dsh-tower 2.1.0 → 2.3.0

package/{lib → host}/doctor.js

@@ -2,19 +2,33 @@
 import { execFile } from '../adapters/vcs-git.js'
 import { promisify } from 'node:util'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { fsp } from '../adapters/store-fs.js'
-import { git } from './git.js'
-import { readStateLock } from './store.js'
-import { inspectArchive } from './archive.js'
+import { git } from '../adapters/git.js'
+import { readStateLock, readGitLock, gitLockView } from '../adapters/store.js'
+import { lockTiming } from '../adapters/persistence.js'
+import { inspectArchive } from '../adapters/archive.js'
 import { inspectStateVersion } from '../domain/state.js'
 import { SCHEMA_VERSION } from '../domain/mission.js'
 import { DEFAULT_MAX_REPORT_BYTES, completionReportBytes } from '../domain/missions/completion.js'
 import { comparisonMode } from '../domain/scope.js'
+import { configSurface } from '../domain/config/schema.js'
+import { parseBaseline, surfaceLine, SURFACE_BASELINE_FILE } from '../domain/surface.js'
 import { assessHostVersion, detectHostVersion, readCompatibility } from './compatibility.js'
 import { profileConfig } from './config.js'
-import { inspectWorkspaceLock } from './workspaceLock.js'
+import { inspectWorkspaceLock } from '../adapters/workspaceLock.js'
 
 const execFileAsync = promisify(execFile)
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+
+/** Read the committed concept-budget baseline read-only; null when absent. */
+async function readSurfaceBaseline() {
+  try {
+    return parseBaseline(await fsp.readFile(path.join(PACKAGE_ROOT, SURFACE_BASELINE_FILE), 'utf8'))
+  } catch {
+    return null
+  }
+}
 
 async function exists(target) {
   try {
@@ -38,6 +52,12 @@ function check(id, status, detail, action) {
   return { id, status, detail, ...(action ? { action } : {}) }
 }
 
+/** Render a lock age the same way the state-lock checker does. */
+function durationText(ms) {
+  if (!Number.isFinite(ms)) return 'an unknown duration'
+  return `${Math.max(0, Math.round(ms / 1000))} s`
+}
+
 /** Read the on-disk state version without loading, migrating, or locking. */
 async function inspectStateSchema(paths) {
   try {
@@ -116,9 +136,10 @@ function stateSchemaReport(info) {
 }
 
 /** Run every read-only diagnostic; never writes state or takes the state lock. */
-export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityFile, loaderRows }) {
+export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityFile, loaderRows, surface }) {
   const checks = []
   let reportsReport = null
+  let stateLockReport = null
   const version = await gitVersion()
   checks.push(version ? check('git', 'pass', version) : check('git', 'fail', 'git is not available', 'install Git and retry'))
 
@@ -167,6 +188,19 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   }
 
   checks.push(check('repository', 'pass', `${tower.root} (common ${tower.commonDir})`))
+  // The repo-scoped git mutex can legally be held for a whole merge (15 min by
+  // default). Report the holder so a stalled tower has a visible cause (#93).
+  const gitLock = gitLockView(await readGitLock(tower.paths))
+  checks.push(
+    gitLock.held
+      ? check(
+          'git-lock',
+          'warn',
+          `held by pid ${gitLock.pid ?? 'unknown'}${gitLock.phase ? ` (${gitLock.phase})` : ''} for ${durationText(gitLock.heldMs)}; the repo-scoped git mutex is busy`,
+          'wait for the git mutation to finish; tower_status reports the same holder',
+        )
+      : check('git-lock', 'pass', 'free'),
+  )
   const schemaInfo = await inspectStateSchema(tower.paths)
   let state = null
   try {
@@ -226,6 +260,32 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
       'optional: add <git-common-dir>/dsh-tower/config.json',
     ),
   )
+  // #84: report the concept-budget surface instead of implying it. The counts
+  // are the live schema/tool surface; the date is the committed baseline, so a
+  // reader sees both the number and the decision it was frozen at.
+  const configCounts = configSurface()
+  const baseline = await readSurfaceBaseline()
+  const toolCount = Number.isInteger(surface?.tools) ? surface.tools : null
+  const surfaceCounts = {
+    configKeys: configCounts.count,
+    sections: configCounts.sections.length,
+    tools: toolCount,
+  }
+  const surfaceReport = {
+    ...surfaceCounts,
+    baselineDate: baseline?.date ?? null,
+    line: surfaceLine(surfaceCounts),
+  }
+  checks.push(
+    toolCount === null
+      ? check('surface', 'warn', `${surfaceReport.line} (tool count unavailable; pass the registered surface)`)
+      : check(
+          'surface',
+          'pass',
+          `${surfaceReport.line}${baseline?.date ? ` (baseline ${baseline.date})` : ''}`,
+          baseline?.date ? undefined : `commit ${SURFACE_BASELINE_FILE} so growth is compared against a decision`,
+        ),
+  )
   const presets = ctx.get?.('agentPresets')
   if (presets && typeof presets.list === 'function') {
     try {
@@ -251,12 +311,45 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
 
