spawnfile 0.1.12 → 0.1.14

package/dist/compiler/teamContextSupport.js

@@ -1,5 +1,6 @@
 import YAML from "yaml";
-import { buildContextOrientation, collectMoltnetBindings, createContextBaseKey, createVisibleTeamCards, findAgentBySource, findTeamBySource, getSystemTeamDoc, reportKeySegment, shortHash } from "./teamContextHelpers.js";
+import { buildContextOrientation, collectMoltnetBindings, createContextBaseKey, createVisibleTeamCards, findTeamBySource, getSystemTeamDoc, reportKeySegment, shortHash } from "./teamContextHelpers.js";
+import { buildActiveEnvironments } from "./teamContextActiveEnvironments.js";
 import { generateTeamRoster, listTeamRepresentatives } from "./teamRoster.js";
 const assignContextKeys = (contexts) => {
     const baseCounts = new Map();
@@ -84,6 +85,11 @@ const createTeamCapabilities = (teamNode) => [
         message: "Team context orientation was surfaced through runtime system instructions",
         outcome: "supported"
     },
+    {
+        key: "team.active_environments",
+        message: "Derived active environment bindings were emitted in team-contexts.yaml",
+        outcome: "supported"
+    },
     {
         key: "team.representatives",
         message: "Representative chains were resolved",
@@ -134,44 +140,11 @@ const createRepresentativeDiagnostics = (plan, teamNode) => {
     }
     return diagnostics;
 };
-const addAmbiguousBindingDiagnostics = (agentNode, contexts, diagnosticsByTeamSource) => {
-    const bindings = new Map();
-    for (const context of contexts) {
-        const teamSource = context.kind === "direct"
-            ? context.membership.teamSource
-            : context.parentTeamNode.source;
-        const memberId = context.kind === "direct"
-            ? context.membership.memberId
-            : context.representativeMemberId;
-        for (const binding of collectMoltnetBindings(agentNode, teamSource, memberId)) {
-            for (const room of binding.rooms) {
-                const key = `moltnet:${binding.network}:${room}`;
-                bindings.set(key, [...(bindings.get(key) ?? []), context]);
-            }
-        }
-    }
-    for (const [binding, bindingContexts] of bindings) {
-        const uniqueKeys = [...new Set(bindingContexts.map((context) => context.contextKey))];
-        if (uniqueKeys.length < 2) {
-            continue;
-        }
-        for (const context of bindingContexts) {
-            const teamSource = context.kind === "direct"
-                ? context.membership.teamSource
-                : context.parentTeamNode.source;
-            addMapEntries(diagnosticsByTeamSource, teamSource, [
-                {
-                    level: "warn",
-                    message: `Agent ${agentNode.name} maps ${binding} to multiple team contexts: ${uniqueKeys.join(", ")}`
-                }
-            ]);
-        }
-    }
-};
 export const prepareTeamCompileSupport = async (plan) => {
     const capabilitiesByTeamSource = new Map();
     const diagnosticsByTeamSource = new Map();
     const filesByAgentSource = new Map();
+    const activeEnvironmentsByAgentSource = new Map();
     const contextsByAgent = collectAgentContexts(plan);
     for (const node of plan.nodes) {
         if (node.value.kind !== "team") {
@@ -180,12 +153,24 @@ export const prepareTeamCompileSupport = async (plan) => {
         addMapEntries(capabilitiesByTeamSource, node.value.source, createTeamCapabilities(node.value));
         addMapEntries(diagnosticsByTeamSource, node.value.source, createRepresentativeDiagnostics(plan, node.value));
     }
-    for (const [agentSource, contexts] of contextsByAgent) {
