spawnfile 0.1.13 → 0.1.17

package/dist/status/lifecycleProbes.js

@@ -0,0 +1,174 @@
+import path from "node:path";
+import { getRuntimeAdapter, RUNTIME_INSTALL_ROOT } from "../runtime/index.js";
+const CONTAINER_ROOTFS_ROOT = "container/rootfs";
+// B62 Option B (src/runtime/pi/appControlSource.ts): the operator-only
+// mutating wake route and its fail-closed gate env/marker.
+const PI_OPERATOR_ROUTE_MARKER = "/spawnfile/agents/";
+const PI_CONTROL_TOKEN_ENV = "SPAWNFILE_PI_CONTROL_TOKEN";
+const PI_FAIL_CLOSED_MARKER = "no operator token configured (";
+// B93: the recipe env assignment containerEntrypointRender.ts stamps into
+// the compiled entrypoint only when the compile-host process env carried a
+// run id (see src/runtime/common.ts's resolveNoopolisRunId).
+const NOOPOLIS_RUN_ID_MARKER = "NOOPOLIS_RUN_ID=";
+// Both adapter names lower to the same generated Pi runtime app
+// (src/runtime/pi/adapter.ts); the daimon adapter is a `{...piAdapter, name: "daimon"}` spread.
+const PI_LIKE_RUNTIMES = new Set(["daimon", "pi"]);
+const LIFECYCLE_KEYS = [
+    "lifecycle.instance.coverage",
+    "lifecycle.instance.runtime",
+    "lifecycle.instance.paths",
+    "lifecycle.wake.operator",
+    "lifecycle.run_id"
+];
+const createObservation = (input) => ({
+    ...input,
+    label: `${input.severity.toUpperCase()} ${input.key}`,
+    source: "compile_report"
+});
+const instanceSubject = (instanceId) => `runtime-instance:${instanceId}`;
+/** No compile report at all: every key is reported once, unknown, never omitted and never ok. */
+const missingReportObservations = () => LIFECYCLE_KEYS.map((key) => createObservation({
+    key,
+    message: `${key} was not checked: no compile report is available`,
+    severity: "unknown",
+    subject: "compile"
+}));
+const collectInstanceCoverageObservations = (nodes, instances) => {
+    const coveredNodeIds = new Set(instances.flatMap((instance) => instance.nodeIds));
+    return nodes
+        .filter((node) => node.kind === "agent")
+        .map((node) => {
+        const covered = coveredNodeIds.has(node.id);
+        return createObservation({
+            key: "lifecycle.instance.coverage",
+            message: covered
+                ? `${node.id} is covered by a compiled runtime instance's node_ids`
+                : `${node.id} does not appear in any compiled runtime instance's node_ids`,
+            severity: covered ? "ok" : "error",
+            subject: node.id
+        });
+    });
+};
+const collectInstanceRuntimeObservations = (instances) => instances.map((instance) => {
+    try {
+        getRuntimeAdapter(instance.runtime);
+        return createObservation({
+            key: "lifecycle.instance.runtime",
+            message: `${instance.id} resolves to the ${instance.runtime} runtime adapter`,
+            severity: "ok",
+            subject: instanceSubject(instance.id)
+        });
+    }
+    catch (error) {
+        return createObservation({
+            key: "lifecycle.instance.runtime",
+            message: error instanceof Error ? error.message : String(error),
+            severity: "error",
+            subject: instanceSubject(instance.id)
+        });
+    }
+});
+const collectInstancePathsObservations = (instances) => instances.map((instance) => {
+    const subject = instanceSubject(instance.id);
+    if (!instance.configPath) {
+        return createObservation({
+            key: "lifecycle.instance.paths",
+            message: `${instance.id} is missing a configPath`,
+            severity: "error",
+            subject
+        });
+    }
+    const missing = [
+        !instance.homePath ? "homePath" : null,
+        !instance.workspacePath ? "workspacePath" : null
+    ].filter((entry) => entry !== null);
+    if (missing.length > 0) {
+        return createObservation({
+            key: "lifecycle.instance.paths",
+            message: `${instance.id} is missing ${missing.join(" and ")}`,
+            severity: "warn",
+            subject
+        });
+    }
+    return createObservation({
+        key: "lifecycle.instance.paths",
+        message: `${instance.id} has configPath, homePath, and workspacePath`,
+        severity: "ok",
+        subject
+    });
+});
