlots.cjs

@@ -28,6 +28,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { sessionSlotsConfigPath } = require('./schedulerPaths.cjs');
 const { appendAuditEvent } = require('./auditLog.cjs');
+const atomicFs = require('./atomicFs.cjs');
 const { isProvablyDead, DEFAULT_GRACE_MS } = require('./reservationExpiry.cjs');
 
 const MIN_SLOTS = 0;
@@ -57,10 +58,7 @@ function setCap(cap) {
     throw new Error(`sessionSlots.setCap: cap must be an integer in [${MIN_SLOTS}, ${MAX_SLOTS}]`);
   }
   const configPath = sessionSlotsConfigPath();
-  fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  const tmp = `${configPath}.${process.pid}.${Date.now()}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify({ cap: n }, null, 2));
-  fs.renameSync(tmp, configPath);
+  atomicFs.writeJsonAtomicSync(configPath, { cap: n });
   for (const fn of listeners) {
     try { fn(); } catch { /* a consumer's pump error is its own problem */ }
   }

package/src/main/lib/shippedPersonaSeeds.cjs

@@ -0,0 +1,179 @@
+'use strict';
+
+/**
+ * SHIPPED_PERSONA_SEEDS — every distinct version this app has ever bundled
+ * for the four seed personas (`src/main/seedAgentPersonas.cjs`'s `PERSONAS`),
+ * keyed by persona name. One entry per version actually shipped in
+ * `src/seed/agents/<name>.md`'s git history; exact duplicates (same body
+ * hash and same `fm`) are dropped.
+ *
+ * `seedAgentPersonas.cjs`'s upgrade pass only replaces an installed persona
+ * file when its body hash matches one of the `bodySha256` values below — a
+ * body that never shipped from this app (hand-written, or hand-edited after
+ * install) is left alone, never overwritten. `fm` holds every frontmatter
+ * key that version had, except `name` and `seedVersion` — those two are
+ * never diffed against this list.
+ *
+ * When you change a bundled persona, add its new version here. The test in
+ * seedAgentPersonas.test.cjs prints the entry to paste.
+ */
+
+function deepFreeze(value) {
+  if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const key of Object.keys(value)) deepFreeze(value[key]);
+  }
+  return value;
+}
+
+const SHIPPED_PERSONA_SEEDS = deepFreeze({
+  "architect": [
+    {
+      commit: "dba99697",
+      bodySha256: "40a4d41445e7fdb128f4f1d8d3eef88b857ca466726b3719b36cb69933f09168",
+      fm: {
+        description: "The primary Actor for an Epic's whole interactive conversation — owns overall plan and decomposition, clarifies scope, searches before building, decomposes work into scheduled PRDs via /develop, tracks them to completion, and verifies before calling anything done. Never implements a PRD itself — that's dev-lead's job, one PRD at a time, headless. Task-type framing is the Epic's Mission tag's job, not this persona's.",
+        model: "opus",
+        tags: "feature, bug, discussion",
+        title: "Engineering — Architect",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+  ],
+  "dev-lead": [
+    {
+      commit: "dba99697",
+      bodySha256: "7821f5bf3f1617fb4c9ea80c81fc37680bfc4c61346e59f58da456c69ef74a90",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. Not currently wired to run automatically; a PRD must name this persona explicitly (e.g. in its Implementation notes) for an executor to adopt it.",
+        model: "fable",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+    {
+      commit: "07b73fac",
+      bodySha256: "21284b34473fd4a9b727e8fa2a0702379751d3af0985392a9814f91a4fdc8551",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. This is the default persona a scheduled PRD runs as: the scheduler resolves a PRD's `agentType` frontmatter field (default `dev-lead`) to this file and launches the headless executor AS this persona via `--append-system-prompt`.",
+        model: "sonnet",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+    {
+      commit: "2751c9f5",
+      bodySha256: "375b46dd6f1edc7b7e304e0be5bf32a4e61ca4adf329bc73d65ba2224e3c7b8a",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. This is the default persona a scheduled PRD runs as: the scheduler resolves a PRD's `agentType` frontmatter field (default `dev-lead`) to this file and launches the headless executor AS this persona via `--append-system-prompt`.",
+        model: "sonnet",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+    {
+      commit: "9f8286d7",
+      bodySha256: "86e5d8a679c3be879b162140d403f905a1ef9edbcc54b3bf4b3a278425dea841",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. This is the default persona a scheduled PRD runs as: the scheduler resolves a PRD's `agentType` frontmatter field (default `dev-lead`) to this file and launches the headless executor AS this persona via `--append-system-prompt`.",
+        model: "sonnet",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+    {
+      commit: "ab4be752",
+      bodySha256: "dbd5500968b75cbbe6549e612dc3df5de8d1569fa902cac173705542ea095225",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. This is the default persona a scheduled PRD runs as: the scheduler resolves a PRD's `agentType` frontmatter field (default `dev-lead`) to this file and launches the headless executor AS this persona via `--append-system-prompt`.",
+        model: "sonnet",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+    {
