instar 1.3.519 → 1.3.521

package/dashboard/index.html

@@ -815,18 +815,34 @@
     .mnd-bad { color: #f85149; border-color: #f8514955; font-weight: 700; }
     .mnd-deny { color: #d29922; border-color: #d2992255; }
     .mnd-dead { color: var(--text-dim); }
-    .mnd-meta { font-size: 13px; color: var(--text-dim); }
-    .mnd-authorities { margin: 0; padding-left: 18px; font-size: 13px; line-height: 1.7; }
+    /* Internals (id, fingerprints, scope slug, action slugs) are SUPPORT
+       metadata only — de-emphasized, never the headline (Operator-Surface
+       Quality item 2). */
+    .mnd-meta { font-size: 12px; color: var(--text-dim); }
+    /* The card's plain-language headline sentence — the primary content. */
+    .mnd-summary { margin: 0; font-size: 15px; line-height: 1.5; color: var(--text-bright); }
     .mnd-empty { font-size: 16px; color: var(--text-dim); line-height: 1.6; padding: 12px 0; }
-    .mnd-revoke-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+    .mnd-revoke-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; margin: 8px 0 4px; }
     .mnd-pin { width: 110px; } .mnd-reason { flex: 1; min-width: 160px; }
     .mnd-btn { padding: 6px 14px; cursor: pointer; }
-    .mnd-btn-danger { color: #f85149; }
+    .mnd-btn-primary { font-weight: 600; }
+    /* Destructive action: quiet by design, never featured (item 3). */
+    .mnd-btn-danger { color: #f85149; font-weight: 400; }
     .mnd-dead-note { font-size: 13px; color: var(--text-dim); font-style: italic; }
     .mnd-grants-head { font-size: 13px; color: var(--text-dim); }
-    .mnd-grants { margin: 0; padding-left: 18px; font-size: 13px; line-height: 1.7; }
-    .mnd-grant-details { font-size: 13px; }
-    .mnd-grant-summary { cursor: pointer; color: var(--text-dim); }
+    .mnd-grants { margin: 0; padding-left: 18px; font-size: 14px; line-height: 1.7; }
+    .mnd-grant-id { color: var(--text-dim); font-size: 12px; }
+    /* The grant form is the card's PRIMARY action — an open, titled block, never
+       a collapsed toggle (Operator-Surface Quality item 1). */
+    .mnd-grant-block { border-top: 1px solid var(--border); padding-top: 10px; margin-top: 2px; }
+    .mnd-grant-title { font-size: 14px; font-weight: 600; color: var(--text-bright); margin-bottom: 6px; }
+    .mnd-grant-sep { font-size: 13px; color: var(--text-dim); }
+    /* Revoke is demoted to a quiet, collapsed secondary control (item 3). */
+    .mnd-revoke-details { font-size: 13px; margin-top: 4px; }
+    .mnd-revoke-summary { cursor: pointer; color: var(--text-dim); font-size: 13px; }
+    .mnd-about { font-size: 14px; color: var(--text-dim); margin-top: -8px; }
+    .mnd-about summary { cursor: pointer; }
+    .mnd-about p { margin: 8px 0 0; line-height: 1.55; }
     .mnd-grant-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; margin: 8px 0 4px; }
     .mnd-grant-field { min-width: 130px; max-width: 100%; padding: 6px 8px; }
     .mnd-notice { min-height: 20px; font-size: 14px; color: #3fb950; }
@@ -842,9 +858,19 @@
     .mnd-notice-ok { border: 1px solid #15803d; background: rgba(21, 128, 61, 0.12); color: #86efac; padding: 12px 14px; border-radius: 8px; font-size: 17px; font-weight: 600; line-height: 1.5; }
     .mnd-table { width: 100%; border-collapse: collapse; font-size: 13px; }
     .mnd-table th, .mnd-table td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
-    .mnd-reason-cell { color: var(--text-dim); max-width: 420px; }