   if (state) {
     const lock = await readStateLock(tower.paths)
+    const timing = lockTiming(lock.record)
+    stateLockReport = {
+      held: Boolean(lock.record),
+      pid: lock.record?.pid ?? null,
+      startedAt: lock.record?.startedAt ?? null,
+      at: lock.record?.at ?? null,
+      alive: lock.alive,
+      ageMs: timing.ageMs,
+      heartbeatAgeMs: timing.heartbeatAgeMs,
+      staleAfterMs: timing.staleAfterMs,
+      stale: timing.stale,
+    }
+    // The PID alone cannot distinguish a live writer from a recycled PID
+    // (#92); report the heartbeat age so a stuck tower is diagnosable without
+    // reading the file.
+    const heartbeatText =
+      timing.heartbeatAgeMs === null
+        ? 'no heartbeat timestamp'
+        : `last heartbeat ${timing.heartbeatAgeMs}ms ago (stale after ${timing.staleAfterMs}ms)`
     checks.push(
       !lock.record
         ? check('state-lock', 'pass', 'no state lock file')
         : lock.alive === false
-          ? check('state-lock', 'warn', `stale state lock (pid ${lock.record.pid ?? 'unknown'} is gone); the next mutation reclaims it atomically`)
-          : check('state-lock', 'warn', `state lock held by pid ${lock.record.pid ?? 'unknown'}; retry after it finishes`),
+          ? check(
+              'state-lock',
+              'warn',
+              `stale state lock (pid ${lock.record.pid ?? 'unknown'} is gone; ${heartbeatText}); the next mutation reclaims it atomically`,
+            )
+          : timing.stale
+            ? check(
+                'state-lock',
+                'warn',
+                `state lock pid ${lock.record.pid ?? 'unknown'} is alive but silent (${heartbeatText}); the next mutation reclaims it after byte verification, or tower_recover clear-stale-lock force:true moves it to a backup`,
+              )
+            : check(
+                'state-lock',
+                'warn',
+                `state lock held by pid ${lock.record.pid ?? 'unknown'}; ${heartbeatText}; retry after it finishes`,
+              ),
     )
     const lockDir = path.join(tower.commonDir, 'dsh-tower', 'tower.lock')
     try {
@@ -342,7 +435,7 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   }
 
   try {
-    const { inspectLeases } = await import('./leases.js')
+    const { inspectLeases } = await import('../adapters/leases.js')
     const leases = await inspectLeases(tower.commonDir)
     checks.push(check('leases', leases.leases?.length ? 'warn' : 'pass', `${leases.leases?.length ?? 0} active lease(s)`))
   } catch (error) {
@@ -359,7 +452,18 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
 
