zora-agent 0.10.0 → 0.10.2

package/dist/orchestrator/orchestrator.js

@@ -13,7 +13,15 @@ import crypto from 'node:crypto';
 import path from 'node:path';
 import os from 'node:os';
 import fs from 'node:fs';
+import { ErrorNormalizer } from '../lib/error-normalizer.js';
+import { NegativeCache } from '../services/negative-cache.js';
+import { ErrorPatternDetector } from './error-pattern-detector.js';
 import { HookRunner } from '../hooks/hook-runner.js';
+import { ToolHookRunner } from '../hooks/tool-hook-runner.js';
+import { ShellSafetyHook } from '../hooks/built-in/shell-safety.js';
+import { AuditLogHook } from '../hooks/built-in/audit-log.js';
+import { RateLimitHook } from '../hooks/built-in/rate-limit.js';
+import { SecretRedactHook } from '../hooks/built-in/secret-redact.js';
 import { Router } from './router.js';
 import { FailoverController } from './failover-controller.js';
 import { RetryQueue } from './retry-queue.js';
@@ -24,9 +32,12 @@ import { SteeringManager } from '../steering/steering-manager.js';
 import { MemoryManager } from '../memory/memory-manager.js';
 import { ExtractionPipeline } from '../memory/extraction-pipeline.js';
 import { createMemoryTools } from '../tools/memory-tools.js';
+import { createSkillTools } from '../tools/skill-tool.js';
+import { createSubagentTools } from '../tools/subagent-tool.js';
 import { ValidationPipeline } from '../memory/validation-pipeline.js';
 import { ContextCompressor } from '../memory/context-compressor.js';
 import { ObservationStore } from '../memory/observation-store.js';
+import { ReflectorWorker } from '../memory/reflector-worker.js';
 import { HeartbeatSystem } from '../routines/heartbeat.js';
 import { RoutineManager } from '../routines/routine-manager.js';
 import { NotificationTools } from '../tools/notifications.js';
@@ -34,7 +45,15 @@ import { PolicyEngine } from '../security/policy-engine.js';
 import { IntentCapsuleManager } from '../security/intent-capsule.js';
 import { LeakDetector } from '../security/leak-detector.js';
 import { sanitizeInput } from '../security/prompt-defense.js';
+import { createCapabilityToken, enforceCapability } from '../security/capability-tokens.js';
+import { IntegrityGuardian } from '../security/integrity-guardian.js';
+import { SecretsManager } from '../security/secrets-manager.js';
 import { createLogger } from '../utils/logger.js';
+import { TLCIDispatcher } from './tlci-dispatcher.js';
+import { PlanCache } from '../memory/plan-cache.js';
+import { runCodeToolStep } from './code-tool-runner.js';
+import { CostTracker } from '../dashboard/cost-tracker.js';
+import { createPlanWorkflowTool } from '../tools/planning-tool.js';
 const log = createLogger('orchestrator');
 export class Orchestrator {
     _config;
@@ -54,6 +73,10 @@ export class Orchestrator {
     // Security
     _intentCapsuleManager;
     _leakDetector;
+    _integrityGuardian;
+    _secretsManager;
+    // Per-job capability tokens (keyed by jobId) for worker isolation enforcement
+    _activeTokens = new Map();
     // Background systems
     _heartbeatSystem = null;
     _routineManager = null;
@@ -61,15 +84,27 @@ export class Orchestrator {
     _validationPipeline;
     // ORCH-12: Lifecycle hooks
     _hookRunner = new HookRunner();
+    // Tool-level lifecycle hooks
+    _toolHookRunner = new ToolHookRunner();
+    // ERR-07: Error normalizer for safe error replay
+    _errorNormalizer = new ErrorNormalizer();
+    // ERR-12 Lite: Global negative cache for cross-session learning
+    _negativeCache;
     // ORCH-14: Context transform callback
     _transformContext = defaultTransformContext;
     // Context compression
     _observationStore;
+    _reflectorWorker;
     // Background intervals
     _authCheckTimeout = null;
     _retryPollTimeout = null;
     _consolidationTimeout = null;
     _booted = false;
+    // TLCI: lazy-initialized dispatcher and plan cache (additive — does not affect submitTask)
+    _planCache;
+    _tlciDispatcher;
+    _tlciCostTracker;
+    _tlciInitP; // Promise guard prevents double-init on concurrent calls
     constructor(options) {
         this._config = options.config;
         this._policy = options.policy;
@@ -105,6 +140,44 @@ export class Orchestrator {
         this._policyEngine.setIntentCapsuleManager(this._intentCapsuleManager);
         // SEC-03: Wire LeakDetector for scanning tool outputs
         this._leakDetector = new LeakDetector();
+        // SEC-11: IntegrityGuardian — baseline + tamper detection for critical config files
+        this._integrityGuardian = new IntegrityGuardian(this._baseDir);
+        const baselinesPath = path.join(this._baseDir, 'state', 'integrity-baselines.json');
+        let baselinesExist = false;
+        try {
+            await fs.promises.access(baselinesPath);
+            baselinesExist = true;
+        }
+        catch {
+            // first boot — baselines don't exist yet
+        }
+        if (!baselinesExist) {
+            await this._integrityGuardian.saveBaseline();
+            log.info('Integrity baselines established on first boot');
+        }
+        else {
+            const integrityResult = await this._integrityGuardian.checkIntegrity();
+            if (!integrityResult.valid) {
+                for (const mismatch of integrityResult.mismatches) {
+                    log.warn({ file: mismatch.file, expected: mismatch.expected.slice(0, 8), actual: mismatch.actual.slice(0, 8) }, 'Integrity mismatch — possible tampering detected');
+                }
+            }
+            else {
+                log.info('Config integrity: clean');
+            }
+        }
+        // SEC-12: SecretsManager — AES-256-GCM encrypted secrets at rest
+        const masterPassword = process.env['ZORA_MASTER_PASSWORD'];
+        if (masterPassword) {
+            this._secretsManager = new SecretsManager(this._baseDir, masterPassword);
+            await this._secretsManager.init();
+            log.info('SecretsManager initialized');
+            // TODO: wire secret values into SecretRedactHook.addPattern() once that
+            // method is added to the hook's interface (SecretRedactHook has no addPattern yet)
+        }
+        else {