-    .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; }
+    .mnd-reason-cell { color: var(--text-dim); }
+    .mnd-audit-head { display: flex; gap: 12px; align-items: center; margin-bottom: 8px; flex-wrap: wrap; }
     .mnd-dim { font-size: 13px; color: var(--text-dim); }
+    /* Mobile-first (item 5): at phone width the 5-column audit table stacks into
+       labelled rows so the reason — the useful column — is never truncated. */
+    @media (max-width: 640px) {
+      .mnd-table thead { position: absolute; left: -9999px; }
+      .mnd-table tr { display: block; border: 1px solid var(--border); border-radius: 8px; margin-bottom: 10px; padding: 6px 4px; }
+      .mnd-table td { display: flex; justify-content: space-between; gap: 12px; border-bottom: none; padding: 4px 8px; }
+      .mnd-table td::before { content: attr(data-label); font-weight: 600; color: var(--text-dim); flex: 0 0 auto; }
+      .mnd-reason-cell { text-align: right; word-break: break-word; }
+      .mnd-grant-field, .mnd-pin, .mnd-reason { width: 100%; min-width: 0; flex: 1 1 100%; }
+    }
 
     /* ── process-health tab (PROCESS-HEALTH-DASHBOARD-TAB-SPEC §4.1) ──
        Large, readable, calm. No monospace, no tables, no alarm colors.
@@ -3384,7 +3410,11 @@
         <h2 class="ph-title">Coordination Mandates</h2>
         <div id="mndStamp" class="ph-stamp" aria-live="polite"></div>
       </div>
-      <p class="ph-intro">Your bounded "permission slips" for autonomous agent-to-agent work. The slip — never the agent — is the authorizer. Issuing and revoking require <strong>your dashboard PIN</strong>; agent credentials alone are refused by design. With no slip issued, every delegated action is denied.</p>
+      <p class="ph-intro">Permission slips you sign with your PIN to let your agents do bounded work together.</p>
+      <details class="mnd-about">
+        <summary>What is this?</summary>
+        <p>These are your permission slips for autonomous agent-to-agent work — each one authorizes a specific, bounded task. The slip — never the agent — is the authorizer. Issuing and revoking require <strong>your dashboard PIN</strong>; an agent's own credentials are refused by design. With no slip issued, every delegated action is denied.</p>
+      </details>
       <div id="mndNotice" class="mnd-notice" aria-live="polite"></div>
       <section class="ph-section">
         <h3 class="ph-h">Issued mandates</h3>

package/dashboard/mandates.js

@@ -61,12 +61,72 @@ function fmtWhen(iso) {
   } catch { return String(iso); }
 }
 
-function userLabel(slackUserId, slackUsers) {
+/** The registry name for a Slack id, or the id itself when we don't know them. */
+function userName(slackUserId, slackUsers) {
   const u = (slackUsers || []).find((x) => x.slackUserId === slackUserId);
-  return u ? `${u.name} (${slackUserId})` : slackUserId;
+  return u ? u.name : slackUserId;
 }
 
-/** The grants a mandate already carries, in operator language. */
+// Operator-Surface Quality (constitution): the card speaks plain language, never
+// the slugs/JSON the data model stores. These maps turn the stored enum/bounds
+// into the sentence a non-engineer would say. Unknown values fall back to a
+// de-slugified phrase — never a raw token dumped at the operator.
+
+// Both the coordination-mandate authority actions AND the RolePolicy floor
+// actions, in plain language. Returns the RAW human string; callers esc() it.