-        const agentNode = findAgentBySource(plan, agentSource);
-        if (!agentNode) {
+    for (const node of plan.nodes) {
+        if (node.value.kind !== "agent") {
             continue;
         }
+        const agentNode = node.value;
+        const agentSource = agentNode.source;
+        const contexts = contextsByAgent.get(agentSource) ?? [];
         const directCount = contexts.filter((context) => context.kind === "direct").length;
+        const activeEnvironmentsResult = buildActiveEnvironments(plan, agentNode, contexts, directCount);
+        for (const { source, diagnostic } of activeEnvironmentsResult.diagnostics) {
+            addMapEntries(diagnosticsByTeamSource, source, [diagnostic]);
+        }
+        if (activeEnvironmentsResult.activeEnvironments !== undefined) {
+            activeEnvironmentsByAgentSource.set(agentSource, activeEnvironmentsResult.activeEnvironments);
+        }
+        if (contexts.length === 0 && activeEnvironmentsResult.activeEnvironments === undefined) {
+            continue;
+        }
         const directIndex = [];
         const representationIndex = [];
         const files = [];
@@ -247,6 +232,9 @@ export const prepareTeamCompileSupport = async (plan) => {
             }
         }
         const contextIndex = {
+            ...(activeEnvironmentsResult.activeEnvironments
+                ? { active_environments: activeEnvironmentsResult.activeEnvironments }
+                : {}),
             direct_memberships: directIndex,
             representations: representationIndex
         };
@@ -258,7 +246,11 @@ export const prepareTeamCompileSupport = async (plan) => {
             path: ".spawnfile/team-contexts.md"
         });
         filesByAgentSource.set(agentSource, files);
-        addAmbiguousBindingDiagnostics(agentNode, contexts, diagnosticsByTeamSource);
     }
-    return { capabilitiesByTeamSource, diagnosticsByTeamSource, filesByAgentSource };
+    return {
+        activeEnvironmentsByAgentSource,
+        capabilitiesByTeamSource,
+        diagnosticsByTeamSource,
+        filesByAgentSource
+    };
 };

package/dist/compiler/teamContextTypes.d.ts

@@ -1,7 +1,9 @@
 import type { CapabilityReport, DiagnosticReport } from "../report/index.js";
+import type { ActiveEnvironmentsIndex } from "./teamContextActiveEnvironments.js";
 import type { EmittedFile } from "../runtime/index.js";
 import type { ResolvedMemberRef, ResolvedTeamMembershipContext, ResolvedTeamNode } from "./types.js";
 export interface TeamCompileSupport {
+    activeEnvironmentsByAgentSource: Map<string, ActiveEnvironmentsIndex>;
     capabilitiesByTeamSource: Map<string, CapabilityReport[]>;
     diagnosticsByTeamSource: Map<string, DiagnosticReport[]>;
     filesByAgentSource: Map<string, EmittedFile[]>;

package/dist/compiler/types.d.ts

@@ -1,6 +1,7 @@
-import { AgentSchedule, ExecutionBlock, McpServer, ModelEndpoint, Secret, TeamNetworkServer } from "../manifest/index.js";
+import { AgentSchedule, ExecutionBlock, McpServer, MemoryConsolidation, MemoryRetention, ModelEndpoint, Secret, TeamNetworkServer, type ExternalParticipantService } from "../manifest/index.js";
 import { ModelAuthMethod, StringMap } from "../shared/index.js";
 import type { ResolvedWorkspaceResource } from "./workspaceResources.js";
+import type { ResolvedExternalParticipant, ResolvedOrganizationIdentity } from "./organizationIdentity.js";
 export interface ResolvedDocument {
     content: string;
     role: string;
@@ -86,8 +87,12 @@ export interface ResolvedMoltnetRoomPolicy {
 }
 export interface ResolvedMoltnetDMConfig extends ResolvedMoltnetRoomPolicy {
     enabled: boolean;
+    allowedWakeSenders?: string[];
 }