+const piAppSourcePath = (outputDirectory, runtimeName) => path.join(outputDirectory, CONTAINER_ROOTFS_ROOT, RUNTIME_INSTALL_ROOT, runtimeName, "app.mjs");
+const collectWakeOperatorObservations = async (instances, outputDirectory, readFile) => {
+    const observations = [];
+    for (const instance of instances) {
+        const subject = instanceSubject(instance.id);
+        if (!PI_LIKE_RUNTIMES.has(instance.runtime)) {
+            observations.push(createObservation({
+                key: "lifecycle.wake.operator",
+                message: `${instance.id} uses runtime ${instance.runtime}; the B62 operator wake route is Pi/Daimon-specific and was not checked`,
+                severity: "unknown",
+                subject
+            }));
+            continue;
+        }
+        if (!outputDirectory) {
+            observations.push(createObservation({
+                key: "lifecycle.wake.operator",
+                message: `${instance.id} has no compiled output directory to read the generated runtime app from`,
+                severity: "unknown",
+                subject
+            }));
+            continue;
+        }
+        const filePath = piAppSourcePath(outputDirectory, instance.runtime);
+        const content = await readFile(filePath);
+        if (content === null) {
+            observations.push(createObservation({
+                key: "lifecycle.wake.operator",
+                message: `${instance.id} generated runtime app is not readable at ${filePath}`,
+                severity: "error",
+                subject
+            }));
+            continue;
+        }
+        const missing = [
+            !content.includes(PI_OPERATOR_ROUTE_MARKER) ? "operator wake route" : null,
+            !content.includes(PI_CONTROL_TOKEN_ENV) ? `${PI_CONTROL_TOKEN_ENV} reference` : null,
+            !content.includes(PI_FAIL_CLOSED_MARKER) ? "fail-closed gate" : null
+        ].filter((entry) => entry !== null);
+        observations.push(createObservation({
+            key: "lifecycle.wake.operator",
+            message: missing.length === 0
+                ? `${instance.id} generated runtime app exposes the B62 fail-closed operator wake route`
+                : `${instance.id} generated runtime app at ${filePath} is missing: ${missing.join(", ")}`,
+            severity: missing.length === 0 ? "ok" : "error",
+            subject
+        }));
+    }
+    return observations;
+};
+const collectRunIdObservation = async (entrypointPath, readFile) => {
+    const content = entrypointPath ? await readFile(entrypointPath) : null;
+    const hasRunId = content !== null && content.includes(NOOPOLIS_RUN_ID_MARKER);
+    return createObservation({
+        key: "lifecycle.run_id",
+        message: hasRunId
+            ? "compiled entrypoint stamps NOOPOLIS_RUN_ID for this run"
+            : "not compiled with a run id",
+        severity: hasRunId ? "ok" : "unknown",
+        subject: "compile"
+    });
+};
+export const collectLifecycleProbeObservations = async (options) => {
+    if (options.loadedReport.kind !== "loaded") {
+        return missingReportObservations();
+    }
+    const { report } = options.loadedReport;
+    return [
+        ...collectInstanceCoverageObservations(report.nodes, report.runtimeInstances),
+        ...collectInstanceRuntimeObservations(report.runtimeInstances),
+        ...collectInstancePathsObservations(report.runtimeInstances),
+        ...await collectWakeOperatorObservations(report.runtimeInstances, options.outputDirectory, options.readFile),
+        await collectRunIdObservation(report.entrypointPath ?? null, options.readFile)
+    ];
+};

package/dist/status/moltnetProbes.d.ts

@@ -2,20 +2,19 @@ import type { DeploymentRecord, DockerInspectionResult, DockerProbeExecFile } fr
 import type { LoadedCompileReport } from "./compileReport.js";
 import type { StatusObservation } from "./types.js";
 export type StatusNetworkInspections = Map<string, DockerInspectionResult>;
+export interface MoltnetHealthResponse {
+    error?: string;
+    ok: boolean;
+}
+export type MoltnetHealthFetch = (url: string, timeoutMs: number) => Promise<MoltnetHealthResponse>;
 export interface CollectMoltnetProbeOptions {