+const ACTION_PHRASES = {
+  'exchange-read-credential': 'exchange a read-only credential',
+  'sign-code-review': 'co-sign a code review',
+  'money-movement': 'move money',
+  'prod-deploy': 'deploy to production',
+  'credential-access': 'use a credential',
+  'destructive-data': 'run a destructive data operation',
+  'external-send': 'send something externally',
+  'grant-authority': 'grant authority to others',
+};
+function humanAction(slug) {
+  const s = String(slug ?? '');
+  return ACTION_PHRASES[s] || s.replace(/-/g, ' ');
+}
+
+/** "you" when the authorizer is the operator-via-PIN; otherwise the raw name. */
+function humanAuthorizer(authorizedBy) {
+  const s = String(authorizedBy ?? '');
+  return /operator|dashboard pin/i.test(s) ? 'you' : s;
+}
+
+/** A short title from the operator's scope name (de-slugified, not the raw slug). */
+function humanScope(scope) {
+  const s = String(scope ?? '').trim();
+  if (!s) return 'Permission slip';
+  const words = s.replace(/[-_]+/g, ' ');
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+
+/** Join phrases the way a person speaks them: "a, b and c". */
+function joinHuman(parts) {
+  if (parts.length === 0) return '';
+  if (parts.length === 1) return parts[0];
+  return parts.slice(0, -1).join(', ') + ' and ' + parts[parts.length - 1];
+}
+
+/**
+ * One plain sentence describing what the mandate authorizes + when it ends —
+ * the card's primary, human-language headline (no slugs, no JSON, no
+ * fingerprints). Each interpolated action is escaped at the call site.
+ */
+function humanSummary(m) {
+  const acts = (m.authorities || []).map((a) => esc(humanAction(a.action)));
+  const agents = (m.agents || []).filter(Boolean);
+  const who = agents.length >= 2 ? 'two agents' : 'an agent';
+  const when = fmtWhen(m.expiresAt);
+  if (acts.length === 0) {
+    return `A permission slip for ${who} that delegates no actions yet. Expires ${when}.`;
+  }
+  return `Lets ${who} ${joinHuman(acts)}. Expires ${when}.`;
+}
+
+/** The grants a mandate already carries, in plain operator language. */
 export function renderGrants(m, slackUsers) {
   const grants = Array.isArray(m.grants) ? m.grants : [];
   if (grants.length === 0) return '';
@@ -75,16 +135,22 @@ export function renderGrants(m, slackUsers) {
     const badge = expired
       ? '<span class="mnd-badge mnd-dead">expired</span>'
       : '<span class="mnd-badge mnd-ok">active</span>';
-    return `<li>${badge} <strong>${esc(userLabel(g.grantedTo, slackUsers))}</strong> may <code>${esc(g.floorAction)}</code> until ${fmtWhen(g.expiresAt)} — authorized by ${esc(g.authorizedBy)}</li>`;
+    const name = userName(g.grantedTo, slackUsers);
+    // The Slack id is support metadata, never the headline — shown muted only
+    // when it differs from the name we render (an unknown id IS the name).
+    const idDetail = name !== g.grantedTo ? ` <span class="mnd-grant-id">(${esc(g.grantedTo)})</span>` : '';
+    return `<li>${badge} <strong>${esc(name)}</strong>${idDetail} can ${esc(humanAction(g.floorAction))} until ${fmtWhen(g.expiresAt)} — authorized by ${esc(humanAuthorizer(g.authorizedBy))}</li>`;
   }).join('');
-  return `<div class="mnd-grants-head">User grants this mandate carries:</div><ul class="mnd-grants">${rows}</ul>`;
+  return `<div class="mnd-grants-head">Who this slip already lets act:</div><ul class="mnd-grants">${rows}</ul>`;
 }
 
 /**
- * The add-grant form for an ACTIVE mandate. Mobile-first by design (the
- * 2026-06-12 lesson, instar#1080): the operator PICKS a person and a duration —
- * the only thing typed is the PIN. A free-text Slack-id input appears only
- * when the user registry has nobody to offer.
+ * The add-grant form for an ACTIVE mandate — the card's PRIMARY action, always
+ * visible (Operator-Surface Quality: lead with the primary action, never behind
+ * a toggle). Mobile-first (the 2026-06-12 lesson, instar#1080): the operator
+ * PICKS a person and a duration — the only thing typed is the PIN. A free-text
+ * Slack-id input appears only when the user registry has nobody to offer. Action
+ * labels read in plain language; the slug is the option VALUE the server needs.
