harnery 0.35.0 → 0.36.0

package/dist/core/events/v3/producers/diagnostic-summaries.js

@@ -0,0 +1,499 @@
+import { createHash, randomUUID } from "node:crypto";
+import { appendFileSync, chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { hostname } from "node:os";
+import { join, resolve } from "node:path";
+import { coordEnv } from "../../../../lib/env.js";
+import { fsyncParentDirectory } from "../../../workflow/durable-record.js";
+import { acquireNoClobberLease } from "../../../workflow/workspaces/leases.js";
+import { EVENT_V3_LEDGER_RELATIVE_ROOT } from "../writer.js";
+/**
+ * Producer-side bound on duplicate diagnostic file creation.
+ *
+ * A producer fault can emit the same diagnostic thousands of times per day,
+ * and every emission used to become one loose file in the diagnostics spool.
+ * This module keeps the first bounded loose exemplars per
+ * (category, reason, instance) key and UTC day unchanged, then coalesces
+ * further identical emissions into one deterministic summary file per key and
+ * window, preserving the exact logical count, first and last times,
+ * represented bytes, hourly rate buckets, and bounded exemplar digests.
+ *
+ * Below the bound the gate creates no state at all: admitted loose filenames
+ * carry the key digest as a suffix, and the gate counts a key's emissions for
+ * the window from those filenames alone. A summary file and its short-lived
+ * per-key lease exist only for a key that actually crossed the bound, so a
+ * healthy spool gains zero files and zero directories from this mitigation.
+ *
+ * The mitigation is fail-open: any count, lease, read, or publish failure
+ * admits the loose diagnostic exactly as before and appends to a lock-free,
+ * size-capped emergency log. It never deletes, moves, or rewrites an existing
+ * loose diagnostic, and it never calls back into the diagnostic writer.
+ */
+export const DIAGNOSTIC_SUMMARY_FORMAT = "harnery-v3-diagnostic-summary";
+export const DIAGNOSTIC_SUMMARY_VERSION = 1;
+/**
+ * Loose exemplars admitted per (category, reason, instance) key per UTC day
+ * before identical emissions coalesce into the key's summary. Frozen from a
+ * whole-history measurement: healthy categories peak well under this value
+ * per day across ALL keys combined, while a producer fault exceeds it within
+ * minutes. The bound is enforced from filename counts without cross-process
+ * locking, so simultaneous writers straddling the crossing can admit a few
+ * extra exemplars; the bound is a flood stop, not an exact quota.
+ */
+export const DIAGNOSTIC_LOOSE_EXEMPLAR_LIMIT = 32;
+/** Bounded exemplar digests retained inside one summary. */
+const SUMMARY_EXEMPLAR_LIMIT = 4;
+/**
+ * Hourly rate buckets retained inside one summary. One summary covers one UTC
+ * day, so at most 24 buckets are reachable; the margin absorbs clock skew.
+ * Consumer windows wider than a day (doctor reads 48h) span multiple
+ * day-scoped summary files, not more buckets in one file.
+ */
+const SUMMARY_HOUR_BUCKET_LIMIT = 26;
+/** Refuse to publish a summary larger than this; falls open to loose writes. */
+const SUMMARY_MAX_BYTES = 128 * 1024;
+/** Coalesce updates fsync only every Nth increment; a crash between durable
+ * points can lose at most this many recent increments from the summary. */
+const SUMMARY_DURABLE_EVERY = 32;
+/** Stop appending to the emergency fail-open log past this size. */
+const MITIGATION_HEALTH_MAX_BYTES = 256 * 1024;
+export const DIAGNOSTIC_MITIGATION_HEALTH_FILE = "mitigation-health.ndjson";
+const LEASE_STALE_AFTER_MS = 5_000;
+const LEASE_RETRIES = 4;
+const LEASE_RETRY_MS = 10;
+const METADATA_KEY_LIMIT = 16;
+const METADATA_VALUE_LIMIT = 256;
+/** Extracts the 15-digit epoch-ms segment of a loose diagnostic order key. */
+const LOOSE_ORDER_KEY_TIMESTAMP = /-(\d{15})-\d{20}-/;
+const sleepCell = new Int32Array(new SharedArrayBuffer(4));
+export function diagnosticSummariesRootV3(coordRoot) {
