lorenz 0.1.4 → 0.1.6

package/README.md

@@ -1,31 +1,59 @@
-# Lorenz
+<div align="center">
 
-[![Documentation](https://img.shields.io/badge/docs-ryanlyn.github.io%2Florenz-14b8a6)](https://ryanlyn.github.io/lorenz/)
+<a href="https://ryanlyn.github.io/lorenz/"><img src="docs/images/lorenz-banner.png" alt="Lorenz - agent orchestration engine" width="100%"></a>
 
-Originated from [OpenAI Symphony](https://openai.com/index/open-source-codex-orchestration-symphony/), Lorenz lets you declare work on trackers (in-memory, Obsidian markdown files, Linear, Jira, Slack etc.) and manage the dispatch, execution, and convergence of concurrent agent sessions until they reach a specified terminal state. It is harness-agnostic through the [Agent-Client Protocol](https://agentclientprotocol.com/get-started/introduction) with support for local, static SSH boxes, or (experimental) cloud-brokered VMs.
+[![docs](https://img.shields.io/badge/docs-ryanlyn.github.io%2Florenz-78DCE8?style=flat-square&labelColor=2D2A2E)](https://ryanlyn.github.io/lorenz/) [![npm](https://img.shields.io/npm/v/lorenz?style=flat-square&label=npm&color=A9DC76&labelColor=2D2A2E)](https://www.npmjs.com/package/lorenz) [![license](https://img.shields.io/badge/license-Apache--2.0-AB9DF2?style=flat-square&labelColor=2D2A2E)](LICENSE) [![protocol](https://img.shields.io/badge/protocol-ACP-FC9867?style=flat-square&labelColor=2D2A2E)](https://agentclientprotocol.com/get-started/introduction) [![node](https://img.shields.io/badge/node-24%2B-FFD866?style=flat-square&labelColor=2D2A2E)](mise.toml)
 
-## Screenshots
+</div>
 
-Lorenz ships two operator views over the same runtime snapshot: an Ink terminal dashboard (TUI)
-and a web dashboard served by the observability API.
+Originated from [OpenAI Symphony](https://openai.com/index/open-source-codex-orchestration-symphony/), **Lorenz** lets you declare work on a tracker (in-memory, Obsidian markdown files, Linear, Jira, Slack) and manages the dispatch, execution, and convergence of concurrent agent sessions until they reach a specified terminal state. It is harness-agnostic through the [Agent-Client Protocol](https://agentclientprotocol.com/get-started/introduction), running agents on local machines, static SSH boxes, or (experimental) cloud-brokered VMs.
 
-### Terminal dashboard (TUI)
+## Features
 
-![Lorenz terminal dashboard](docs/images/lorenz-tui.png)
+<table>
+<tr>
+<td width="50%" valign="top">
 
-### Web dashboard
+**Any tracker**<br>
+Linear, Jira, Slack, Obsidian, local files, or in-memory.
 
-![Lorenz web dashboard](docs/images/lorenz-dashboard.png)
+</td>
+<td width="50%" valign="top">
 
-## Documentation
+**Harness-agnostic**<br>
+Codex, Claude, or anything that speaks the Agent-Client Protocol.
 
-The published documentation site is at **[ryanlyn.github.io/lorenz](https://ryanlyn.github.io/lorenz/)**, built from [`docs/`](./docs). Start here:
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
 
-- [Getting started](./docs/getting-started.md) - install, write a `WORKFLOW.md`, run your first issue.
-- [How it works](./docs/how-it-works.md) - the polling, dispatch, and run lifecycle.
-- [Configuration reference](./docs/reference/configuration.md) - every front-matter key, default, and meaning.
-- [Trackers](./docs/trackers/index.md) - Linear, Jira, Slack, local, and memory sources of issues.
-- [CLI](./docs/cli.md) - commands, flags, and run history.
+**Concurrency control**<br>
+Global and per-host caps, with routing labels to share one project across instances.
+
+</td>
+<td width="50%" valign="top">
+
+**Retry and backoff**<br>
+Rate-limit aware, with stall detection and automatic requeue.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Two operator views**<br>
+An Ink terminal dashboard and a web dashboard over one runtime snapshot.
+
+</td>
+<td width="50%" valign="top">
+
+**Local, SSH, or cloud workers**<br>
+Disposable local boxes, static SSH hosts, or brokered VMs on demand.
+
+</td>
+</tr>
+</table>
 
