instar 1.3.588 → 1.3.590

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAg4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAshdtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmCH,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AAuBjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAkH7D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AAyID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAg4CD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GACpD,IAAI,CA8eN;AA2lBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ndtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -12196,6 +12196,43 @@ export async function startServer(options) {
             completionEvaluator = new CompletionEvaluator({ intelligence: sharedIntelligence });
             console.log(pc.green('  Completion evaluator: active (independent /goal-style judge)'));
         }
+        // ── LiveTestGate (live-user-channel-proof spec §4) ──────────────────────
+        // The completion-gate teeth: refuse a "done" verdict for a USER-FACING feature
+        // without a verified live-test artifact. DEV-GATED + dry-run default — the gate
+        // COMPUTES the veto and logs it but never overrides a verdict until promoted to
+        // warn/veto. Same machine signs + verifies (dev dogfood); cross-machine verify
+        // (resolve a peer's harness pubkey) is a tracked follow-on.
+        let liveTestGate;
+        let liveTestGateMode = 'dry-run';
+        try {
+            const ltgEnabled = resolveDevAgentGate(config.monitoring?.liveTestGate?.enabled, config);
+            const idMgrForLtg = coordinator?.managers?.identityManager;
+            if (ltgEnabled && idMgrForLtg && coordinator?.identity?.machineId) {
+                const { LiveTestArtifactStore } = await import('../core/LiveTestArtifactStore.js');
+                const { LiveTestGate } = await import('../core/LiveTestGate.js');
+                const nodeCrypto = await import('node:crypto');
+                const signingKeyPem = idMgrForLtg.loadSigningKey();
+                const publicKeyPem = nodeCrypto.createPublicKey({ key: signingKeyPem }).export({ type: 'spki', format: 'pem' }).toString();
+                const machineId = coordinator.identity.machineId;
+                const ltStore = new LiveTestArtifactStore({
+                    stateDir: config.stateDir,
+                    machineId,
+                    signerFingerprint: machineId,
+                    sign: (d) => signEd25519(d, signingKeyPem),
+                    verify: (d, s) => verifyEd25519(d, s, publicKeyPem),
+                    logger: (m) => console.log(pc.dim(`  ${m}`)),
+                });
+                liveTestGate = new LiveTestGate(ltStore);
+                const m = config.monitoring?.liveTestGate?.mode;
+                liveTestGateMode = m === 'warn' || m === 'veto' ? m : 'dry-run';
+                console.log(pc.dim(`  [live-test-gate] active (dev-gate, mode=${liveTestGateMode}) — completion veto §4`));
+            }
+        }
+        catch (err) {
+            // @silent-fallback-ok — gate not wired → no veto (today's exact completion
+            // behavior). Logged; never blocks server boot.
+            console.log(pc.dim(`  [live-test-gate] not wired: ${err instanceof Error ? err.message : String(err)}`));
+        }
         // ── CollaborationRedriveEngine ────────────────────────────────────
         // Proactively re-engage a COUNTERPART that has gone silent on an open
         // threadline-reply commitment. Bounded peer nudges with a durable,
@@ -13938,8 +13975,42 @@ export async function startServer(options) {
                 // is constructed further down (working-set wiring); until then the floor
                 // reads 0, which preserves pre-fix behavior for the boot window.
                 let ownershipEpochFloor = null;
+                // ── Transfer fix (spec docs/specs/live-user-channel-proof-standard.md §7.2) ──
+                // The in-memory store was the bug: a transfer wrote the target's ownership
+                // into the SOURCE's process Map → vanished on restart, never crossed machines.
+                // Behind the DEV-AGENT DARK GATE (live on a dev agent / dark on the fleet),
+                // swap in the DURABLE per-session store; the OwnershipApplier (wired below)
+                // materializes ownership on the target from the REPLICATED placement journal,
+                // so a seat genuinely moves. Off → InMemory (today's exact behavior).
+                // Pool-consistent activation (docs/specs/pool-consistent-multimachine-activation.md):
+                // gating PURELY on the per-machine dev flag left the durable store DARK on a non-dev
+                // pool machine (the Mini), so a transferred seat's ownership was never materialized
+                // there → the seat died on arrival (caught by the live Laptop↔Mini proof, 2026-06-16).