+    return join(resolve(coordRoot), EVENT_V3_LEDGER_RELATIVE_ROOT, "diagnostic-summaries");
+}
+function looseDiagnosticsRootV3(coordRoot) {
+    return join(resolve(coordRoot), EVENT_V3_LEDGER_RELATIVE_ROOT, "diagnostics");
+}
+export function diagnosticSummariesEnabledV3() {
+    return coordEnv("V3_DIAGNOSTIC_SUMMARIES") !== "0";
+}
+function sanitizeComponent(value, fallback) {
+    if (typeof value !== "string" || value.length === 0)
+        return fallback;
+    const safe = value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 128);
+    return safe.length > 0 ? safe : fallback;
+}
+function keyDigest(category, reason, instanceId) {
+    return createHash("sha256")
+        .update(`${category}\n${reason}\n${instanceId}`)
+        .digest("hex")
+        .slice(0, 16);
+}
+function utcDay(nowMs) {
+    return new Date(nowMs).toISOString().slice(0, 10);
+}
+function utcHour(nowMs) {
+    return new Date(nowMs).toISOString().slice(0, 13);
+}
+function summaryPath(root, category, window, digest) {
+    return join(root, `${category}-${window.replaceAll("-", "")}-${digest}.json`);
+}
+function ensureOwnerOnlyDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    chmodSync(path, 0o700);
+}
+function publishOwnerOnlyJson(path, value, durable) {
+    const contents = `${JSON.stringify(value)}\n`;
+    if (Buffer.byteLength(contents, "utf8") > SUMMARY_MAX_BYTES) {
+        throw new Error("diagnostic summary exceeds its size bound");
+    }
+    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+    let fd;
+    try {
+        fd = openSync(temporary, "wx", 0o600);
+        writeFileSync(fd, contents, "utf8");
+        if (durable)
+            fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        renameSync(temporary, path);
+        if (durable)
+            fsyncParentDirectory(path);
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+function pidIsAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== "ESRCH";
+    }
+}
+function withKeyLease(root, digest, operation) {
+    const leasesDir = join(root, "leases");
+    ensureOwnerOnlyDirectory(leasesDir);
+    const leaseDir = join(leasesDir, digest);
+    const authority = createHash("sha256").update(resolve(root)).digest("hex");
+    let lease;
+    for (let attempt = 0; attempt < LEASE_RETRIES; attempt += 1) {
+        try {
+            lease = acquireNoClobberLease({
+                path: leaseDir,
+                scope: "event-v3-diagnostic-summary",
+                authoritySha256: authority,
+                staleAfterMs: LEASE_STALE_AFTER_MS,
+                validateStaleOwner: (owner) => owner.host === hostname() && !pidIsAlive(owner.pid),
+            });
+            break;
+        }
+        catch (error) {
+            if (attempt === LEASE_RETRIES - 1)
+                throw error;
+            Atomics.wait(sleepCell, 0, 0, LEASE_RETRY_MS);
+        }
+    }
+    if (!lease)
+        throw new Error("diagnostic summary lease is busy");
+    try {
+        return operation();
+    }
+    finally {
+        // A durably published result must survive release-time faults (an epoch
+        // rotation can remove the lease state mid-operation); stale takeover
+        // recovers any residue. The empty lease directory is removed so per-key
+        // lease state never outlives the contention that needed it.
+        try {
+            lease.release();
+        }
+        catch {
+            // Swallowed: the operation's outcome already stands.
+        }
+        try {
+            rmdirSync(leaseDir);
+        }
+        catch {
+            // A concurrent acquirer repopulated it, or release left residue.
+        }
+    }
+}
+/**
+ * Count the key's admitted loose exemplars for a UTC-day window from their
+ * digest-suffixed filenames. Files written before this mitigation carry no
+ * suffix and are not counted, so a pre-existing flood does not consume the
+ * window's exemplar budget.
