monomind 1.10.1 → 1.10.2

package/.claude/skills/mastermind/diagnose.md

@@ -0,0 +1,249 @@
+---
+name: mastermind-diagnose
+description: Mastermind diagnose — forensic procedure for investigating why agent work stalled, looped, or went too deep. Surfaces the exact stop-point in the issue tree, frames the fix as a product rule respecting three invariants (productive work continues / only real blockers stop work / no infinite loops), and delivers an approved plan before any code changes. Mirrors diagnose-why-work-stopped Paperclip skill.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Diagnose
+
+This skill is invoked by `mastermind:diagnose` or directly via `/mastermind:diagnose`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to investigate (required)
+- `issue_id`: specific issue or task ID that stalled (optional — omit to scan all stalled work)
+- `agent_id`: scope investigation to a specific agent (optional)
+- `action`: scan | diagnose | report
+- `caller`: command | master
+
+---
+
+## Three Invariants (MUST be preserved in all analysis and proposed fixes)
+
+Every diagnosis and every proposed rule must hold these three invariants together:
+
+1. **Productive work continues.** Agents with a clear next action must keep working without needing a human to wake them.
+2. **Only real blockers stop work.** Stops happen when something genuinely cannot proceed (missing approval, missing dependency, human owner). Pseudo-stops must be detected and routed.
+3. **No infinite loops.** Recovery and continuation loops must be bounded and distinguishable from genuinely productive continuation.
+
+If a proposed fix violates any invariant, drop it or rework it. State explicitly how each invariant is held.
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Org State
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+stateFile=".monomind/orgs/${org_name}-state.json"
+activityFile=".monomind/orgs/${org_name}-activity.jsonl"
+issuesFile=".monomind/orgs/${org_name}-issues.json"
+routinesFile=".monomind/orgs/${org_name}-routines.json"
+```
+
+---
+
+## Step 2 — Execute Action
+
+### scan (default)
+
+Scan for stalled work across the org:
+
+```bash
+echo "STALL SCAN — $org_name"
+echo "════════════════════════════════════════════════════════"
+
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+now=$(date +%s)
+
+echo ""
+echo "AGENT HEARTBEATS"
+echo "────────────────────────────────────────────────────────"
+
+python3 - "$orgFile" "$stateFile" "$now" <<'PYEOF'
+import json, sys, os
+from datetime import datetime, timezone
+
+org = json.load(open(sys.argv[1]))
+state_path = sys.argv[2]
+now = int(sys.argv[3])
+
+hb = {}
+if os.path.exists(state_path):
+    try:
+        state = json.load(open(state_path))
+        for r in state.get("roles", []):
+            hb[r.get("id","")] = r.get("last_heartbeat")
+    except:
+        pass
+
+roles = org.get("roles", [])
+stalled = []
+for r in roles:
+    rid   = r.get("id","?")
+    title = r.get("title",rid)
+    last  = hb.get(rid)
+    if not last:
+        age = "never"
+        stalled.append((rid, title, "no heartbeat"))
+    else:
+        try:
+            dt = datetime.fromisoformat(last.replace("Z","+00:00"))
+            age_s = now - int(dt.timestamp())
+            age = f"{age_s//60}m ago"
+            if age_s > 3600:
+                stalled.append((rid, title, f"stale ({age})"))
+        except:
+            age = "?"
+    print(f"  {rid:<28} {title:<24} last: {last or 'never'}")
+
+print()
+if stalled:
+    print(f"  STALLED AGENTS ({len(stalled)}):")
+    for rid, title, reason in stalled:
+        print(f"    ⚠  {rid}  {title}  — {reason}")
+else:
+    print("  All agents have recent heartbeats.")
