smol-symphony 0.2.0 → 0.3.0

package/dist/tests/shell/workspace-live-config.test.js

@@ -0,0 +1,140 @@
+// Focused tests for finding #3: the workspace adapter must read workspace.root /
+// source-repo via a LIVE config closure, NOT a boot snapshot, so a WORKFLOW.yaml
+// hot-reload that moves workspace.root retargets create/list/remove instead of
+// stranding them on the stale path.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createWorkspaceAdapter } from '../../src/shell/interp/workspace.js';
+// A ProcessRunner stub — list/remove/workspacePathFor don't spawn, so a throwing
+// runner proves these paths are pure fs against the LIVE root.
+const noProcess = {
+    run: async () => { throw new Error('process.run must not be called on the list/remove path'); },
+};
+// assertContained is the pure core guard; the identity-on-contained behaviour is
+// all the adapter needs here (root/<key> is always a strict child).
+const assertContained = (_root, target) => target;
+async function withDirs(fn) {
+    const base = await mkdtemp(path.join(os.tmpdir(), 'symphony-ws-live-'));
+    const a = path.join(base, 'root-a');
+    const b = path.join(base, 'root-b');
+    await mkdir(a, { recursive: true });
+    await mkdir(b, { recursive: true });
+    try {
+        await fn(a, b);
+    }
+    finally {
+        await rm(base, { recursive: true, force: true });
+    }
+}
+test('workspacePathFor follows a live workspace.root change (no boot snapshot)', async () => {
+    await withDirs(async (rootA, rootB) => {
+        let liveRoot = rootA;
+        const ws = createWorkspaceAdapter({
+            root: () => liveRoot,
+            sourceRepo: () => '/unused',
+            process: noProcess,
+            assertContained,
+        });
+        assert.equal(ws.workspacePathFor('7'), path.join(rootA, '7'));
+        // Simulate a WORKFLOW.yaml hot-reload that moved workspace.root.
+        liveRoot = rootB;
+        assert.equal(ws.workspacePathFor('7'), path.join(rootB, '7'), 'path uses the NEW live root');
+    });
+});
+test('list() enumerates the NEW root after a config change', async () => {
+    await withDirs(async (rootA, rootB) => {
+        // Seed a workspace dir under each root.
+        await mkdir(path.join(rootA, 'old-ws'), { recursive: true });
+        await mkdir(path.join(rootB, 'new-ws'), { recursive: true });
+        let liveRoot = rootA;
+        const ws = createWorkspaceAdapter({
+            root: () => liveRoot,
+            sourceRepo: () => '/unused',
+            process: noProcess,
+            assertContained,
+        });
+        assert.deepEqual((await ws.list()).map((l) => l.name).sort(), ['old-ws']);
+        liveRoot = rootB;
+        assert.deepEqual((await ws.list()).map((l) => l.name).sort(), ['new-ws'], 'list reads the NEW root');
+    });
+});
+test('an in-flight ensureFor after a root change targets the NEW root (not the stale old-root clone)', async () => {
+    await withDirs(async (rootA, rootB) => {
+        // The source repo must look like a git dir (setup() stats <source>/.git first).
+        const sourceRepo = path.dirname(rootA);
+        await mkdir(path.join(sourceRepo, '.git'), { recursive: true });
+        const ok = (overrides = {}) => ({ ran: true, exit_code: 0, signal: null, timed_out: false, stdout: '', stderr: '', ...overrides });
+        // Record the cwd (= workspace path) of every `git clone` and gate the FIRST clone
+        // so it stays in-flight while we change the root and fire a second ensureFor.