+ */
+function countLooseExemplars(coordRoot, digest, window) {
+    const directory = looseDiagnosticsRootV3(coordRoot);
+    if (!existsSync(directory))
+        return 0;
+    const windowStartMs = Date.parse(`${window}T00:00:00.000Z`);
+    const windowEndMs = windowStartMs + 24 * 60 * 60 * 1000;
+    const suffix = `-${digest}.json`;
+    let count = 0;
+    for (const name of readdirSync(directory)) {
+        if (!name.endsWith(suffix))
+            continue;
+        const epochMs = Number(LOOSE_ORDER_KEY_TIMESTAMP.exec(name)?.[1]);
+        if (Number.isFinite(epochMs) && epochMs >= windowStartMs && epochMs < windowEndMs) {
+            count += 1;
+        }
+    }
+    return count;
+}
+function boundedMetadata(metadata) {
+    const bounded = {};
+    let kept = 0;
+    for (const [key, value] of Object.entries(metadata)) {
+        if (kept >= METADATA_KEY_LIMIT)
+            break;
+        if (typeof value === "string" && value.length > METADATA_VALUE_LIMIT)
+            continue;
+        bounded[key] = value;
+        kept += 1;
+    }
+    return bounded;
+}
+function pruneHourBuckets(buckets, nowMs) {
+    const keys = Object.keys(buckets).sort();
+    const horizon = utcHour(nowMs - SUMMARY_HOUR_BUCKET_LIMIT * 60 * 60 * 1000);
+    const pruned = {};
+    for (const key of keys) {
+        if (key >= horizon)
+            pruned[key] = buckets[key];
+    }
+    // A pathological clock can still grow the map; hard-cap by newest keys.
+    const capped = Object.keys(pruned).sort().slice(-SUMMARY_HOUR_BUCKET_LIMIT);
+    const result = {};
+    for (const key of capped)
+        result[key] = pruned[key];
+    return result;
+}
+function freshSummary(category, reason, instanceId, window) {
+    return {
+        format: DIAGNOSTIC_SUMMARY_FORMAT,
+        format_version: DIAGNOSTIC_SUMMARY_VERSION,
+        category,
+        reason,
+        instance_id: instanceId,
+        window,
+        loose_count: 0,
+        summarized_count: 0,
+        first_summarized_at: null,
+        last_summarized_at: null,
+        represented_bytes: 0,
+        exemplars: [],
+        metadata: {},
+        recent_hours: {},
+    };
+}
+function readSummaryFile(path) {
+    let parsed;
+    try {
+        const metadata = lstatSync(path);
+        if (!metadata.isFile() || metadata.isSymbolicLink())
+            return undefined;
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return undefined;
+    const summary = parsed;
+    if (summary.format !== DIAGNOSTIC_SUMMARY_FORMAT ||
+        summary.format_version !== DIAGNOSTIC_SUMMARY_VERSION ||
+        typeof summary.category !== "string" ||
+        typeof summary.reason !== "string" ||
+        typeof summary.instance_id !== "string" ||
+        !/^\d{4}-\d{2}-\d{2}$/.test(summary.window) ||
+        !Number.isSafeInteger(summary.loose_count) ||
+        summary.loose_count < 0 ||
+        !Number.isSafeInteger(summary.summarized_count) ||
+        summary.summarized_count < 0 ||
+        !Number.isSafeInteger(summary.represented_bytes) ||
+        summary.represented_bytes < 0 ||
+        !Array.isArray(summary.exemplars) ||
+        !summary.recent_hours ||
+        typeof summary.recent_hours !== "object" ||
+        Array.isArray(summary.recent_hours)) {
+        return undefined;
+    }
+    // Drop malformed rate buckets so a corrupt value can neither poison later
+    // increments nor silently diverge windowed counts from the total.
+    const hours = {};
+    for (const [key, value] of Object.entries(summary.recent_hours)) {
+        if (/^\d{4}-\d{2}-\d{2}T\d{2}$/.test(key) && Number.isSafeInteger(value) && value >= 0) {
+            hours[key] = value;
+        }
+    }
+    summary.recent_hours = hours;
+    return summary;
+}
+/**
+ * Append one line to the emergency fail-open log. Lock-free by design: an
+ * O_APPEND write of one small line is atomic, so concurrent fail-opens never