 ## Quickstart
 
@@ -35,7 +63,7 @@ Running Lorenz is as easy as:
 npx lorenz WORKFLOW.md
 ```
 
-with full CLI options:
+The full CLI surface:
 
 ```sh
 lorenz [--once] [--dry-run] [--no-tui] [--port <port>] [--logs-root <path>] [path-to-WORKFLOW.md]
@@ -50,6 +78,36 @@ runs, a Claude ACP bridge for Claude runs, and SSH access for remote workers. Se
 [Getting started](./docs/getting-started.md) for the full list. Run commands from the repository
 root unless a command says otherwise.
 
+## How It Works
+
+Lorenz polls a tracker for eligible issues, dispatches each one to a worker as a concurrent agent
+session, and drives it through its run lifecycle until it reaches a terminal state, honoring
+concurrency caps, retries, and rate limits along the way. The polling, dispatch, and run lifecycle
+are covered in [How it works](./docs/how-it-works.md).
+
+## Dashboards
+
+Lorenz ships two operator views over the same runtime snapshot: an Ink terminal dashboard (TUI) and
+a web dashboard served by the observability API.
+
+**Terminal dashboard (TUI)**
+
+![Lorenz terminal dashboard](docs/images/lorenz-tui.png)
+
+**Web dashboard**
+
+![Lorenz web dashboard](docs/images/lorenz-dashboard.png)
+
+## Documentation
+
+The published documentation site is at **[ryanlyn.github.io/lorenz](https://ryanlyn.github.io/lorenz/)**, built from [`docs/`](./docs). Start here:
+
+- [Getting started](./docs/getting-started.md) - install, write a `WORKFLOW.md`, run your first issue.
+- [How it works](./docs/how-it-works.md) - the polling, dispatch, and run lifecycle.
+- [Configuration reference](./docs/reference/configuration.md) - every front-matter key, default, and meaning.
+- [Trackers](./docs/trackers/index.md) - Linear, Jira, Slack, local, and memory sources of issues.
+- [CLI](./docs/cli.md) - commands, flags, and run history.
+
 ## Configuration
 
 Configuration lives in the YAML front matter of a workflow file. The Markdown body below the front
@@ -79,7 +137,7 @@ complete variable list is in the [Workflow prompt reference](./docs/reference/wo
 ## Skills
 
 The `skills/` directory holds orchestration skills (`lorenz-commit`, `lorenz-push`, `lorenz-pull`,
-`lorenz-land`, `lorenz-debug`) referenced by the example workflows. Lorenz copies skills into
+`lorenz-land`, `lorenz-debug`) referenced by the example workflows. Lorenz installs skills into
 `.lorenz/skills/` in each prepared workspace before the agent starts. See
 [Skills](./docs/agents/skills.md) for how `agent.skills` and tool-pack skills are resolved.
 
@@ -90,7 +148,10 @@ retry queue, and dispatch blocks. The web dashboard exposes the same runtime sna
 HTTP server, started with `--port` or `server.port`. Routes, the WebSocket stream, and `/mcp` tool
 serving are documented in [Observability](./docs/observability.md).
 
-## Contributing
+<details>
+<summary><b>Contributing &amp; development</b></summary>
+
+<br>
 
 ### Requirements
 
@@ -161,6 +222,8 @@ The checked-in workflow files (`WORKFLOW.md`, `WORKFLOW_FULL_ACCESS.md`) are exe
 `pnpm test` guards workflow docs, prompt rendering, dashboard snapshots, runtime behavior, and CLI
 documentation. Update the fixture and the matching test together when the public contract changes.
 
