S0: initial public repo genesis#1
Merged
Merged
Conversation
Carry the master public-release-program run and the canonical package-jsr-alpha run into the public repo so S1-S6 execute here rather than in netscript-start. Add the S1 (package-quality) supervisor scaffold (plan + phase-registry) reconciled to the current 27-unit surface, carry DOCS-STRUCTURE into docs/architecture, and refresh the master context-pack to reflect S0 complete.
rickylabs
marked this pull request as ready for review
June 5, 2026 03:54
This was referenced Jun 5, 2026
rickylabs
added a commit
that referenced
this pull request
Jun 9, 2026
- PLAN-EVAL row: PASS (OpenHands qwen3.7-max, separate session, 8/8 boxes, no deno.lock churn); 2 non-blocking procedural notes logged - add ## Design section (run-loop.md 3b) as the file->concept traceability index for IMPL-EVAL, per PLAN-EVAL procedural note #1 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rickylabs
pushed a commit
that referenced
this pull request
Jun 10, 2026
Evaluator verdict: PASS - All 13 plan-gate items satisfied - Research rigor verified (measure-first baseline with deno check/doc-lint/publish dry-run) - 13 decisions locked with rationale (D-1 through D-13) - 15 commit slices well under 30-slice cap, each with gate+files - A4+A3 archetype gate set justified - Consumer census confirms 0 breaking changes needed - Drift D-1 (fork point) and D-2 (deno.json exclude) logged with mitigations Improvements made: - Added scalar.min.js 3.3MB debt entry to arch-debt.md (advisory finding #2) - Corrected method rename analysis (advisory finding #1 was erroneous) - Refined remaining 4 advisory findings with actionable recommendations Plan is now locked and ready for implementation. Co-authored-by: openhands <openhands@all-hands.dev>
This was referenced Jun 12, 2026
rickylabs
pushed a commit
that referenced
this pull request
Jun 13, 2026
- Lock L-5d4-7: local fake-timer/clock test helper in packages/fresh; promote to shared ./testing only if 5d5/5d6 needs it. - Reword Open-Decision Sweep clock-port item to RESOLVED. - Close Question for supervisor #1 (answered). - Mark drift D-5d4-7 RESOLVED. Plan-only revision; zero implementation. Co-authored-by: openhands <openhands@all-hands.dev>
This was referenced Jun 16, 2026
rickylabs
pushed a commit
that referenced
this pull request
Jun 18, 2026
Adversarial PLAN-EVAL run for docs/content-architecture PR #59. VERDICT: FAIL_PLAN — three blocking gaps must close before authoring: B1 — watchers coverage: briefs/00-INDEX §Phase 3 misclassifies @netscript/watchers as internal/dev-tooling. Verified against packages/watchers/{mod.ts,README.md,deno.json}: it is a fully publish-configured, README-instrumented JSR-installable public package (createWatcher, FileWatcher). Must get a reachable hub or explicit cluster card. Conflicts with user north-star and with the §2a inventory. B2 — accuracy guardrail without teeth: §2c rule + briefs Global Acceptance Bar #1 are policy only. Required fix is a .llm/tools/docs/api-cite.ts gate script + per-page worklog. B3 — Phase 0 overloaded: components + nav + Shiki + toc + sitemap + callout shim + breadcrumb + nextPrev block Phase 1. Split into 0a (chrome-only, shippable) / 0b (engine config). Engine decisions adjudicated: D-E1 hybrid (caveat — nav.ts only on Reference sub-tree), D-E2 adopt Shiki with Phase-0b acceptance line, D-E3/D-E4 adopt, D-E5 defer to wave 2. Single most important bar-raising change: every authored hub page must contain at least one annotated, runnable, JSR-import-realistic code proof in comp.tabbedCode (verified via deno doc), which is also what turns B2 from policy into practice. Files: docs/site/_plan/09-research-integration.md (§8 added — adversarial hooks tying verdict back into the supervisor's synthesis) .llm/tmp/run/docs-content-architecture--planeval/plan-eval.md (verdict, per-challenge findings, gate checklist pass/fail) Co-authored-by: openhands <openhands@all-hands.dev>
rickylabs
added a commit
that referenced
this pull request
Jun 18, 2026
…(cycle-1) Resolves the three blocking gaps from the Minimax-M3 adversarial PLAN-EVAL (plan-eval.md, run 27795772956), all within docs/site/_plan/** (no source): - B1 (watchers coverage): add 10th capability hub "File watching & ingestion" (@netscript/watchers) in briefs/00-INDEX.md §Phase 3; remove the internal/dev-tooling framing + open-question footnote; mark 09 §2a as the binding surface authority. 05 Phase 3 + artifact table → 10 hubs. - B2 (accuracy guardrail teeth): Global Acceptance Bar #1 now defines a two-tier enforced gate — target .llm/tools/docs/api-cite.ts (extract @netscript/* imports → deno doc --json → fail PR on unknown symbol; wire into archetype-gate-matrix docs lane) + mandatory per-page worklog floor (docs/site/_plan/worklog/<page>.md). Added Global Bar #2: ≥1 annotated runnable JSR-import-realistic comp.tabbedCode proof per hub/landing/why page. Brief template carries a WORKLOG line. - B3 (Phase 0 overload): split into Phase 0a (component + nav chrome, shippable Pages preview) and Phase 0b (Shiki/toc/sitemap/callout shim + api-cite.ts, Codex config, does not block prose) in briefs/00-INDEX.md and 05. Engine caveats locked in 09 §3: D-E1 nav.ts Reference-subtree-only (never global); D-E2 Shiki Phase-0b compat acceptance line; D-E4 sitemap base_path acceptance. Accuracy nits: §2b adapter lists corrected (Nitro is NOT an adapter; queue = Deno KV + Redis + RabbitMQ, KV = deno-kv + redis + memory); R5 Aspire framing precision added as Global Bar #8. Resolution trail recorded in 09 §8a. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018fq9V7ujx7e1rWXi57qkPG
rickylabs
pushed a commit
that referenced
this pull request
Jun 18, 2026