+            log.warn('ZORA_MASTER_PASSWORD not set — encrypted secrets storage unavailable. Set this env var to enable.');
+        }
         this._sessionManager = new SessionManager(this._baseDir);
         this._steeringManager = new SteeringManager(this._baseDir);
         await this._steeringManager.init();
@@ -114,6 +187,12 @@ export class Orchestrator {
         // Initialize observation store for context compression
         this._observationStore = new ObservationStore(path.join(this._baseDir, 'memory', 'observations'));
         await this._observationStore.init();
+        // MEM-20: Initialize ReflectorWorker if compression is enabled
+        if (this._config.memory?.compression?.enabled) {
+            const compressFn = this._buildCompressFn();
+            this._reflectorWorker = new ReflectorWorker(compressFn, this._memoryManager);
+            log.info('ReflectorWorker initialized');
+        }
         // R2: Wire Router
         this._router = new Router({
             providers: this._providers,
@@ -125,6 +204,9 @@ export class Orchestrator {
         // R5: Initialize RetryQueue
         this._retryQueue = new RetryQueue(this._baseDir);
         await this._retryQueue.init();
+        // ERR-12 Lite: Initialize global negative cache
+        this._negativeCache = new NegativeCache(this._baseDir);
+        await this._negativeCache.init();
         // R4: Schedule AuthMonitor
         this._authMonitor = new AuthMonitor({
             providers: this._providers,
@@ -145,18 +227,29 @@ export class Orchestrator {
             }, 5 * 60 * 1000);
         };
         scheduleAuthCheck();
-        // R5: Poll RetryQueue (every 30 seconds) — remove task only after successful re-submission
+        // R5 / ERR-08: Poll RetryQueue (every 30 seconds) — use _resumeTask to preserve full
+        // TaskContext (state continuity) instead of re-submitting just the original prompt.
         const scheduleRetryPoll = () => {
             this._retryPollTimeout = setTimeout(async () => {
                 try {
-                    const readyTasks = this._retryQueue.getReadyTasks();
-                    for (const task of readyTasks) {
+                    const readyEntries = this._retryQueue.getReadyEntries();
+                    for (const entry of readyEntries) {
                         try {
-                            await this.submitTask({ prompt: task.task, jobId: task.jobId });
-                            await this._retryQueue.remove(task.jobId);
+                            // ERR-08: Increment budgetConsumed before re-executing to track retry depth
+                            if (entry.task.errorBudget) {
+                                entry.task.errorBudget.budgetConsumed += 1;
+                                // Skip tasks with exhausted budget
+                                if (entry.task.errorBudget.budgetConsumed >= entry.task.errorBudget.maxBudget) {
+                                    log.warn({ jobId: entry.task.jobId }, 'Retry skipped: error budget exhausted');
+                                    await this._retryQueue.remove(entry.task.jobId);
+                                    continue;
+                                }
+                            }
+                            await this._resumeTask(entry.task);
+                            await this._retryQueue.remove(entry.task.jobId);
                         }
                         catch (err) {
-                            log.error({ jobId: task.jobId, err }, 'Retry failed');
+                            log.error({ jobId: entry.task.jobId, err }, 'Retry failed');
                             // Leave task in queue for next poll cycle
                         }
                     }
@@ -192,7 +285,12 @@ export class Orchestrator {
         const scheduleConsolidation = () => {
             this._consolidationTimeout = setTimeout(async () => {
                 try {
-                    const count = await this._memoryManager.consolidateDailyNotes(7);
+                    const reflectFn = this._reflectorWorker
+                        ? async (content) => {
+                            await this._reflectorWorker.reflect(content, `consolidation_${Date.now()}`);
+                        }
+                        : undefined;
+                    const count = await this._memoryManager.consolidateDailyNotes(7, reflectFn);
                     if (count > 0) {
                         log.info({ consolidated: count }, 'Daily notes consolidated');
                     }
@@ -206,13 +304,26 @@ export class Orchestrator {
         // Run first check shortly after boot (30 seconds), then daily
         this._consolidationTimeout = setTimeout(async () => {
             try {
-                await this._memoryManager.consolidateDailyNotes(7);
+                const reflectFn = this._reflectorWorker
+                    ? async (content) => {
+                        await this._reflectorWorker.reflect(content, `consolidation_${Date.now()}`);
+                    }
+                    : undefined;
+                await this._memoryManager.consolidateDailyNotes(7, reflectFn);
             }
             catch (err) {
                 log.warn({ err }, 'Initial daily note consolidation failed');
             }
             scheduleConsolidation();
         }, 30 * 1000);
+        // Register default tool-level hooks
+        this._toolHookRunner.register(ShellSafetyHook);
+        this._toolHookRunner.register(new AuditLogHook());
+        this._toolHookRunner.register(new RateLimitHook([
+            { tool: 'bash', maxCalls: 60, windowMs: 60_000 },
+            { tool: 'http_request', maxCalls: 100, windowMs: 60_000 },
+        ]));
+        this._toolHookRunner.register(SecretRedactHook);
         this._booted = true;
     }
     /**
@@ -262,6 +373,9 @@ export class Orchestrator {
      */
     async submitTask(options) {
         const jobId = options.jobId ?? `job_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+        // SEC-10: Create a scoped capability token for this job
+        const capToken = createCapabilityToken(jobId, this._policy);
+        this._activeTokens.set(jobId, capToken);
         // Reset per-task state: ValidationPipeline rate limit is per-session, not per-orchestrator-lifetime.
