pi-harness-runtime 1.1.396 → 1.1.398

package/AGENTS.md

@@ -648,20 +648,41 @@ Production detection ≠ deployment authorization
 
 ## Centralized Application Logging
 
-All application logs can be shipped to **Cloudflare R2** (durable archive) and to the
-**unified webhook server** (live path). The pipeline lives in `packages/logging`
-(`@pi-harness/logging`); the harness uses the process-wide singleton from it.
+All application logs can be shipped to the **unified webhook server** (ingest path),
+which is the only component that writes to **Cloudflare R2** (durable archive). The
+pipeline lives in `packages/logging` (`@pi-harness/logging`); the harness uses the
+process-wide singleton from it.
 
-**Delivery order** (first success wins, the rest are skipped):
+**Client side** (first success wins, the rest are skipped - a fallback chain, never
+a broadcast):
 
 ```text
-producer -> redact -> sample -> buffer -> R2 -> webhook -> local spool (~/.pi-harness-runtime/logs/spool)
+producer -> classify -> redact -> sample -> buffer -> webhook -> local spool (~/.pi-harness-runtime/logs/spool)
+```
+
+**Server side** (durable hand-off, then an independent upload):
+
+```text
+POST /api/logs -> authenticate -> validate -> durable outbox -> 202
+                                              |
+                                              v
+                                    worker -> R2 -> done
 ```
 
 - The local spool is the fallback: if every transport fails the batch is written to
   disk as NDJSON and re-shipped on the next successful flush. Nothing is lost, only delayed.
 - The local log files (`~/.pi-harness-runtime/logs/*.jsonl`, `harness/*.log`) stay the
   source of truth. The centralized pipeline is a copy for the archive.
+- **Only the server writes to R2.** In `auto` mode the webhook is preferred when
+  `PI_LOG_WEBHOOK_URL` is set, so client machines need no R2 credentials.
+
+**What may leave the machine** (`classify`): an event allowlist decides, not a
+denylist. Structured service/session/validation events are remote; the catch-all
+`harness.log` mirror of a local log line, prompts, responses and command output stay
+local. A message only travels when it looks sanitized (one line, short, no path, no
+URL with a query string), and fields with a private key name (`prompt`, `output`,
+`path`, `url`, `user`, ...) are dropped. `PI_LOG_DIAGNOSTIC=1` relaxes the message rule
+for a user who explicitly asked for more - it never widens the event allowlist.
 
 **Configuration** (environment first, then `~/.pi-harness-runtime/keys/`):
 
@@ -676,6 +697,9 @@ producer -> redact -> sample -> buffer -> R2 -> webhook -> local spool (~/.pi-ha
 | `PI_LOG_FLUSH_INTERVAL_MS` | Automatic flush interval | `15000` |
 | `PI_LOG_WEBHOOK_URL` | Ingest URL of the webhook server | unset |
 | `PI_LOG_WEBHOOK_TOKEN` | Bearer token for the ingest endpoint | unset |
+| `PI_LOG_APP_VERSION` | Version reported with every batch | unset |
+| `PI_LOG_INSTALLATION_ID` | Stable id of this installation | generated once |
+| `PI_LOG_DIAGNOSTIC` | `1` allows raw messages (events stay allowlisted) | unset |
 | `PI_LOG_R2_BUCKET` / `PI_LOG_R2_ENDPOINT` / `PI_LOG_R2_ACCESS_KEY_ID` / `PI_LOG_R2_SECRET_ACCESS_KEY` | R2 credentials | key files |
 | `PI_LOG_SPOOL_DIR` | Local spool directory | `~/.pi-harness-runtime/logs/spool` |
 
@@ -686,9 +710,32 @@ R2 credentials are read from the key files `r2-bucket-name.txt`, `r2-endpoint.tx
 
 - Emit through the singleton: `centralInfo/centralWarn/centralError(source, event, message?, fields?)`.
   The `source` identifies the component, the `event` is a dotted name.
+- The event name decides whether a record may leave the machine. Use one of the
+  allowlisted shapes (`service.*`, `session.*`, `validation.*`, `harness.service-diagnostics.*`,
+  `harness.planner.decision`, `harness.glm-quota.quota`, ...) or a `warn`/`error` level.
+  An unknown event stays local.
 - Redaction is automatic (key names, credential patterns, truncation), but producers must
   not pass user content: prompts, raw model output and message bodies are dropped by the
   redactor, so shipping them is pointless.
 - Never put a credential in a log message. The redactor is a safety net, not a licence.
-- The webhook server exposes `POST /api/logs` for the ingest path. Set `LOG_INGEST_TOKEN`
-  to require a bearer token; the server re-redacts every batch and relays it to R2.
+- Prefer a structured event over mirroring a local log line. The `logToFile()` mirror
+  (`harness.log`) stays local on purpose - the local file is the source of truth.
+
+**Server endpoints** (all require an ingest credential):
+
+| Route | Method | Purpose |
+|-------|--------|---------|
+| `/api/logs` | POST | Accept a batch. `202` only after the durable write, `503` when the endpoint is not configured or the queue is unavailable (the client keeps its spool). |
+| `/api/logs/query` | POST | Read-only, tenant-scoped metadata query (installation, session, time range, level, source, event). Bounded and paginated; never returns message text. |
+| `/api/logs/health` | GET | Queue depth, oldest pending age, failure count, last error. |
+
+**Ingest credentials** (server side):
+
+- The endpoint **fails closed**: without a credential every write is refused with `503`.
+- `LOG_INGEST_TOKEN` (or `keys/log-ingest-token.txt`) is a shared token for a
+  single-tenant deployment; `LOG_INGEST_TENANT` names its tenant.
+- `keys/log-ingest-credentials.json` holds scoped credentials, one per installation:
+  `{ "id", "tenantId", "label", "scopes", "tokenHash", "createdAt", "revokedAt" }`.
+  Tokens are stored as SHA-256 hashes; the tenant is derived from the credential and
+  never from the request body.
+- Rotate by adding an entry and revoking the old one (`revokedAt`).