+</details>
+
 ## License
 
 See [CHANGELOG.md](CHANGELOG.md) for notable changes. This project is licensed under the [Apache License 2.0](LICENSE).

package/RELEASE-MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.4",
+  "version": "0.1.6",
   "entrypoint": "bin/lorenz",
   "dashboardDist": "node_modules/@lorenz/dashboard/dist",
   "installCommand": "npm install --omit=dev",
@@ -65,6 +65,10 @@
       "name": "@lorenz/domain",
       "path": "node_modules/@lorenz/domain"
     },
+    {
+      "name": "@lorenz/flags",
+      "path": "node_modules/@lorenz/flags"
+    },
     {
       "name": "@lorenz/humanize",
       "path": "node_modules/@lorenz/humanize"
@@ -189,6 +193,7 @@
     "@hono/node-server",
     "@hono/node-ws",
     "@linear/sdk",
+    "@tursodatabase/database",
     "better-sqlite3",
     "commander",
     "diff",

package/node_modules/@lorenz/agent-sdk/dist/index.d.ts

@@ -1,2 +1,3 @@
 export { AgentExecutorRegistry, defaultAgentExecutorRegistry, type AgentExecutorProvider, } from "./provider.js";
+export { AGENT_EXECUTOR_SDK_VERSION, assertAgentExecutorModule, defineAgentExecutor, type AgentExecutorModule, } from "./module.js";
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@lorenz/agent-sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC"}

package/node_modules/@lorenz/agent-sdk/dist/index.js

@@ -1,2 +1,3 @@
 export { AgentExecutorRegistry, defaultAgentExecutorRegistry, } from "./provider.js";
+export { AGENT_EXECUTOR_SDK_VERSION, assertAgentExecutorModule, defineAgentExecutor, } from "./module.js";
 //# sourceMappingURL=index.js.map

package/node_modules/@lorenz/agent-sdk/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,aAAa,CAAC"}

package/node_modules/@lorenz/agent-sdk/dist/module.d.ts

@@ -0,0 +1,38 @@
+import type { AgentExecutorProvider } from "./provider.js";
+/**
+ * The agent-executor SDK version this build of the engine speaks. Out-of-tree
+ * executor modules declare the version they target via
+ * {@link AgentExecutorModule.sdkVersion}; the loader rejects a mismatch before the
+ * module ever reaches the registry. Major-only: additive, backwards-compatible
+ * SDK changes never bump it.
+ */
+export declare const AGENT_EXECUTOR_SDK_VERSION = 1;
+/**
+ * The unit an OUT-OF-TREE agent-executor module exports: an
+ * {@link AgentExecutorProvider} carrying the SDK version it targets. A dynamically
+ * imported module crosses a version boundary the daemon cannot type-check, so the
+ * explicit `sdkVersion` handshake stands in for the compiler.
+ */
+export interface AgentExecutorModule extends AgentExecutorProvider {
+    readonly sdkVersion: number;
+}
+/**
+ * Structural check + version handshake for a dynamically loaded agent-executor
+ * module. `source` names where the value came from so every error is actionable.
+ */
+export declare const assertAgentExecutorModule: (value: unknown, source: string) => asserts value is AgentExecutorModule;
+/**
+ * Authoring sugar for out-of-tree executor modules: shape-asserts the module at
+ * definition time (so a typo fails in the author's tests, not the operator's
+ * daemon) and returns it unchanged. Usage:
+ *
+ * ```ts
+ * export default defineAgentExecutor({
+ *   executor: "acme",
+ *   sdkVersion: 1,
+ *   createExecutor: (kind, settings) => new AcmeExecutor(kind, settings),
+ * });
+ * ```
+ */
+export declare function defineAgentExecutor(module: AgentExecutorModule): AgentExecutorModule;
+//# sourceMappingURL=module.d.ts.map

package/node_modules/@lorenz/agent-sdk/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAaD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,CACtC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,KAAK,IAAI,mBAA2C,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,CAEpF"}