+      commit: "535b04f8",
+      bodySha256: "91232cfd7ce5fb1dc608ff639a07dcb1c5c13c22502ae4790f51707f498ec917",
+      fm: {
+        description: "Executes exactly one already-scoped PRD at a time, headless, start to finish — reads the PRD's Goal/Acceptance Criteria/Implementation notes and standards.md, implements it, verifies against its own AC, and reports. Has no visibility into the overall plan — that's architect's job. This is the default persona a scheduled PRD runs as: the scheduler resolves a PRD's `agentType` frontmatter field (default `dev-lead`) to this file and launches the headless executor AS this persona via `--append-system-prompt`.",
+        model: "sonnet",
+        title: "Engineering — Software Engineer",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
+  ],
+  "project-home-builder": [
+    {
+      commit: "e9f2f540",
+      bodySha256: "e1c80f465179f814f1e9ea95529434309e5238facdc8c6664cb8f44f8302e148",
+      fm: {
+        description: "Generates a project's 5 static Project Page HTML files (Home / Marketing Landing / Feature Description / Architecture Overview / Brief) by following the session-manager app's own MCP contract for the pipeline — portable to any machine with the app installed, no source-repo paths required.",
+        title: "Project Pages — Builder",
+        tools: "Read, Grep, Glob, Bash, Write, Edit",
+      },
+    },
+    {
+      commit: "5cc32fa4",
+      bodySha256: "7ad61d9b9dbe7f35727baf83f94c3c244deb25133eebb78c9295c9841237dd1c",
+      fm: {
+        description: "Reads a project and writes ONE self-contained overview page (home.html) for its Project Home tab, then saves it with a single project_home_write call.",
+        title: "Project Home — Builder",
+        tools: "Read, Grep, Glob, Bash, Write, Edit",
+      },
+    },
+  ],
+  "validator": [
+    {
+      commit: "41c28597",
+      bodySha256: "4791f25651b4fc3b7cfa3a26148e6dd1cceec05f057b882516fafcdcc04f71e7",
+      fm: {
+        description: "Validates a finished PLAN (the PRDs that share one planId) once, after its last PRD lands — re-runs each PRD's gate, checks every acceptance criterion against the real tree, reviews the plan's combined diff, and reports one VERIFIED/REFUTED verdict per PRD via sentinel lines. Runs headless as a scheduled PRD (agentType: validator); never edits product code and never queues work.",
+        model: "sonnet",
+        title: "Engineering — Plan Validator",
+        tools: "Read, Grep, Glob, Bash",
+      },
+    },
+    {
+      commit: "7ed8dd1d",
+      bodySha256: "80d19294bc8a0e654f242a6177ae14ebdb116c899614c6b6bed503774624a0b8",
+      fm: {
+        description: "Validates a finished PLAN (the PRDs that share one planId) once, after its last PRD lands — re-runs each PRD's gate, checks every acceptance criterion against the real tree, reviews the plan's combined diff, and reports one VERIFIED/REFUTED verdict per PRD via sentinel lines. Runs headless as a scheduled PRD (agentType: validator); never edits product code and never queues work.",
+        model: "sonnet",
+        title: "Engineering — Plan Validator",
+        tools: "Read, Grep, Glob, Bash",
+      },
+    },
+    {
+      commit: "9f8286d7",
+      bodySha256: "8e95bfe06f70e7f9ae7f22de829b6f40727714e7f66364d166756b269ad7d50f",
+      fm: {
+        description: "Validates a finished PLAN (the PRDs that share one planId) once, after its last PRD lands — re-runs each PRD's gate, checks every acceptance criterion against the real tree, reviews the plan's combined diff, and reports one VERIFIED/REFUTED verdict per PRD via sentinel lines. Runs headless as a scheduled PRD (agentType: validator); never edits product code and never queues work.",
+        model: "sonnet",
+        title: "Engineering — Plan Validator",
+        tools: "Read, Grep, Glob, Bash",
+      },
+    },
+    {
+      commit: "ab4be752",
+      bodySha256: "512ec61490f6b652268bedc2aebd07fb4aafe8df53cfed38bb728348a29f29cc",
+      fm: {
+        description: "Validates a finished PLAN (the PRDs that share one planId) once, after its last PRD lands — re-runs each PRD's gate, checks every acceptance criterion against the real tree, reviews the plan's combined diff, and reports one VERIFIED/REFUTED verdict per PRD via sentinel lines. Runs headless as a scheduled PRD (agentType: validator); never edits product code and never queues work.",
+        model: "sonnet",
+        title: "Engineering — Plan Validator",
+        tools: "Read, Grep, Glob, Bash",
+      },
+    },
+    {
+      commit: "535b04f8",
+      bodySha256: "5aeaf796a30ac98bdce440a6fcd088e1c776ae762f2778327439ab8d75a2de94",
+      fm: {
+        description: "Validates a finished PLAN (the PRDs its validate PRD lists) once, after its last PRD lands — re-runs each PRD's gate, checks every acceptance criterion against the real tree, reviews the plan's combined diff, and reports one VERIFIED/REFUTED verdict per PRD via sentinel lines. Runs headless as a scheduled PRD (agentType: validator); never edits product code and never queues work.",
+        model: "sonnet",
+        title: "Engineering — Plan Validator",
+        tools: "Read, Grep, Glob, Bash",
+      },
+    },
+  ],
+});
+
+module.exports = { SHIPPED_PERSONA_SEEDS };