package/harness/notification-events.ts

@@ -105,7 +105,7 @@ export class HarnessNotificationEvents {
 	 */
 	async emitQuotaPaused(resumeAt?: string): Promise<void> {
 		await this.emit("QuotaPaused", {
-			error: resumeAt ? `Resumes at ${resumeAt}` : undefined,
+			reason: resumeAt ? `Resumes at ${resumeAt}` : undefined,
 		});
 	}
 
@@ -113,7 +113,7 @@ export class HarnessNotificationEvents {
 	 * Emit ResumeScheduled event
 	 */
 	async emitResumeScheduled(resumeAt: string): Promise<void> {
-		await this.emit("ResumeScheduled", { error: resumeAt });
+		await this.emit("ResumeScheduled", { reason: resumeAt });
 	}
 
 	/**
@@ -121,7 +121,7 @@ export class HarnessNotificationEvents {
 	 */
 	async emitContextCompacted(tokensCompacted?: number): Promise<void> {
 		await this.emit("ContextCompacted", {
-			error: tokensCompacted
+			reason: tokensCompacted
 				? `Compacted ${tokensCompacted.toLocaleString()} tokens`
 				: undefined,
 		});
@@ -132,7 +132,7 @@ export class HarnessNotificationEvents {
 	 */
 	async emitOutputLimitContinued(attempt: number): Promise<void> {
 		await this.emit("OutputLimitContinued", {
-			error: `Attempt ${attempt}`,
+			reason: `Attempt ${attempt}`,
 		});
 	}
 
@@ -149,7 +149,7 @@ export class HarnessNotificationEvents {
 	 * Emit HumanReviewNeeded event
 	 */
 	async emitHumanReviewNeeded(taskId: string, reason: string): Promise<void> {
-		await this.emit("HumanReviewNeeded", { taskId, error: reason });
+		await this.emit("HumanReviewNeeded", { taskId, reason });
 	}
 
 	/**
@@ -163,7 +163,7 @@ export class HarnessNotificationEvents {
 	 * Emit JobCancelled event
 	 */
 	async emitJobCancelled(reason?: string): Promise<void> {
-		await this.emit("JobCancelled", { error: reason });
+		await this.emit("JobCancelled", { reason });
 	}
 
 	/**

package/index.ts

@@ -5610,7 +5610,7 @@ Run \`bd ready\` to see current bd issues.
 			pi.sendUserMessage(content, { deliverAs });
 			await nc("ResumeScheduled", {
 				requirement: "Session auto-resume",
-				error: reason,
+				reason,
 			});
 		} catch (error) {
 			logToFile(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-harness-runtime",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",
   "type": "module",
   "scripts": {

package/packages/a2a-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/a2a-adapter",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Google Agent-to-Agent (A2A) protocol adapter for pi-harness",
   "main": "dist/index.js",

package/packages/agent-policy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/agent-policy",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Agent policy runtime for pi-harness - enforces mandatory rule delivery and mutation gating",
   "type": "module",
   "main": "./dist/index.js",

package/packages/architecture-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/architecture-generator",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Generate ADR and Mermaid diagrams from project analysis",
   "type": "module",
   "main": "./dist/index.js",

package/packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/auth",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "pi-harness-runtime — auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/autonomous-refactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-refactor",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Autonomous refactoring engine",
   "main": "dist/index.js",

package/packages/autonomous-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/autonomous-runtime",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Autonomous Operations Runtime — task inbox, lease management, and worker lifecycle (RFC-0101)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cache-strategy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cache-strategy",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Smart caching with TTL and invalidation strategies (RFC-0022)",
   "main": "dist/index.js",

package/packages/capability-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/capability-registry",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Capability Registry for pi-harness-runtime — tracks model capabilities and enables capability-based routing",
   "type": "module",
   "main": "./dist/index.js",