+                // The durable store MUST run on every machine that CONSUMES replicated placement
+                // journals. So activate ALSO on the explicit, pool-consistent
+                // `coherenceJournal.replication.enabled === true` signal — the SAME one that gates the
+                // journalSyncApplier (~server.ts:16588). Invariant: a machine running the placement-
+                // replication applier runs the ownership applier + durable store too (same placements).
+                // Single-machine agents (no replication) stay on InMemory — strict no-op.
+                const { shouldActivateDurableOwnership, isPlacementReplicationEnabled } = await import('../core/durableOwnershipActivation.js');
+                const _replicationOn = isPlacementReplicationEnabled(config);
+                const durableOwnershipOn = shouldActivateDurableOwnership(config, resolveDevAgentGate);
+                let durableOwnershipStore = null;
+                let ownershipStore;
+                if (durableOwnershipOn) {
+                    const { LocalSessionOwnershipStore } = await import('../core/LocalSessionOwnershipStore.js');
+                    durableOwnershipStore = new LocalSessionOwnershipStore({
+                        dir: path.join(config.stateDir, 'ownership', 'local'),
+                        logger: (m) => console.log(pc.dim(`  ${m}`)),
+                    });
+                    ownershipStore = durableOwnershipStore;
+                    console.log(pc.dim(`  [ownership] durable LocalSessionOwnershipStore active (${_replicationOn ? 'pool: replication-on' : 'dev-gate'}) — transfer-fix §7.2`));
+                }
+                else {
+                    ownershipStore = new ownMod.InMemorySessionOwnershipStore();
+                }
                 sessionOwnershipRegistry = new ownMod.SessionOwnershipRegistry({
-                    store: new ownMod.InMemorySessionOwnershipStore(),
+                    store: ownershipStore,
                     seenNonce: (k) => seenOwnNonces.has(k),
                     recordNonce: (k) => seenOwnNonces.add(k),
                     epochFloorOf: (sk) => ownershipEpochFloor?.(sk) ?? 0,
@@ -14050,6 +14121,38 @@ export async function startServer(options) {
                     }, tickMs);
                     ws13Timer.unref?.();
                 }
+                // ── Transfer fix §7.2: OwnershipApplier ─────────────────────────────────
+                // Materialize durable local ownership from the REPLICATED placement journal
+                // (peers/<machineId>.topic-placement.jsonl) so the machine a topic moved TO
+                // resolves the right owner on the next message — the step the in-memory store
+                // never had. Off the hot path: ticked on an interval + once at boot (to adopt
+                // a transfer that landed while we were down). Only when the durable store is
+                // active (dev-gate); InMemory has no cross-machine replication to apply.
+                if (durableOwnershipStore && _meshSelfId) {
+                    const { OwnershipApplier } = await import('../core/OwnershipApplier.js');
+                    const { CoherenceJournalReader } = await import('../core/CoherenceJournalReader.js');
+                    const applier = new OwnershipApplier({
+                        reader: new CoherenceJournalReader({ stateDir: config.stateDir }),
+                        store: durableOwnershipStore,
+                        selfMachineId: _meshSelfId,
+                        logger: (m) => console.log(pc.dim(`  ${m}`)),
+                    });
+                    try {
+                        applier.tick();
+                    }
+                    catch { /* @silent-fallback-ok — boot tick best-effort; the interval converges */ }
+                    const applierTimer = setInterval(() => {
+                        try {
+                            const r = applier.tick();
+                            if (r.materialized)
+                                console.log(pc.dim(`  [OwnershipApplier] materialized ${r.materialized}/${r.examined} topic(s) from replicated placements`));
+                        }
+                        catch (err) {
+                            console.error('[OwnershipApplier] tick failed:', err instanceof Error ? err.message : String(err));
+                        }