         // Without this, after MAX_SAVES_PER_SESSION saves across all tasks, memory_save permanently blocks.
         this._validationPipeline.resetSession();
@@ -288,17 +402,12 @@ export class Orchestrator {
         // Create per-task context compressor if compression is enabled
         let compressor = null;
         if (this._config.memory?.compression?.enabled) {
-            const compressFn = async (prompt) => {
-                const compressLoop = new ExecutionLoop({
-                    systemPrompt: 'You are a conversation observer. Compress messages into concise, dated observations. Respond with ONLY the observations.',
-                    permissionMode: 'default',
-                    cwd: process.cwd(),
-                    maxTurns: 1,
-                    model: this._config.memory.compression.model,
-                });
-                return compressLoop.run(prompt);
-            };
-            compressor = new ContextCompressor(this._config.memory.compression, this._observationStore, compressFn, jobId);
+            const compressFn = this._buildCompressFn();
+            compressor = new ContextCompressor(this._config.memory.compression, this._observationStore, compressFn, jobId, this._reflectorWorker
+                ? async (obs, sid) => {
+                    await this._reflectorWorker.reflectAndPersist(obs, sid, this._observationStore);
+                }
+                : undefined);
             await compressor.loadExisting();
         }
         // Build cross-session context from observations
@@ -326,12 +435,29 @@ export class Orchestrator {
         }
         // ASI01: Create signed intent capsule for goal drift detection
         if (this._intentCapsuleManager) {
-            this._intentCapsuleManager.createCapsule(sanitizedPrompt);
+            const inferredCategories = this._intentCapsuleManager.inferCategories(sanitizedPrompt);
+            this._intentCapsuleManager.createCapsule(sanitizedPrompt, {
+                // Only set allowedActionCategories when constraints were actually inferred.
+                // Passing an empty array would block all actions; undefined means no restriction.
+                allowedActionCategories: inferredCategories.length > 0 ? inferredCategories : undefined,
+            });
+            if (inferredCategories.length > 0) {
+                log.info({ jobId, inferredCategories }, 'Intent capsule created with inferred action categories');
+            }
         }
         // Classify task for routing
         const classification = this._router.classifyTask(sanitizedPrompt);
         // Build custom tools (permissions + memory tools + recall_context)
         const customTools = this._createCustomTools();
+        // ERR-09: Build initial error budget — maxBudget from failover config, maxTurns from options
+        const maxRetries = this._config.failover.max_retries ?? 3;
+        const maxTurns = options.maxTurns ?? 0;
+        const errorBudget = {
+            maxBudget: maxRetries,
+            budgetConsumed: 0,
+            maxTurns,
+            turnsConsumed: 0,
+        };
         // Build task context
         const taskContext = {
             jobId,
@@ -345,8 +471,9 @@ export class Orchestrator {
             modelPreference: options.model,
             maxCostTier: options.maxCostTier,
             maxTurns: options.maxTurns,
+            errorBudget,
             customTools,
-            canUseTool: this._policyEngine.createCanUseTool(),
+            canUseTool: this._buildTokenAwareCanUseTool(jobId),
         };
         // ORCH-12: Run onTaskStart hooks (can modify context before routing)
         const hookedContext = await this._hookRunner.runOnTaskStart(taskContext);
@@ -356,10 +483,17 @@ export class Orchestrator {
             selectedProvider = await this._router.selectProvider(hookedContext);
         }
         catch (err) {
+            this._activeTokens.delete(jobId);
             throw new Error(`No provider available: ${err instanceof Error ? err.message : String(err)}`);
         }
         // Execute with the selected provider (injectionDepth=0 for initial call)
-        return this._executeWithProvider(selectedProvider, hookedContext, options.onEvent, 0, 0, compressor);
+        // SEC-10: Clean up capability token after task completes (success or failure)
+        try {
+            return await this._executeWithProvider(selectedProvider, hookedContext, options.onEvent, 0, 0, compressor);
+        }
+        finally {
+            this._activeTokens.delete(jobId);
+        }
     }
     /** Tracks errors that have already been through the failover path */
     static _failoverErrors = new WeakSet();
@@ -381,10 +515,37 @@ export class Orchestrator {
      * - The _failoverErrors WeakSet prevents double-failover: errors already processed
      *   by the failover path are not re-triggered in the outer catch block.