+        const cloneCwds = [];
+        let firstCloneSeen;
+        const firstCloneStarted = new Promise((res) => { firstCloneSeen = res; });
+        let releaseFirstClone;
+        const firstCloneGate = new Promise((res) => { releaseFirstClone = res; });
+        let cloneCount = 0;
+        const recordingProcess = {
+            run: async (argv, opts) => {
+                const cwd = opts?.cwd ?? '';
+                if (argv[0] === 'git' && argv[1] === 'clone') {
+                    cloneCwds.push(cwd);
+                    if (cloneCount++ === 0) {
+                        firstCloneSeen();
+                        await firstCloneGate;
+                    }
+                }
+                // restorePushedBranch: `git remote get-url origin` exit!=0 → local-only → checkout -b.
+                if (argv[1] === 'remote' && argv[2] === 'get-url')
+                    return ok({ exit_code: 1 });
+                if (argv[1] === 'remote' && argv.length === 2)
+                    return ok({ stdout: '' }); // no remotes to strip
+                return ok();
+            },
+        };
+        let liveRoot = rootA;
+        const ws = createWorkspaceAdapter({
+            root: () => liveRoot,
+            sourceRepo: () => sourceRepo,
+            process: recordingProcess,
+            assertContained,
+        });
+        const opts = { baseBranch: 'main', githubRepo: null };
+        const first = ws.ensureFor('9', opts); // clones into rootA, then parks on the gate
+        await firstCloneStarted;
+        // WORKFLOW.yaml hot-reload moves workspace.root mid-clone.
+        liveRoot = rootB;
+        // A fresh ensureFor for the SAME id must NOT reuse the parked old-root promise —
+        // the in-flight key includes the live root, so this starts a new clone under rootB.
+        const second = ws.ensureFor('9', opts);
+        releaseFirstClone();
+        const [r1, r2] = await Promise.all([first, second]);
+        assert.equal(r1.path, path.join(rootA, '9'), 'first ensureFor resolved under the OLD root');
+        assert.equal(r2.path, path.join(rootB, '9'), 'second ensureFor targets the NEW root');
+        // Two DISTINCT clones happened (one per root) — the stale promise was not reused.
+        assert.deepEqual(cloneCwds.sort(), [path.join(rootA, '9'), path.join(rootB, '9')].sort());
+    });
+});
+test('remove() targets the NEW root after a config change', async () => {
+    await withDirs(async (rootA, rootB) => {
+        // Same workspace key exists under both roots; remove must hit the live one.
+        await mkdir(path.join(rootA, 'dup'), { recursive: true });
+        await writeFile(path.join(rootA, 'dup', 'keep.txt'), 'a', 'utf8');
+        await mkdir(path.join(rootB, 'dup'), { recursive: true });
+        await writeFile(path.join(rootB, 'dup', 'gone.txt'), 'b', 'utf8');
+        let liveRoot = rootB;
+        const ws = createWorkspaceAdapter({
+            root: () => liveRoot,
+            sourceRepo: () => '/unused',
+            process: noProcess,
+            assertContained,
+        });
+        await ws.remove('dup', 'stale_issue');
+        // The dir under the LIVE root (B) is gone; the same-named dir under A survives.