   try {
     const text = await fsp.readFile(path.join(tower.paths.dir, 'lock-holds.jsonl'), 'utf8')
-    const samples = text.split('\n').filter(Boolean).slice(-200).map((line) => JSON.parse(line).ms).filter((ms) => Number.isFinite(ms)).sort((a, b) => a - b)
+    // These percentiles are about the state lock. Git-mutex holds are logged
+    // too (kind: 'git' / the pre-#93 phase: 'git' form) and can legitimately
+    // span a merge, so they must not be counted as slow state mutations.
+    const samples = text
+      .split('\n')
+      .filter(Boolean)
+      .slice(-200)
+      .map((line) => JSON.parse(line))
+      .filter((hold) => hold.kind !== 'git' && hold.phase !== 'git')
+      .map((hold) => hold.ms)
+      .filter((ms) => Number.isFinite(ms))
+      .sort((a, b) => a - b)
     if (samples.length === 0) {
       checks.push(check('lock-holds', 'pass', 'no lock-hold samples yet'))
     } else {
@@ -410,9 +514,12 @@ export async function runDoctor({ tower, ctx, agent, hostVersion, compatibilityF
   return {
     ok: failed === 0,
     checks,
+    stateLock: stateLockReport,
+    gitLock,
     stateSchema: schemaReport.stateSchema,
 // reports (from #89) and archive (from #73) are both kept
     reports: reportsReport,
+    surface: surfaceReport,
     archive: {
       missions: state ? state.missions.length : null,
       archivedMissions: archiveInventory.missions,

package/{lib → host}/modeStore.js

@@ -6,7 +6,7 @@
 import { fs } from '../adapters/store-fs.js'
 import os from 'node:os'
 import path from 'node:path'
-import { acquireLockSync, readJsonSync, writeJsonAtomicSync } from './persistence.js'
+import { acquireLockSync, readJsonSync, writeJsonAtomicSync } from '../adapters/persistence.js'
 
 const DEFAULT_MAX_ENTRIES = 200
 

package/{lib → host}/tool-registry.js

@@ -14,8 +14,15 @@ import {
   isTowerRole,
   isUnknownRole,
 } from '../domain/vocabulary.js'
-import { git, resolveRepo, hasAnyCommit } from './git.js'
+import { git, resolveRepo, hasAnyCommit } from '../adapters/git.js'
 import { runtimeConfig } from './config.js'
+import { runDoctor } from './doctor.js'
+import { createHmrBridge } from './hmr.js'
+import { assertPresetsAvailable } from './presets.js'
+import { readStateLock } from '../adapters/store.js'
+import { lockTiming } from '../adapters/persistence.js'
+import { acquireLease, releaseLease, inspectLeases } from '../adapters/leases.js'
+import { importLegacySnapshot, validateLegacyMap } from '../adapters/legacy.js'
 import { registerDoctorTool } from '../tools/doctor.js'
 import { registerRecoverTool } from '../tools/recover.js'
 import { registerTestTool } from '../tools/test.js'
@@ -43,10 +50,12 @@ import { registerSpawnTool } from '../tools/spawn.js'
 import { registerCompleteTool } from '../tools/complete.js'
 import { registerFindingTool } from '../tools/finding.js'
 import { registerFindingsTool } from '../tools/findings.js'
-import { readDiscoveryConfig, normalizeDiscovery, runDiscovery } from './tests.js'
+import { readDiscoveryConfig, normalizeDiscovery, runDiscovery } from '../adapters/tests.js'
 import { summarize as summarizeBatch } from '../domain/batch.js'
+import { assertPorts } from '../ports/index.js'
 import path from 'node:path'
 import { fsp } from '../adapters/store-fs.js'
+import { createDefaultDeps } from '../adapters/default.js'
 import crypto from 'node:crypto'
 