+    /** Compatibility-only until the out-of-scope CLI stops resolving status auth. */
     authValues?: Record<string, string>;
     deployments: DeploymentRecord[];
     execFile?: DockerProbeExecFile;
-    fetchJson?: MoltnetFetchJson;
+    fetchHealth?: MoltnetHealthFetch;
     inspections: StatusNetworkInspections;
     loadedReport: LoadedCompileReport;
     timeoutMs?: number;
 }
-export type MoltnetFetchJson = (url: string, headers: Record<string, string>, timeoutMs: number) => Promise<MoltnetProbeResponse>;
-interface MoltnetProbeResponse {
-    error?: string;
-    json: unknown;
-    ok: boolean;
-}
 export declare const collectMoltnetProbeObservations: (options: CollectMoltnetProbeOptions) => Promise<StatusObservation[]>;
-export {};

package/dist/status/moltnetProbes.js

@@ -4,77 +4,22 @@ const createObservation = (input) => ({
     label: `${input.severity.toUpperCase()} ${input.key}`,
     source: "network"
 });
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const toString = (value) => typeof value === "string" ? value : null;
-const toStringArray = (value) => Array.isArray(value)
-    ? value.filter((entry) => typeof entry === "string")
-    : [];
-const parseRooms = (value) => {
-    const entries = isRecord(value) && Array.isArray(value.rooms) ? value.rooms : [];
-    return entries.flatMap((entry) => {
-        if (!isRecord(entry))
-            return [];
-        const id = toString(entry.id);
-        return id ? [{ id, members: toStringArray(entry.members) }] : [];
-    });
-};
-const parseAgents = (value) => {
-    const entries = isRecord(value) && Array.isArray(value.agents) ? value.agents : [];
-    return entries.flatMap((entry) => {
-        if (!isRecord(entry))
-            return [];
-        const id = toString(entry.id);
-        return id
-            ? [{ connected: entry.connected === true, id, rooms: toStringArray(entry.rooms) }]
-            : [];
-    });
-};
-const parseNetwork = (value) => ({
-    directMessages: isRecord(value) && isRecord(value.capabilities) && typeof value.capabilities.direct_messages === "boolean"
-        ? value.capabilities.direct_messages
-        : null,
-    networkId: isRecord(value) ? toString(value.id) : null
-});
-const defaultFetchJson = async (url, headers, timeoutMs) => {
+const defaultFetchHealth = async (url, timeoutMs) => {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const response = await fetch(url, { headers, signal: controller.signal });
-        if (!response.ok) {
-            return { error: `HTTP ${response.status}`, json: null, ok: false };
-        }
-        return { json: await response.json(), ok: true };
+        const response = await fetch(url, { signal: controller.signal });
+        return response.ok
+            ? { ok: true }
+            : { error: `HTTP ${response.status}`, ok: false };
     }
     catch (error) {
-        return { error: error instanceof Error ? error.message : String(error), json: null, ok: false };
+        return { error: error instanceof Error ? error.message : String(error), ok: false };
     }
     finally {
         clearTimeout(timer);
     }
 };
-const authHeadersFor = (server, authValues = {}) => {
-    if (!server.operatorTokenSecret) {
-        return {};
-    }
-    const token = authValues[server.operatorTokenSecret] ?? process.env[server.operatorTokenSecret];
-    return token ? { Authorization: `Bearer ${token}` } : null;
-};
-const readManagedJson = async (gateway, server, path, headers) => {
-    if (!server.port) {
-        return { error: "managed Moltnet server has no internal port", json: null, ok: false };
-    }
-    const response = await gateway.httpGet(server.port, path, headers);
-    if (!response.ok) {
-        return { error: response.error, json: null, ok: false };
-    }
-    try {
-        return { json: JSON.parse(response.body), ok: true };
-    }
-    catch (error) {
-        return { error: error instanceof Error ? error.message : String(error), json: null, ok: false };
-    }
-};
-const readExternalJson = async (fetchJson, server, path, headers, timeoutMs) => fetchJson(`${server.baseUrl.replace(/\/$/u, "")}${path}`, headers, timeoutMs);
 const createManagedGateway = (deployments, inspections, options) => {