+        assert.deepEqual((await ws.list()).map((l) => l.name), [], 'live root dir removed');
+        liveRoot = rootA;
+        assert.deepEqual((await ws.list()).map((l) => l.name), ['dup'], 'stale-root dir untouched');
+    });
+});
+//# sourceMappingURL=workspace-live-config.test.js.map

package/dist/tests/shell/workspace-live-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-live-config.test.js","sourceRoot":"","sources":["../../../tests/shell/workspace-live-config.test.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,oCAAoC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAI7E,iFAAiF;AACjF,+DAA+D;AAC/D,MAAM,SAAS,GAAkB;IAC/B,GAAG,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC,CAAC;CAChG,CAAC;AAEF,iFAAiF;AACjF,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC;AAE1E,KAAK,UAAU,QAAQ,CAAC,EAA2C;IACjE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,EAAE,GAAG,sBAAsB,CAAC;YAChC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ;YACpB,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;YAC3B,OAAO,EAAE,SAAS;YAClB,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9D,iEAAiE;QACjE,QAAQ,GAAG,KAAK,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,wCAAwC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,EAAE,GAAG,sBAAsB,CAAC;YAChC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ;YACpB,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;YAC3B,OAAO,EAAE,SAAS;YAClB,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1E,QAAQ,GAAG,KAAK,CAAC;QACjB,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;IAChH,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,gFAAgF;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhE,MAAM,EAAE,GAAG,CAAC,YAAoC,EAAE,EAAiB,EAAE,CACnE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAEtG,kFAAkF;QAClF,8EAA8E;QAC9E,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,IAAI,cAA2B,CAAC;QAChC,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,GAAG,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,iBAA8B,CAAC;QACnC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,GAAG,iBAAiB,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,MAAM,gBAAgB,GAAkB;YACtC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;gBACxB,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC5B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;oBAC7C,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACpB,IAAI,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;wBAAC,cAAc,EAAE,CAAC;wBAAC,MAAM,cAAc,CAAC;oBAAC,CAAC;gBACrE,CAAC;gBACD,uFAAuF;gBACvF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/E,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB;gBAChG,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;SACF,CAAC;QAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,EAAE,GAAG,sBAAsB,CAAC;YAChC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ;YACpB,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;YAC5B,OAAO,EAAE,gBAAgB;YACzB,eAAe;SAChB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAG,4CAA4C;QACrF,MAAM,iBAAiB,CAAC;QAExB,2DAA2D;QAC3D,QAAQ,GAAG,KAAK,CAAC;QACjB,iFAAiF;QACjF,oFAAoF;QACpF,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEvC,iBAAiB,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAEpD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,6CAA6C,CAAC,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,uCAAuC,CAAC,CAAC;QACtF,kFAAkF;QAClF,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACpC,4EAA4E;QAC5E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAElE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,EAAE,GAAG,sBAAsB,CAAC;YAChC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ;YACpB,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;YAC3B,OAAO,EAAE,SAAS;YAClB,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACtC,gFAAgF;QAChF,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACpF,QAAQ,GAAG,KAAK,CAAC;QACjB,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smol-symphony",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "TypeScript orchestrator that runs coding agents (Claude, Codex, OpenCode) in per-issue Gondolin microVMs over ACP.",
   "keywords": [
     "orchestrator",
@@ -29,26 +29,37 @@
   },
   "files": [
     "dist/",
-    "WORKFLOW.md",
-    "WORKFLOW.template.md",
+    "patches/",
+    "WORKFLOW.yaml",
+    "WORKFLOW.minimal.yaml",
+    "WORKFLOW.template.yaml",
+    "assets/",
+    "prompts/",
+    "prompts-minimal/",
     "AGENTS.md",
     "SPEC.md",
     "PRODUCT.md",
     "DESIGN.md",
+    "scripts/postinstall.mjs",
     "scripts/vm-agent.mjs",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
+    "postinstall": "node scripts/postinstall.mjs",