 // Mutable composition state is grouped in one const object: the registration
@@ -54,6 +63,41 @@ import crypto from 'node:crypto'
 const runtimeState = {
   workspaceHook: null,
   hmrBridge: null,
+  // #69: the host entry builds the adapter set once and passes it in. The lazy
+  // fallback is for tests/embedders that call registerTowerTools() directly;
+  // it is still built once per process.
+  deps: null,
+  // #84: the defined tool names are recorded before the exposure switches run,
+  // so the concept budget measures the full surface rather than one profile's
+  // subset. The number is reported by tower_doctor and compared with the
+  // committed scripts/surface-baseline.json.
+  definedTools: new Set(),
+}
+
+/** The full defined tool surface (names, sorted), independent of exposure flags. */
+export function definedToolNames() {
+  return [...runtimeState.definedTools].sort()
+}
+
+/** The number of tools defined by this build, used by the concept budget (#84). */
+export function definedToolCount() {
+  return runtimeState.definedTools.size
+}
+
+/** The injected port set for the app layer (built once per process). */
+function towerDeps() {
+  if (!runtimeState.deps) runtimeState.deps = createDefaultDeps()
+  return runtimeState.deps
+}
+
+/** Compose the app Tower with the injected ports (never a bare adapter import). */
+function openTower(repoRoot) {
+  return Tower.open(repoRoot, towerDeps())
+}
+
+/** Build a Tower with an explicit config for the read-only doctor path. */
+function createTower(repo, config) {
+  return new Tower(repo, config, towerDeps())
 }
 
 function normalizeToolArgs(args, aliases = {}) {
@@ -324,6 +368,9 @@ function plainSchema(value) {
  */
 function define(ctx, definition) {
   const { aliases, requiresMissionId, board, execute, ...rest } = definition
+  // Record the definition before the exposure gate: the concept budget counts
+  // the tools this build can register, not only the ones a profile exposes.
+  runtimeState.definedTools.add(rest.name)
   const toolsConfig = runtimeConfig().tools ?? {}
   const flag = OPERATIONAL_TOOLS.get(rest.name)
   if (flag && (toolsConfig.exposeOperational === false || toolsConfig[flag] === false)) return
@@ -364,7 +411,7 @@ function define(ctx, definition) {
         }
         if (board === true && typeof normalized.repoRoot === 'string') {
           try {
-            const opened = await Tower.open(normalized.repoRoot)
+            const opened = await openTower(normalized.repoRoot)
             await opened.writeBoard()
           } catch {
             // board output is best effort
@@ -451,6 +498,24 @@ async function observeActivity(ctx, tower) {
 export function registerTowerTools(ctx, options = {}) {
   runtimeState.workspaceHook = options.workspace ?? null
   runtimeState.hmrBridge = options.hmrBridge ?? null
+  // #69: the host entry (index.js) is the composition root. When it supplies the
+  // port set, adopt it — validated once — instead of constructing a second set
+  // here. Tests/embedders that omit deps fall back to one lazily built set.
+  // #75: the event port is bound here to the live Cordis emitter; emitting is
+  // best effort so a listener can never fail the tool that produced the fact.
+  const baseDeps = options.deps ? assertPorts(options.deps) : (runtimeState.deps ?? createDefaultDeps())
+  runtimeState.deps = {
+    ...baseDeps,
+    events: {
+      emit(name, payload) {
+        try {
+          ctx.emit?.(name, payload)
+        } catch {
+          // events are an optional side channel; never fail a tool for them
+        }
+      },
+    },
+  }
   // A lightweight roster watchdog: the authoritative activity comes from the
   // subagents catalog; a missing observation after spawn.staleMs is marked
   // stale (never silently treated as stopped) and blocks merge via the gate.
@@ -460,7 +525,7 @@ export function registerTowerTools(ctx, options = {}) {
       try {
         if (!ctx.get('subagents')) return
         for (const repoRoot of [...WATCHED_REPOS]) {
-          const tower = await Tower.open(repoRoot)
+          const tower = await openTower(repoRoot)
           const view = await tower.rosterView()
           const live = view.roster.filter((entry) => !ROSTER_INACTIVE_STATES.includes(entry.state))
           if (live.length === 0) { WATCHED_REPOS.delete(repoRoot); continue }
@@ -481,59 +546,69 @@ export function registerTowerTools(ctx, options = {}) {
   }, watchMs)
   timer.unref?.()
   ctx.effect(() => () => clearInterval(timer))
-  registerInitTool(ctx, { define, actorFor, requireTowerActor, workspaceHook: runtimeState.workspaceHook, ensureRepository })
+  registerInitTool(ctx, { openTower, define, actorFor, requireTowerActor, workspaceHook: runtimeState.workspaceHook, ensureRepository, resolveRepo, runtimeConfig })
 