+                    }, 15000);
+                    applierTimer.unref?.();
+                }
                 // Coherence journal §3.3: the emit is a thin wrapper at every CAS call
                 // site — `reason` is caller knowledge (cas() is a storage primitive and
                 // cannot know WHY). A mesh-applied action records the coarse reason;
@@ -16175,7 +16278,7 @@ export async function startServer(options) {
                 carrier: _topicProfileCarrier,
             }
             : null;
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, getInboundQueue: () => _inboundQueue, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, cartographer: cartographer ?? undefined, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, subscriptionPool, quotaPoller, quotaAwareScheduler: _quotaAwareScheduler ?? undefined, proactiveSwapMonitor: _proactiveSwapMonitor ?? undefined, inUseAccountResolver, enrollmentWizard, credentialRepointing, semanticMemory, activitySentinel, rateLimitSentinel, releaseReadinessSentinel: releaseReadinessSentinel ?? undefined, greenPrAutoMerger: greenPrAutoMerger ?? undefined, guardLatchStore: guardLatchStore ?? undefined, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, topicProfile: _topicProfileCtx ?? undefined, sessionRefresh: _sessionRefresh ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, leaseTransport, onLeasePullRequest: () => leaseCoordinatorRef?.currentLease() ?? null, liveTailReceiver, handoffWireTransport, onHandoffBegin, onHandoffInitiate: handoffInitiate, handoffInProgress: handoffSentinelInProgress, messageLedger, currentInboundByTopic, replyMarkerTransport, onReplyMarker: messageLedger ? (marker) => { const m = marker; messageLedger.applyRemoteReplyMarker(m.dedupeKey, { platform: m.platform, replyIdempotencyKey: m.replyIdempotencyKey, epoch: m.epoch, topic: m.topic ?? null }); } : undefined, whatsapp: whatsappAdapter, slack: slackAdapter, imessage: imessageAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRouter, conversationStore, threadLog, threadMessageRecorder, warrantsReplyGate, collaborationSurfacer, threadResumeMap, topicLinkageHandler: topicLinkageHandler ?? undefined, threadlineRelayClient, threadlineReplyWaiters, listenerManager: listenerManager ?? undefined, a2aDeliveryTracker: a2aDeliveryTracker ?? undefined, responseReviewGate, messagingToneGate, outboundDedupGate, telemetryHeartbeat, pasteManager, featureRegistry, discoveryEvaluator, completionEvaluator, unifiedTrust, liveConfig, sharedStateLedger, ledgerSessionRegistry, worktreeManager, oidcEnrolledRepos: parallelDevConfig?.oidcEnrolledRepos, initiativeTracker, projectRoundRunner, projectDriftChecker, machineHeartbeat, machinePoolRegistry, getInboundQueue: () => _inboundQueue, meshRpcDispatcher, workingSetPullCoordinator, commitmentReplicaStore, preferenceReplicaStore, replicatedRecordEmitter, conflictStore, rollbackUnmerge, droppedOriginRegistry, preferencesUnionReader, forwardCommitmentMutate, sessionOwnershipRegistry, topicPinStore: _topicPinStore ?? undefined, streamTicketStore: _streamTicketStore ?? undefined, poolStreamAllowRemoteInput: config.dashboard?.poolStream?.allowRemoteInput ?? false, poolStreamConnector: _poolStreamConnector ?? undefined, secretSync: _secretSyncHandle ?? undefined, meshSelfId: _meshSelfId ?? undefined, resolveRouterUrl: _resolveRouterUrl ?? undefined, resolvePeerUrls: _resolvePeerUrls ?? undefined, guardRegistry, listPoolMachines: _listPoolMachines ?? undefined, poolLink: _poolLink ?? undefined, poolPollCache: _poolPollCache ?? undefined, sessionPoolE2EResultStore, proxyCoordinator, topicIntentStore, topicIntentArcCheck, usherSignalStore, intelligence: sharedIntelligence ?? undefined, telegramBridgeConfig, telegramBridge: telegramBridge ?? undefined, threadlineObservability, briefDeps, workingMemory, taskFlowRegistry, threadlineFlowBridge, sessionReaper, agentWorktreeReaper, orphanedWorkSentinel, mcpProcessReaper, geminiLoopRunner, sleepController, agentActivityState, reapLog, resumeQueue, resumeDrainer, operatorStopRecorder: recordOperatorStop, sleepWakeDetector, unjustifiedStopGate, stopGateDb, stopNotifier, liveTestGate, liveTestGateMode }); // Resolve the late-bound topic-operator getter (increment 2e): routing was
         // wired before the server existed; from here on inbound binds use the
         // server's own store instance.
         _agentServerRef = server;