+PYEOF
+
+echo ""
+echo "OPEN ISSUES (stall candidates)"
+echo "────────────────────────────────────────────────────────"
+
+if [ -f "$issuesFile" ]; then
+  python3 - "$issuesFile" "$now" <<'PYEOF'
+import json, sys
+from datetime import datetime, timezone
+
+data = json.load(open(sys.argv[1]))
+now  = int(sys.argv[2])
+
+issues = [i for i in data.get("issues",[])
+          if i.get("status") in ("open","in_progress","in_review")]
+
+if not issues:
+    print("  (no open/stalled issues)")
+else:
+    for iss in issues[:20]:
+        iid   = iss.get("id","?")[:28]
+        title = iss.get("title","-")[:38]
+        st    = iss.get("status","?")
+        upd   = iss.get("updatedAt","-")[:10]
+        asgn  = (iss.get("assigneeId") or "—")[:20]
+        print(f"  [{st:<11}] {title:<38} assigned={asgn}  updated={upd}")
+PYEOF
+else
+  echo "  (no issues file)"
+fi
+
+echo ""
+echo "  For deep diagnosis: /mastermind:diagnose --org $org_name --action diagnose --issue-id <id>"
+```
+
+### diagnose
+
+Forensic deep-dive on a specific issue or agent:
+
+```bash
+echo "DEEP DIAGNOSIS — $org_name"
+echo "════════════════════════════════════════════════════════"
+echo ""
+
+if [ -n "$issue_id" ]; then
+  echo "ISSUE: $issue_id"
+  echo "────────────────────────────────────────────────────────"
+  if [ -f "$issuesFile" ]; then
+    jq --arg id "$issue_id" '.issues[] | select(.id == $id)' "$issuesFile" 2>/dev/null \
+      || echo "  Issue not found: $issue_id"
+  fi
+fi
+
+if [ -n "$agent_id" ]; then
+  echo ""
+  echo "AGENT ACTIVITY: $agent_id"
+  echo "────────────────────────────────────────────────────────"
+  if [ -f "$activityFile" ]; then
+    grep "$agent_id" "$activityFile" | tail -20 | while read -r line; do
+      echo "  $line"
+    done
+  else
+    echo "  (no activity log found)"
+  fi
+fi
+
+echo ""
+echo "DIAGNOSIS FRAMEWORK"
+echo "────────────────────────────────────────────────────────"
+echo "  Walk the issue tree and find the exact stop-point."
+echo "  Common stall shapes:"
+echo "    1. Issue is 'in_review' with no active run or pending interaction"
+echo "    2. Issue is 'in_progress' after a successful run with no next action"
+echo "    3. Blocker chain whose leaf is cancelled or inaccessible"
+echo "    4. Recovery loop waking the same issue repeatedly after successful runs"
+echo "    5. Stranded-work recovery treating its own recovery issues as source work"
+echo ""
+echo "  Root cause format:"
+echo "    - Stop-point: <issue-id> stuck at status=<status> because <reason>"
+echo "    - Evidence: <run ids, timestamps, status transitions>"
+echo "    - Proposed rule: <rule that prevents recurrence>"
+echo "    - Invariant check: [1] productive work continues? [2] real blockers only? [3] bounded?"
+```
+
+### report
+
+```bash
+echo "DIAGNOSTIC REPORT — $org_name"
+echo "════════════════════════════════════════════════════════"
+echo "Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+echo ""
+
+agentCount=$(jq '.roles | length' "$orgFile")
+echo "Org agents:  $agentCount"
+
+if [ -f "$issuesFile" ]; then
+  openCount=$(jq '[.issues[] | select(.status == "open")] | length' "$issuesFile")
+  inpCount=$(jq '[.issues[] | select(.status == "in_progress")] | length' "$issuesFile")
+  doneCount=$(jq '[.issues[] | select(.status == "done")] | length' "$issuesFile")
+  echo "Issues:      open=$openCount  in_progress=$inpCount  done=$doneCount"
+fi
+
+echo ""
+echo "THREE INVARIANT STATUS:"
+echo "  1. Productive work continues:  [check heartbeats + open issues]"
+echo "  2. Only real blockers stop:    [check stall candidates above]"
+echo "  3. No infinite loops:          [check activity log for repeat patterns]"
+echo ""
+echo "  Run scan first: /mastermind:diagnose --org $org_name --action scan"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org_name: <org_name>
+invariants:
+  productive_work_continues: check
+  only_real_blockers: check
+  no_infinite_loops: check
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/env.md

@@ -0,0 +1,198 @@
+---
+name: mastermind-env
+description: Mastermind env — audit and configure the runtime environment for an org. Shows LLM provider config, memory backend, agent JWT settings, logging, and storage — highlighting missing or misconfigured values.