…fied Cycle-1 FAIL_PLAN verdict (2726499) identified three blocking gaps + engine caveats + adapter/accuracy nits. Supervisor revision 0e049f7 closes all three at the plan level: - B1 (watchers coverage): CLOSED — 10th hub 'File watching & ingestion' added; 'internal/ dev-tooling' framing removed; §2a marked binding. - B2 (accuracy guardrail teeth): CLOSED — Global Bar #1 now specifies a two-tier enforced gate (target .llm/tools/docs/api-cite.ts + per-page worklog floor); Global Bar #2 requires ≥1 annotated runnable JSR-import-realistic code proof per hub page; brief template carries the WORKLOG line. - B3 (Phase 0 split): CLOSED — Phase 0 split into 0a (chrome-only, shippable, with merge-gate acceptance) and 0b (engine config, does not block prose) in BOTH 00-INDEX and 05. Engine caveats (D-E1 nav.ts Reference-only, D-E2 Shiki Phase-0b acceptance, D-E4 sitemap base_path) now binding in 09 §3 + 05. §2b adapter lists corrected (Nitro NOT an adapter; queue = Deno KV + Redis + RabbitMQ; KV = deno-kv + redis + memory). R5 Aspire framing precision added as Global Bar #8. Plan-Gate PARTIAL items re-walked: open-decision sweep PASS (watchers hub); gate set selected PASS (api-cite.ts → archetype-gate-matrix.md as docs-content-gate). Risk register remains PARTIAL but non-blocking per cycle-1. VERDICT: PLAN-EVAL: PASS — plan is implementation-ready; authoring dispatch may begin against Phase 0a. Co-authored-by: openhands <openhands@all-hands.dev>
This was referenced Jun 22, 2026
Closed
rickylabs
added a commit
that referenced
this pull request
Jun 30, 2026
…xes) in commits.md Append-only commit-log bookkeeping for the two #182 PLAN-EVAL cycle-1 commits: the arch:check -core extension (fix #4) and the plan.md/research.md fixes (#1 D2 doc-fence, #2 KvTriggerEventStore deconflict, #3 ## Risks block). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct
rickylabs
added a commit
that referenced
this pull request
Jun 30, 2026
…n-source copy (#172) * docs(scaffold-167): corrected research + plan for thin typesafe scaffold surface Re-architecture spine for #157: plugin add emits ONLY userland glue (wiring entrypoint + config edits + user-owned sample stubs + dep-sourced prisma) via a typesafe factory/typed code model. Disease (string-copied plugin TS source) is deleted. Supersedes chore/plugin-167-harden / PR #170. Grounded in 4 read-only agent sweeps (hexagon+emit map, plugin-add mutation map, prisma, doctrine+gates). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(scaffold-167): S1 typesafe @netscript/plugin/scaffold core surface Add the typesafe core scaffold surface under packages/plugin/src/scaffold, exported as @netscript/plugin/scaffold. Provides ScaffoldArtifact, a typed manifest spec + byte-identical scaffold.plugin.json renderer, centralized kebab pluginName parsing, a composition factory (createPluginScaffold) over an injected FileSystemPort, and the --context-json CLI runner. No abstract base, no string codegen, no casing module. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(scaffold-167): S2a thin workers scaffolder (userland-only, no plugin-source copy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(scaffold-167): S2b thin sagas scaffolder (userland-only, no plugin-source copy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(scaffold-167): S2b thin triggers scaffolder (userland-only, no plugin-source copy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(scaffold-167): S2b thin streams scaffolder (userland-only, no plugin-source copy) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(scaffold-167): S2c thin auth scaffolder (userland-only, no plugin-source copy) Re-architect the auth plugin scaffolder onto the shared @netscript/plugin/scaffold composition surface, replacing the legacy 26-template full plugin-copy with a single userland barrel. plugin add auth now emits only auth/mod.ts (re-exporting the published @netscript/plugin-auth-core/contracts/v1 surface); the service, routes, streams, Aspire wiring, deno.json/config, and auth.prisma all resolve from the @netscript/plugin-auth dependency (D-NOCOPY, D-CONFIG-KEEP, D-PRISMA: databaseMigrationsAdded:false). Delete artifacts.ts, files.ts, and all src/scaffold/templates/**. Migrate the auth manifest spec verbatim into plugins/auth/src/scaffold/spec.ts as authManifestSpec and retire the central packages/plugin test_fixtures/manifest-specs.ts (each plugin now owns its byte-identity test in-package). Completes S2 across all five official plugins. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(scaffold-167): lock unified plugin-command-contract architecture (v2) Re-architect the scaffold surface into FULL UNIFICATION: one core-owned plugin command contract (Vite-style composition + typed seams, strong single-target defaults, no cross-package inheritance). research.md + plan.md rewritten; context-pack added. Decisions also locked into PR #172 body + issue #167. Mandatory: install/doctor/info/update/remove. Optional: add/generate <resource>. ONE typesafe ItemScaffolder. Full rename+namespace. Forward-only reconcile of v1. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(scaffold-167): add author-side tooling (plugin verify + plugin new) + DoD Fold the user's two maintainer-facing capabilities into the unified plan: - S8 `netscript plugin verify` — author-grade plugin doctor (deno doc --lint + publish --dry-run + manifest schema + arch:check + adapter-contract completeness → one "exactly what is wrong" report; reuses repo/Deno tools). - S9 `netscript plugin new <name>` — conforming starter-shape generator built on the SAME unified item generator (dogfood); skeleton passes verify+dry-run. Both are the marketplace AUTHOR side of #167 and reinforce "core owns the shape". Also records an explicit Definition of Done: skill-first+harness, Deno-native first, JSR-ready, doctrine/fitness as actual merge gates, zero dead/dup code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(scaffold-167): record PLAN-EVAL dispatch prompt (OpenHands minimax-M3) Hard Plan-Gate trigger on PR #172 for the unified plugin-command-contract re-architecture (S1-S9). No implementation slice begins before PASS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(scaffold-167): record re-architecture license for packages/plugin + cli User grants explicit license to rethink/re-architect the internal design of packages/plugin and packages/cli (not just graft the contract onto existing structure). Widens latitude, not the bar — all doctrine/JSR/no-leak/cast/lock invariants still bind. PLAN-EVAL prompt updated to judge bold restructuring as legitimate/preferred. Re-dispatching the gate on the updated plan. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(openhands): apply agent changes * chore(openhands): record run trace 28346124073-1 * feat(plugin): S1 core plugin adapter contract * feat(plugin-workers): connect workers to plugin adapter contract * fix(plugin-workers): remove casts from adapter connector * feat(plugin-sagas): S3a sagas connector on @netscript/plugin/adapter * feat(plugin-triggers): S3a triggers connector on @netscript/plugin/adapter * feat(plugin-streams): S3b streams connector on @netscript/plugin/adapter (one ItemScaffolder; delete legacy scaffolders) * feat(plugin-auth): S3b auth connector on @netscript/plugin/adapter (install-only; delete legacy scaffolder) * refactor(plugin): unify forked local-project-files CLI adapters into @netscript/plugin #171a-1: replace the three per-plugin local-project-files.ts forks (workers/sagas/triggers) with one generic LocalProjectFiles + ProjectFiles in packages/plugin/src/cli/adapters/project-files.ts, re-exported via the existing @netscript/plugin/cli subpath. Entry widened to the superset {path,relativePath,size}; parameterized over project root only, no per-kind branching. All 12 import sites repointed; the three forks deleted and empty adapters/ dirs pruned. Scoped check (--unstable-kv) / lint / fmt green across packages/plugin and plugins/{workers,sagas,triggers}. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * refactor(plugin): extract shared registry-emission machinery into @netscript/plugin #171a-2: add a generic renderRegistryModule + toRegistryImportSpecifier in packages/plugin/src/cli/application/registry-emitter.ts (new application/ role folder; pure code emitter). Thin the three ProjectFiles-based static-registry generators (workers registry-compiler, sagas registry-generator, triggers trigger-registry-compiler) and the triggers inline runtime generator to delegate to it, passing only their specifics (discovery, import-line + entry-block shape, header/body). The generic owns ordering + import-specifier path math; zero per-kind branching. Exported via the existing @netscript/plugin/cli subpath. Byte-identity proven: golden snapshot tests for all three registry shapes ran green against the original generators (oracle locked) and remained byte-identical after thinning (3/3 passed). Workers Family-A runtime-registry-generator (manifest/ profile/job-definition engine) deliberately left un-unified — folding it in would require a leaky abstraction; sharing the renderer skeleton is the correct thinness outcome. Scoped check (--unstable-kv) 0 errors / lint 0 / fmt 0 across packages/plugin and plugins/{workers,sagas,triggers}; publish dry-run + doc --lint clean. Zero new casts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * refactor(plugin): data-driven verifyPlugin + single-source plugin version from deno.json #171b: replace the five hand-rolled per-plugin verify-plugin.ts files with one data-driven verifyPlugin(manifest, expectations) + runPluginVerificationCli in packages/plugin/src/diagnostics/verify-plugin.ts (exported from the root @netscript/plugin entrypoint alongside inspectPlugin). PluginExpectations is a pure data description of every contribution axis (services, processors, topics, schemas, contracts, runtimeConfigTopics, e2e, aspire, deps, telemetry, helpers), each item carrying its own finding message so wording is reproduced verbatim. Each plugin's verify-plugin.ts is now a thin verifyPlugin(...) call + one-line CLI main; named verify<Kind>Plugin() exports preserved. Dynamic helper-key reads use Reflect.get (unknown, no cast). 18-test generic suite added. Single-source the version: every plugin manifest now derives its version from its own deno.json via a JSON import attribute (JSR-safe; deno.json is in publish include), replacing the stale hardcoded literals/consts (alpha.0 / 0.1.0). A release:cut deno.json bump now propagates to every manifest automatically. All five verifiers truthfully return ok:true / findings:[] / exit 0 at the current 0.0.1-alpha.12; version-pinned test assertions repointed to deno.json. Scoped check (--unstable-kv) 0 errors / lint 0 / fmt 0 across packages/plugin and all five plugins; per-plugin suites green (workers 20, sagas 42, triggers 14, streams 11, auth 23) + generic 18; publish dry-run Success; zero new casts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * refactor(plugin): centralize generic E2E gate + probe machinery into core #171c: lift the convention-bearing E2E primitives that were duplicated (or sagas-local) across plugin src/e2e into @netscript/plugin (src/diagnostics, the sanctioned verification-concern folder; e2e is not in the core folder vocabulary). New core surface (exported from the root @netscript/plugin entry, mirroring verifyPlugin): - PluginE2eGate: the single { id, description, command } gate-definition type. The per-plugin WorkersE2eGate/SagasE2eGate/StreamsE2eGate are now thin aliases. - Generic HTTP-probe primitives: ProbeHttpResult, summarizeResponse, assertSuccessfulProbe, joinProbeUrl, normalizeProbePath. - resolveProbeUrl(envVarNames, fallbackUrl, { stripTrailingSlash }) + ResolveProbeUrlOptions: one env->URL resolver replacing three hand-rolled forks. Connectors rewired to thin consumers, kind-specifics preserved verbatim: - sagas: deleted local probe primitives, resolvers now call the core helpers; saga roundtrip payload + env names + defaults