 export interface ResolvedMoltnetAttachment {
+    auth?: {
+        tokenId: string;
+    };
     contextRooms?: Record<string, string[]>;
     dms?: ResolvedMoltnetDMConfig;
     memberId: string | null;
@@ -123,6 +128,67 @@ export interface ResolvedTeamNetwork {
     rooms: ResolvedTeamNetworkRoom[];
     server?: TeamNetworkServer;
 }
+export interface ResolvedMemoryStorePersistence {
+    mode: "durable" | "ephemeral";
+    mount?: string;
+    name?: string;
+}
+export interface ResolvedMemoryStore {
+    kind: "json" | "memory" | "postgres" | "sqlite";
+    path?: string;
+    persistence?: ResolvedMemoryStorePersistence;
+    dsn_secret?: string;
+}
+export interface ResolvedMemoryIndex {
+    graph: {
+        enabled: boolean;
+        kind?: "entity_graph" | "temporal_kg";
+    };
+    lexical: {
+        enabled: boolean;
+        engine?: "bm25" | "sqlite_fts";
+    };
+    rerank: {
+        enabled: boolean;
+    };
+    vector: {
+        base_url?: string;
+        enabled: boolean;
+        model?: string;
+        provider?: "ollama";
+        dimensions?: number;
+        timeout_ms?: number;
+    };
+}
+export interface ResolvedMemoryConsolidation {
+    mode: MemoryConsolidation["mode"];
+    schedule?: string;
+    summarize_after_events?: number;
+}
+export interface ResolvedMemoryRetention {
+    forgetting: MemoryRetention["forgetting"];
+    ttl?: string;
+}
+export interface ResolvedMemoryBank {
+    access?: {
+        members?: string[];
+    };
+    consolidation: ResolvedMemoryConsolidation;
+    declaredBy: "agent" | "team";
+    declaredName: string;
+    id: string;
+    index: ResolvedMemoryIndex;
+    retention: ResolvedMemoryRetention;
+    source: string;
+    store: ResolvedMemoryStore;
+}
+export interface ResolvedMemoryAccess {
+    agentSource: string;
+    declaringKind: "agent" | "team";
+    slotId?: string;
+    source: string;
+    bank: ResolvedMemoryBank;
+}
 export interface EffectiveModelTarget {
     auth: {
         key?: string;
@@ -159,8 +225,11 @@ export interface ResolvedAgentNode {
     secrets: Secret[];
     skills: ResolvedSkill[];
     source: string;
+    sourcePath?: string;
     surfaces?: ResolvedAgentSurfaces;
     subagents: ResolvedSubagentRef[];
+    memory?: ResolvedMemoryBank[];
+    memoryAccess?: ResolvedMemoryAccess[];
     workspaceResources?: ResolvedWorkspaceResource[];
 }
 export interface ResolvedTeamNode {
@@ -168,6 +237,7 @@ export interface ResolvedTeamNode {
     docs: ResolvedDocument[];
     external: string[];
     externalExplicit?: boolean;
+    externalParticipants?: ExternalParticipantService[];
     kind: "team";
     lead: string | null;
     members: ResolvedMemberRef[];
@@ -184,6 +254,7 @@ export interface ResolvedTeamNode {
         skills: ResolvedSkill[];
         packages?: ResolvedPackage[];
     };
+    memory?: ResolvedMemoryBank[];
     source: string;
 }
 export interface CompilePlanEdge {
@@ -224,6 +295,7 @@ export interface ResolvedMoltnetRoomMembership {
 }
 export interface CompilePlan {
     edges: CompilePlanEdge[];
+    memoryAccess?: ResolvedMemoryAccess[];
     memberships?: ResolvedTeamMembershipContext[];
     moltnetRoomMemberships?: ResolvedMoltnetRoomMembership[];
     nodes: CompilePlanNode[];
@@ -231,4 +303,13 @@ export interface CompilePlan {
     runtimes: Record<string, {
         nodeIds: string[];
     }>;
+    organizationIdentity?: ResolvedOrganizationIdentity;
+    moltnetExternalParticipantIntents?: MoltnetExternalParticipantIntent[];
+}
+export interface MoltnetExternalParticipantIntent {
+    participant: ResolvedExternalParticipant;
+    networkId: string;
+    tokenId: string;