+type: domain-skill
+default_mode: auto
+---
+
+# Mastermind Env
+
+This skill is invoked by `mastermind:env` or directly via `/mastermind:env`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block
+- `org_name`: org to inspect env for
+- `action`: show | set | validate
+- `key`: env var key to set (for set action)
+- `value`: value to set (for set action — use env var reference, not inline secrets)
+- `section`: llm | memory | jwt | logging | storage | all (default: all)
+- `caller`: command | master
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Org Config
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '$org_name' not found."; exit 1; }
+
+memNs="org:${org_name}"
+```
+
+---
+
+## Step 2 — Execute Action
+
+### show (default)
+
+Collect and display environment configuration for this org's agents:
+
+```bash
+echo "╔══════════════════════════════════════════════════════╗"
+echo "║  ENV AUDIT — org: ${org_name}"
+echo "╚══════════════════════════════════════════════════════╝"
+echo ""
+
+# LLM / Adapter config
+echo "LLM PROVIDER"
+echo "────────────"
+ceo_model=$(jq -r '.run_config.ceo_adapter // "claude-sonnet-4-6"' "$orgFile")
+echo "  CEO adapter model:  $ceo_model"
+jq -r '.roles[] | "  \(.id): \(.adapter_config.model // "inherited from CEO")"' "$orgFile" 2>/dev/null
+echo ""
+
+# API key availability (check env vars, never print values)
+echo "API KEYS (present/missing)"
+echo "──────────────────────────"
+for key in ANTHROPIC_API_KEY OPENAI_API_KEY GOOGLE_API_KEY; do
+  if [ -n "${!key}" ]; then
+    echo "  $key: ✓ present (${!key:0:6}***)"
+  elif [ -f ".monomind/orgs/.secrets/${org_name}/${key}" ]; then
+    echo "  $key: ✓ in org secrets"
+  else
+    echo "  $key: ✗ MISSING"
+  fi
+done
+echo ""
+
+# Memory config
+echo "MEMORY"
+echo "──────"
+echo "  namespace: org:${org_name}"
+npx monomind@latest memory list --namespace "org:${org_name}" 2>/dev/null | wc -l | xargs echo "  stored entries:"
+echo ""
+
+# Board config
+echo "TASK BOARD"
+echo "──────────"
+board_id=$(jq -r '.board_id // "NOT CONFIGURED"' "$orgFile")
+echo "  board_id:    $board_id"
+echo "  todo_col:    $(jq -r '.todo_col_id // "NOT CONFIGURED"' "$orgFile")"
+echo "  doing_col:   $(jq -r '.doing_col_id // "NOT CONFIGURED"' "$orgFile")"
+echo "  done_col:    $(jq -r '.done_col_id // "NOT CONFIGURED"' "$orgFile")"
+echo ""
+
+# Run config
+echo "RUN CONFIG"
+echo "──────────"
+jq -r '.run_config | to_entries[] | "  \(.key): \(.value)"' "$orgFile" 2>/dev/null
+echo ""
+
+# Governance
+echo "GOVERNANCE"
+echo "──────────"
+jq -r '"  policy: \(.governance.policy // "auto")"' "$orgFile" 2>/dev/null
+echo ""
+
+# Dashboard
+echo "DASHBOARD"
+echo "─────────"
+CTRL_URL=$(jq -r '.url // "http://localhost:4242"' ".monomind/control.json" 2>/dev/null || echo "http://localhost:4242")
+echo "  url:    $CTRL_URL"
+curl -s "${CTRL_URL}/api/health" >/dev/null 2>&1 && echo "  status: ✓ reachable" || echo "  status: ✗ not reachable"
+```
+
+### validate
+
+Run a preflight check before starting an org run:
+
+```bash
+echo "PREFLIGHT CHECK — org: $org_name"
+errors=0
+
+# Check all required env vars
+for key in ANTHROPIC_API_KEY; do
+  if [ -z "${!key}" ] && [ ! -f ".monomind/orgs/.secrets/${org_name}/${key}" ]; then
+    echo "  ✗ MISSING: $key"
+    errors=$((errors + 1))
+  else
+    echo "  ✓ $key"
+  fi
+done
+
+# Check board IDs
+board_id=$(jq -r '.board_id // empty' "$orgFile")
+[ -z "$board_id" ] && { echo "  ✗ MISSING: board_id — run /mastermind:createorg to rebuild"; errors=$((errors + 1)); } || echo "  ✓ board_id"
+
+# Check roles
+role_count=$(jq '.roles | length' "$orgFile")
+[ "$role_count" -eq 0 ] && { echo "  ✗ MISSING: no roles defined"; errors=$((errors + 1)); } || echo "  ✓ $role_count roles"
+
+# Summary
+echo ""
+if [ "$errors" -eq 0 ]; then
+  echo "✓ All checks passed — org is ready to run."