unchanged; src/e2e/mod.ts public export NAMES unchanged (generic four now source from @netscript/plugin, one definition). - workers: resolveWorkersProbeUrl keeps its exact no-strip behavior via { stripTrailingSlash: false }. - streams: resolveStreamsProbeUrl strips as before; createProbeStreamPath / ignoreExpectedProbeCleanupError / probePayloadSchema untouched. No gate id/description/command, env var name, default URL/port, or payload changed. Triggers tests/e2e migration, richer probes, and gate-data convergence are out of scope (deferred to plugin convergence). src/adapter and the #171a/b surfaces untouched. Scoped check (--unstable-kv) 320 files 0 errors / lint 0 / fmt 0 across packages/plugin + workers/sagas/streams; diagnostics + 3-plugin e2e suites 29/0 (table-driven equivalence: 500-char preview, frozen result, exact error wording, slash-join, env precedence, strip/no-strip per kind); publish dry-run Success (both new files ship in the tarball); no new casts, no new slow types, no new doc-lint errors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * refactor(plugins): #172a-1 contract + barrel structural convergence (auth L6) Converge all five plugins toward the canonical thin-connector shape (workers = reference): - Collapse src/plugin/mod.ts -> src/public/mod.ts (sagas/triggers/auth); deno.json "./plugin" now points at src/public/mod.ts (exact alias of "./public"/"."). - auth L6: "./contracts" ./contracts.ts -> new thin ./contracts/v1/mod.ts barrel (re-exports @netscript/plugin-auth-core/contracts/v1 + AUTH_SESSION_STATES); publish.include + check/doc-lint tasks + manifest loader strings + 2 tests repointed. - Delete orphan loose contracts.ts (workers/sagas/triggers) and orphan services/mod.ts (workers/sagas/auth) — zero importers (grep-proven); "./services" already targets services/src/main.ts. - Repoint sagas/triggers reference doc tables to src/public/mod.ts. Surface preserved: "./plugin" aliasing "./public" gains the *_API_*/*_PLUGIN_* constants the old curated barrel omitted (already reachable via "."), a surface expansion not a regression. Sagas contract-definition move DEFERRED: plugin-sagas-core already ships an evolved/divergent sagasContractV1 the plugin router does not implement; reconcile in the base-contract seam slice (#175 / 172a-2), not a relocation slice. Validation: scoped deno check 283 files / 0 diagnostics; 110 passed / 0 failed plugin tests; deno publish --dry-run (workers/sagas/triggers/auth) Success; deno doc --lint clean; arch:check EXIT=0. No packages/ source, src/adapter/, or deno.lock changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin): #172a-2a base plugin contract + base service seam (package core) Add the package-core base seam every feature plugin converges onto, per the USER base-contract/service design (contracts live in -core by design — anti-cyclic, core derives seam types; package core owns the base each -core contract extends). @netscript/plugin/contract-base (new export): - BASE_PLUGIN_ERRORS — shared oRPC error fragment (NOT_FOUND/VALIDATION_ERROR reuse @netscript/contracts schemas; INTERNAL owned here) spread into every plugin contract's error map. - PluginCapabilities + PluginCapabilitiesSchema — marketplace-discoverable capability descriptor (pluginName, contractVersions, routeGroups, capabilities). - BASE_PLUGIN_CONTRACT_ROUTES — spreadable fragment carrying the single mandatory typed `describe` (GET /describe) route, pre-wired to the base errors + output. - BasePluginContract type — each -core contract declares `satisfies BasePluginContract`; a missing/mis-typed `describe` is a compile error (the negative @ts-expect-error test proves it). oRPC has no .extend(); convergence is object-spread + satisfies. @netscript/plugin/service (new export): - createPluginService() — base service via COMPOSITION (A5), wrapping @netscript/service createService and baking the un-violable builder chain (cors->logger->openapi->docs->database->use->context->withRPC->withHealth-> withServiceInfo) as data; connectors describe the service as data and only .serve(). Absorbs the two Hono plugin services without class inheritance. Health/info stay INFRA (raw Hono handlers registered by withHealth/withServiceInfo), so the base CONTRACT mandates only the typed `describe`; the factory mandates the infra. Two non-mirror seams by design. Casts: 2 `as unknown as` at the oRPC contract boundary (sanctioned centralized- contract pattern, mirrors @netscript/contracts baseContract); no `any`, no novel cast category. JSR-safe (explicit return types, @module + symbol JSDoc). Validation: scoped check 6 files/0 diagnostics; package `check` task EXIT=0; lint 0; 3/3 new tests pass (incl. integration boot of /health + describe oRPC route); deno publish --dry-run Success (no --allow-slow-types). deno.lock additive only (@netscript/contracts, @netscript/service, npm:@orpc/server). No other package source touched; pre-existing src/adapter #174 reds unchanged (zero diff vs HEAD). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin-workers): #172a-2b adopt base contract seam + createPluginService (reference connector) Workers is the reference connector for the #172 convergence: it adopts the 172a-2a package-core base seam and defines the shape sagas/triggers/auth copy. Contract (@netscript/plugin-workers-core/contracts/v1): - Spread BASE_PLUGIN_ERRORS (NOT_FOUND/VALIDATION_ERROR/INTERNAL) over the hand-rolled error map, converging on the shared plugin error vocabulary. - Spread BASE_PLUGIN_CONTRACT_ROUTES so the mandatory typed `describe` (GET /describe) route is present; declare the definition `satisfies BasePluginContract` (the real compile-time conformance guard). All 21 existing routes preserved. describe handler (plugins/workers/services/src/routers/describe.ts): - Returns a real PluginCapabilities doc for workers (pluginName @netscript/plugin-workers, contractVersions [v1], routeGroups