-  registerPlanTool(ctx, { define, actorFor, requireTowerActor })
+  registerPlanTool(ctx, { openTower, define, actorFor, requireTowerActor, assertPresetsAvailable })
 
-  registerMissionTool(ctx, { define, actorFor, requireKnownActor })
+  registerMissionTool(ctx, { openTower, define, actorFor, requireKnownActor })
 
-  registerStatusTool(ctx, { define, workspaceHook: runtimeState.workspaceHook, spawnBackoffView, observeActivity })
+  registerStatusTool(ctx, { openTower, define, workspaceHook: runtimeState.workspaceHook, spawnBackoffView, observeActivity })
 
-  registerSpawnTool(ctx, { define, actorFor, requireTowerActor, enqueueSpawn, observeActivity, spawnBackoffState, spawnBackoffView, recordSpawnThrottle, recordSpawnSuccess, runMissionDiscovery, textOf })
+  registerSpawnTool(ctx, { openTower, define, actorFor, requireTowerActor, enqueueSpawn, observeActivity, spawnBackoffState, spawnBackoffView, recordSpawnThrottle, recordSpawnSuccess, runMissionDiscovery, textOf, inspectLeases })
 
-  registerRosterTool(ctx, { define, workspaceHook: runtimeState.workspaceHook, observeActivity, actorFor, requireTowerActor, interruptRosterAgent })
+  registerRosterTool(ctx, { openTower, define, workspaceHook: runtimeState.workspaceHook, observeActivity, actorFor, requireTowerActor, interruptRosterAgent })
 
-  registerInterruptTool(ctx, { define, actorFor, requireTowerActor, interruptRosterAgent })
+  registerInterruptTool(ctx, { openTower, define, actorFor, requireTowerActor, interruptRosterAgent })
 
-  registerDiffTool(ctx, { define, actorFor, requireTowerActor })
+  registerDiffTool(ctx, { openTower, define, actorFor, requireTowerActor })
 
-  registerAdoptTool(ctx, { define, actorFor, requireTowerActor })
+  registerAdoptTool(ctx, { openTower, define, actorFor, requireTowerActor })
 
-  registerSendTool(ctx, { define, actorFor, checkSendRate })
+  registerSendTool(ctx, { openTower, define, actorFor, checkSendRate })
 
-  registerInboxTool(ctx, { define })
+  registerInboxTool(ctx, { openTower, define })
 
-  registerCompleteTool(ctx, { define, runMissionDiscovery })
+  registerCompleteTool(ctx, { openTower, define, runMissionDiscovery })
 
-  registerFindingTool(ctx, { define, actorFor, requireKnownActor })
+  registerFindingTool(ctx, { openTower, define, actorFor, requireKnownActor })
 
-  registerFindingsTool(ctx, { define, actorFor, requireKnownActor })
+  registerFindingsTool(ctx, { openTower, define, actorFor, requireKnownActor })
 
-  registerReviewTool(ctx, { define, actorFor })
+  registerReviewTool(ctx, { openTower, define, actorFor })
 
-  registerPreflightTool(ctx, { define, observeActivity })
+  registerPreflightTool(ctx, { openTower, define, observeActivity })
 
-  registerMergeTool(ctx, { define, actorFor, requireTowerActor, observeActivity })
+  registerMergeTool(ctx, { openTower, define, actorFor, requireTowerActor, observeActivity })
 
-  registerRebaseTool(ctx, { define, actorFor, requireTowerActor, observeActivity })
+  registerRebaseTool(ctx, { openTower, define, actorFor, requireTowerActor, observeActivity })
 