+else
+  echo "✗ $errors issue(s) found — resolve before running."
+fi
+```
+
+### set
+
+Update a run_config key or governance field in the org JSON:
+
+```bash
+# Only allow safe keys — never set arbitrary JSON to prevent injection
+allowed_keys="checkpoint_interval_min max_concurrent_agents budget_tokens alert_threshold ceo_adapter"
+echo "$allowed_keys" | grep -qw "$key" || { echo "ERROR: Key '$key' not settable via this command. Edit $orgFile directly."; exit 1; }
+
+tmp="${orgFile}.tmp"
+jq --arg key "$key" --arg value "$value" \
+   '.run_config[$key] = ($value | if test("^[0-9]+$") then tonumber else . end)' \
+   "$orgFile" > "$tmp" && mv "$tmp" "$orgFile"
+echo "Set run_config.$key = $value"
+```
+
+---
+
+## Agent Environment Template
+
+When spawning agents, include this env block in their prompt:
+
+```bash
+# CEO/boss agent env block (prepend to all boss prompts):
+echo "ENVIRONMENT:
+  Memory namespace: org:${orgName}
+  Dashboard: ${CTRL_URL}
+  Budget: $(jq -r '.run_config.budget_tokens // "unlimited"' "$orgFile") tokens
+  Governance: $(jq -r '.governance.policy // "auto"' "$orgFile")
+  ANTHROPIC_API_KEY: $([ -n "$ANTHROPIC_API_KEY" ] && echo "present" || echo "missing — check org secrets")
+"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+validation_errors: <N>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.

package/.claude/skills/mastermind/environments.md

@@ -0,0 +1,250 @@
+---
+name: mastermind-environments
+description: Mastermind environments — manage execution environments (local, SSH, sandbox) for an org. Controls where agent workloads run, SSH connection details, and which environment is the default.
+type: domain-skill
+default_mode: confirm
+---
+
+# Mastermind Environments
+
+This skill is invoked by `mastermind:environments` or directly via `/mastermind:environments`.
+
+---
+
+## Inputs
+
+- `brain_context`: BRAIN CONTEXT block (injected by command, or loaded below if standalone)
+- `org_name`: org to manage environments for (required)
+- `action`: list | create | edit | delete | probe | set-default
+- `env_id`: environment id (required for edit/delete/probe/set-default)
+- `kind`: local | ssh | sandbox (required for create)
+- `name`: display name (required for create)
+- `host`: SSH hostname or IP (required for ssh kind)
+- `port`: SSH port (default 22)
+- `user`: SSH username (required for ssh kind)
+- `secret_ref`: secret name holding the SSH private key (see mastermind:secrets — NEVER pass raw key values)
+- `work_dir`: remote working directory (default: /tmp/monomind)
+- `caller`: command | master
+
+---
+
+## Security Constraints
+
+- NEVER print SSH private key values
+- NEVER store key material in environment JSON files — store only the secret_ref name
+- SSH keys must be stored via `mastermind:secrets` and referenced by name only
+- Probe connection is read-only (runs `echo ok` over SSH)
+
+---
+
+## Step 0 — Brain Load (standalone only)
+
+If `caller` is not "command", load brain context following _protocol.md Brain Load Procedure with namespace: `ops`.