  */
 export function renderGrantForm(m, slackUsers) {
   const users = (slackUsers || []).filter((u) => u.slackUserId);
@@ -94,21 +160,23 @@ export function renderGrantForm(m, slackUsers) {
       }</select>`
     : `<input type="text" class="mnd-grant-field" data-grant-user="${esc(m.id)}" placeholder="Slack user id (e.g. U0…)" />`;
   const actionField = `<select class="mnd-grant-field" data-grant-action="${esc(m.id)}">${
-    FLOOR_ACTIONS.map((a) => `<option value="${a}"${a === 'prod-deploy' ? ' selected' : ''}>${a}</option>`).join('')
+    FLOOR_ACTIONS.map((a) => `<option value="${a}"${a === 'prod-deploy' ? ' selected' : ''}>${esc(humanAction(a))}</option>`).join('')
   }</select>`;
   const durationField = `<select class="mnd-grant-field" data-grant-duration="${esc(m.id)}">${
     GRANT_DURATIONS.map((d) => `<option value="${d.minutes}"${d.minutes === 60 ? ' selected' : ''}>${d.label}</option>`).join('')
   }</select>`;
-  return `<details class="mnd-grant-details"><summary class="mnd-grant-summary">Grant a user a floor action (PIN required)</summary>
+  return `<div class="mnd-grant-block">
+    <div class="mnd-grant-title">Grant a person an action</div>
     <div class="mnd-grant-row">
       ${granteeField}
       ${actionField}
+      <span class="mnd-grant-sep">for</span>
       ${durationField}
-      <input type="password" class="mnd-pin" data-grant-pin="${esc(m.id)}" placeholder="PIN" autocomplete="off" />
-      <button class="mnd-btn" data-grant="${esc(m.id)}">Grant</button>
+      <input type="password" class="mnd-pin" data-grant-pin="${esc(m.id)}" placeholder="Your PIN" autocomplete="off" />
+      <button class="mnd-btn mnd-btn-primary" data-grant="${esc(m.id)}">Grant</button>
     </div>
-    <span class="mnd-hint">Lifts the picked person to ONE floor action for the picked window. Signed into this mandate by your PIN — revoking the mandate voids it; it can never outlive the mandate.</span>
-  </details>`;
+    <span class="mnd-hint">Lets the person you pick take that one action for the window you choose. Confirmed with your PIN — never stored. A grant can never outlive this slip, and revoking the slip ends it.</span>
+  </div>`;
 }
 
 export function renderMandates(list, slackUsers = []) {
@@ -119,30 +187,39 @@ export function renderMandates(list, slackUsers = []) {
     const expired = Date.parse(m.expiresAt) < Date.now();
     const state = m.revoked ? 'revoked' : expired ? 'expired' : 'active';
     const stateCls = state === 'active' ? 'mnd-ok' : 'mnd-dead';
+    const stateLabel = state === 'active' ? 'active' : state === 'revoked' ? 'revoked' : 'expired';
     const authBadge = m.authorshipValid
       ? '<span class="mnd-badge mnd-ok">authorship verified</span>'
       : '<span class="mnd-badge mnd-bad">AUTHORSHIP INVALID</span>';
-    const authorities = (m.authorities || []).map((a) =>
-      `<li><code>${esc(a.action)}</code> — bounds <code>${esc(JSON.stringify(a.bounds))}</code>${a.requiresCondition ? ` — requires <code>${esc(a.requiresCondition)}</code>` : ''}</li>`,
-    ).join('');
-    const revokeUi = state === 'active'
-      ? `<div class="mnd-revoke-row">
-           <input type="password" class="mnd-pin" data-revoke-pin="${esc(m.id)}" placeholder="PIN" autocomplete="off" />
-           <input type="text" class="mnd-reason" data-revoke-reason="${esc(m.id)}" placeholder="reason" />
-           <button class="mnd-btn mnd-btn-danger" data-revoke="${esc(m.id)}">Revoke</button>
-         </div>`
-      : `<div class="mnd-dead-note">${m.revoked ? `revoked ${fmtWhen(m.revoked.at)} — ${esc(m.revoked.reason)}` : `expired ${fmtWhen(m.expiresAt)}`}</div>`;
+    // Internals (id, agent fingerprints, scope slug, raw action names, bounds)
+    // are SUPPORT metadata, never the headline — kept on one muted line so the
+    // operator can quote an id when asking for help, but never has to read JSON.