package/packages/checkpoint/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/checkpoint",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Enhanced checkpoint system with incremental snapshots, diff-based storage, and recovery strategies",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cli-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/cli-plugin-sdk",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "CLI Plugin SDK for pi-harness — install, list, remove, update, invoke plugins",
   "main": "dist/index.js",

package/packages/clipboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/clipboard-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/clipboard-plugin",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/code-generation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-generation",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Code generation pipeline for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/code-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/code-review",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Automated code review engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/codex-adapter",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "OpenAI Codex provider adapter for pi-harness",
   "main": "dist/index.js",

package/packages/codex-watcher/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/codex-watcher",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Watches Codex CLI sessions and emits visible messages for PING-PONG monitoring",
   "type": "module",
   "main": "./dist/src/index.js",

package/packages/config-capture/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/config-capture",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Auto-capture API-fetched configuration values to AGENTS.md",
   "type": "module",
   "main": "src/index.ts",

package/packages/connection-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/connection-runtime",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Connection management with jittered exponential backoff for pi-harness",
   "main": "./dist/index.js",

package/packages/context-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-compiler",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Bounded context selection engine for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/context-discovery/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/context-discovery",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/context-manager/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/context-manager",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Context Window Manager — prevents model context overflow via compaction and resume prompts (RFC-0010)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/contracts",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "RPC schema definitions for pi-harness runtime",
   "main": "./dist/index.js",

package/packages/cookie-sanitizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cookie-sanitizer",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "pi-harness-runtime — cookie sanitizer (provider-quota cookie file normaliser)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/cost-optimizer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/cost-optimizer",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Cost Optimizer for pi-harness-runtime — budget tracking, forecasting, and model selection optimization",
   "type": "module",
   "main": "./dist/index.js",

package/packages/dependency-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/dependency-analyzer",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/django-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/django-plugin",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Django framework analysis — models, management commands, settings",
   "type": "module",
   "main": "./dist/index.js",

package/packages/doc-generator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/doc-generator",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Auto-Doc Generator — generate documentation from source code (RFC-0014)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/durable-review/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/durable-review",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "SQLite-backed durable reviewer using @earendil-works/pi-durable",
   "type": "module",
   "main": "src/index.ts",

package/packages/e2e-tester/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/e2e-tester",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "WebMCP-powered E2E testing for pi-harness - natural language test scenarios",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/evaluation-engine",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Evaluation engine for pi-harness runtime (RFC-0057)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/evaluation-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/evaluation-runner",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Framework-agnostic evaluation framework for AI outputs (RFC-0020)",
   "main": "dist/index.js",

package/packages/event-bus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-bus",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/event-sink/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/event-sink",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Atomic event sourcing with SQLite transactions for pi-harness",
   "main": "./dist/index.js",

package/packages/event-store/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/event-store",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/experience-replay/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/experience-replay",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Experience replay for debugging and reproducibility (RFC-0059)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/feedback-collector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/feedback-collector",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Collect and aggregate human/automated feedback (RFC-0021)",
   "main": "dist/index.js",

package/packages/file-copy-helper/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moocoding/file-copy-helper",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Injects cp/sudo cp rule when user asks to mimic/copy files",
   "type": "module",
   "main": "dist/index.js",

package/packages/framework-detector/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-detector",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Framework detection system for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/framework-plugin-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/framework-plugin-sdk",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Framework plugin SDK for pi-harness-runtime",
   "type": "module",
   "main": "./dist/index.js",

package/packages/frappe-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/frappe-plugin",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Frappe/ERPNext framework analysis — DocTypes, hooks, bench sites, site config",
   "type": "module",
   "main": "./dist/index.js",

package/packages/generic-web-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/generic-web-plugin",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Generic web framework analysis — REST/GraphQL endpoints, OpenAPI, auth",
   "type": "module",
   "main": "./dist/index.js",

package/packages/health-monitor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/health-monitor",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "description": "Health monitoring and auto-healing",
   "main": "dist/index.js",

package/packages/intent-analyzer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/intent-analyzer",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

package/packages/jev-judge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/jev-judge",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Jev Judge - Structured decision model for agent routing, E2E testing, and automated decisions",
   "type": "module",
   "main": "./dist/index.js",

package/packages/knowledge-graph/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/knowledge-graph",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Knowledge Graph extraction and provenance linking for SKILL.md files",
   "type": "module",
   "main": "./dist/index.js",

package/packages/knowledge-retrieval/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/knowledge-retrieval",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Knowledge retrieval via TencentDB-Agent-Memory MCP (RFC-0105)",
   "type": "module",
   "main": "./dist/index.js",

package/packages/laravel-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi/laravel-plugin",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Laravel framework analysis — artisan commands, Eloquent models, Blade",
   "type": "module",
   "main": "./dist/index.js",

package/packages/learning-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/learning-engine",
-  "version": "1.1.396",
+  "version": "1.1.398",
   "description": "Learning engine for extracting lessons from runtime execution (RFC-0058)",
   "type": "module",
   "main": "./dist/index.js",