      */
-    async _executeWithProvider(provider, taskContext, onEvent, failoverDepth = 0, injectionDepth = 0, compressor) {
+    async _executeWithProvider(provider, taskContext, onEvent, failoverDepth = 0, injectionDepth = 0, compressor, patternDetectorIn) {
+        // ERR-09: Check error budget before every provider call
+        if (taskContext.errorBudget) {
+            const budget = taskContext.errorBudget;
+            if (budget.budgetConsumed >= budget.maxBudget) {
+                const errEvent = {
+                    type: 'error',
+                    timestamp: new Date(),
+                    source: 'orchestrator',
+                    content: {
+                        message: `Error budget exceeded: ${budget.budgetConsumed}/${budget.maxBudget} retries consumed`,
+                        code: 'error_budget_exceeded',
+                        subtype: 'budget_consumed',
+                    },
+                };
+                if (onEvent)
+                    onEvent(errEvent);
+                throw new Error(`error_budget_exceeded: retry budget exhausted (${budget.budgetConsumed}/${budget.maxBudget})`);
+            }
+        }
         let result = '';
         let eventsSinceLastTick = 0;
         const TICK_INTERVAL = 10; // Check compression thresholds every N events
+        // ERR-10: Per-execution pattern detector (in-session circuit breaker)
+        const patternDetector = patternDetectorIn ?? new ErrorPatternDetector();
+        // ERR-09: Stale-state loop detection — track whether a tool was called this turn
+        let toolCalledThisTurn = false;
+        let consecutiveNonToolTurns = 0;
+        const STALE_LOOP_THRESHOLD = 3;
+        // Tool-level hook tracking: map toolCallId → call start timestamp
+        const _toolCallStartTimes = new Map();
         // Event batching: buffer session writes, flush every 500ms or on done/error.
         // Wrapped in try/finally to ensure close() runs on ALL exit paths including failover.
         const bufferedWriter = new BufferedSessionWriter(this._sessionManager, taskContext.jobId, 500);
@@ -392,8 +553,12 @@ export class Orchestrator {
             try {
                 // Execute via the provider's async generator
                 for await (const event of provider.execute(taskContext)) {
-                    // R8: Persist events via buffered writer (batched disk I/O)
-                    bufferedWriter.append(event);
+                    // R8: Persist events via buffered writer (batched disk I/O).
+                    // tool_call events are deferred until after before-hooks run so
+                    // SecretRedactHook can modify args before they hit the log.
+                    if (event.type !== 'tool_call') {
+                        bufferedWriter.append(event);
+                    }
                     // Feed events to context compressor for rolling compression
                     if (compressor) {
                         compressor.ingest(event);
@@ -425,7 +590,125 @@ export class Orchestrator {
                         if (leaks.length > 0) {
                             log.warn({ jobId: taskContext.jobId, tool: toolCallContent.tool, leaks: leaks.map(l => ({ pattern: l.pattern, severity: l.severity })) }, 'Potential secret leak detected in tool call arguments');
                         }
+                        // ERR-12 Lite: Check NegativeCache for hot-failing tool signatures
+                        const args = toolCallContent.arguments ?? {};
+                        try {
+                            const cacheResult = await this._negativeCache.check(toolCallContent.tool, args);
+                            if (cacheResult.isHotFailing && cacheResult.hint) {
+                                log.warn({ jobId: taskContext.jobId, tool: toolCallContent.tool, failures: cacheResult.failureCount }, 'NegativeCache: hot-failing tool detected — injecting system hint');
+                                const hintEvent = {
+                                    type: 'steering',
+                                    timestamp: new Date(),
+                                    source: 'negative-cache',
+                                    content: { text: cacheResult.hint, source: 'negative-cache', author: 'system' },
+                                };
+                                taskContext.history.push(hintEvent);
+                                if (onEvent)
+                                    onEvent(hintEvent);
+                            }
+                        }
+                        catch (err) {
+                            log.debug({ err }, 'NegativeCache check failed (non-critical)');
+                        }
+                        // ERR-09: Stale-state loop — tool call resets the consecutive counter
+                        toolCalledThisTurn = true;
+                        consecutiveNonToolTurns = 0;
+                        // Tool-level before-hooks: record start time and run before-hooks.
+                        // Logging happens AFTER hooks so SecretRedactHook can redact args
+                        // before they are written to disk or the session log.