     "build": "tsc",
-    "start": "tsx src/bin/symphony.ts",
-    "symphony": "tsx src/bin/symphony.ts WORKFLOW.md",
-    "dev": "tsx watch src/bin/symphony.ts",
+    "start": "tsx src/shell/main.ts",
+    "symphony": "tsx src/shell/main.ts WORKFLOW.yaml",
+    "dev": "tsx watch src/shell/main.ts",
     "typecheck": "tsc --noEmit",
-    "test": "node --test --import tsx tests/*.test.ts",
-    "prepublishOnly": "npm run typecheck && npm test && npm run build",
     "lint": "eslint src --max-warnings 0",
-    "lint:arch": "depcruise src --ts-config tsconfig.json --ignore-known",
+    "lint:arch": "depcruise src --ts-config tsconfig.json",
+    "check:ratio": "node scripts/check-core-ratio.mjs",
+    "check:pokes": "node scripts/check-state-pokes.mjs",
+    "check:io": "node scripts/check-shell-io.mjs",
+    "test": "node --test --import tsx $(find tests -name '*.test.ts')",
+    "verify": "npm run typecheck && npm run lint && npm run lint:arch && npm run check:ratio && npm run check:pokes && npm run check:io && npm test",
+    "prepublishOnly": "npm run typecheck && npm test && npm run build",
     "build:image": "bash images/agents/build-image-oci.sh"
   },
   "dependencies": {
@@ -56,6 +67,7 @@
     "@earendil-works/gondolin": "^0.12.0",
     "chokidar": "^4.0.3",
     "liquidjs": "^10.21.1",
+    "patch-package": "^8.0.1",
     "yaml": "^2.6.1"
   },
   "devDependencies": {

package/patches/@earendil-works+gondolin+0.12.0.patch

@@ -0,0 +1,173 @@
+diff --git a/node_modules/@earendil-works/gondolin/dist/src/qemu/network-stack.js b/node_modules/@earendil-works/gondolin/dist/src/qemu/network-stack.js
+index f08a11f..b8603bd 100644
+--- a/node_modules/@earendil-works/gondolin/dist/src/qemu/network-stack.js
++++ b/node_modules/@earendil-works/gondolin/dist/src/qemu/network-stack.js
+@@ -10,6 +10,35 @@ const IP_PROTO_ICMP = 1;
+ function makeTcpNatKey(srcIP, srcPort, dstIP, dstPort) {
+     return `TCP:${srcIP}:${srcPort}:${dstIP}:${dstPort}`;
+ }
++// TCP sequence and acknowledgement numbers are 32 bits wide and wrap at 2^32.
++// We keep every stored counter (mySeq/myAck/vmSeq/vmAck) masked into [0, 2^32)
++// and compare them with RFC 1982 serial-number arithmetic instead of raw </>,
++// which break across the wrap boundary. Skipping either half re-introduces the
++// `writeUInt32BE` overflow crash or silent reassembly desync near 0xFFFFFFFF.
++/** Fold a value into the 32-bit TCP sequence space [0, 2^32). */
++function wrapSeq(value) {
++    return value >>> 0;
++}
++/**
++ * Signed RFC 1982 distance between two sequence numbers: > 0 when `a` is "after"
++ * `b`, < 0 when "before", 0 when equal. ToInt32 (`| 0`) folds the difference into
++ * the [-2^31, 2^31) serial window so comparisons stay correct across wrap.
++ */
++function seqDistance(a, b) {
++    return (a - b) | 0;
++}
++/** `a` is strictly after `b` in serial-number order. */
++function seqGt(a, b) {
++    return seqDistance(a, b) > 0;
++}
++/** `a` is strictly before `b` in serial-number order. */
++function seqLt(a, b) {
++    return seqDistance(a, b) < 0;
++}
++/** `a` is at or before `b` in serial-number order. */
++function seqLe(a, b) {
++    return seqDistance(a, b) <= 0;
++}
+ const HTTP_METHODS = [
+     "GET",
+     "POST",
+@@ -503,7 +532,7 @@ export class NetworkStack extends EventEmitter {
+                 vmSeq: seq,
+                 vmAck: ack,
+                 mySeq: Math.floor(Math.random() * 0x0fffffff),
+-                myAck: seq + 1,
++                myAck: wrapSeq(seq + 1),
+                 peerWindow: window,
+                 pendingOutbound: Buffer.alloc(0),
+                 endPending: false,
+@@ -527,14 +556,14 @@ export class NetworkStack extends EventEmitter {
+         }
+         if (!session) {
+             if (!SYN) {
+-                this.sendTCP(srcIP, srcPort, dstIP, dstPort, 0, seq + (payload.length || 1), 0x04);
++                this.sendTCP(srcIP, srcPort, dstIP, dstPort, 0, wrapSeq(seq + (payload.length || 1)), 0x04);
+             }
+             return;
+         }
+         const prevPeerWindow = session.peerWindow;
+         session.peerWindow = window;
+         let shouldDrainOutbound = false;
+-        if (ack > session.vmAck && ack <= session.mySeq) {
++        if (seqGt(ack, session.vmAck) && seqLe(ack, session.mySeq)) {
+             session.vmAck = ack;
+             shouldDrainOutbound = true;
+         }
+@@ -553,12 +582,12 @@ export class NetworkStack extends EventEmitter {
+             // This matters for SSH in particular: duplicating bytes can desync the
+             // protocol and trigger errors like "Bad packet length".