+    tokenEnv: string;
+    directMessagePeers: string[];
 }

package/dist/compiler/upProject.d.ts

@@ -14,6 +14,11 @@ export interface UpProjectOptions extends CompileProjectOptions {
     envFilePath?: string;
     imageTag?: string;
     runRunner?: DockerRunRunner;
+    networkAttachmentHandle?: string;
+    organizationHandoffRunId?: string;
+    descriptorDigest?: string;
+    selectedTargetReceipt?: unknown;
+    selectedTargetReceiptDigest?: string;
     targetExecFile?: DockerTargetExecFile;
 }
 export interface UpProjectResult extends BuildProjectResult {

package/dist/compiler/upProject.js

@@ -1,11 +1,110 @@
 import path from "node:path";
-import { removeDirectory } from "../filesystem/index.js";
-import { writeDockerDeploymentRecordForRun } from "../deployment/index.js";
+import { createHash } from "node:crypto";
+import { rm } from "node:fs/promises";
+import { createOrganizationReadinessPending, createDockerOrganizationHandoffSession, createDockerDeploymentRecord, initializeOrganizationHandoffAuthorityStore, parseCanonicalSha256Digest, probeDockerOrganizationReadiness, readDeploymentRecord, resolveDockerDeploymentTarget, resolveDeploymentRecordPath, writeDeploymentRecord, writeDockerDeploymentRecordForRun } from "../deployment/index.js";
+import { createCanonicalSelectedTargetReceiptBytes, parseOpaqueTargetHandle, parseRunId, parseSelectedTargetReceipt, selectTarget } from "../target/index.js";
 import { buildProject } from "./buildProject.js";
 import { createDockerRunInvocation, resolveDetachedDeploymentOptions, runDockerContainer } from "./runProject.js";
+import { executeDockerRunWithSupportCleanup } from "./runProjectLifecycle.js";
 import { requireAuthProfile } from "../auth/index.js";
-import { DEFAULT_OUTPUT_DIRECTORY } from "../shared/index.js";
+import { DEFAULT_OUTPUT_DIRECTORY, SpawnfileError } from "../shared/index.js";
+import { ensureNoopolisRunId, resolveNoopolisRunId } from "../runtime/index.js";
+import { fileExists } from "../filesystem/index.js";
+import { resolveHostCliCredential } from "./runProjectAuth.js";
+const handoffInputError = () => new SpawnfileError("validation_error", "Organization handoff requires authorized run id, selected target receipt, descriptor digest, selected target receipt digest, network attachment handle, and world bindings");
+const handoffRecoveryIncompleteError = () => new SpawnfileError("runtime_error", "Organization handoff recovery is incomplete; redeploy with explicit authorization");
+const stableRecord = (record) => {
+    const { created_at: _createdAt, export_index: _exportIndex, organization_ready: _organizationReady, ...stable } = record;
+    return stable;
+};
+const canonicalJson = (value) => {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined)
+        throw handoffInputError();
+    return serialized;
+};
+const resolveRequestedHandoff = (options) => {
+    const values = [
+        options.descriptorDigest,
+        options.organizationHandoffRunId,
+        options.selectedTargetReceiptDigest,
+        options.selectedTargetReceipt,
+        options.networkAttachmentHandle,
+        options.worldBindingsPath
+    ];
+    if (values.every((value) => value === undefined))
+        return null;
+    if (values.some((value) => value === undefined) || !options.detach)
+        throw handoffInputError();
+    try {
+        const selectedTarget = parseSelectedTargetReceipt(options.selectedTargetReceipt);
+        const selectedDigest = parseCanonicalSha256Digest(options.selectedTargetReceiptDigest, "selected_target_receipt_digest");
+        const computedDigest = `sha256:${createHash("sha256").update(createCanonicalSelectedTargetReceiptBytes(selectedTarget), "utf8").digest("hex")}`;