+                        _toolCallStartTimes.set(toolCallContent.toolCallId, Date.now());
+                        try {
+                            const hookBefore = await this._toolHookRunner.runBefore({
+                                jobId: taskContext.jobId,
+                                tool: toolCallContent.tool,
+                                arguments: toolCallContent.arguments ?? {},
+                            });
+                            // Log the event now (with potentially-redacted args from hooks)
+                            const hookedArgs = hookBefore.args;
+                            const loggedEvent = hookedArgs !== (toolCallContent.arguments ?? {})
+                                ? { ...event, content: { ...toolCallContent, arguments: hookedArgs } }
+                                : event;
+                            bufferedWriter.append(loggedEvent);
+                            log.debug({ jobId: taskContext.jobId, tool: toolCallContent.tool, arguments: hookedArgs }, 'tool call');
+                            if (!hookBefore.allow) {
+                                // Inject a synthetic tool_result indicating the tool was blocked
+                                const blockedEvent = {
+                                    type: 'tool_result',
+                                    timestamp: new Date(),
+                                    source: 'tool-hook-runner',
+                                    content: {
+                                        toolCallId: toolCallContent.toolCallId,
+                                        result: null,
+                                        error: `Tool call blocked by hook: ${toolCallContent.tool}`,
+                                    },
+                                };
+                                bufferedWriter.append(blockedEvent);
+                                taskContext.history.push(blockedEvent);
+                                if (onEvent)
+                                    onEvent(blockedEvent);
+                            }
+                        }
+                        catch (err) {
+                            // If hooks fail, still log the original event so the call isn't lost
+                            bufferedWriter.append(event);
+                            log.error({ err, tool: toolCallContent.tool, jobId: taskContext.jobId }, 'tool-hook runBefore error (non-critical)');
+                        }
+                    }
+                    // ERR-10: Pattern detection on tool results + ERR-12: record failures/successes
+                    if (event.type === 'tool_result') {
+                        const toolResultContent = event.content;
+                        const hasFailed = Boolean(toolResultContent.error);
+                        // Find the matching tool_call in history to get name + args
+                        const matchingCall = [...taskContext.history].reverse().find(e => e.type === 'tool_call' &&
+                            e.content.toolCallId === toolResultContent.toolCallId);
+                        if (matchingCall) {
+                            const callContent = matchingCall.content;
+                            const args = callContent.arguments ?? {};
+                            // ERR-12: Record failure/success in persistent negative cache
+                            if (hasFailed) {
+                                this._negativeCache.recordFailure(callContent.tool, args).catch(err => {
+                                    log.debug({ err }, 'NegativeCache recordFailure failed (non-critical)');
+                                });
+                            }
+                            else {
+                                this._negativeCache.recordSuccess(callContent.tool, args).catch(err => {
+                                    log.debug({ err }, 'NegativeCache recordSuccess failed (non-critical)');
+                                });
+                            }
+                            // ERR-10: In-session circuit breaker — detect repeat failures
+                            const detection = patternDetector.record(callContent.tool, args, !hasFailed);
+                            if (detection.isRepeating && detection.hint) {
+                                log.warn({ jobId: taskContext.jobId, tool: detection.toolName }, 'ERR-10: Repeat tool failure detected — injecting hard steering hint');
+                                const hintEvent = {
+                                    type: 'steering',
+                                    timestamp: new Date(),
+                                    source: 'error-pattern-detector',
+                                    content: { text: detection.hint, source: 'error-pattern-detector', author: 'system' },
+                                };
+                                bufferedWriter.append(hintEvent);
+                                taskContext.history.push(hintEvent);
+                                if (onEvent)
+                                    onEvent(hintEvent);
+                            }
+                        }
+                        // ERR-09: Stale-state — tool_result is a "turn", but only counts if no tool call followed
+                        // (tracked by text events below)
+                        // Tool-level after-hooks: run after every tool result
+                        const _startMs = _toolCallStartTimes.get(toolResultContent.toolCallId);
+                        _toolCallStartTimes.delete(toolResultContent.toolCallId);
+                        const _matchingCallForHook = matchingCall;
+                        if (_matchingCallForHook) {
+                            const _callContentForHook = _matchingCallForHook.content;
+                            await this._toolHookRunner.runAfter({
+                                jobId: taskContext.jobId,
+                                tool: _callContentForHook.tool,
+                                arguments: _callContentForHook.arguments ?? {},
+                                result: toolResultContent.result,
+                                durationMs: _startMs !== undefined ? Date.now() - _startMs : undefined,
+                            });
+                        }
                     }
+                    // (ERR-09: stale-state tracking is done on 'done' events below)
                     // R7: Poll SteeringManager with debouncing (max once per 2 seconds)
                     if (event.type === 'text' || event.type === 'tool_result') {
                         const pendingMessages = await this._steeringManager.cachedGetPendingMessages(taskContext.jobId, 2000);
@@ -450,13 +733,82 @@ export class Orchestrator {
                         onEvent(event);
                     // Track history for failover handoff
                     taskContext.history.push(event);
-                    // Capture result text
+                    // Capture result text and enforce turn budget
                     if (event.type === 'done') {
                         result = event.content.text ?? '';
+                        // ERR-09: Increment turnsConsumed and check maxTurns limit