+
+---
+
+## Step 1 — Load Environments File
+
+```bash
+orgFile=".monomind/orgs/${org_name}.json"
+[ ! -f "$orgFile" ] && { echo "ERROR: Org '${org_name}' not found."; exit 1; }
+
+envFile=".monomind/orgs/${org_name}-environments.json"
+[ ! -f "$envFile" ] && cat > "$envFile" <<'EOF'
+{"environments":[],"default_env":null}
+EOF
+```
+
+---
+
+## Step 2 — Execute Action
+
+### list (default)
+
+```bash
+echo "ENVIRONMENTS — org: $org_name"
+echo "────────────────────────────────────────────────────────"
+printf "%-20s %-10s %-28s %-8s %s\n" "ID" "KIND" "HOST / PATH" "DEFAULT" "SECRET REF"
+echo "────────────────────────────────────────────────────────"
+
+defaultEnv=$(jq -r '.default_env // "none"' "$envFile")
+count=$(jq '.environments | length' "$envFile")
+
+if [ "$count" -eq 0 ]; then
+  echo "  No environments. Use --action create to add one."
+else
+  jq -r --arg def "$defaultEnv" '.environments[] |
+    [
+      .id,
+      (.kind // "local"),
+      (if .kind == "ssh" then ((.user // "?") + "@" + (.host // "?") + ":" + ((.port // 22) | tostring)) else (.work_dir // "(local)") end),
+      (if .id == $def then "yes" else "-" end),
+      (.secret_ref // "-")
+    ] | @tsv' "$envFile" | while IFS=$'\t' read -r id kind loc def sref; do
+    printf "%-20s %-10s %-28s %-8s %s\n" "$id" "$kind" "$loc" "$def" "$sref"
+  done
+fi
+
+echo ""
+echo "Total: $count environment(s)  |  Default: $defaultEnv"
+```
+
+### create
+
+```bash
+[ -z "$kind" ] && { echo "ERROR: --kind required (local|ssh|sandbox)."; exit 1; }
+[ -z "$name" ] && { echo "ERROR: --name required."; exit 1; }
+case "$kind" in local|ssh|sandbox) : ;; *)
+  echo "ERROR: --kind must be local, ssh, or sandbox"; exit 1 ;;
+esac
+if [ "$kind" = "ssh" ]; then
+  [ -z "$host" ] && { echo "ERROR: --host required for ssh kind."; exit 1; }
+  [ -z "$user" ] && { echo "ERROR: --user required for ssh kind."; exit 1; }
+  [ -z "$secret_ref" ] && { echo "WARNING: No --secret-ref supplied. SSH key must be pre-configured on the agent."; }
+fi
+
+envId=$(echo "${name}" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9' '-' | sed 's/^-//;s/-$//')
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+tmp="${envFile}.tmp"
+jq --arg id "$envId" \
+   --arg n "$name" \
+   --arg kind "$kind" \
+   --arg host "${host:-}" \
+   --argjson port "${port:-22}" \
+   --arg user "${user:-}" \
+   --arg sref "${secret_ref:-}" \
+   --arg wdir "${work_dir:-/tmp/monomind}" \
+   --arg ts "$ts" \
+  '.environments = [.environments[] | select(.id != $id)] +
+   [{"id":$id,"name":$n,"kind":$kind,
+     "host":(if $host != "" then $host else null end),
+     "port":(if $host != "" then $port else null end),
+     "user":(if $user != "" then $user else null end),
+     "secret_ref":(if $sref != "" then $sref else null end),
+     "work_dir":$wdir,
+     "createdAt":$ts,"lastProbe":null,"probeStatus":null}]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Created environment: $envId (kind: $kind)"
+[ "$kind" = "ssh" ] && echo "  SSH: ${user}@${host}:${port:-22}  key ref: ${secret_ref:-(none)}"
+echo "Run --action probe --env-id $envId to verify connectivity."