+ * serialize on shared state. Best-effort, size-capped, and nonrecursive: a
+ * failure here is swallowed, never diagnosed, and never blocks the loose
+ * fallback write.
+ */
+function recordFailOpen(root, stage, nowMs) {
+    try {
+        ensureOwnerOnlyDirectory(root);
+        const path = join(root, DIAGNOSTIC_MITIGATION_HEALTH_FILE);
+        try {
+            if (statSync(path).size >= MITIGATION_HEALTH_MAX_BYTES)
+                return;
+        }
+        catch {
+            // Missing log starts fresh.
+        }
+        const line = JSON.stringify({ at: new Date(nowMs).toISOString(), stage, pid: process.pid });
+        appendFileSync(path, `${line}\n`, { mode: 0o600 });
+    }
+    catch {
+        // The emergency log may undercount when storage is unavailable; it is a
+        // signal, not accounting, and must never throw into the producer path.
+    }
+}
+function readMitigationHealth(path) {
+    let contents;
+    let size = 0;
+    try {
+        const metadata = lstatSync(path);
+        if (!metadata.isFile() || metadata.isSymbolicLink())
+            return null;
+        size = metadata.size;
+        contents = readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const health = {
+        fail_open_count: 0,
+        last_fail_open_at: null,
+        by_stage: {},
+        truncated: size >= MITIGATION_HEALTH_MAX_BYTES,
+    };
+    for (const line of contents.split("\n")) {
+        if (line.trim().length === 0)
+            continue;
+        // Every non-empty line was one fail-open, even a torn one.
+        health.fail_open_count += 1;
+        try {
+            const row = JSON.parse(line);
+            if (typeof row.at === "string")
+                health.last_fail_open_at = row.at;
+            if (typeof row.stage === "string" && row.stage.length <= 32) {
+                if (Object.keys(health.by_stage).length < 16 || health.by_stage[row.stage] !== undefined) {
+                    health.by_stage[row.stage] = (health.by_stage[row.stage] ?? 0) + 1;
+                }
+            }
+        }
+        catch {
+            // A torn tail line still counts above.
+        }
+    }
+    return health;
+}
+/**
+ * Decide whether one diagnostic emission may become a loose file.
+ *
+ * Below the per-key bound (counted from digest-suffixed loose filenames) the
+ * emission is admitted with the suffix to append, and no summary or lease
+ * state is created. At or past the bound the emission is durably coalesced
+ * into the key's summary under a short per-key lease and `admit: false` is
+ * returned with the summary path. Any mitigation failure, and the disabled
+ * gate, admit the loose write exactly as before.
+ */
+export function gateProducerDiagnosticV3(coordRoot, input, nowMs = Date.now()) {
+    if (!diagnosticSummariesEnabledV3())
+        return { admit: true, loose_name_suffix: "" };
+    const at = Number.isFinite(nowMs) ? nowMs : Date.now();
+    const category = sanitizeComponent(input.category, "unknown");
+    const reason = sanitizeComponent(input.reason, "none");
+    const instanceId = sanitizeComponent(input.instanceId, "unknown");
+    const window = utcDay(at);
+    const digest = keyDigest(category, reason, instanceId);
+    const admitLoose = { admit: true, loose_name_suffix: `-${digest}` };
+    const root = diagnosticSummariesRootV3(coordRoot);
+    let stage = "peek";
+    try {
+        const path = summaryPath(root, category, window, digest);
+        if (!readSummaryFile(path)) {
+            stage = "count";
+            if (countLooseExemplars(coordRoot, digest, window) < DIAGNOSTIC_LOOSE_EXEMPLAR_LIMIT) {
+                return admitLoose;
+            }
+        }
+        stage = "coalesce";
+        ensureOwnerOnlyDirectory(root);
+        return withKeyLease(root, digest, () => {
+            const existing = readSummaryFile(path);
+            const state = existing ?? freshSummary(category, reason, instanceId, window);