+                        if (taskContext.errorBudget) {
+                            const budget = taskContext.errorBudget;
+                            budget.turnsConsumed += 1;
+                            // Stale-state detection: count consecutive turns with no tool calls
+                            if (!toolCalledThisTurn) {
+                                consecutiveNonToolTurns += 1;
+                                if (consecutiveNonToolTurns >= STALE_LOOP_THRESHOLD) {
+                                    const staleEvent = {
+                                        type: 'error',
+                                        timestamp: new Date(),
+                                        source: 'orchestrator',
+                                        content: {
+                                            message: `Stale state loop: ${consecutiveNonToolTurns} consecutive turns without tool calls`,
+                                            code: 'error_budget_exceeded',
+                                            subtype: 'stale_state_loop',
+                                        },
+                                    };
+                                    bufferedWriter.append(staleEvent);
+                                    if (onEvent)
+                                        onEvent(staleEvent);
+                                    throw new Error(`error_budget_exceeded: stale state loop detected (${consecutiveNonToolTurns} turns without tool calls)`);
+                                }
+                            }
+                            else {
+                                consecutiveNonToolTurns = 0;
+                            }
+                            // Reset per-turn flag
+                            toolCalledThisTurn = false;
+                            // Check hard maxTurns limit
+                            if (budget.maxTurns > 0 && budget.turnsConsumed >= budget.maxTurns) {
+                                const turnErrEvent = {
+                                    type: 'error',
+                                    timestamp: new Date(),
+                                    source: 'orchestrator',
+                                    content: {
+                                        message: `Turn limit exceeded: ${budget.turnsConsumed}/${budget.maxTurns} turns consumed`,
+                                        code: 'error_budget_exceeded',
+                                        subtype: 'turn_limit_exceeded',
+                                    },
+                                };
+                                if (onEvent)
+                                    onEvent(turnErrEvent);
+                                throw new Error(`error_budget_exceeded: turn limit exhausted (${budget.turnsConsumed}/${budget.maxTurns})`);
+                            }
+                        }
+                        else {
+                            // Reset per-turn flag even without budget tracking
+                            toolCalledThisTurn = false;
+                        }
                     }
                     // Handle errors — trigger failover (R3)
                     if (event.type === 'error') {
                         const errorContent = event.content;
+                        // ERR-07: Normalize error for structured logging (safe message, category)
+                        const normalized = this._errorNormalizer.normalize(errorContent.message ?? 'Unknown provider error');
+                        log.warn({ jobId: taskContext.jobId, category: normalized.category, message: normalized.safeMessage }, 'ERR-07: Provider error normalized');
+                        // ERR-07: Inject failure_report as a tool_result event into history for LLM context
+                        const failureToolCallId = `err_${Date.now()}`;
+                        const failureReport = this._errorNormalizer.toFailureReport(failureToolCallId, normalized);
+                        const failureEvent = {
+                            type: 'tool_result',
+                            timestamp: new Date(),
+                            source: 'orchestrator',
+                            content: {
+                                toolCallId: failureToolCallId,
+                                result: failureReport,
+                                error: normalized.safeMessage,
+                            },
+                        };
+                        taskContext.history.push(failureEvent);
+                        if (onEvent)
+                            onEvent(failureEvent);
                         const error = new Error(errorContent.message ?? 'Unknown provider error');
                         // Guard: skip failover if depth exceeded
                         if (failoverDepth >= Orchestrator.MAX_FAILOVER_DEPTH) {
@@ -466,7 +818,8 @@ export class Orchestrator {
                         const failoverResult = await this._failoverController.handleFailure(taskContext, provider, error);
                         if (failoverResult) {
                             // Re-execute with the failover provider (increment depth)
-                            return this._executeWithProvider(failoverResult.nextProvider, taskContext, onEvent, failoverDepth + 1, injectionDepth, compressor);
+                            // Preserve intent capsule across failover and pass same patternDetector
+                            return this._executeWithFailoverProvider(failoverResult.nextProvider, taskContext, onEvent, failoverDepth + 1, injectionDepth, compressor, patternDetector);
                         }
                         // R5: Enqueue for retry if no failover available
                         try {
@@ -490,7 +843,8 @@ export class Orchestrator {
                     if (failoverResult) {
                         // Mark the error so downstream doesn't re-trigger failover
                         Orchestrator._failoverErrors.add(err);
-                        return this._executeWithProvider(failoverResult.nextProvider, taskContext, onEvent, failoverDepth + 1, injectionDepth, compressor);
+                        // Preserve intent capsule across failover and pass same patternDetector
+                        return this._executeWithFailoverProvider(failoverResult.nextProvider, taskContext, onEvent, failoverDepth + 1, injectionDepth, compressor, patternDetector);
                     }
                     // R5: Enqueue for retry
                     try {
@@ -549,6 +903,133 @@ export class Orchestrator {
         }
         return result;
     }
+    /**
+     * submitWorkflow — TLCI-aware multi-step workflow dispatch.
+     *
+     * Routes each step to the cheapest capable tier:
+     *   Tier 1 (code): deterministic code tools — httpFetch, transform, fileOp, etc.
+     *   Tier 2 (slm):  local Ollama model (free cost-tier provider), falls back to frontier
+     *   Tier 3 (frontier): existing Zora provider stack (Claude/Gemini)
+     *
+     * Pass structured parameters for code-tool steps via WorkflowStep.context:
+     *   { id: '1', description: 'fetch user data', context: { url: 'https://api.example.com/users' } }
+     *
+     * Additive — does not touch submitTask.