+```
+
+### edit
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+exists=$(jq --arg id "$env_id" '[.environments[] | select(.id == $id)] | length' "$envFile")
+[ "$exists" -eq 0 ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" \
+   --arg host "${host:-}" \
+   --argjson port "${port:-0}" \
+   --arg user "${user:-}" \
+   --arg sref "${secret_ref:-}" \
+   --arg wdir "${work_dir:-}" \
+  '.environments = [.environments[] | if .id == $id then
+     . *
+     (if $host != "" then {"host":$host} else {} end) *
+     (if $port > 0 then {"port":$port} else {} end) *
+     (if $user != "" then {"user":$user} else {} end) *
+     (if $sref != "" then {"secret_ref":$sref} else {} end) *
+     (if $wdir != "" then {"work_dir":$wdir} else {} end)
+   else . end]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Updated environment: $env_id"
+```
+
+### delete
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" \
+  '.environments = [.environments[] | select(.id != $id)] |
+   if .default_env == $id then .default_env = null else . end' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+echo "Deleted environment: $env_id"
+```
+
+### probe
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+envData=$(jq -r --arg id "$env_id" '.environments[] | select(.id == $id)' "$envFile")
+[ -z "$envData" ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+kind=$(echo "$envData" | jq -r '.kind')
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+case "$kind" in
+  local)
+    if [ -d "$(echo "$envData" | jq -r '.work_dir // "/tmp/monomind"')" ]; then
+      status="ok"
+    else
+      status="unreachable"
+    fi
+    ;;
+  ssh)
+    sshHost=$(echo "$envData" | jq -r '.host')
+    sshUser=$(echo "$envData" | jq -r '.user')
+    sshPort=$(echo "$envData" | jq -r '.port // 22')
+    sref=$(echo "$envData" | jq -r '.secret_ref // ""')
+    keyPath=""
+    [ -n "$sref" ] && keyPath=$(cat ".monomind/orgs/.secrets/${org_name}/${sref}" 2>/dev/null | jq -r '.path // ""' 2>/dev/null || echo "")
+    
+    if [ -n "$keyPath" ] && [ -f "$keyPath" ]; then
+      result=$(ssh -i "$keyPath" -p "$sshPort" -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
+        "${sshUser}@${sshHost}" "echo ok" 2>&1)
+    else
+      result=$(ssh -p "$sshPort" -o ConnectTimeout=5 -o StrictHostKeyChecking=no \
+        "${sshUser}@${sshHost}" "echo ok" 2>&1)
+    fi
+    [ "$result" = "ok" ] && status="ok" || status="unreachable"
+    ;;
+  sandbox)
+    status="unknown"
+    ;;
+esac
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" --arg st "$status" --arg ts "$ts" \
+  '.environments = [.environments[] | if .id == $id then .probeStatus = $st | .lastProbe = $ts else . end]' \
+  "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+
+echo "Probe [$env_id]: $status  (checked at $ts)"
+```
+
+### set-default
+
+```bash
+[ -z "$env_id" ] && { echo "ERROR: --env-id required."; exit 1; }
+exists=$(jq --arg id "$env_id" '[.environments[] | select(.id == $id)] | length' "$envFile")
+[ "$exists" -eq 0 ] && { echo "ERROR: Environment '$env_id' not found."; exit 1; }
+
+tmp="${envFile}.tmp"
+jq --arg id "$env_id" '.default_env = $id' "$envFile" > "$tmp" && mv "$tmp" "$envFile"
+echo "Default environment → $env_id"
+```
+
+---
+
+## Step 3 — Return Output
+
+```yaml
+domain: ops
+status: complete
+action: <action>
+org: <org_name>
+environments_count: <N>
+default_env: <id or null>
+```
+
+---
+
+## Step 4 — Brain Write (standalone only)
+
+If `caller` is not "command", follow _protocol.md Brain Write Procedure for domain `ops`.