+             const expectedSeq = session.myAck;
+-            if (seq > expectedSeq) {
++            if (seqGt(seq, expectedSeq)) {
+                 // Out-of-order: re-ACK what we've already seen.
+                 this.sendTCP(session.srcIP, session.srcPort, session.dstIP, session.dstPort, session.mySeq, session.myAck, 0x10);
+                 return;
+             }
+-            const skip = Math.max(0, expectedSeq - seq);
++            const skip = Math.max(0, seqDistance(expectedSeq, seq));
+             if (skip >= payload.length) {
+                 // Pure retransmit (or segment contains only already-acked bytes)
+                 this.sendTCP(session.srcIP, session.srcPort, session.dstIP, session.dstPort, session.mySeq, session.myAck, 0x10);
+@@ -568,7 +597,7 @@ export class NetworkStack extends EventEmitter {
+             }
+             const newPayload = payload.subarray(skip);
+             let sendBuffer = null;
+-            const nextAck = expectedSeq + newPayload.length;
++            const nextAck = wrapSeq(expectedSeq + newPayload.length);
+             if (!session.flowProtocol) {
+                 session.pendingData = Buffer.concat([session.pendingData, newPayload]);
+                 if (session.allowRawTcp) {
+@@ -635,20 +664,20 @@ export class NetworkStack extends EventEmitter {
+         if (FIN) {
+             // FIN consumes one sequence number, so only accept it once the sequence
+             // space up to the FIN is fully received.
+-            const finSeq = seq + payload.length;
+-            if (finSeq > session.myAck) {
++            const finSeq = wrapSeq(seq + payload.length);
++            if (seqGt(finSeq, session.myAck)) {
+                 // Out-of-order FIN: keep ACKing the last in-order byte.
+                 this.sendTCP(session.srcIP, session.srcPort, session.dstIP, session.dstPort, session.mySeq, session.myAck, 0x10);
+                 return;
+             }
+-            if (finSeq < session.myAck) {
++            if (seqLt(finSeq, session.myAck)) {
+                 // Duplicate FIN (already acked)
+                 this.sendTCP(session.srcIP, session.srcPort, session.dstIP, session.dstPort, session.mySeq, session.myAck, 0x10);
+                 return;
+             }
+             // finSeq === session.myAck
+             this.callbacks.onTcpClose({ key, destroy: false });
+-            session.myAck++;
++            session.myAck = wrapSeq(session.myAck + 1);
+             this.sendTCP(session.srcIP, session.srcPort, session.dstIP, session.dstPort, session.mySeq, session.myAck, 0x10);
+             if (session.state === "CLOSED_BY_REMOTE" ||
+                 session.state === "FIN_WAIT") {
+@@ -664,8 +693,10 @@ export class NetworkStack extends EventEmitter {
+         const header = Buffer.alloc(20);
+         header.writeUInt16BE(srcPort, 0);
+         header.writeUInt16BE(dstPort, 2);
+-        header.writeUInt32BE(seq, 4);
+-        header.writeUInt32BE(ack, 8);
++        // Counters are kept wrapped at their mutation sites; mask again here so the
++        // serialization boundary can never emit an out-of-range uint32 (the crash).