-  registerTeardownTool(ctx, { define, actorFor, requireTowerActor, observeActivity })
+  registerTeardownTool(ctx, { openTower, define, actorFor, requireTowerActor, observeActivity })
 
-  registerDoctorTool(ctx, define)
+  registerDoctorTool(ctx, {
+    openTower,
+    define,
+    createTower,
+    resolveRepo,
+    runtimeConfig,
+    runDoctor,
+    // #84: the doctor reports the live surface; the count is the full defined
+    // tool surface, independent of which operational switches this profile uses.
+    surface: () => ({ tools: definedToolCount() }),
+  })
 
-  registerRecoverTool(ctx, { define, actorFor, requireTowerActor })
+  registerRecoverTool(ctx, { openTower, define, actorFor, requireTowerActor, readStateLock, lockTiming })
 
-  registerTestTool(ctx, { define, actorFor, requireKnownActor, runMissionDiscovery })
+  registerTestTool(ctx, { openTower, define, actorFor, requireKnownActor, runMissionDiscovery })
 
-  registerBatchTool(ctx, { define, actorFor, requireTowerActor, summarizeBatch, verifyBatchReceiptFiles })
+  registerBatchTool(ctx, { openTower, define, actorFor, requireTowerActor, summarizeBatch, verifyBatchReceiptFiles })
 
-  registerResourceTool(ctx, { define, actorFor, requireTowerActor })
+  registerResourceTool(ctx, { openTower, define, actorFor, requireTowerActor, acquireLease, releaseLease, inspectLeases })
 
-  registerImportLegacyTool(ctx, { define, actorFor, requireTowerActor })
+  registerImportLegacyTool(ctx, { openTower, define, actorFor, requireTowerActor, importLegacySnapshot })
 
-  registerLegacyMapTool(ctx, { define, actorFor, requireTowerActor })
+  registerLegacyMapTool(ctx, { openTower, define, actorFor, requireTowerActor, validateLegacyMap })
 
-  registerReloadTool(ctx, { define, actorFor, requireTowerActor, sharedHmrBridge: runtimeState.hmrBridge })
+  registerReloadTool(ctx, { openTower, define, actorFor, requireTowerActor, sharedHmrBridge: runtimeState.hmrBridge, runtimeConfig, createHmrBridge })
 }
 
 export const __testSpawnBackoff = {

package/host/tower.js

@@ -0,0 +1,32 @@
+// Default-deps binding of the Tower app service (#69).
+//
+// The composition root (index.js / host/tool-registry.js) builds one deps object
+// and injects it into the app layer. This module is the convenience binding for
+// embedders and tests that want the process-default adapters; it is the only
+// host/ module besides tool-registry.js that knows the default adapter set.
+//
+// Object layout supplied here is memoised in adapters/default.js, so every
+// caller shares the same adapter instances.
+import { Tower as InjectedTower } from '../app/tower.js'
+import { defaultDeps } from '../adapters/default.js'
+
+export class Tower extends InjectedTower {
+  /**
+   * @param {{ root: string, commonDir: string, branch?: string | null }} repo
+   * @param {import('../types/index.js').TowerConfig} [config]
+   * @param {Record<string, any>} [deps]
+   */
+  constructor(repo, config, deps = defaultDeps) {
+    super(repo, config, deps)
+  }
+
+  /**
+   * @param {string} repoRoot
+   * @param {Record<string, any>} [deps]
+   */
+  static async open(repoRoot, deps = defaultDeps) {
+    const repo = await deps.vcs.resolveRepo(repoRoot)
+    const config = await deps.config.resolveRepoConfig(repo)
+    return new Tower(repo, config, deps)
+  }
+}