+     */
+    async submitWorkflow(steps, opts) {
+        await this._ensureTLCI();
+        return this._tlciDispatcher.dispatch(steps, opts ?? {});
+    }
+    /** Expose CostTracker for DashboardServer /api/tlci-stats wiring. */
+    getTLCICostTracker() {
+        return this._tlciCostTracker;
+    }
+    /**
+     * Initialize TLCI subsystem exactly once, even under concurrent submitWorkflow calls.
+     * Uses a promise guard to prevent double-initialization race conditions.
+     */
+    _ensureTLCI() {
+        if (!this._tlciInitP) {
+            this._tlciInitP = this._initTLCI();
+        }
+        return this._tlciInitP;
+    }
+    async _initTLCI() {
+        this._planCache = new PlanCache();
+        await this._planCache.init();
+        this._tlciCostTracker = new CostTracker(this._planCache);
+        const self = this;
+        const ollamaProvider = this._providers.find(p => p.costTier === 'free');
+        this._tlciDispatcher = new TLCIDispatcher(this._planCache, { autonomyLevel: 'full' }, 
+        // Tier 1: real code tools — no LLM call, no token cost
+        async (step) => {
+            const classifiedStep = step;
+            const result = await runCodeToolStep({
+                id: step.id,
+                suggestedCodeTool: classifiedStep.suggestedCodeTool,
+                context: step.context,
+                description: step.description,
+            });
+            if (!result.success) {
+                log.warn({ stepId: step.id, tool: result.tool, error: result.error }, 'code-tool step failed');
+            }
+            return result;
+        }, 
+        // Tier 2: Ollama (local, free) — route via maxCostTier:'free'
+        // Falls back to frontier only on connection refusal / unavailability
+        async (step) => {
+            if (ollamaProvider) {
+                try {
+                    const available = await ollamaProvider.isAvailable();
+                    if (available) {
+                        return await self.submitTask({ prompt: step.description, maxCostTier: 'free' });
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    // Only fall back for connection errors, not execution failures
+                    if (/ECONNREFUSED|ENOTFOUND|timeout|unavailable/i.test(msg)) {
+                        log.warn({ stepId: step.id, err: msg }, 'Ollama unreachable — falling back to frontier');
+                    }
+                    else {
+                        throw err; // real execution error — propagate
+                    }
+                }
+            }
+            log.warn({ stepId: step.id }, 'Ollama unavailable — falling back to frontier for SLM step');
+            return self.submitTask({ prompt: step.description });
+        }, 
+        // Tier 3: frontier — existing provider stack
+        async (step) => self.submitTask({ prompt: step.description }), 
+        // Approval — auto in full-autonomy mode
+        async (_message) => true, 
+        // Wire CostTracker so it records every dispatch
+        this._tlciCostTracker);
+    }
+    /**
+     * ERR-08: Resume a previously-failed task using its full serialized TaskContext.
+     *
+     * Unlike submitTask(), this skips the "Planning/Classification" phase entirely.
+     * The existing history and memoryContext are preserved so the provider can
+     * continue from the exact point of failure — State Continuity.
+     *
+     * Called by the RetryQueue poll to resume persisted task contexts.
+     *
+     * @param context - The full TaskContext as persisted by the RetryQueue
+     * @returns The final text result from the resumed execution
+     */
+    async _resumeTask(context, onEvent, compressor) {
+        if (!this._booted)
+            throw new Error('Orchestrator.boot() must be called before _resumeTask');
+        log.info({ jobId: context.jobId, historyLength: context.history.length }, 'ERR-08: Resuming task with preserved context (skipping classification)');
+        // Reset ValidationPipeline rate limit for the resumed session
+        this._validationPipeline?.resetSession();
+        // Refresh canUseTool — the original closure may be stale after a restart
+        // SEC-10: Re-issue a capability token for the resumed job and apply token-aware enforcement
+        const resumeJobId = context.jobId;
+        const resumeCapToken = createCapabilityToken(resumeJobId, this._policy);
+        this._activeTokens.set(resumeJobId, resumeCapToken);
+        const resumeContext = {
+            ...context,
+            canUseTool: this._buildTokenAwareCanUseTool(resumeJobId),
+        };
+        // Route to provider using the preserved classification (no re-classification)
+        let selectedProvider;
+        try {
+            selectedProvider = await this._router.selectProvider(resumeContext);
+        }
+        catch (err) {
+            this._activeTokens.delete(resumeJobId);
+            throw new Error(`No provider available for resume: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // SEC-10: Clean up capability token after resumed task completes (success or failure)
+        try {
+            return await this._executeWithProvider(selectedProvider, resumeContext, onEvent, 0, 0, compressor);
+        }
+        finally {
+            this._activeTokens.delete(resumeJobId);
+        }
+    }
     /**
      * MEM-09: Runs memory extraction asynchronously after job completion.
      *
@@ -619,6 +1100,22 @@ export class Orchestrator {
         }
         log.info({ jobId: taskContext.jobId, extracted: result.items.length, saved: savedCount }, 'Memory extraction complete');
     }
+    /**
+     * Execute with a failover provider while preserving the active intent capsule.