+    const actionSlugs = (m.authorities || []).map((a) => esc(a.action)).filter(Boolean).join(', ') || 'none';
+    const referenceLine = `<div class="mnd-meta">For support: id <code>${esc(m.id)}</code> · agents <code>${esc(shortFp(m.agents?.[0]))}</code> + <code>${esc(shortFp(m.agents?.[1]))}</code> · scope <code>${esc(m.scope)}</code> · authorizes ${actionSlugs} · issued by ${esc(m.author)}</div>`;
+    // The grant form is the PRIMARY action and renders ABOVE revoke. Revoke is
+    // destructive, so it is demoted to a quiet collapsed control, never featured.
     const grantUi = state === 'active' ? renderGrantForm(m, slackUsers) : '';
+    const revokeUi = state === 'active'
+      ? `<details class="mnd-revoke-details">
+           <summary class="mnd-revoke-summary">Revoke this permission slip</summary>
+           <div class="mnd-revoke-row">
+             <input type="password" class="mnd-pin" data-revoke-pin="${esc(m.id)}" placeholder="Your PIN" autocomplete="off" />
+             <input type="text" class="mnd-reason" data-revoke-reason="${esc(m.id)}" placeholder="reason (optional)" />
+             <button class="mnd-btn mnd-btn-danger" data-revoke="${esc(m.id)}">Revoke</button>
+           </div>
+           <span class="mnd-hint">Ends the slip and everything it authorized, right away. This cannot be undone.</span>
+         </details>`
+      : `<div class="mnd-dead-note">${m.revoked ? `Revoked ${fmtWhen(m.revoked.at)} — ${esc(m.revoked.reason)}` : `Expired ${fmtWhen(m.expiresAt)}`}</div>`;
     return `<div class="mnd-card">
       <div class="mnd-card-head">
-        <span class="mnd-scope">${esc(m.scope)}</span>
-        <span class="mnd-badge ${stateCls}">${state}</span>
+        <span class="mnd-scope">${esc(humanScope(m.scope))}</span>
+        <span class="mnd-badge ${stateCls}">${stateLabel}</span>
         ${authBadge}
       </div>
-      <div class="mnd-meta">id <code>${esc(m.id)}</code> · agents <code>${esc(shortFp(m.agents?.[0]))}</code> + <code>${esc(shortFp(m.agents?.[1]))}</code> · by ${esc(m.author)} · expires ${fmtWhen(m.expiresAt)}</div>
-      <ul class="mnd-authorities">${authorities}</ul>
+      <p class="mnd-summary">${humanSummary(m)}</p>
       ${renderGrants(m, slackUsers)}
       ${grantUi}
+      ${referenceLine}
       ${revokeUi}
     </div>`;
   }).join('');
@@ -157,13 +234,17 @@ export function renderAudit(payload) {
   if (entries.length === 0) {
     return `<div class="mnd-audit-head">${chainBadge}</div><div class="mnd-empty">No decisions recorded yet.</div>`;
   }
+  // Mobile-first (Operator-Surface Quality item 5): each cell carries a
+  // data-label so the table can stack into labelled rows at phone width (the
+  // CSS media query in index.html), instead of cramming five columns and
+  // truncating the most useful one — the reason — into an unreadable sliver.