package/index.js

@@ -12,21 +12,22 @@
 // plugin from disk when the HMR service is present (dev/linked installs).
 import fs from 'node:fs'
 import { randomUUID } from 'node:crypto'
-import { registerTowerTools } from './lib/tool-registry.js'
-import { loadModes, saveModes, storePath } from './lib/modeStore.js'
-import { ModeState } from './lib/modeState.js'
-import { Config as ConfigSchema, DEFAULT_DENY_TOOLS, configureRuntime, runtimeConfig } from './lib/config.js'
+import { registerTowerTools } from './host/tool-registry.js'
+import { createDefaultDeps } from './adapters/default.js'
+import { loadModes, saveModes, storePath } from './host/modeStore.js'
+import { ModeState } from './host/modeState.js'
+import { Config as ConfigSchema, DEFAULT_DENY_TOOLS, configureRuntime, runtimeConfig } from './host/config.js'
 import { TowerToolError } from './domain/errors.js'
-import { resolveRepo } from './lib/git.js'
+import { resolveRepo } from './adapters/git.js'
 import {
   acquireWorkspaceLock,
   inspectWorkspaceLock,
   releaseWorkspaceLock,
   touchWorkspaceLock,
   workspaceLockToken,
-} from './lib/workspaceLock.js'
-import { createHmrBridge } from './lib/hmr.js'
-import { assertPresetsAvailable } from './lib/presets.js'
+} from './adapters/workspaceLock.js'
+import { createHmrBridge } from './host/hmr.js'
+import { assertPresetsAvailable } from './host/presets.js'
 
 export const name = 'dsh-tower'
 export const inject = ['tools', 'systemPrompt']
@@ -343,7 +344,9 @@ export function apply(ctx, rawConfig) {
     },
   }
 
-  registerTowerTools(ctx, { workspace, hmrBridge })
+  // #69: the host entry is the composition root — the adapters are constructed
+  // once here and injected into the tool layer and every Tower instance.
+  registerTowerTools(ctx, { workspace, hmrBridge, deps: createDefaultDeps() })
 
   // On dispose (including an HMR reload) release advisory workspace locks this
   // process still owns; a reloaded plugin restores the entries from modes.json.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tower",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "type": "module",
   "description": "DSH-native Tower: mission planning, worktree isolation, review-gated merges, and a human-owned Tower mode.",
   "license": "MIT",
@@ -41,7 +41,7 @@
     "reviewer.js",
     "skills.js",
     "skills/",
-    "lib/*.js",
+    "host/*.js",
     "domain/**/*.js",
     "app/*.js",
     "tools/*.js",
@@ -58,6 +58,7 @@
     "LICENSE",
     "CONTRIBUTING.md",
     "SECURITY.md",
+    "PRINCIPLES.md",
     "docs/",
     "ui-bundle/",
     "ports/*.js"
@@ -71,22 +72,28 @@
     "test": "node --test tests/*.test.mjs",
     "test:watch": "node --test --watch tests/*.test.mjs",
     "test:coverage": "node --test --experimental-test-coverage tests/*.test.mjs",
+    "test:live": "node tests/live/run.cjs",
     "smoke:mount": "node scripts/mount-smoke.mjs",
     "smoke:fixtures": "node scripts/mount-smoke/fixtures.mjs",
     "release:check": "node scripts/release-check.mjs",
     "audit:issues": "node scripts/issue-audit.mjs",
+    "audit:regressions": "node scripts/regression-audit.mjs",
+    "surface:check": "node scripts/surface-baseline.mjs",
     "dev:hmr": "node scripts/enable-dev-hmr.mjs",
     "docs:check": "node scripts/check-docs.mjs",
+    "docs:check:philosophy": "node scripts/check-philosophy.mjs",
     "docs:generate:errors": "node scripts/generate-error-reference.mjs",
     "docs:check:generated": "node scripts/generate-error-reference.mjs --check",
     "docs:generate:tools": "node scripts/generate-tools-reference.mjs",
     "docs:check:generated:tools": "node scripts/generate-tools-reference.mjs --check",
     "docs:generate:config": "node scripts/generate-config-reference.mjs",
     "docs:check:generated:config": "node scripts/generate-config-reference.mjs --check",
+    "docs:generate:events": "node scripts/generate-events-reference.mjs",
+    "docs:check:generated:events": "node scripts/generate-events-reference.mjs --check",
     "pack:check": "node scripts/check-pack.mjs",
     "architecture:check": "node scripts/architecture.mjs",
     "types:check": "tsc --noEmit",
-    "check": "npm test && npm run docs:check && npm run pack:check && npm run architecture:check && npm run types:check && npm run domain:check",
+    "check": "npm test && npm run docs:check && npm run docs:check:philosophy && npm run docs:check:generated && npm run docs:check:generated:tools && npm run docs:check:generated:config && npm run docs:check:generated:events && npm run surface:check && npm run pack:check && npm run architecture:check && npm run types:check && npm run domain:check",
     "domain:metrics": "node scripts/domain-metrics.mjs",
     "domain:check": "node scripts/domain-metrics.mjs --check"
   },