     for (const deployment of deployments) {
         const inspectionMap = inspections.get(deployment.name);
@@ -92,149 +37,33 @@ const createManagedGateway = (deployments, inspections, options) => {
     }
     return null;
 };
-const readSnapshot = async (server, options, headers) => {
-    const timeoutMs = options.timeoutMs ?? 10_000;
-    const gateway = server.mode === "managed"
-        ? createManagedGateway(options.deployments, options.inspections, options)
-        : null;
-    if (server.mode === "managed" && !gateway) {
-        return { error: "no running deployment unit hosts the managed Moltnet server", json: null, ok: false };
+const healthForServer = async (server, options) => {
+    if (server.mode === "managed") {
+        const gateway = createManagedGateway(options.deployments, options.inspections, options);
+        if (!gateway)
+            return { error: "no running deployment unit hosts the managed Moltnet server", ok: false };
+        if (!server.port)
+            return { error: "managed Moltnet server has no internal port", ok: false };
+        const response = await gateway.httpGet(server.port, "/healthz");
+        return response.ok ? { ok: true } : { error: response.error, ok: false };
     }
-    const readJson = (path) => gateway
-        ? readManagedJson(gateway, server, path, headers)
-        : readExternalJson(options.fetchJson ?? defaultFetchJson, server, path, headers, timeoutMs);
-    const health = await readJson("/healthz");
-    if (!health.ok)
-        return health;
-    const network = await readJson("/v1/network");
-    if (!network.ok)
-        return network;
-    const rooms = await readJson("/v1/rooms");
-    if (!rooms.ok)
-        return rooms;
-    const agents = await readJson("/v1/agents");
-    if (!agents.ok)
-        return agents;
-    const parsedNetwork = parseNetwork(network.json);
-    return {
-        json: null,
-        ok: true,
-        snapshot: {
-            agents: parseAgents(agents.json),
-            directMessages: parsedNetwork.directMessages,
-            networkId: parsedNetwork.networkId,
-            rooms: parseRooms(rooms.json)
-        }
-    };
-};
-const compareSnapshot = (server, snapshot) => {
-    const observations = [];
-    observations.push(createObservation({
-        key: "network.reachable",
-        message: `${server.networkId} Moltnet server is reachable`,
-        severity: "ok",
-        subject: `network:${server.networkId}`
-    }));
-    if (snapshot.networkId && snapshot.networkId !== server.networkId) {
-        observations.push(createObservation({
-            key: "network.id",
-            message: `expected network ${server.networkId}, live network is ${snapshot.networkId}`,
-            severity: "error",
-            subject: `network:${server.networkId}`
-        }));
-    }
-    const liveRooms = new Map(snapshot.rooms.map((room) => [room.id, room]));
-    const liveAgents = new Map(snapshot.agents.map((agent) => [agent.id, agent]));
-    for (const room of server.rooms) {
-        const liveRoom = liveRooms.get(room.id);
-        if (!liveRoom) {
-            observations.push(createObservation({
-                key: "network.room",
-                message: `${server.networkId}/${room.id} is missing from live Moltnet`,
-                severity: "error",
-                subject: `room:${server.networkId}:${room.id}`
-            }));
-            continue;
-        }
-        observations.push(createObservation({
-            key: "network.room",
-            message: `${server.networkId}/${room.id} exists with ${liveRoom.members.length} member(s)`,
-            severity: "ok",
-            subject: `room:${server.networkId}:${room.id}`
-        }));
-        for (const member of room.members) {
-            const liveAgent = liveAgents.get(member);
-            if (!liveAgent) {
-                observations.push(createObservation({
-                    key: "network.member",
-                    message: `${member} is expected in ${room.id} but is not registered`,
-                    severity: "warn",
-                    subject: `agent:${member}`
-                }));
-            }
-            else if (!liveAgent.rooms.includes(room.id)) {