+        if (selectedDigest !== computedDigest)
+            throw new Error("selected receipt digest mismatch");
+        return {
+            descriptorDigest: parseCanonicalSha256Digest(options.descriptorDigest, "descriptor_digest"),
+            runId: parseRunId(options.organizationHandoffRunId),
+            networkAttachmentHandle: parseOpaqueTargetHandle(options.networkAttachmentHandle),
+            selectedTarget,
+            selectedTargetReceiptDigest: selectedDigest
+        };
+    }
+    catch {
+        throw handoffInputError();
+    }
+};
+const verifyRequestedHandoffTarget = async (requested, resolved, options) => {
+    if (!requested)
+        return;
+    if (typeof resolved.dockerContext !== "string" || resolved.dockerContext.length === 0
+        || resolved.dockerHost != null || process.env.DOCKER_HOST != null)
+        throw handoffInputError();
+    try {
+        const actual = await selectTarget({
+            context: resolved.dockerContext,
+            dockerCommand: options.dockerCommand,
+            execFile: options.targetExecFile
+        });
+        if (createCanonicalSelectedTargetReceiptBytes(actual)
+            !== createCanonicalSelectedTargetReceiptBytes(requested.selectedTarget))
+            throw new Error("target mismatch");
+    }
+    catch {
+        throw handoffInputError();
+    }
+};
+const resolveCompiledHandoff = (requested, buildResult) => {
+    if (!requested)
+        return undefined;
+    try {
+        const bindingDigest = buildResult.organizationReadinessEvidence.worldBindings?.digest;
+        if (!bindingDigest)
+            throw new Error("missing compiled binding evidence");
+        const bindingDigestParsed = parseCanonicalSha256Digest(bindingDigest, "binding_digest");
+        return { authority: { ...requested, bindingDigest: bindingDigestParsed }, organizationHandoff: {
+                bindingDigest: bindingDigestParsed, networkAttachmentHandle: requested.networkAttachmentHandle,
+                selectedTargetReceiptDigest: requested.selectedTargetReceiptDigest
+            } };
+    }
+    catch {
+        throw handoffInputError();
+    }
+};
 export const upProject = async (inputPath, options = {}) => {
+    // Parse caller authority before any target or build work. Target identity is
+    // verified below from the resolved detached options, including exact record reuse.
+    const requestedHandoff = resolveRequestedHandoff(options);
+    // Handoff reservation identity must survive a process crash.  Unlike an
+    // ordinary deployment run, it may never silently mint a fresh run id.
+    if (requestedHandoff && resolveNoopolisRunId(process.env) !== requestedHandoff.runId)
+        throw handoffInputError();
     const resolvedOptions = await resolveDetachedDeploymentOptions(path.resolve(options.outputDirectory ?? DEFAULT_OUTPUT_DIRECTORY), {
         authProfile: options.authProfile,
         containerName: options.containerName,
@@ -18,19 +117,37 @@ export const upProject = async (inputPath, options = {}) => {
         imageTag: options.imageTag,
         targetExecFile: options.targetExecFile
     });
+    await verifyRequestedHandoffTarget(requestedHandoff, resolvedOptions, options);
+    // Every authority container compiled for this deployment must stamp
+    // causal events under the same real run id (see specs/CAUSAL.md).
+    // buildProject/compileProject stay deterministic functions of the host
+    // env; this only fills in a generated id when the host did not already
+    // provide one, before the build step that bakes it into the
+    // entrypoint/recipe env.