package/node_modules/@lorenz/agent-sdk/dist/module.js

@@ -0,0 +1,41 @@
+import { makeSdkModuleContract } from "@lorenz/domain";
+/**
+ * The agent-executor SDK version this build of the engine speaks. Out-of-tree
+ * executor modules declare the version they target via
+ * {@link AgentExecutorModule.sdkVersion}; the loader rejects a mismatch before the
+ * module ever reaches the registry. Major-only: additive, backwards-compatible
+ * SDK changes never bump it.
+ */
+export const AGENT_EXECUTOR_SDK_VERSION = 1;
+const contract = makeSdkModuleContract({
+    errorPrefix: "agent_executor",
+    moduleNoun: "an agent executor module",
+    identityField: "executor",
+    defineCall: "defineAgentExecutor({ executor, sdkVersion, createExecutor })",
+    requiredFns: [
+        { field: "createExecutor", signature: "createExecutor(kind, settings)", article: "a" },
+    ],
+    sdkVersion: AGENT_EXECUTOR_SDK_VERSION,
+});
+/**
+ * Structural check + version handshake for a dynamically loaded agent-executor
+ * module. `source` names where the value came from so every error is actionable.
+ */
+export const assertAgentExecutorModule = contract.assertModule;
+/**
+ * Authoring sugar for out-of-tree executor modules: shape-asserts the module at
+ * definition time (so a typo fails in the author's tests, not the operator's
+ * daemon) and returns it unchanged. Usage:
+ *
+ * ```ts
+ * export default defineAgentExecutor({
+ *   executor: "acme",
+ *   sdkVersion: 1,
+ *   createExecutor: (kind, settings) => new AcmeExecutor(kind, settings),
+ * });
+ * ```
+ */
+export function defineAgentExecutor(module) {
+    return contract.defineModule(module, "defineAgentExecutor");
+}
+//# sourceMappingURL=module.js.map

package/node_modules/@lorenz/agent-sdk/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAIvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAY5C,MAAM,QAAQ,GAAG,qBAAqB,CAAsB;IAC1D,WAAW,EAAE,gBAAgB;IAC7B,UAAU,EAAE,0BAA0B;IACtC,aAAa,EAAE,UAAU;IACzB,UAAU,EAAE,+DAA+D;IAC3E,WAAW,EAAE;QACX,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gCAAgC,EAAE,OAAO,EAAE,GAAG,EAAE;KACvF;IACD,UAAU,EAAE,0BAA0B;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAGM,QAAQ,CAAC,YAAY,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,OAAO,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAC9D,CAAC"}

package/node_modules/@lorenz/cli/dist/agentExecutorLoader.d.ts

@@ -0,0 +1,30 @@
+import { type AgentExecutorRegistry } from "@lorenz/agent-sdk";
+import { type EnsureExtensionLoadedOptions, type ExtensionRef } from "./extensionLoader.js";
+/**
+ * Out-of-tree agent-executor loading: a configured `agents.<kind>.executor`
+ * accepts a module specifier in addition to a registered executor selector.
+ * Instantiates the axis-generic {@link createExtensionLoader}; identity field is
+ * the provider `executor`. See {@link createExtensionLoader} for the trust
+ * boundary, module pinning, and exact-selector-wins resolution shared by every
+ * axis.
+ *
+ * A caller (a `loadWorkflow` prepareRegistries hook or the executor-factory step)
+ * invokes {@link ensureAgentExecutorLoaded} for the configured
+ * `agents.<kind>.executor` BEFORE the registry resolves it, exactly as
+ * `prepareTrackerExtensions` does for trackers.
+ */
+/** A parsed configured executor value that is not a registered selector. */
+export type AgentExecutorRef = ExtensionRef;
+/** Options for {@link ensureAgentExecutorLoaded}. */
+export type EnsureAgentExecutorLoadedOptions = EnsureExtensionLoadedOptions;
+/** Parses a configured executor string into its module-specifier form. */
+export declare function parseAgentExecutorRef(executor: string): AgentExecutorRef;
+/**
+ * Idempotently makes the configured executor resolvable in `registry` (see
+ * {@link createExtensionLoader} for the load/pin semantics). A caller invokes this
+ * BEFORE the agent-runner resolves the executor at startup and on every reload, so
+ * the runner's `registry.require(agent.executor)` resolves an out-of-tree executor
+ * exactly like a built-in.
+ */
+export declare function ensureAgentExecutorLoaded(executor: string, registry: AgentExecutorRegistry, options?: EnsureAgentExecutorLoadedOptions): Promise<void>;
+//# sourceMappingURL=agentExecutorLoader.d.ts.map

package/node_modules/@lorenz/cli/dist/agentExecutorLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentExecutorLoader.d.ts","sourceRoot":"","sources":["../src/agentExecutorLoader.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,YAAY,EAElB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE5C,qDAAqD;AACrD,MAAM,MAAM,gCAAgC,GAAG,4BAA4B,CAAC;AAoD5E,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAExE;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/node_modules/@lorenz/cli/dist/agentExecutorLoader.js

