cyberfleet 0.4.0 → 0.5.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "cyberfleet",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Fleet & crew personas over cyberlegion — Pod (ship's bridge), Operator (command center), Crimp (crew recruitment), and Mechanic (automaton building).",
 	"author": {
 		"name": "unional"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "cyberfleet",
-	"version": "0.4.0",
+	"version": "0.5.0",
 	"description": "Fleet & crew personas over cyberlegion — Pod (ship's bridge), Operator (command center), Crimp (crew recruitment), and Mechanic (automaton building).",
 	"author": {
 		"name": "unional"

package/.plugin/pins.json

@@ -0,0 +1,3 @@
+{
+	"cyberlegion": "1.1.0"
+}

package/agents/headless-operator.md

@@ -32,7 +32,13 @@ while capacity K and ready:
   mission-graph append node/edge ... (claim)   # SINGLE WRITER: status=in-progress, before spawn
   cyberlegion unit spawn <ship>                # AFK -> autonomous ship; HITL -> human channel
 on mission-done(m):                            # m reports through its existing HANDOFF relay
+  if the summons carries no Council words authorizing this tick's merges:
+    hold m: no merge, no retire, pod left running; batch a decision-request naming the merge
+    continue
   merge per merge-backstop-governance          # Operation order + speculative-CI gate + bisect-on-red
+  if the harness or host refuses the merge:      # never re-run it, never another command/API/unit/setting
+    hold m as above, naming the refusal in the decision-request
+    continue
   cyberlegion unit close <id>                    # tear down the pod that ran it (spawn's inverse)
   mail every other open pod: trunk moved         # rebase, adapt, re-verify, report (merge-backstop §5)
   mission-graph append (retire + discovered edges/nodes)   # SINGLE WRITER
@@ -53,9 +59,14 @@ on mission-done(m):                            # m reports through its existing
   human-attributed verdict, a publish, a history rewrite, a settings or secret change, a widened
   delegation, or a minted owner identity, load **`authority-governance`** by name and follow it — the
   same way the merge step loads `merge-backstop-governance`. Never carry the authority judgment inline.
-- **The tick is the delegation.** Being summoned for a tick is what permits this loop to retire that
-  tick's missions; the merge still lands only on green speculative CI. It covers that tick's missions and
-  no other class of action — a release, a settings change, or anything else on **`authority-governance`**'s
+- **The summons alone is not the delegation.** Being summoned for a tick does not permit this loop to
+  merge. It merges that tick's missions only when the summons carries the **Council's own words**
+  authorizing those merges (relayed as `authority-governance` §3 requires), and the merge still lands only
+  on green speculative CI. Without those words, hold each clean merge: no merge, no retirement, its pod
+  left running, and a decision-request naming that merge batched into the return packet — the merge waits
+  for a tick whose summons carries the Council's answer. A merge the harness or host refuses is never
+  retried or reached another way; hold it and report the refusal. The delegation covers that tick's
+  missions and no other class of action — a release, a settings change, or anything else on **`authority-governance`**'s
   ratification-class list needs its own Council decision, batched up the relay rather than assumed. The
   SDD leash is not this delegation: it governs which SDD gate an agent may self-assert, never a merge.
 - **Two orderings split.** `ready` governs **issue**; **retirement is Operation-ordered merge**. Load
@@ -78,7 +89,8 @@ that stands on its own (the new Pod starts cold and reads it through its own Ses
 
 The Operator never asks live. It **batches** into its return packet every point the in-session Operator
 would surface to the Council — an ambiguous rank tie it has no policy to break, a mission whose brief
-is missing, a HITL mission it has no human channel to serve — and whatever spawned it owns the relay and
+is missing, a HITL mission it has no human channel to serve, a clean merge it holds for want of the
+Council's words, a merge the harness refused — and whatever spawned it owns the relay and
 re-invokes once answers land. If it was started **frameless** (a bare scheduler run with no spawner
 awaiting its return), push the report to the standing owner inbox and exit. This is the same relay
 contract the headless-legate uses; do not re-derive it here.
@@ -92,6 +104,27 @@ reaches for an MCP messaging server, and never assumes every ship runs the same
 single graph writer and the read-only consumer of `ready` — the loop and the frontier consumption are
 the Operator's; the per-unit spawn mechanism is cyberlegion's.
 
+## Resolving `cyberlegion`
+
+Every `cyberlegion …` command in this loop runs whichever CLI resolves below, resolved afresh in each
+session and again after any plugin reload. Never hardcode a versioned
+`~/.claude/plugins/cache/…/<version>/` path: a reload installs a new version beside the old one, and a
+remembered path keeps running the old CLI. The pin is the `cyberlegion` entry in this plugin's
+bundled `<this agent's directory>/../.plugin/pins.json` — read it, never invent or scrape a version. Take the first rung that
+resolves and whose `cyberlegion --version` is at or above the pin; skip a rung that reports an older
+version:
+
+1. `cyberlegion` on `PATH`.
+2. The installed cyberlegion plugin: read `~/.claude/plugins/installed_plugins.json` now, take the
+   `installPath` of its `cyberlegion@<marketplace>` entry, and run `node
+   <installPath>/bin/cyberlegion.mjs`.
+3. `npx -y cyberlegion@<pin>`.
+
+With no pin (no `pins.json`, no `cyberlegion` key, or a malformed map), no rung has a version floor
+and the last rung is the unpinned `npx -y cyberlegion`. When no rung resolves, stop the tick and report it up the relay with the
+install hint: install the `cyberlegion` plugin beside this one, or `npm install -g
+cyberlegion@<pin>`.
+
 ## Stateless per tick
 
 Spawned cold for each tick and carrying no memory across ticks: derive everything from the current

package/bin/cyberfleet.mjs

@@ -1,6 +1,23 @@
 #!/usr/bin/env node
+import { existsSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const dir = dirname(fileURLToPath(import.meta.url))
-await import(join(dir, '..', 'dist', 'cli.mjs'))
+const cli = join(dir, '..', 'dist', 'cli.mjs')
+
+// A plugin installed from a source checkout carries whatever the checkout carries, and no install
+// step runs after the copy. Without the built CLI, a bare import dies with ERR_MODULE_NOT_FOUND and
+// no way forward; say what is missing and name the exact published version that runs instead.
+if (!existsSync(cli)) {
+	const { version } = JSON.parse(readFileSync(join(dir, '..', 'package.json'), 'utf8'))
+	process.stderr.write(
+		`cyberfleet: the built CLI is missing: ${cli}\n` +
+			'This install has no dist/ — it is a source checkout that was never built.\n' +
+			`Run the published CLI of the same version instead: npx -y cyberfleet@${version}\n` +
+			`Or build it in place: pnpm install && pnpm build (in ${join(dir, '..')})\n`,
+	)
+	process.exit(1)
+}
+
+await import(cli)