+    if (!requestedHandoff)
+        ensureNoopolisRunId();
     const buildResult = await buildProject(inputPath, {
         buildRunner: options.buildRunner,
         clean: options.clean,
+        containerArchitecture: options.containerArchitecture,
+        dockerContext: resolvedOptions.dockerContext,
         dockerCommand: options.dockerCommand,
         imageTag: resolvedOptions.imageTag,
-        outputDirectory: options.outputDirectory
+        outputDirectory: options.outputDirectory,
+        runtimePackageOverrides: options.runtimePackageOverrides,
+        ...(options.worldBindingsPath !== undefined
+            ? { worldBindingsPath: options.worldBindingsPath }
+            : {})
     });
+    const handoff = resolveCompiledHandoff(requestedHandoff, buildResult);
     const authProfile = resolvedOptions.authProfile
         ? await requireAuthProfile(resolvedOptions.authProfile)
         : null;
+    const cliCredential = await resolveHostCliCredential(buildResult.report.container);
     const imageTag = resolvedOptions.imageTag ?? buildResult.imageTag;
     const invocation = await createDockerRunInvocation(buildResult, imageTag, {
         authProfile,
+        ...(cliCredential ? { cliCredential: { name: cliCredential.name, value: cliCredential.value } } : {}),
         containerName: resolvedOptions.containerName,
         detach: options.detach,
         deploymentName: resolvedOptions.deploymentName,
@@ -39,27 +156,147 @@ export const upProject = async (inputPath, options = {}) => {
         dockerHost: resolvedOptions.dockerHost,
         envFilePath: resolvedOptions.envFilePath
     });
-    let runMetadata;
+    let authority;
+    let deploymentRecordPath;
+    let recovered = false;
+    let dockerLifecycleInvoked = false;
     try {
-        runMetadata = await (options.runRunner ?? runDockerContainer)(invocation);
+        let pending;
+        if (handoff) {
+            if (!invocation.deploymentLabels || !invocation.containerName)
+                throw handoffInputError();
+            const session = createDockerOrganizationHandoffSession({
+                bindingDigest: handoff.authority.bindingDigest,
+                containerName: invocation.containerName,
+                deploymentLabels: invocation.deploymentLabels,
+                descriptorDigest: handoff.authority.descriptorDigest,
+                organizationHandoff: handoff.organizationHandoff,
+                runId: handoff.authority.runId,
+                selectedTarget: handoff.authority.selectedTarget,
+                selectedTargetReceiptDigest: handoff.authority.selectedTargetReceiptDigest
+            });
+            authority = await initializeOrganizationHandoffAuthorityStore();
+            const begun = await authority.begin(session.authorityInput);
+            pending = begun.pending;
+            recovered = !begun.created;
+        }
+        let runMetadata = undefined;
+        if (!recovered) {
+            dockerLifecycleInvoked = true;
+            runMetadata = await executeDockerRunWithSupportCleanup(invocation, options.runRunner ?? runDockerContainer);
+        }
+        const observed = recovered && authority && pending
+            ? await authority.readDockerMutation(pending.pending_key)
+            : undefined;
+        if (recovered && !observed)
+            throw handoffRecoveryIncompleteError();
+        const recoveredMetadata = observed
+            ? { containerId: observed.container_id, deploymentLabels: observed.deployment_labels, imageId: observed.image_id }
+            : undefined;
+        const exactRunMetadata = runMetadata ?? recoveredMetadata;
+        let organizationHandoffHandle;
+        if (handoff) {
+            if (!exactRunMetadata?.containerId || !exactRunMetadata.deploymentLabels || !exactRunMetadata.imageId || !authority || !pending)
+                throw handoffInputError();
+            if (!recovered)
+                await authority.observeDockerMutation(pending.pending_key, {