+            if (!existing)
+                state.loose_count = countLooseExemplars(coordRoot, digest, window);
+            const atIso = new Date(at).toISOString();
+            state.summarized_count += 1;
+            state.first_summarized_at ??= atIso;
+            state.last_summarized_at = atIso;
+            if (Number.isSafeInteger(input.fingerprint?.bytes) && input.fingerprint.bytes >= 0) {
+                state.represented_bytes += input.fingerprint.bytes;
+            }
+            if (state.exemplars.length < SUMMARY_EXEMPLAR_LIMIT && input.fingerprint) {
+                state.exemplars.push({
+                    bytes: input.fingerprint.bytes,
+                    sha256: input.fingerprint.sha256,
+                });
+            }
+            if (Object.keys(state.metadata).length === 0) {
+                state.metadata = boundedMetadata(input.metadata ?? {});
+            }
+            const hour = utcHour(at);
+            state.recent_hours[hour] = (state.recent_hours[hour] ?? 0) + 1;
+            state.recent_hours = pruneHourBuckets(state.recent_hours, at);
+            const durable = !existing || state.summarized_count % SUMMARY_DURABLE_EVERY === 0;
+            publishOwnerOnlyJson(path, state, durable);
+            return { admit: false, summary_path: path };
+        });
+    }
+    catch {
+        recordFailOpen(root, stage, at);
+        return admitLoose;
+    }
+}
+/**
+ * Read every summary in the active epoch's `diagnostic-summaries/` subtree.
+ * Skips lease state, temp files, and the mitigation health log (which is
+ * aggregated into `mitigation_health` instead). Never throws; a missing
+ * subtree returns an empty listing.
+ */
+export function listDiagnosticSummariesV3(coordRoot) {
+    const root = diagnosticSummariesRootV3(coordRoot);
+    const listing = {
+        summaries: [],
+        file_count: 0,
+        unreadable_count: 0,
+        mitigation_health: null,
+    };
+    let names;
+    try {
+        const metadata = lstatSync(root);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink())
+            return listing;
+        names = readdirSync(root);
+    }
+    catch {
+        return listing;
+    }
+    for (const name of names.sort()) {
+        if (name === "leases" || name.includes(".tmp-"))
+            continue;
+        if (name.startsWith("mitigation-health")) {
+            if (name === DIAGNOSTIC_MITIGATION_HEALTH_FILE) {
+                listing.mitigation_health = readMitigationHealth(join(root, name));
+            }
+            continue;
+        }
+        if (!name.endsWith(".json"))
+            continue;
+        listing.file_count += 1;
+        const summary = readSummaryFile(join(root, name));
+        if (summary)
+            listing.summaries.push(summary);
+        else
+            listing.unreadable_count += 1;
+    }
+    return listing;
+}
+/**
+ * Sum summarized-only occurrences inside a lookback window, from hour
+ * buckets. Hour-granular and conservative: a bucket is counted only when its
+ * whole hour lies inside `[sinceMs, nowMs]`, so a boundary bucket is excluded
+ * (up to 59 minutes undercounted) rather than fully included (up to 59
+ * minutes overcounted), and a future-dated bucket from clock skew never
+ * inflates a window.
+ */
+export function countSummarizedSinceV3(summaries, sinceMs, filter, nowMs = Date.now()) {
+    let count = 0;
+    for (const summary of summaries) {
+        if (filter && !filter(summary))
+            continue;
+        for (const [hour, value] of Object.entries(summary.recent_hours)) {
+            const hourStartMs = Date.parse(`${hour}:00:00.000Z`);
+            if (Number.isFinite(hourStartMs) &&
+                hourStartMs >= sinceMs &&
+                hourStartMs <= nowMs &&
+                Number.isSafeInteger(value) &&
+                value > 0) {
+                count += value;
+            }
+        }
+    }
+    return count;
+}