@@ -0,0 +1,63 @@
+import { isRecord } from "@lorenz/domain";
+import { assertAgentExecutorModule, } from "@lorenz/agent-sdk";
+import { createExtensionLoader, } from "./extensionLoader.js";
+const agentExecutorLoader = createExtensionLoader({
+    errorPrefix: "agent_executor",
+    eventNames: {
+        loaded: "agent_executor_loaded",
+        pinned: "agent_executor_module_pinned",
+    },
+    defineHelperName: "defineAgentExecutor",
+    unitNoun: "agent executors",
+    assertModule: assertAgentExecutorModule,
+    looksLikeModule: (value) => isRecord(value) && typeof value["createExecutor"] === "function",
+    // Spread the loaded module so every provider hook (createExecutor, parseOptions,
+    // validateAgent, configAliases, ...) is preserved and only `executor` is
+    // overridden to the configured specifier.
+    toFactory: (specifier, module) => ({ ...module, executor: specifier }),
+    // The agent axis's identity field is `executor`; map it onto the generic `kind`
+    // audit field so the loaded/pinned events stay uniform across axes.
+    describeModule: (module) => ({ kind: module.executor, sdkVersion: module.sdkVersion }),
+});
+/**
+ * One stable {@link ExtensionRegistry} adapter per underlying
+ * {@link AgentExecutorRegistry}. The generic loader keys its pinned-specifier set
+ * in a WeakMap by the registry IDENTITY it is handed, so the adapter must be the
+ * SAME object across reload calls for the same executor registry - otherwise the
+ * module-pinned re-encounter event would never fire. Caching by the real registry
+ * preserves that identity.
+ */
+const adapters = new WeakMap();
+/**
+ * Adapts an {@link AgentExecutorRegistry} to the minimal {@link ExtensionRegistry}
+ * surface the generic loader needs. The executor registry exposes `executors()`
+ * rather than the generic `kinds()`, so the loader sees registered executor
+ * selectors through this thin shim.
+ */
+function asExtensionRegistry(registry) {
+    let adapter = adapters.get(registry);
+    if (adapter === undefined) {
+        adapter = {
+            get: (executor) => registry.get(executor),
+            register: (provider) => registry.register(provider),
+            kinds: () => registry.executors(),
+        };
+        adapters.set(registry, adapter);
+    }
+    return adapter;
+}
+/** Parses a configured executor string into its module-specifier form. */
+export function parseAgentExecutorRef(executor) {
+    return agentExecutorLoader.parseRef(executor);
+}
+/**
+ * Idempotently makes the configured executor resolvable in `registry` (see
+ * {@link createExtensionLoader} for the load/pin semantics). A caller invokes this
+ * BEFORE the agent-runner resolves the executor at startup and on every reload, so
+ * the runner's `registry.require(agent.executor)` resolves an out-of-tree executor
+ * exactly like a built-in.
+ */
+export async function ensureAgentExecutorLoaded(executor, registry, options = {}) {
+    return agentExecutorLoader.ensureLoaded(executor, asExtensionRegistry(registry), options);
+}
+//# sourceMappingURL=agentExecutorLoader.js.map

package/node_modules/@lorenz/cli/dist/agentExecutorLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentExecutorLoader.js","sourceRoot":"","sources":["../src/agentExecutorLoader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,yBAAyB,GAI1B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,GAItB,MAAM,sBAAsB,CAAC;AAsB9B,MAAM,mBAAmB,GAAG,qBAAqB,CAA6C;IAC5F,WAAW,EAAE,gBAAgB;IAC7B,UAAU,EAAE;QACV,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,8BAA8B;KACvC;IACD,gBAAgB,EAAE,qBAAqB;IACvC,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,yBAAyB;IACvC,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,gBAAgB,CAAC,KAAK,UAAU;IAC5F,iFAAiF;IACjF,yEAAyE;IACzE,0CAA0C;IAC1C,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtE,gFAAgF;IAChF,oEAAoE;IACpE,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;CACvF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAmE,CAAC;AAEhG;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,QAA+B;IAE/B,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG;YACR,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnD,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE;SAClC,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,QAA+B,EAC/B,UAA4C,EAAE;IAE9C,OAAO,mBAAmB,CAAC,YAAY,CAAC,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5F,CAAC"}