+                    containerId: exactRunMetadata.containerId, deploymentLabels: exactRunMetadata.deploymentLabels, imageId: exactRunMetadata.imageId
+                });
+            const finalized = await authority.finalize(pending.pending_key, { containerId: exactRunMetadata.containerId, deploymentLabels: exactRunMetadata.deploymentLabels });
+            organizationHandoffHandle = finalized.organization_handoff_handle;
+            const existingRecordPath = invocation.detach && invocation.deploymentName
+                ? resolveDeploymentRecordPath(buildResult.outputDirectory, invocation.deploymentName)
+                : null;
+            if (existingRecordPath && await fileExists(existingRecordPath)) {
+                const existing = await readDeploymentRecord(existingRecordPath);
+                const target = await resolveDockerDeploymentTarget({
+                    context: invocation.dockerContext ?? undefined,
+                    dockerCommand: invocation.command,
+                    dockerHost: invocation.dockerHost ?? undefined,
+                    execFile: options.targetExecFile
+                });
+                const expected = createDockerDeploymentRecord({
+                    authProfileName: authProfile?.name ?? null,
+                    compileFingerprint: buildResult.report.compile_fingerprint ?? "",
+                    containerName: invocation.containerName,
+                    deploymentName: invocation.deploymentName ?? undefined,
+                    envFilePath: resolvedOptions.envFilePath,
+                    imageTag,
+                    networkIds: buildResult.report.container?.moltnet?.server_plans
+                        .filter((server) => server.mode === "managed").map((server) => server.network_id),
+                    nodes: buildResult.report.nodes,
+                    organizationHandoff: handoff.organizationHandoff,
+                    organizationHandoffHandle,
+                    outputDirectory: buildResult.outputDirectory,
+                    projectRoot: buildResult.report.root,
+                    runId: handoff.authority.runId,
+                    runMetadata: exactRunMetadata,
+                    runtimeInstanceIds: buildResult.report.container?.runtime_instances.map((instance) => instance.id) ?? [],
+                    target
+                });
+                if (canonicalJson(stableRecord(existing)) !== canonicalJson(stableRecord(expected)))
+                    throw handoffInputError();
+                deploymentRecordPath = existingRecordPath;
+            }
+            else
+                deploymentRecordPath = invocation.detach && invocation.deploymentName
+                    ? await writeDockerDeploymentRecordForRun({ authProfileName: authProfile?.name ?? null, envFilePath: resolvedOptions.envFilePath,
+                        imageTag, invocation, outputDirectory: buildResult.outputDirectory,
+                        organizationHandoff: handoff.organizationHandoff, organizationHandoffHandle, report: buildResult.report,
+                        runMetadata: exactRunMetadata, targetExecFile: options.targetExecFile })
+                    : null;
+        }
+        else
+            deploymentRecordPath = invocation.detach && invocation.deploymentName
+                ? await writeDockerDeploymentRecordForRun({ authProfileName: authProfile?.name ?? null, envFilePath: resolvedOptions.envFilePath,
+                    imageTag, invocation, outputDirectory: buildResult.outputDirectory, report: buildResult.report,
+                    runMetadata: runMetadata ?? undefined, targetExecFile: options.targetExecFile })
+                : null;
     }
     finally {
-        if (!invocation.detach) {
-            await removeDirectory(invocation.supportDirectory);
+        // Replay creates a fresh support directory but does not invoke the normal
+        // Docker lifecycle wrapper. Preserve its detached credential cleanup
+        // semantics without deleting bind-mount support files.