package/dist/core/events/v3/producers/hook-base.js

@@ -320,7 +320,7 @@ function turnRitualObservation(adapter, evidence) {
 function inputContextMeasurement(payload, phase) {
     const metadata = plainRecord(payload.raw.compact_metadata);
     const usedKeys = phase === "before"
-        ? ["pre_tokens", "pre_compact_tokens", "used_tokens"]
+        ? ["pre_tokens", "pre_compact_tokens", "used_tokens", "context_tokens"]
         : ["post_tokens", "post_compact_tokens", "used_tokens"];
     const limitKeys = [
         "context_window_size",

package/dist/core/events/v3/producers/intake.d.ts

@@ -65,6 +65,13 @@ export declare function removeIntakeRecordV3(path: string): void;
  * are reduced to byte counts and digests so the diagnostics spool never holds
  * prompt, tool input, or tool output bodies (invariant: delivered evidence is
  * never silently destroyed, and never re-exposed either).
+ *
+ * Identical emissions are bounded per (category, reason, instance) key and
+ * UTC day: past the loose-exemplar limit the emission is coalesced into the
+ * key's summary file. Returns the path of the durable record either way (the
+ * loose file when admitted, the summary file when coalesced); `undefined`
+ * means nothing durable was written. The gate is fail-open, so a mitigation
+ * failure still produces the loose file.
  */
 export declare function writeProducerDiagnosticV3(coordRoot: string, category: string, record: Record<string, unknown>): string | undefined;
 export {};

package/dist/core/events/v3/producers/intake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/producers/intake.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;;;;;;GAWG;AAEH,QAAA,MAAM,aAAa,EAAG,wBAAiC,CAAC;AACxD,QAAA,MAAM,cAAc,EAAG,CAAU,CAAC;AAwClC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,aAAa,CAAC;IAC7B,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,eAAe,CAAC,EAAE;QAChB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;QAC/B,oBAAoB,EAAE,OAAO,MAAM,EAAE,CAAC;QACtC,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,OAAO,MAAM,EAAE,CAAC;KACrC,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAUD,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,MAAM,EAAE,GAC3B,MAAM,CAER;AA+BD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,OAAO,MAAM,EAAE,EAC5B,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAOR;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAsB7E;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAc9E;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvD;AAkED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,GAAG,SAAS,CAiBpB"}
+{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/producers/intake.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;;;;;;GAWG;AAEH,QAAA,MAAM,aAAa,EAAG,wBAAiC,CAAC;AACxD,QAAA,MAAM,cAAc,EAAG,CAAU,CAAC;AA4ClC,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,aAAa,CAAC;IAC7B,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,eAAe,CAAC,EAAE;QAChB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;QAC/B,oBAAoB,EAAE,OAAO,MAAM,EAAE,CAAC;QACtC,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,OAAO,MAAM,EAAE,CAAC;KACrC,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACxC;AAUD,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,OAAO,MAAM,EAAE,GAC3B,MAAM,CAER;AA+BD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,OAAO,MAAM,EAAE,EAC5B,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAOR;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAsB7E;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAc9E;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvD;AAkED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,GAAG,SAAS,CA8BpB"}

package/dist/core/events/v3/producers/intake.js

@@ -3,6 +3,7 @@ import { chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, open
 import { join, resolve } from "node:path";
 import { fsyncParentDirectory } from "../../../workflow/durable-record.js";
 import { EVENT_V3_LEDGER_RELATIVE_ROOT } from "../writer.js";
+import { gateProducerDiagnosticV3, } from "./diagnostic-summaries.js";
 /**
  * Durable intake spool for hook signals, plus the producer diagnostics spool.
  *
@@ -54,6 +55,10 @@ const DIAGNOSTIC_METADATA_KEYS = new Set([
     "sequence",
     "expected",
     "actual",
+    "thread_id_present",
+    "wslenv_present",
+    "wslenv_names",
+    "identity_recovery_source",
 ]);
 function intakeRoot(coordRoot) {
     return join(resolve(coordRoot), EVENT_V3_LEDGER_RELATIVE_ROOT, "intake", "hook");
@@ -212,17 +217,35 @@ function validTurnRitual(value) {
  * are reduced to byte counts and digests so the diagnostics spool never holds
  * prompt, tool input, or tool output bodies (invariant: delivered evidence is
  * never silently destroyed, and never re-exposed either).
+ *
+ * Identical emissions are bounded per (category, reason, instance) key and
+ * UTC day: past the loose-exemplar limit the emission is coalesced into the
+ * key's summary file. Returns the path of the durable record either way (the
+ * loose file when admitted, the summary file when coalesced); `undefined`
+ * means nothing durable was written. The gate is fail-open, so a mitigation
+ * failure still produces the loose file.
  */
 export function writeProducerDiagnosticV3(coordRoot, category, record) {
     try {
         const safeCategory = category.replace(/[^a-z0-9_-]/gi, "_").slice(0, 64);
+        const redacted = redactDiagnosticRecord(record);
+        const { content_fingerprint: fingerprint, ...metadata } = redacted;
+        const decision = gateProducerDiagnosticV3(coordRoot, {
+            category: safeCategory,
+            reason: typeof record.reason === "string" ? record.reason : undefined,
+            instanceId: typeof record.instance_id === "string" ? record.instance_id : undefined,
+            fingerprint: fingerprint,
+            metadata: metadata,
+        });
+        if (!decision.admit)
+            return decision.summary_path;
         const root = diagnosticsRoot(coordRoot);
         ensureOwnerOnlyDirectory(root);
-        const path = join(root, `${safeCategory}-${intakeOrderKey()}.json`);
+        const path = join(root, `${safeCategory}-${intakeOrderKey()}${decision.loose_name_suffix}.json`);
         const contents = `${JSON.stringify({
             recorded_at: new Date().toISOString(),
             category: safeCategory,
-            ...redactDiagnosticRecord(record),
+            ...redacted,
         })}\n`;
         writeOwnerOnlyFileDurably(path, contents);
         return path;