-                observations.push(createObservation({
-                    key: "network.member",
-                    message: `${member} is registered but not attached to ${room.id}`,
-                    severity: "warn",
-                    subject: `agent:${member}`
-                }));
-            }
-            else if (!liveAgent.connected) {
-                observations.push(createObservation({
-                    key: "network.agent.connected",
-                    message: `${member} is attached to ${room.id} but disconnected`,
-                    severity: "warn",
-                    subject: `agent:${member}`
-                }));
-            }
-            else {
-                observations.push(createObservation({
-                    key: "network.agent.connected",
-                    message: `${member} is connected to ${room.id}`,
-                    severity: "ok",
-                    subject: `agent:${member}`
-                }));
-            }
-        }
-    }
-    if (snapshot.directMessages !== null && server.directMessages !== null && snapshot.directMessages !== server.directMessages) {
-        observations.push(createObservation({
-            key: "network.direct_messages",
-            message: `direct messages expected ${server.directMessages}, live value is ${snapshot.directMessages}`,
-            severity: "warn",
-            subject: `network:${server.networkId}`
-        }));
-    }
-    return observations;
+    return (options.fetchHealth ?? defaultFetchHealth)(`${server.baseUrl.replace(/\/$/u, "")}/healthz`, options.timeoutMs ?? 10_000);
 };
 export const collectMoltnetProbeObservations = async (options) => {
-    if (options.loadedReport.kind !== "loaded") {
+    if (options.loadedReport.kind !== "loaded")
         return [];
-    }
+    // authValues is intentionally unread and unused; status is health-only.
     const observations = [];
     for (const server of options.loadedReport.report.moltnetServers ?? []) {
-        const headers = authHeadersFor(server, options.authValues);
-        if (headers === null) {
-            observations.push(createObservation({
-                key: "network.auth",
-                message: `${server.networkId} requires operator token ${server.operatorTokenSecret}, but no value is available`,
-                severity: "unknown",
-                subject: `network:${server.networkId}`
-            }));
-            continue;
-        }
-        const response = await readSnapshot(server, options, headers);
-        if (!response.ok || !response.snapshot) {
-            observations.push(createObservation({
-                key: "network.reachable",
-                message: `${server.networkId} Moltnet metadata probe failed: ${response.error ?? "unknown failure"}`,
-                severity: "unknown",
-                subject: `network:${server.networkId}`
-            }));
-            continue;
-        }
-        observations.push(...compareSnapshot(server, response.snapshot));
+        const response = await healthForServer(server, options);
+        observations.push(createObservation({
+            key: "network.reachable",
+            message: response.ok
+                ? `${server.networkId} public health endpoint responded`
+                : `${server.networkId} public health endpoint unavailable: ${response.error ?? "unknown failure"}`,
+            severity: response.ok ? "ok" : "unknown",
+            subject: `network:${server.networkId}`
+        }));
     }
     return observations;
 };

package/dist/status/moltnetWiringProbes.d.ts

@@ -0,0 +1,19 @@
+import type { LoadedCompileReport } from "./compileReport.js";
+import type { StatusObservation } from "./types.js";
+/**
+ * Offline Moltnet-wiring cross-check probes (B38). A pure reader over the
+ * already-loaded compile report plus an injected `readFile` (same
+ * injected-read style as its sibling `src/status/lifecycleProbes.ts`) so
+ * this stays hermetic for both `status --out <dir>` (real filesystem) and the
+ * home-deployment path (no compiled output tree; readFile always resolves
+ * `null`). Same cardinal rule as `src/status/lifecycleProbes.ts` and
+ * `src/audit/`: absent input is `unknown`, never `ok`.