+        let cleanupError;
+        try {
+            if (invocation.detach && !dockerLifecycleInvoked)
+                await rm(invocation.envFilePath, { force: true });
+        }
+        catch (error) {
+            cleanupError = error;
+        }
+        try {
+            await authority?.dispose();
         }
+        catch (error) {
+            if (cleanupError === undefined)
+                throw error;
+        }
+        if (cleanupError !== undefined)
+            throw cleanupError;
+    }
+    if (deploymentRecordPath && buildResult.organizationReadinessEvidence) {
+        const record = await readDeploymentRecord(deploymentRecordPath);
+        const pending = createOrganizationReadinessPending(buildResult.organizationReadinessEvidence, {
+            compileFingerprint: record.compile_fingerprint,
+            deploymentName: record.name,
+            runId: record.run_id ?? null,
+            unitCount: record.units.length,
+            unitId: record.units[0]?.id ?? "invalid-unit"
+        });
+        const pendingRecord = { ...record, organization_ready: pending };
+        await writeDeploymentRecord(buildResult.outputDirectory, pendingRecord);
+        const organizationReady = await probeDockerOrganizationReadiness({
+            dockerCommand: options.dockerCommand,
+            evidence: buildResult.organizationReadinessEvidence,
+            execFile: options.targetExecFile,
+            record: pendingRecord
+        });
+        await writeDeploymentRecord(buildResult.outputDirectory, {
+            ...pendingRecord,
+            organization_ready: organizationReady
+        });
     }
-    const deploymentRecordPath = invocation.detach && invocation.deploymentName
-        ? await writeDockerDeploymentRecordForRun({
-            authProfileName: authProfile?.name ?? null,
-            envFilePath: resolvedOptions.envFilePath,
-            imageTag,
-            invocation,
-            outputDirectory: buildResult.outputDirectory,
-            report: buildResult.report,
-            runMetadata: runMetadata ?? undefined,
-            targetExecFile: options.targetExecFile
-        })
-        : null;
     return {
         ...buildResult,
         authProfileName: authProfile?.name ?? null,

package/dist/compiler/upReceipt.d.ts

@@ -0,0 +1,36 @@
+import { type CompiledEngineEntry, type CompiledScheduleEntry, type UpReceipt } from "../deployment/index.js";
+import type { CompilePlan } from "./types.js";
+import type { UpProjectResult } from "./upProject.js";
+/**
+ * Extracts the `{agent, cron}` pairs an up-receipt's `compiled_schedule` field carries
+ * (Decision 21 Piece 4) — the raw material for simfile's wake-diff denominator oracle.
+ * Only `kind: "cron"` schedules are represented; `every`/`disabled` schedules have no
+ * cron-fire cadence to diff against sim-time and are intentionally omitted, not zeroed.
+ */
+export declare const resolveCompiledSchedule: (plan: CompilePlan) => CompiledScheduleEntry[];
+/**
+ * Extracts `{agent, engine}` pairs (Piece 5, Slice B) — disclosure ground truth for the
+ * run-manifest's `pinned-engine` field, so a `scripted` (or any non-default) pi engine is
+ * visibly disclosed rather than an invisible test-only branch. Reads
+ * `report.container.runtime_instances[].engine_by_node_id`, the single source of truth
+ * `containerArtifacts.ts` already stamps from the pi adapter's own resolved engine kinds
+ * (see `src/runtime/pi/adapter.ts`'s `createContainerTargets`) — deliberately not
+ * re-derived from a fresh `buildCompilePlan` walk (unlike `resolveCompiledSchedule` above),
+ * since that would recompute the exact same fact from pi-adapter-internal logic
+ * (`resolvePiEngine`) that compiler code has no business reaching into directly.
+ */
+export declare const resolveCompiledEngines: (report: UpProjectResult["report"]) => CompiledEngineEntry[];
+/**
+ * Builds `spawnfile.up-receipt.v1` from a project-path `upProject()` result. Reads back
+ * the deployment record `upProject` already wrote (for `run_id`/deployment name/container
+ * id — the same record `spawnfile artifacts export`/`spawnfile down` resolve), and
+ * re-derives `compiled_schedule` from the resolved graph, since `compileProject` does not
+ * retain its own `CompilePlan` past the compile step.
+ *
+ * `readiness` reuses whatever signal `upProject` already has — a bare `docker run -d`
+ * that returned a container id, not a new health probe: `up` has never polled
+ * application-level readiness, and this receipt does not invent one. `moltnet_base_url`
+ * comes straight from the compiled container report's own managed/external server plan;
+ * no credentials ever land on this contract (contracts.md).
+ */
+export declare const buildUpReceipt: (inputPath: string, result: UpProjectResult) => Promise<UpReceipt>;