jobs/executions/ tasks/task-executions/topics/subscribe/admin, capabilities background-processor/job-scheduling/task-execution/sse-streaming), every field derived from the manifest + contract surface. Served at /api/v1/workers/describe. Service migration (plugins/workers/services/src/main.ts): - Migrated off the raw createService(...) chain onto createPluginService(router, config); every option (cors/logger/openapi/docs/database/context/health/ serviceInfo + the onStartup hook) is now data. The @netscript/kv/redis side-effect import and the import.meta.main bootstrap are preserved verbatim. Base-factory fold-in (discovered-necessary, @netscript/plugin/service): - createPluginService gained data-only onStartup/onShutdown hook arrays applied after withServiceInfo (workers' job-registration + stream mutation hook needs onStartup). Documented chain JSDoc updated; an onStartup serve-test added. Casts: only the sanctioned centralized-contract `as unknown as` category (the base error map and the seam-typed `describe` cross into the oRPC builders the same way @netscript/contracts baseContract does); no new `any`, lint-ignore, or novel cast category. JSR-safe. No deno.json import additions or deno.lock changes: @netscript/plugin resolves by Deno workspace member name (same pattern workers-core already uses for @netscript/plugin-streams-core), and its ./contract-base + ./service exports exist from 172a-2a. Validation (supervisor-run, independent of the generator): - scoped check 191 files/0 diagnostics; scoped lint exit 0/0 - deno test workers-core + workers + plugin/service: 46 passed/0 failed (incl. new contract-conformance, GET /describe integration, onStartup tests) - deno publish --dry-run both packages: Success, no --allow-slow-types - deno.lock untouched Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(run): track 172a-2a + 172a-2b commits in scaffold-surface run log * fix(plugin): #172a-2 posix-join workspace artifact paths (closes #174 Windows reds) The core plugin adapter resolved artifact write targets with the platform-native @std/path join, which emits backslash keys on Windows (\workspace\src\jobs\starter.ts) while the command reports POSIX createdFiles (src/jobs/starter.ts). The two adapter tests that read written artifacts back by their POSIX key therefore passed on Linux CI but failed on Windows (install_test / plugin-cli-runner_test) - the pre-existing #174 reds. Switch resolveWorkspacePath to @std/path/posix join so the resolved key is byte-deterministic across operating systems and matches the reported POSIX createdFiles. Deno accepts forward-slash paths for filesystem writes on Windows; createDenoFileSystem keeps native dirname for the real-disk mkdir. Verified (supervisor-run): packages/plugin scoped check 139/0, lint 0, deno test packages/plugin 63 passed/0 failed (both former reds now green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin-workers): #172a-2-SOUND type-sound base contract seam + workers reference Closes the two systemic soundness holes in the plugin service stack (Hole A caused Hole B), making the workers connector the rock-solid reference shape the remaining connectors copy. No any, no Record<string,unknown> handler maps, no contract erasure - contract to handler to router is type-enforced end to end. Base seam (@netscript/plugin/contract-base): - describe is now a real oc contract route (was a phantom built with the server os.errors(...) builder and cast to a hand-rolled __output marker). - BasePluginContract enforces the typed describe route via the real AnyContractRouter constraint; the permissive [route: string]: unknown index signature that made satisfies illusory is gone. Workers contract (@netscript/plugin-workers-core/contracts/v1): - workers.contract-definition rewritten isolatedDeclarations-clean and precise: explicit WorkersContractDefinition, per-route Route<inSchema,outSchema> aliases, all 21 routes + describe, no whole-contract as-unknown-as Parameters<typeof implement>[0] erasure. implement() stays precise. - WorkersContract/WorkersContractV1/WorkersRouter DERIVED from the real types (no longer hand-maintained, no drift from the Zod schemas). - ExecutionRecordShape annotated with concrete Zod constructor types (ZodString/ZodNullable/ZodDefault/...) instead of z.ZodType<T> upcasts, which under Zod v4 erased _output to unknown through .omit().extend() and silently widened the published ExecutionRecordResponse fields. Implementation conformed UP to the (correct) contract - registry/runtime/state read-boundary types tightened so handlers receive contract-conformant jobs; no published response field was loosened. Workers connector (plugins/workers/services): - router/v1/handler modules assembled through the contract-bound implementer's .router() (conformance checked); deleted v1: any, router: any, workersV1 as any, and the Record<string,unknown> handler maps + their deno-lint-ignore. Casts: only the sanctioned centralized-contract as-unknown-as category at the oRPC boundary (mirrors @netscript/contracts baseContract). New negative type-test (workers-contract-soundness_test) pins the seam with @ts-expect-error. deno.json/lock: additive only - workers-core now genuinely imports @orpc/contract (oc), @orpc/server (implement), and @netscript/plugin (base seam); plugin adds @orpc/contract. Lock re-resolved additively (no version changes). Verified (supervisor-run, independent of generator): scoped check 331 files/0 diagnostics; scoped lint 0; deno test workers-core + workers + plugin/service 108 passed/0 failed; deno publish --dry-run @netscript/plugin and @netscript/plugin-workers-core both Success, no --allow-slow-types. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin-sagas): #172a-2c sagas SOUND convergence (Decision-B fold) Roll the proven workers SOUND pattern (8a12e48f) onto the sagas connector + plugin-sagas-core contract, closing both systemic soundness holes (Hole A caused Hole B) and folding in the paused Decision-B evolved-contract work. No any, no Record<string,unknown> handler maps, no contract erasure - contract to handler to router is type-enforced end to end. Core contract (@netscript/plugin-sagas-core/contracts/v1): - sagas.contract rewritten isolatedDeclarations-clean: adopts the @netscript/plugin base seam (spreads BASE_PLUGIN_ERRORS via the single sanctioned oc.errors boundary cast, BASE_PLUGIN_CONTRACT_ROUTES describe route, satisfies BasePluginContract); explicit per-route Route<TIn,TOut> alias for all 7 routes + describe; no whole-contract as-unknown-as Parameters<typeof implement>[0] erasure; sagasContract/sagasContractV1 exported precise. - Every response Zod schema annotated with concrete Zod constructor types (ZodString/ZodNullable/ZodDefault/...) instead of z.ZodType<T> upcasts, which under Zod v4 erased _output to unknown and silently widened published fields. - Decision-B fields populated in the published schemas: sagaId/instanceId/ correlationKey on instance/history/SSE responses, correlationKey/messageId on publish response, durabilityTier (default t1) on definition responses. - Dropped the hand-rolled ContractProcedureLike and the (options: any) SagasRouteHandler. Connector (plugins/sagas): - Deleted the dead connector-local duplicate contract (plugins/sagas/contracts/v1/sagas.contract.ts; its SagasRoute* types were unused). contracts/v1/mod.ts reduced to a thin re-export of the core contract, so the manifest loader path + deno.json export resolve through the single canonical source - exactly like workers binds to workers-core. - New routers/router-context.ts: contract-bound implementer sagasContractV1.$context<SagaServiceContext>() + SagasHandlers<K> mapped type (kills router:any). - router/v1-handlers assembled through the implementer's .router(); deleted v1:any, router:any, sagasV1 as any, the Record<string,unknown> handler maps (incl. health) and their deno-lint-ignores. describe route returns real PluginCapabilities. Only AnyRouter at the top-level router assembly boundary. - Handlers conform UP to the contract: mapStateToInstance emits the Decision-B identifiers and normalizes the legacy 'active' status to the canonical 'running' (SAGA_INSTANCE_STATUSES); mapSagaToResponse emits durabilityTier. No published response field was loosened. - main.ts migrated from the raw createService(...).withCors()... chain to createPluginService(router, {...}).serve(); the durable-runtime lifecycle (registerSagas/openSagaRuntimeKv/createDurableSagaRuntime/start/stream mirror) moves to onStartup and the deterministic stop-runtime -> dispose order moves to a single onShutdown hook (try sagaRuntime.stop / finally durableRuntime.dispose). Casts: only the two sanctioned categories - the centralized-contract as-unknown-as at the oRPC error-map boundary (identical to workers) and the top-level router AnyRouter. Open domain data (saga state, message payload) stays an explicit open Record<string,unknown>. New negative @ts-expect-error type-test (sagas-contract-soundness_test) pins the seam. deno.json/lock: no change - the additive imports (@netscript/plugin-sagas-core/ contracts/v1, @netscript/plugin/contract-base) resolve through existing workspace members. Verified (supervisor-run, independent of generator): scoped check 306 files/0 diagnostics; scoped lint 167 files/0; deno test plugin-sagas-core 29 passed/0 failed (incl. new soundness test) and plugins/sagas 42 passed/0 failed; deno publish --dry-run @netscript/plugin-sagas-core and @netscript/plugin both Success, no --allow-slow-types. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin-triggers): #172a-2d triggers-core SOUND contract (Hole A) Roll the proven workers/sagas SOUND pattern (8a12e48f / c1d8bec4) onto the @netscript/plugin-triggers-core published oRPC contract, closing Hole A (contract->inference erasure). Contract-package scope ONLY - the triggers connector (plugins/triggers raw Hono service: 8 unimplemented oRPC routes + raw-body HMAC webhook ingress incompatible with oRPC Zod input parsing) is a separate PLAN-EVAL-gated daemon-attached slice, recorded as explicit arch-debt. No any, no Record<string,unknown> contract export, no contract erasure. Core contract (@netscript/plugin-triggers-core/contracts/v1): - triggers.contract rewritten isolatedDeclarations-clean: adopts the @netscript/plugin base seam (spreads BASE_PLUGIN_ERRORS via the single sanctioned oc.errors boundary cast; BASE_PLUGIN_CONTRACT_ROUTES describe route; satisfies BasePluginContract). Base error set is a superset of the prior local NOT_FOUND/VALIDATION_ERROR map; TRIGGERS_ERROR_CODES are TriggersError domain codes, not contract error-map entries, so no merge needed - no route-referenced error dropped. - Explicit interface TriggersContractDefinitionShape extends BasePluginContract with per-route Route<TIn,TOut> aliases for all 10 business routes + describe (11 total) plus a dedicated SubscribeEventsRoute for the eventIterator SSE route; no whole-contract as-unknown-as Readonly<Record<string,unknown>> erasure. triggersContract/triggersContractV1 exported precise and DERIVED from the real implement(triggersContractDefinition). - Every response/input Zod schema annotated with concrete Zod constructor types (ZodString/ZodNullable/ZodDefault/ZodObject/ZodEnum) instead of z.ZodType<T> upcasts, which under Zod v4 erased _output to unknown and silently widened published fields. Deleted the erasing TriggerContractSchema<T> indirection type and its as-unknown-as casts (grep confirmed no external importers); introduced structural ContractSchema/ContractSchemaResult mirroring sagas. - Open domain data (trigger payload, event metadata, SSE data) stays an explicit open z.ZodRecord<z.ZodString, z.ZodUnknown> - allowed open domain, not erasure. Domain enums (TRIGGER_DURABILITY_TIERS / TRIGGER_EVENT_STATUSES / TRIGGER_KINDS) preserved; no allowed value