   const rows = entries.slice(-25).reverse().map((e) =>
     `<tr>
-      <td>${fmtWhen(e.ts)}</td>
-      <td><span class="mnd-badge ${e.decision === 'allow' ? 'mnd-ok' : 'mnd-deny'}">${esc(e.decision)}</span></td>
-      <td><code>${esc(e.action)}</code></td>
-      <td><code>${esc(shortFp(e.agentFp))}</code></td>
-      <td class="mnd-reason-cell">${esc(e.reason)}</td>
+      <td data-label="When">${fmtWhen(e.ts)}</td>
+      <td data-label="Decision"><span class="mnd-badge ${e.decision === 'allow' ? 'mnd-ok' : 'mnd-deny'}">${esc(e.decision)}</span></td>
+      <td data-label="Action"><code>${esc(e.action)}</code></td>
+      <td data-label="Agent"><code>${esc(shortFp(e.agentFp))}</code></td>
+      <td data-label="Reason" class="mnd-reason-cell">${esc(e.reason)}</td>
     </tr>`,
   ).join('');
   return `<div class="mnd-audit-head">${chainBadge}<span class="mnd-dim">${entries.length} total decisions · newest first</span></div>

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA4G7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAm1CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuuZtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA8G7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAm1CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6yZtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -85,6 +85,8 @@ import { GitSyncManager } from '../core/GitSync.js';
 import { RegistrySyncDebouncer } from '../core/RegistrySyncDebouncer.js';
 import { wireRegistrySync } from '../core/wireRegistrySync.js';
 import { assertSeamlessnessInvariants } from '../core/seamlessnessConfig.js';
+import { assertStateSyncInvariants } from '../core/stateSyncConfig.js';
+import { ReplicatedKindRegistry, checkPoolFlagCoherence } from '../core/ReplicatedRecordEnvelope.js';
 import { FencedLease } from '../core/FencedLease.js';
 import { GitLeaseStore } from '../core/GitLeaseStore.js';
 import { LocalLeaseStore } from '../core/LocalLeaseStore.js';
@@ -3271,6 +3273,38 @@ export async function startServer(options) {
         // that breaks the RPO bound) is REJECTED here with a clear message rather
         // than degrading silently. Default/absent config resolves to valid values.
         const seamlessness = assertSeamlessnessInvariants(config.multiMachine);
+        // Replicated-store foundation (multi-machine-replicated-store-foundation §10.2)
+        // — resolve + validate the FOUNDATION-LEVEL stateSync knobs at startup. An
+        // out-of-range value (e.g. a maxDriftMs below the 60s floor that would start
+        // quarantining ordinary NTP jitter, or a non-positive journal budget) is
+        // REJECTED here with a clear message rather than silently coerced (§10.2:
+        // "a bad config is REJECTED, not silently degraded"). Default/absent config
+        // resolves to valid values. The per-store on-switches are dark by default and
+        // not range-validated; with none on, the foundation is inert.
+        const stateSync = assertStateSyncInvariants(config.multiMachine);
+        void stateSync; // foundation knobs are consumed by the store PRs (WS2.1+)
+        // The replicated-kind registry (Component 2). Ships EMPTY in this step — the
+        // first concrete store (WS2.1) registers its kind onto it. Constructed here so
+        // the substrate is wired and the per-store stateSyncReceive advert can be
+        // self-reported from the set of registered+enabled stores (machinery presence,
+        // never a hardcoded true). A machine advertises a store's receive capability
+        // ONLY when that store's kind is registered here AND emission is enabled in
+        // config — i.e. it can both validate AND apply that kind. With an empty
+        // registry the advert is `{}` (non-participant for every store): the correct
+        // single-machine / no-store-yet behavior (a strict no-op).