package/node_modules/@lorenz/cli/dist/daemon.d.ts

@@ -1,7 +1,7 @@
 import { type AgentExecutorRegistry } from "@lorenz/agent-sdk";
 import { type RunAgentAttemptInput, type RunResult } from "@lorenz/agent-runner";
 import { type WorkerDriverRegistry } from "@lorenz/worker-sdk";
-import type { DefaultSettingsOptions } from "@lorenz/config";
+import { type DefaultSettingsOptions } from "@lorenz/config";
 import { type RuntimeTrackerClient, type Settings } from "@lorenz/domain";
 import { type WorkerPool } from "@lorenz/worker-pool";
 import { type DispatchCoordinator } from "@lorenz/dispatch-coordinator";
@@ -24,6 +24,27 @@ export interface BackendRegistries {
  */
 export declare function registerBuiltinBackends(registries?: BackendRegistries): void;
 export declare function runtimeDefaultSettingsOptions(): DefaultSettingsOptions;
+/**
+ * `loadWorkflow` pre-parse hook: dynamic-import any out-of-tree tracker named by
+ * `tracker.kind` (a module specifier rather than a registered kind) and register
+ * it into `trackers` under that exact string, BEFORE the config parser resolves
+ * the tracker provider. Mirrors {@link buildWorkerPool}'s driver-loading step:
+ * the loader is a no-op for a built-in kind, dynamic-imports on a miss, and
+ * fail-loud on an unresolvable specifier / SDK mismatch at the same startup point
+ * as an unregistered kind. Re-running it on a reload re-encounters an
+ * already-loaded specifier and emits `tracker_provider_module_pinned`; a config
+ * that switches `tracker.kind` to a NEW specifier hot-loads it.
+ *
+ * `baseDir` anchors `./relative` specifiers to the workflow file's directory (the
+ * most predictable anchor for operators), and `logEvent` routes the
+ * `tracker_provider_loaded`/`_module_pinned` audit events to the configured log
+ * file when one is known.
+ */
+export declare function prepareTrackerExtensions(rawConfig: Record<string, unknown>, context: {
+    baseDir: string;
+    logFile?: string | undefined;
+    trackers?: TrackerRegistry;
+}): Promise<void>;
 export declare function createTrackerClient(settings: Settings, env?: NodeJS.ProcessEnv): RuntimeTrackerClient;
 /** Options for {@link buildWorkerPool} / {@link buildDispatchCoordinator}. */
 export interface BuildWorkerPoolOptions {
@@ -35,32 +56,34 @@ export interface BuildWorkerPoolOptions {
     baseDir?: string | undefined;
 }
 /**
- * Constructs the warm worker pool when `worker.worker_pool.enabled` is set, and
- * returns `undefined` otherwise so the disabled path stays byte-identical to the
- * pre-pool daemon. The pool resolves the configured `driver` against the
- * worker-driver registry populated by {@link registerBuiltinBackends}; a driver
- * string that is NOT a registered kind is treated as a module specifier and
- * dynamic-imported into the registry first (see {@link ensureWorkerDriverLoaded}),
- * so third-party drivers load at the same fail-loud startup point - an
- * unresolvable driver throws `worker_pool_driver_unavailable` before the pool, the
- * runtime, or any provision exists. The write-ahead ledger (only consulted by
- * cloud drivers) lives under `<workspace.root>/.lorenz/worker-pool/`.
+ * Constructs the warm worker pool for the parsed worker-pool settings. The pool is the single
+ * dispatch path, so a parsed config always carries an enabled pool (an absent `worker_pool`
+ * defaults to an enabled `local` pool that provisions nothing eagerly). The internal `enabled`
+ * field is only flipped off by the reload-drain (a removed pool reconciled to drain to zero); this
+ * guard returns `undefined` for such an internally disabled / absent settings object so nothing is
+ * rebuilt. The pool resolves the configured `driver` against the worker-driver registry populated
+ * by {@link registerBuiltinBackends}; a driver string that is NOT a registered kind is treated as a
+ * module specifier and dynamic-imported into the registry first (see
+ * {@link ensureWorkerDriverLoaded}), so third-party drivers load at the same fail-loud startup