++        header.writeUInt32BE(wrapSeq(seq), 4);
++        header.writeUInt32BE(wrapSeq(ack), 8);
+         header[12] = 0x50;
+         header[13] = flags;
+         header.writeUInt16BE(65535, 14);
+@@ -925,7 +956,7 @@ export class NetworkStack extends EventEmitter {
+             }
+             return;
+         }
+-        const inFlight = Math.max(0, session.mySeq - session.vmAck);
++        const inFlight = Math.max(0, seqDistance(session.mySeq, session.vmAck));
+         const maxInFlight = Math.max(0, Math.min(session.peerWindow, this.TCP_MAX_IN_FLIGHT_BYTES));
+         if (inFlight < maxInFlight) {
+             this.txFlowPaused.delete(key);
+@@ -945,7 +976,7 @@ export class NetworkStack extends EventEmitter {
+         }
+         const MSS = 1460;
+         let bytesBurstThisTick = 0;
+-        let inFlight = Math.max(0, session.mySeq - session.vmAck);
++        let inFlight = Math.max(0, seqDistance(session.mySeq, session.vmAck));
+         const maxInFlight = Math.max(0, Math.min(session.peerWindow, this.TCP_MAX_IN_FLIGHT_BYTES));
+         while (session.pendingOutbound.length > 0 &&
+             inFlight < maxInFlight &&
+@@ -963,7 +994,7 @@ export class NetworkStack extends EventEmitter {
+             if (!isLiveSession()) {
+                 return;
+             }
+-            session.mySeq += chunk.length;
++            session.mySeq = wrapSeq(session.mySeq + chunk.length);
+             inFlight += chunk.length;
+             bytesBurstThisTick += chunk.length;
+         }
+@@ -990,7 +1021,7 @@ export class NetworkStack extends EventEmitter {
+                 if (!isLiveSession()) {
+                     return;
+                 }
+-                session.mySeq++;
++                session.mySeq = wrapSeq(session.mySeq + 1);
+                 session.state = "FIN_WAIT";
+                 session.endPending = false;
+                 inFlight += 1;
+@@ -1012,7 +1043,7 @@ export class NetworkStack extends EventEmitter {
+             return;
+         session.state = "ESTABLISHED";
+         this.sendTCP(session.srcIP, session.srcPort, session.dstIP, session.dstPort, session.mySeq, session.myAck, 0x12);
+-        session.mySeq++;
++        session.mySeq = wrapSeq(session.mySeq + 1);
+     }
+     handleTcpData(message) {
+         const session = this.natTable.get(message.key);

package/prompts/Reflect.md

@@ -0,0 +1,91 @@
+You are the **reflector** running symphony's *sleep cycle*. You are not
+implementing or reviewing a product change. Your job: mine symphony's own
+finished work for *recurring* friction in **how it runs work**, distil concrete
+lessons, and file one harness-improvement proposal per lesson into Triage —
+where a human operator decides whether to adopt it. Then close out this cycle.
+
+You are a single-run, ephemeral reflection issue: you were spawned for this one
+cycle, you run once, and you terminate in `Reflected`. There is no parked ticket
+to re-arm — the orchestrator mints a fresh reflection issue for the next cycle.
+
+This is a self-modifying loop: you read agent-authored transcripts and then
+propose changes to *your own* operating instructions. The guardrails below are
+load-bearing — follow them exactly.
+
+**What you can read** (read-only mounts present only in this state):
+
+- `/symphony/issues/` — every issue file across every state directory. The
+  richest signal is `/symphony/issues/Done/*.md`: each file is the full handoff
+  thread (every `symphony.transition` notes block from implementer → reviewer →
+  approval is appended to the body), so a Done file shows how the work actually
+  went, not just the final result. `Triage/`, `Cancelled/`, and the active
+  state dirs are visible too.
+- `/symphony/logs/<id>.jsonl` — the per-issue run log: every ACP frame, adapter
+  stderr line, typed-action output, and orchestrator lifecycle event for that issue.