package/ports/archive.js

@@ -0,0 +1,18 @@
+// Terminal-mission archive port (#69). The readers/writers are store-agnostic:
+// they take the store port and the Tower paths, so the same archive logic runs
+// on the filesystem adapter and on an in-memory store.
+import { assertPort, definePort } from './contract.js'
+
+/**
+ * @typedef {object} ArchivePort
+ * @property {(store: unknown, paths: { dir: string }) => Promise<{ ok: boolean, file: string, missions: any[], error?: string, exists: boolean }>} readIndex
+ * @property {(store: unknown, paths: { dir: string }, missionId: string) => Promise<any>} readEntry
+ * @property {(store: unknown, paths: { dir: string }, input: { entries: any[], now?: number }) => Promise<any>} writeEntries
+ */
+
+export const ARCHIVE_PORT = definePort('ArchivePort', ['readIndex', 'readEntry', 'writeEntries'])
+
+/** @param {unknown} impl */
+export function assertArchivePort(impl) {
+  return /** @type {ArchivePort} */ (assertPort(impl, ARCHIVE_PORT, 'archive'))
+}

package/ports/caseSensitivity.js

@@ -0,0 +1,15 @@
+// Case-sensitivity probe port (#69). tower_init probes the checkout filesystem
+// once; a composition without a real filesystem injects its own answer.
+import { assertPort, definePort } from './contract.js'
+
+/**
+ * @typedef {object} CaseSensitivityPort
+ * @property {(root: string) => Promise<boolean | null>} detect
+ */
+
+export const CASE_SENSITIVITY_PORT = definePort('CaseSensitivityPort', ['detect'])
+
+/** @param {unknown} impl */
+export function assertCaseSensitivityPort(impl) {
+  return /** @type {CaseSensitivityPort} */ (assertPort(impl, CASE_SENSITIVITY_PORT, 'caseSensitivity'))
+}

package/ports/clock.js

@@ -1,6 +1,14 @@
-// Clock port (#56).
+// Clock port (#69).
+import { assertPort, definePort } from './contract.js'
+
 /**
  * @typedef {object} ClockPort
  * @property {() => number} now
  */
-export {}
+
+export const CLOCK_PORT = definePort('ClockPort', ['now'])
+
+/** @param {unknown} impl */
+export function assertClockPort(impl) {
+  return /** @type {ClockPort} */ (assertPort(impl, CLOCK_PORT, 'clock'))
+}

package/ports/config.js

@@ -0,0 +1,19 @@
+// Config port (#69).
+//
+// App use cases read the effective Tower config through this port. They do not
+// import host/config.js, so the process-level config store stays a property of
+// the composition root rather than a module-global dependency of the app.
+import { assertPort, definePort } from './contract.js'
+
+/**
+ * @typedef {object} ConfigPort
+ * @property {() => import('../types/index.js').TowerConfig} runtimeConfig
+ * @property {(repo: { root: string, commonDir: string, branch?: string|null }) => Promise<import('../types/index.js').TowerConfig>} resolveRepoConfig
+ */
+
+export const CONFIG_PORT = definePort('ConfigPort', ['runtimeConfig', 'resolveRepoConfig'])
+
+/** @param {unknown} impl */
+export function assertConfigPort(impl) {
+  return /** @type {ConfigPort} */ (assertPort(impl, CONFIG_PORT, 'config'))
+}