+ * point - an unresolvable driver throws `worker_pool_driver_unavailable` before the pool, the
+ * runtime, or any provision exists. The write-ahead ledger (only consulted by cloud drivers) lives
+ * under `<workspace.root>/.lorenz/worker-pool/`.
  */
 export declare function buildWorkerPool(settings: Settings, _env?: NodeJS.ProcessEnv, options?: BuildWorkerPoolOptions): Promise<WorkerPool | undefined>;
 /**
- * Constructs the runtime-facing {@link DispatchCoordinator} when
- * `worker.worker_pool.enabled` is set, wrapping the same {@link WorkerPool} that
- * {@link buildWorkerPool} builds and the injected {@link McpEndpointManager}. Returns
- * `undefined` when the pool is disabled so the disabled path stays byte-identical
- * to the pre-pool daemon.
+ * Constructs the runtime-facing {@link DispatchCoordinator}, wrapping the same
+ * {@link WorkerPool} that {@link buildWorkerPool} builds and the injected
+ * {@link McpEndpointManager}. The pool is the single dispatch path, so a parsed config always
+ * yields a coordinator. Returns `undefined` only for an internally disabled / absent settings
+ * object (the reload-drain's drained-to-zero shape), mirroring {@link buildWorkerPool}.
  *
- * The CONCRETE per-run {@link McpEndpointManager} (`perRunEndpoint=true`) is wired
+ * The CONCRETE per-run {@link McpEndpointManager} (`perRunClaimEnforcement=true`) is wired
  * here: it OWNS the whole per-run MCP endpoint lease (auth token + refcounted local
  * mcp server + reverse tunnel) via the injected `acquireAgentMcpEndpointForRun`. The
  * daemon is the right ownership boundary because it already depends on
  * `@lorenz/mcp`, keeping `@lorenz/worker-pool` and
- * `@lorenz/dispatch-coordinator` free of any mcp/tunnel runtime dependency
- * (invariant #8). At the default `slotsPerMachine=1` this opens exactly ONE endpoint
+ * `@lorenz/dispatch-coordinator` free of any mcp/tunnel runtime dependency.
+ * At the default `slotsPerMachine=1` this opens exactly ONE endpoint
  * per run (just coordinator-owned), and the manager returns `null` for an empty
  * (local) worker host so the local path keeps using acp's own endpoint -
  * byte-identical to the single-tenant path. `buildWorkerPool` stays for the worker-pool

package/node_modules/@lorenz/cli/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAe,KAAK,oBAAoB,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAQvF,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,6BAA6B,EAC7B,qBAAqB,EAGtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC9C,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAAE,iBAAsB,GAAG,IAAI,CAqBhF;AAED,wBAAgB,6BAA6B,IAAI,sBAAsB,CAEtE;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CAEtB;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,MAAM,CAAC,UAAwB,EACrC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAejC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,QAAQ,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAiC1C;AAmCD,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAKrF;AAED,eAAO,MAAM,eAAe;;;;CAI3B,CAAC"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEzF,OAAO,EAAe,KAAK,oBAAoB,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAQvF,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,6BAA6B,EAC7B,qBAAqB,EAGtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAK7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC9C,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAAE,iBAAsB,GAAG,IAAI,CAsBhF;AAED,wBAAgB,6BAA6B,IAAI,sBAAsB,CAEtE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GACrF,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CAEtB;AAED,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,QAAQ,EAClB,IAAI,GAAE,MAAM,CAAC,UAAwB,EACrC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAejC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,QAAQ,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAiD1C;AAmCD,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAKrF;AAED,eAAO,MAAM,eAAe;;;;CAI3B,CAAC"}