+  This is where stalls, turn-budget exhaustion, retries, and timeouts show up
+  in detail.
+- Your workspace is a clone of the symphony repo, so you can read `WORKFLOW.yaml`,
+  `WORKFLOW.template.yaml`, `src/`, `images/agents/`, etc. to ground each proposal
+  in the concrete knob it would change.
+
+If structured per-issue run summaries exist (companion issue #123), start from
+those as an index; otherwise skim `Done/*.md` and open the
+`/symphony/logs/<id>.jsonl` for the issues that look anomalous.
+
+**What to look for — *recurring* patterns, not one-offs.** One bad run is
+noise; the same failure shape across several issues is signal. For example:
+
+- repeated `Review → Todo` rejects with the same root cause (the reviewer keeps
+  catching the same class of mistake the implementer prompt doesn't prevent);
+- turn-budget exhaustion (a state hits `max_turns` before it can transition);
+- stalls / timeouts (`stall_timeout_ms` / `prompt_timeout_ms` trips);
+- rebase / merge-conflict churn on re-dispatch;
+- credential re-login loops;
+- acceptance-criteria misses a sharper prompt or checklist would have caught;
+- prompt ambiguity that forced `request_human_steering`.
+
+**For each distilled lesson, file exactly one `symphony.propose_issue` call**
+(one per fix — never batch multiple fixes into one proposal; Triage is
+per-item). Each proposal must:
+
+- name a single concrete change to the **harness / operating config**: a
+  per-state `prompt_file`, a per-state `model` / `max_turns` /
+  `allowed_transitions` / `effort` / `actions`, the `gondolin` image config, an
+  acceptance criterion, or a timeout;
+- include a **before → after** (what the config/prompt says now, what you'd
+  change it to);
+- cite the **evidence** — the issue ids (and, where useful, the log lines or
+  Done-file quotes) that motivated it — so the operator can check the lesson
+  against the trajectories rather than trusting your summary.
+
+**Hard guardrails — a proposal that violates any of these must NOT be filed:**
+
+- Propose changes to the **harness only** — `WORKFLOW.yaml` /
+  `WORKFLOW.template.yaml`, per-state config (including `actions:`), the `gondolin`
+  image config, acceptance criteria, timeouts. Do **not** propose edits to product/source code under
+  `src/` as a "fix" for a trajectory; if a genuine product bug is the root
+  cause, that is an ordinary `propose_issue` for an implementer, not a harness
+  change, and you should frame it that way.
+- Never propose anything that **weakens a quality gate.** Do not weaken or
+  remove the Review state, the `npm run typecheck` / `npm test` /
+  `npm run lint:arch` / `npm run lint` gates, or the Triage human-approval gate
+  itself. The whole point of this loop is that a human stays in it; proposals
+  that would let the loop dispatch its own changes without review are
+  forbidden, even if the trajectories seem to "justify" them.
+- One fix per proposal, each with cited evidence. No proposal without issue ids.
+
+When you have filed your proposals — or concluded there is no recurring pattern
+worth acting on this cycle — hand off by terminating in `Reflected`:
+
+```
+symphony.transition({
+  to_state: "Reflected",
+  notes: "<one-paragraph log of this cycle: how many issues you reviewed, the
+          patterns you found, and the proposal titles you filed (or 'no
+          actionable pattern this cycle')>"
+})
+```
+
+Then end your turn; do not call any further tools. This issue is archived in the
+`Reflected` column as a per-cycle audit trail; the orchestrator mints a fresh
+reflection issue for the next cycle.

package/prompts/Review.md

@@ -0,0 +1,97 @@
+You are the **reviewer**. The implementer has committed work to the per-issue
+branch (`agent/{{ issue.identifier }}`) and handed off. Their summary is in
+the issue description above. Your job: decide whether the work is correct and
+either approve (→ Done) or send it back (→ Todo) with specific findings.