+ */
+export type MoltnetWiringReadFile = (filePath: string) => Promise<string | null>;
+export interface CollectMoltnetWiringProbeOptions {
+    loadedReport: LoadedCompileReport;
+    /** Compiled output directory to resolve node config files under `container/rootfs`. `null` when there is no compiled output tree (home-deployment status). */
+    outputDirectory: string | null;
+    readFile: MoltnetWiringReadFile;
+}
+export declare const collectMoltnetWiringProbeObservations: (options: CollectMoltnetWiringProbeOptions) => Promise<StatusObservation[]>;

package/dist/status/moltnetWiringProbes.js

@@ -0,0 +1,178 @@
+import path from "node:path";
+const CONTAINER_ROOTFS_ROOT = "container/rootfs";
+const MOLTNET_NODE_CONFIG_VERSION = "moltnet.node.v1";
+// src/compiler/moltnetRuntimeConfig.ts:108 — pi/daimon attachments both lower to kind "pi".
+const CONTROL_URL_PATTERN = /^http:\/\/127\.0\.0\.1:\d+\/agents\/[a-z0-9-]+\/wake$/u;
+const WIRING_KEYS = [
+    "network.wiring.node_config",
+    "network.wiring.control_url",
+    "network.wiring.network_resolves",
+    "network.wiring.membership"
+];
+const createObservation = (input) => ({
+    ...input,
+    label: `${input.severity.toUpperCase()} ${input.key}`,
+    source: "compile_report"
+});
+const missingReportObservations = () => WIRING_KEYS.map((key) => createObservation({
+    key,
+    message: `${key} was not checked: no compile report is available`,
+    severity: "unknown",
+    subject: "compile"
+}));
+// node_plans[].config_path is a container-absolute path
+// (toContainerRootfsPath, src/compiler/moltnetArtifactPaths.ts) — the
+// physical file on disk lives under the compiled output's rootfs mirror.
+const nodeConfigPhysicalPath = (outputDirectory, configPath) => path.join(outputDirectory, CONTAINER_ROOTFS_ROOT, configPath);
+const readNodePlans = async (nodePlans, outputDirectory, readFile) => Promise.all(nodePlans.map(async (plan) => {
+    if (!outputDirectory) {
+        return { networkId: plan.networkId, parsed: null, physicalPath: null };
+    }
+    const physicalPath = nodeConfigPhysicalPath(outputDirectory, plan.configPath);
+    const content = await readFile(physicalPath);
+    if (content === null) {
+        return { networkId: plan.networkId, parsed: null, physicalPath };
+    }
+    try {
+        return { networkId: plan.networkId, parsed: JSON.parse(content), physicalPath };
+    }
+    catch {
+        return { networkId: plan.networkId, parsed: null, physicalPath };
+    }
+}));
+const isValidNodeConfig = (plan) => plan.parsed !== null && plan.parsed.version === MOLTNET_NODE_CONFIG_VERSION;
+const collectNodeConfigObservations = (plans) => plans.map((plan) => {
+    const subject = `network:${plan.networkId}`;
+    if (!plan.physicalPath) {
+        return createObservation({
+            key: "network.wiring.node_config",
+            message: `${plan.networkId} node config has no compiled output directory to read from`,
+            severity: "unknown",
+            subject
+        });
+    }
+    if (plan.parsed === null) {
+        return createObservation({
+            key: "network.wiring.node_config",
+            message: `${plan.networkId} node config at ${plan.physicalPath} is unreadable or not valid JSON`,
+            severity: "error",
+            subject
+        });
+    }
+    const validVersion = isValidNodeConfig(plan);
+    return createObservation({
+        key: "network.wiring.node_config",
+        message: validVersion
+            ? `${plan.networkId} node config at ${plan.physicalPath} parses as ${MOLTNET_NODE_CONFIG_VERSION}`
+            : `${plan.networkId} node config at ${plan.physicalPath} does not declare version ${MOLTNET_NODE_CONFIG_VERSION}`,
+        severity: validVersion ? "ok" : "error",
+        subject
+    });
+});
+const collectControlUrlObservations = (plans) => {
+    const observations = [];
+    for (const plan of plans) {
+        if (!isValidNodeConfig(plan)) {
+            continue;
+        }
+        const subject = `network:${plan.networkId}`;
+        for (const attachment of plan.parsed?.attachments ?? []) {
+            const kind = attachment.runtime?.kind;
+            const agentId = typeof attachment.agent?.id === "string" ? attachment.agent.id : "unknown-agent";
+            if (kind === "pi") {
+                const controlUrl = attachment.runtime?.control_url;