changed. Wire shape unchanged. - Added derived TriggersContract/TriggersContractV1/TriggersRouter/ TriggersCapabilities exports; mod.ts drops the dead TriggerContractSchema export and adds the new precise types. Casts: only the single centralized-contract as-unknown-as at the oRPC error-map boundary (identical to workers/sagas). New negative @ts-expect-error type-test (triggers-contract-soundness_test) pins the seam. No deno.json/lock change. Verified (supervisor-run, independent of generator): scoped check 253 files/0 diagnostics (plugin-triggers-core + plugins/triggers + plugin); scoped lint 0; deno test plugin-triggers-core 14 passed/0 failed (incl. new soundness test); deno publish --dry-run @netscript/plugin-triggers-core and @netscript/plugin both Success, no --allow-slow-types. The plugins/triggers root in the check confirms the connector's contract import did not break. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin-auth): #172a-2d auth SOUND convergence (Hole A + Hole B) Roll the proven workers/sagas SOUND pattern (8a12e48f / c1d8bec4) onto the auth plugin end to end: close both systemic soundness holes and adopt the base seam + createPluginService. No any, no Record<string,unknown> handler maps, no contract erasure - contract -> handler -> router is type-enforced. Implementation types conform UP to the (correct) contract; no published contract field loosened. Core contract (@netscript/plugin-auth-core/contracts/v1): - auth.contract rewritten isolatedDeclarations-clean: adopts the @netscript/plugin base seam (BASE_PLUGIN_ERRORS merged with auth-specific UNAUTHORIZED/AUTH_PROVIDER_ERROR/VALIDATION_ERROR via the single sanctioned oc.errors boundary cast - no auth error dropped; BASE_PLUGIN_CONTRACT_ROUTES describe route; satisfies BasePluginContract). Explicit AuthContractDefinitionShape extends BasePluginContract with per-route Route<TIn,TOut> aliases for all 5 business routes (signin POST /signin, callback POST /callback, signout POST /signout, session GET /session, me GET /me) + describe; no whole-contract as-unknown-as Parameters<typeof implement>[0] erasure; no permissive Record<string,unknown> index signature. authContractV1/AuthContractV1/AuthRouter/AuthContract DERIVED from the real implement(...) - no phantom as-unknown-as upcast. - All 11 z.ZodType<T> annotations replaced with concrete Zod constructor types, fixing the Zod v4 _output erasure. Session state enum (AUTH_SESSION_STATES: active/expired/revoked) preserved. mod.ts + public/mod.ts add AuthCapabilities /AuthContract/AuthContractDefinition and drop dead type exports (AuthContractErrorFactory/Errors, AuthRouteHandler(Options)). Connector (plugins/auth): - New routers/router-context.ts: authContractV1.$context<AuthServiceContext>() implementer + AuthHandlers<K> mapped type (kills router:any). v1-handlers typed AuthHandlers<AuthV1RouteKey> (was Record<string,unknown>); added the describe handler returning a real PluginCapabilities const. health.ts typed via HealthHandlers<K> mapped type. router.ts rebuilt through authImplementer.router(authV1) + os.$context<...>().use(mw).prefix('/v1/auth') .router(...); deleted every any / as any / deno-lint-ignore. AnyRouter only at the top-level router boundary. v1-helpers mappers return mutable arrays/claims matching the contract output schema. - main.ts migrated from the raw createService(...).withCors()... chain to createPluginService(router, {...}).serve(): openApi/docs/database/ middleware:[withAuthRequest]/context/traceContext map 1:1; registry resolution + adapter selection (better-auth/workos/kv-oauth via backend-registry) unchanged. Casts: only the two sanctioned categories - centralized-contract as-unknown-as at the oRPC error-map boundary (identical to workers/sagas) and the top-level router AnyRouter. Open domain data (token payloads, provider metadata, claims) stays explicit open Record<string,unknown>. New negative @ts-expect-error type-test (auth-contract-soundness_test). No deno.json/lock change. Verified (supervisor-run, independent of generator): scoped check 253 files/0 diagnostics; scoped lint 0; deno test plugin-auth-core 27 passed/0 failed and plugins/auth 23 passed/0 failed (incl. new soundness test + full signin->callback->session->me->signout round-trip through the new router + createPluginService); deno publish --dry-run @netscript/plugin-auth-core and @netscript/plugin both Success, no --allow-slow-types. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(run): record #172a-2d triggers-core + auth SOUND commits in run log * chore(debt): record deferred triggers-connector SOUND convergence (triggers-connector-sound-deferred) * chore(debt): record deferred streams-connector SOUND convergence (streams-connector-sound-deferred) * chore(run-log): record deb801aa + 74e9e5ce deferred proxy-connector debt entries * feat(plugin): #180a createPluginService raw-route + serveRpc escape hatch (package-core) Adds the reusable capability the triggers (raw-body HMAC webhook) and streams (transparent proxy) connectors need to adopt createPluginService(...).serve(). @netscript/service: new ServiceRouteMethod union adds 'all'; route()/DeferredRoute retyped; install loop branches 'all' -> app.all(...). @netscript/plugin: new PluginRawRoute interface + PluginServiceConfig.rawRoutes (forwarded via route()) and serveRpc?:boolean (default true; false skips withRPC for pure passthrough connectors with no oRPC contract). {} stays a valid ServiceRouter so a no-router proxy needs no cast. New surface re-exported through both service mods (incl. ServiceHandler/ServiceRouteMethod from plugin/service/mod for the JSR private-type-ref rule). Verified (supervisor-run, independent of generator): scoped check 0 errors, lint 0 (25 files), deno test 59 passed/0 failed (incl. 2 new raw-route tests: serveRpc:false catch-all + /health coexist + /api/rpc passthrough; mixed-mode raw POST webhook unparsed-body alongside withRPC), dry-run @netscript/service + @netscript/plugin both Success (no --allow-slow-types). No deno.json/lock change. No new casts. 