+
+1. Read the implementer's notes in the issue description carefully — title,
+   summary, files claimed touched. (Follow-ups belong in `propose_issue`,
+   not the notes; if you see a "Follow-ups not done" section in the notes,
+   reject and ask the implementer to file each item as a separate
+   `propose_issue` call instead.)
+2. Inspect the diff against the freshly-fetched base. The host fetched
+   `origin/main` (or whatever base branch `SYMPHONY_BASE_BRANCH` names — `main`
+   is the default here) into this workspace before the dispatch, and the
+   implementer rebased onto it, so `origin/main` is the true base:
+
+   ```
+   git log --oneline origin/main..HEAD
+   git diff origin/main..HEAD
+   ```
+
+   Diff against `origin/main`, **not** the local `main` ref: your workspace's
+   local `main` is frozen at clone time and goes **stale** as sibling PRs merge
+   — `origin/main` advances but local `main` does not. Diffing `main..HEAD` then
+   surfaces commits already on base as if they were the implementer's change,
+   and can make a correctly-based branch look like it *reverts* recently-landed
+   work. (Local-only mode — no `origin` remote — has no such drift, so `main`
+   stays the correct base there.) If `HEAD`'s merge-base is behind `origin/main`
+   (e.g. `git merge-tree --write-tree HEAD origin/main` reports conflicts),
+   reject to `Todo` asking the implementer to rebase onto `origin/main` — don't
+   agonize over an apparent revert.
+
+   Look at each file the implementer claimed to touch. Spot-check tests and
+   typecheck pass:
+
+   ```
+   npm run typecheck
+   npm test
+   ```
+
+3. Placement check — is the change on the right side of the seam?
+
+   The orchestrator (`src/agent/runner.ts`, `src/mcp.ts`, `src/orchestrator.ts`)
+   owns the state machine and tracker. Repo-local glue (`git push`, `gh pr
+   create`, rescuing artifacts) lives in a state's typed `actions:` block
+   (or a `run_in_vm` action for arbitrary guest commands). Reject when the
+   diff crosses that line:
+
+   - An action implements a new state transition, or mutates the tracker
+     filesystem the orchestrator owns (e.g. `mv issues/<state>/<id>.md
+     issues/<other-state>/<id>.md`).
+   - An action mutates runtime state the orchestrator committed earlier (e.g.
+     undoing a cleanup flag) and the runner now has to re-detect what the
+     action did via a post-action scan.
+   - A new `SYMPHONY_*` env var is added so an action can reach into
+     orchestrator-owned state. The contract is growing because the logic is
+     on the wrong side; surface it as a typed call in the runner/MCP layer
+     instead.
+
+   If any of the above fires, reject with a pointer to the right home
+   (runner, MCP tool, or orchestrator). Action-only diffs that stay within
+   repo-local glue (push/PR/format-patch) are fine — this check is
+   about state-machine logic leaking into a state's `actions:`.
+
+4. Decide:
+
+   - **Approve**: the change is correct, tests pass, no blocking issues. Call
+
+     ```
+     symphony.transition({
+       to_state: "Done",
+       notes: "<approval rationale; this becomes the PR body>"
+     })
+     ```
+
+     Your notes are appended to the issue body and feed straight into the PR
+     description the host opens against the base branch. Be specific about
+     what you verified.
+
+   - **Reject**: the change is wrong, incomplete, or has issues that need
+     rework. Call
+
+     ```
+     symphony.transition({
+       to_state: "Todo",
+       notes: "<specific findings: file paths, line numbers, what's wrong,
+               what needs to change. Be concrete — the implementer will see
+               this as their next prompt.>"
+     })
+     ```
+
+     The issue goes back to Todo with your findings appended. The same
+     workspace and `agent/{{ issue.identifier }}` branch survive the round
+     trip, so the next implementer dispatch sees both your notes and their
+     prior commits.
+
+   Either way, end your turn after the transition call. Do not call any
+   further tools.