+                const valid = typeof controlUrl === "string" && CONTROL_URL_PATTERN.test(controlUrl);
+                observations.push(createObservation({
+                    key: "network.wiring.control_url",
+                    message: valid
+                        ? `${agentId} control_url ${String(controlUrl)} matches the expected loopback wake pattern`
+                        : typeof controlUrl === "string"
+                            ? `${agentId} control_url "${controlUrl}" does not match the expected loopback wake pattern`
+                            : `${agentId} pi attachment is missing control_url`,
+                    severity: valid ? "ok" : "error",
+                    subject
+                }));
+            }
+            else if (kind === "picoclaw") {
+                const configPath = attachment.runtime?.config_path;
+                const valid = typeof configPath === "string" && configPath.length > 0;
+                observations.push(createObservation({
+                    key: "network.wiring.control_url",
+                    message: valid
+                        ? `${agentId} picoclaw runtime declares config_path ${String(configPath)}`
+                        : `${agentId} picoclaw attachment is missing config_path`,
+                    severity: valid ? "ok" : "error",
+                    subject
+                }));
+            }
+        }
+    }
+    return observations;
+};
+const collectNetworkResolvesObservations = (nodePlans, servers) => {
+    const serverNetworkIds = new Set(servers.map((server) => server.networkId));
+    return nodePlans.map((plan) => {
+        const resolves = serverNetworkIds.has(plan.networkId);
+        return createObservation({
+            key: "network.wiring.network_resolves",
+            message: resolves
+                ? `${plan.networkId} node plan resolves to a compiled Moltnet server plan`
+                : `${plan.networkId} node plan has no matching compiled Moltnet server plan`,
+            severity: resolves ? "ok" : "error",
+            subject: `network:${plan.networkId}`
+        });
+    });
+};
+const collectAttachmentAgentIdsByNetwork = (plans) => {
+    const idsByNetwork = new Map();
+    for (const plan of plans) {
+        if (!isValidNodeConfig(plan)) {
+            continue;
+        }
+        const ids = idsByNetwork.get(plan.networkId) ?? new Set();
+        for (const attachment of plan.parsed?.attachments ?? []) {
+            if (typeof attachment.agent?.id === "string") {
+                ids.add(attachment.agent.id);
+            }
+        }
+        idsByNetwork.set(plan.networkId, ids);
+    }
+    return idsByNetwork;
+};
+const collectMembershipObservations = (servers, plans) => {
+    const agentIdsByNetwork = collectAttachmentAgentIdsByNetwork(plans);
+    const observations = [];
+    for (const server of servers) {
+        const knownAgentIds = agentIdsByNetwork.get(server.networkId);
+        for (const room of server.rooms) {
+            const subject = `room:${server.networkId}:${room.id}`;
+            for (const memberId of room.members) {
+                const orphan = !knownAgentIds?.has(memberId);
+                observations.push(createObservation({
+                    key: "network.wiring.membership",
+                    message: orphan
+                        ? `${server.networkId}/${room.id} member ${memberId} has no matching node config attachment`
+                        : `${server.networkId}/${room.id} member ${memberId} maps to a node config attachment`,
+                    severity: orphan ? "warn" : "ok",
+                    subject
+                }));
+            }
+        }
+    }
+    return observations;
+};
+export const collectMoltnetWiringProbeObservations = async (options) => {
+    if (options.loadedReport.kind !== "loaded") {
+        return missingReportObservations();
+    }
+    const { report } = options.loadedReport;
+    const servers = report.moltnetServers ?? [];
+    const nodePlans = report.moltnetNodePlans ?? [];
+    const readPlans = await readNodePlans(nodePlans, options.outputDirectory, options.readFile);
+    return [
+        ...collectNodeConfigObservations(readPlans),
+        ...collectControlUrlObservations(readPlans),
+        ...collectNetworkResolvesObservations(nodePlans, servers),
+        ...collectMembershipObservations(servers, readPlans)
+    ];
+};