+     * Serializes the capsule before handing off to the next provider and restores
+     * it afterwards if the execution cleared it (defensive measure).
+     */
+    async _executeWithFailoverProvider(nextProvider, taskContext, onEvent, failoverDepth, injectionDepth, compressor, patternDetector) {
+        const capsuleSnapshot = this._intentCapsuleManager?.serializeActiveCapsule() ?? null;
+        const result = await this._executeWithProvider(nextProvider, taskContext, onEvent, failoverDepth, injectionDepth, compressor, patternDetector);
+        if (capsuleSnapshot && this._intentCapsuleManager && !this._intentCapsuleManager.getActiveCapsule()) {
+            const restored = this._intentCapsuleManager.restoreCapsule(capsuleSnapshot);
+            if (!restored) {
+                log.warn({ jobId: taskContext.jobId }, 'Failed to restore intent capsule after failover — drift detection disabled for remainder of task');
+            }
+        }
+        return result;
+    }
     /**
      * Creates custom tools available to the agent during execution.
      * Includes: permission tools, memory tools (search/save/forget), recall_context.
@@ -706,7 +1203,40 @@ export class Orchestrator {
                 return { notes, count: notes.length, days };
             },
         };
-        return [...permissionTools, ...memoryTools, recallContextTool];
+        // Skill tools: list_skills and invoke_skill for agent-callable skill library
+        const skillTools = createSkillTools(this._policyEngine);
+        // Wire plan_workflow tool — bound to submitWorkflow so the LLM can decompose
+        // and optionally execute TLCI workflows mid-conversation.
+        const planWorkflowTool = createPlanWorkflowTool((steps, opts) => this.submitWorkflow(steps, opts));
+        // Subagent tools: list_subagents and delegate_to_subagent
+        const subagentTools = createSubagentTools((opts) => this.submitTask({ prompt: opts.prompt }));
+        return [...permissionTools, ...memoryTools, recallContextTool, ...skillTools, planWorkflowTool, ...subagentTools];
+    }
+    /**
+     * SEC-10: Builds a token-aware canUseTool function that enforces capability
+     * token restrictions on path and command inputs before delegating to the
+     * policy engine. Call this once per job to get a closure bound to jobId.
+     */
+    _buildTokenAwareCanUseTool(jobId) {
+        const policyCanUseTool = this._policyEngine.createCanUseTool();
+        return async (tool, input, options) => {
+            const token = this._activeTokens.get(jobId);
+            if (token) {
+                const pathArg = input['path'];
+                if (pathArg) {
+                    const capResult = enforceCapability(token, { type: 'path', target: pathArg });
+                    if (!capResult.allowed)
+                        return { behavior: 'deny', message: capResult.reason ?? 'Path denied by capability token' };
+                }
+                const cmdArg = input['command'];
+                if (cmdArg) {
+                    const capResult = enforceCapability(token, { type: 'command', target: cmdArg });
+                    if (!capResult.allowed)
+                        return { behavior: 'deny', message: capResult.reason ?? 'Command denied by capability token' };
+                }
+            }
+            return policyCanUseTool(tool, input, options);
+        };
     }
     /**
      * Parse interval strings like "30m", "1h" to minutes.
@@ -763,6 +1293,10 @@ export class Orchestrator {
     get hookRunner() {
         return this._hookRunner;
     }
+    /** Register a tool-level lifecycle hook (fires before/after every tool call) */
+    registerToolHook(hook) {
+        this._toolHookRunner.register(hook);
+    }
     /** ORCH-14: Set a custom context transform function */
     set transformContext(fn) {
         this._transformContext = fn;
@@ -771,11 +1305,43 @@ export class Orchestrator {
     get transformContext() {
         return this._transformContext;
     }
+    /** SEC-11: Access the IntegrityGuardian for baseline and tamper checks */
+    get integrityGuardian() {
+        this._assertBooted();
+        return this._integrityGuardian;
+    }
+    /** SEC-11: Re-save integrity baselines after intentional config changes */
+    async rebaselineIntegrity() {
+        this._assertBooted();
+        await this._integrityGuardian.saveBaseline();
+        log.info('Integrity baselines updated');
+    }
+    /** SEC-12: Access the SecretsManager (undefined if ZORA_MASTER_PASSWORD not set) */
+    get secretsManager() {
+        return this._secretsManager;
+    }
     get config() {
         return this._config;
     }
     get providers() {
         return this._providers;
     }
+    // ── Private helpers ──────────────────────────────────────────────
+    /**
+     * MEM-20: Build the compressFn used by ContextCompressor and ReflectorWorker.
+     * Extracted so it can be reused in boot() (for ReflectorWorker) and submitTask().
+     */
+    _buildCompressFn() {
+        return async (prompt) => {
+            const compressLoop = new ExecutionLoop({
+                systemPrompt: 'You are a conversation observer. Compress messages into concise, dated observations. Respond with ONLY the observations.',
+                permissionMode: 'default',
+                cwd: process.cwd(),
+                maxTurns: 1,
+                model: this._config.memory?.compression?.model,
+            });
+            return compressLoop.run(prompt);
+        };
+    }
 }
 //# sourceMappingURL=orchestrator.js.map