package/dist/core/events/v3/producers/producer-state-observer.d.ts

@@ -0,0 +1,8 @@
+export interface HookProducerStateSummaryV3 {
+    generation_id: `gen_${string}`;
+    open_span_count: number;
+    turn_open: boolean;
+}
+/** Read the narrow producer-state facts needed by passive coordination views. */
+export declare function listHookProducerStateSummariesV3(coordRoot: string): HookProducerStateSummaryV3[];
+//# sourceMappingURL=producer-state-observer.d.ts.map

package/dist/core/events/v3/producers/producer-state-observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"producer-state-observer.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/producers/producer-state-observer.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,iFAAiF;AACjF,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,0BAA0B,EAAE,CAuChG"}

package/dist/core/events/v3/producers/producer-state-observer.js

@@ -0,0 +1,45 @@
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { readEventV3ControlState } from "../control.js";
+import { EVENT_V3_LEDGER_RELATIVE_ROOT } from "../reader.js";
+/** Read the narrow producer-state facts needed by passive coordination views. */
+export function listHookProducerStateSummariesV3(coordRoot) {
+    const control = readEventV3ControlState(coordRoot);
+    if (control.state !== "candidate" && control.state !== "active")
+        return [];
+    const producerRoot = join(resolve(coordRoot), EVENT_V3_LEDGER_RELATIVE_ROOT, "private-producers");
+    if (!existsSync(producerRoot))
+        return [];
+    const summaries = [];
+    for (const adapter of ["claude-code", "codex", "cursor"]) {
+        const directory = join(producerRoot, adapter);
+        if (!existsSync(directory))
+            continue;
+        const directoryMetadata = lstatSync(directory);
+        if (!directoryMetadata.isDirectory() || directoryMetadata.isSymbolicLink()) {
+            throw new Error("V3 producer state directory is unsafe");
+        }
+        for (const name of readdirSync(directory).filter((entry) => /^hid_[a-f0-9]{64}\.json$/.test(entry))) {
+            const file = join(directory, name);
+            const metadata = lstatSync(file);
+            if (!metadata.isFile() || metadata.isSymbolicLink())
+                continue;
+            const value = JSON.parse(readFileSync(file, "utf8"));
+            if (value.format !== "harnery-v3-hook-producer" ||
+                value.format_version !== 3 ||
+                value.adapter !== adapter ||
+                value.terminal === true ||
+                typeof value.generation_id !== "string" ||
+                !/^gen_[a-zA-Z0-9._-]+$/.test(value.generation_id) ||
+                !Array.isArray(value.spans)) {
+                continue;
+            }
+            summaries.push({
+                generation_id: value.generation_id,
+                open_span_count: value.spans.length,
+                turn_open: typeof value.current_turn_id === "string",
+            });
+        }
+    }
+    return summaries.sort((left, right) => left.generation_id.localeCompare(right.generation_id));
+}