+        const replicatedKindRegistry = new ReplicatedKindRegistry();
+        const selfStateSyncReceive = () => {
+            const out = {};
+            const stores = config.multiMachine?.stateSync;
+            for (const store of replicatedKindRegistry.stores()) {
+                // Advertise the receive capability iff the machinery exists (kind
+                // registered) AND the store is enabled here — so a peer never forwards a
+                // kind we'd silently drop (the named skew-failure mode).
+                if (stores?.[store]?.enabled === true)
+                    out[store] = true;
+            }
+            return out;
+        };
         // Read local signing key for machine route authentication
         let localSigningKeyPem = '';
         if (coordinator.enabled && coordinator.identity) {
@@ -12150,7 +12184,7 @@ export async function startServer(options) {
                                 // WS1.1 capability advertisement (spec invariant 5): a bounded
                                 // fixed-size summary, never an inventory. Reported live each
                                 // heartbeat so a queue going dark withdraws the capability.
-                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue, ws12DrainReceive: !!_drainRunner, ws44PoolLinks: !!_poolLink },
+                                seamlessnessFlags: { ws11DeliverReceive: !!_inboundQueue, ws12DrainReceive: !!_drainRunner, ws44PoolLinks: !!_poolLink, stateSyncReceive: selfStateSyncReceive() },
                                 // Durable Inbound Message Queue §5.1: depth + oldest + tenure +
                                 // bounded top-K — the survivor's loss-SUSPECTED item, capped
                                 // re-placement arm, and supersede-dedupe key all read these.
@@ -12189,6 +12223,46 @@ export async function startServer(options) {
                     const poolTimer = setInterval(refreshPool, 30_000);
                     if (typeof poolTimer.unref === 'function')
                         poolTimer.unref();
+                    // Boot-time pool-flag-coherence check (multi-machine-replicated-store-
+                    // foundation §4). For each LOCALLY-ENABLED replicated store, surface
+                    // ONCE (coalesced — never per-peer-per-tick) any peer that does NOT
+                    // advertise the matching stateSyncReceive capability: that peer would
+                    // SILENTLY DROP our kind (the journal applier drops unknown kinds), the
+                    // NAMED data-loss skew mode. Correct for N peers — checkPoolFlagCoherence
+                    // iterates ALL advertising peers. With an EMPTY registry (the Step-2
+                    // substrate-only state) this is a strict no-op (no registered stores →
+                    // empty verdict → nothing surfaced). The first concrete store (WS2.1)
+                    // registers its kind and this check starts doing real work automatically.
+                    let stateSyncCoherenceSurfaced = false;
+                    const checkStateSyncCoherence = () => {
+                        if (stateSyncCoherenceSurfaced)
+                            return;
+                        if (replicatedKindRegistry.size === 0)
+                            return; // no concrete store yet
+                        const peers = machinePoolRegistry
+                            .getCapacities()
+                            .filter((c) => c.machineId !== poolSelfId)
+                            .map((c) => ({
+                            machineId: c.machineId,
+                            online: c.online,
+                            stateSyncReceive: c.seamlessnessFlags?.stateSyncReceive,
+                        }));
+                        const stores = config.multiMachine?.stateSync;
+                        const verdict = checkPoolFlagCoherence(replicatedKindRegistry, stores, peers);
+                        if (verdict.mixedStores.length > 0) {
+                            // Surface ONCE (coalesced): one log line listing every mixed store.
+                            // A richer surface (one Attention item) is the store PR's to add;
+                            // the substrate guarantees the single, deduped detection here.
+                            stateSyncCoherenceSurfaced = true;
+                            console.log(pc.yellow(`  [stateSync] pool-flag-coherence — mixed flag state across ${verdict.mixedStores.length} store(s):`));
+                            for (const line of verdict.summary)
+                                console.log(pc.yellow(`    • ${line}`));
+                        }
+                    };
+                    checkStateSyncCoherence();
+                    const coherenceTimer = setInterval(checkStateSyncCoherence, 60_000);
+                    if (typeof coherenceTimer.unref === 'function')
+                        coherenceTimer.unref();
                 }
             }
         }