7 files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(streams): converge connector onto createPluginService proxy surface (#172 S180b) Migrate the streams service entrypoint from a hand-rolled Hono + Deno.serve front to the mandated `createPluginService({}, { serveRpc: false, ... }).serve()` surface, adopting the raw-route + serveRpc escape hatch landed in S180a (c19ebf59). Streams is the one plugin with no oRPC contract, so it serves with an empty router (`{}`, a valid ServiceRouter — no cast) and `serveRpc: false` (withRPC skipped). The transparent proxy to the upstream DurableStreamTestServer moves to a raw catch-all route (`{ method: 'all', path: '/*' }`); `/health[/live|/ready]` come from `withHealth`; the upstream-reachability probe is folded into `healthChecks`. `serve()` now owns the listener and SIGINT/SIGTERM/SIGBREAK graceful shutdown, so the manual signal listeners and front-server shutdown are deleted and the upstream `server.stop()` runs as an `onShutdown` hook. Behavior deltas (both verified benign — no consumer depends on either path): - `GET /` now returns NetScript service-info (withServiceInfo) instead of proxying to the upstream root. E2E probes, Aspire health, and the upstream health probe all target `/health` or explicit stream paths, never bare `/`. - `/health/ready` readiness list is now empty (always ready); createPluginService exposes no readiness-predicate knob. Upstream-reachability is still asserted via `/health`, which is the path all consumers probe. Launch contract preserved: aspire/scaffold launch the connector as a direct `deno run` of services/src/main.ts; it stays a top-level script (no factory — streams has no DB/registry/context). Version single-sourced from deno.json. No `any`, no new casts; the only escape is the pre-existing `@ts-ignore` for Request `duplex` (a Deno lib-types platform gap). Adds a services smoke test (excluded from the publish tarball). Closes streams-connector-sound-deferred. Verified (supervisor-run, from the streams package dir): - `deno task check` (14 entrypoints incl. services/src/main.ts) — 0 errors - `deno lint services/src` — 0 errors (2 files) - `deno test services/src/main_test.ts` — 1 passed / 0 failed (graceful serve() shutdown + onShutdown hook fired) - `deno publish --dry-run --allow-dirty` (NO --allow-slow-types) — Success; services/src/main.ts in tarball, main_test.ts excluded, no slow types Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(plugin-triggers): #180c converge triggers connector onto createPluginService (oRPC contract + raw HMAC webhook) Slice A of #180c: migrates the triggers connector from a hand-rolled raw Hono server to the mandated `createPluginService(...).serve()` surface, binding the already-SOUND `@netscript/plugin-triggers-core` v1 contract (Hole-A, 74656d71) for every backed route and fronting the raw-body HMAC webhook ingress through the #180a `rawRoutes` escape hatch. Connector (Archetype-5 presentation seam, specifics only): - routers/router-context.ts: binds `triggersContractV1.$context<TriggerServiceContext>()` and exports the precise `TriggersHandlers<K>` mapped type (per-route `ImplementedProcedure`, isolatedDeclarations annotation with no `any`/Record erasure). - routers/v1.ts: the 11-route contract handler map. Five routes backed by real runtime state (describe → static PluginCapabilities; listTriggers/getTrigger via the loaded definition registry; listEvents/getEvent via the event store). Six mutating/streaming routes (fireTrigger, testWebhook, previewSchedule, enableTrigger, disableTrigger, subscribeEvents) have no sound triggers-core backing yet and defer honestly (throw → oRPC 500; subscribeEvents is an immediately-throwing async generator that never violates the SSE schema). - routers/v1-types.ts: TriggerServiceContext (definitions/eventStore/ingress). - router.ts: oRPC router assembly { v1 }. - main.ts: createTriggersService factory on createPluginService (serveRpc:true, openApi/docs, context, rawRoutes for POST /api/v1/webhooks/:triggerId[/*]); self-bootstrapping createTriggersServiceContext + startTriggersService + import.meta.main. Raw HMAC webhook ingress (x-hub-signature-256) reads c.req.raw. - Deleted routers/events.ts, health.ts, webhooks.ts (folded into v1 handlers / withHealth / the raw webhook route). Type soundness (rock-solid, zero connector casts): - The webhook handler resolves the external path parameter against the loaded definitions and passes the definition's already-branded `.id` to ingress — the same brand-free string-resolution pattern as listEvents/getEvent — so the prior `triggerId as TriggerId` brand cast is ELIMINATED, not deferred. Unknown id → behavior-equivalent 404 (ingress's known set ⊆ context.definitions). - toContractKind narrows the open domain TriggerKind to the closed contract kind by membership test (no cast); tags spread into a fresh mutable array to match the contract output type without weakening the domain type. - Shipped connector source has ZERO casts and zero `any`. Only sanctioned categories remain repo-wide (top-level AnyRouter in router.ts; the centralized error-map `as unknown` lives in -core, not here). Test-only casts are confined to main_test.ts fixtures (branded-id fixture + in-memory status mutate). Deferred net-new triggers-core surface (manual/test fire helper, persistent enabled-state store + TriggerDefinitionBase.enabled/name, cron preview engine, event-subscription/SSE seam, typed internalError helper) recorded in .llm/harness/debt/arch-debt.md (TRIGGERS-CONNECTOR-DEFERRED-ROUTES) and queued as the PLAN-EVAL-gated triggers feature-backing program (task #181). This slice is strictly additive vs the prior raw-Hono connector, which served none of the contract routes. Verified (supervisor-run, independent of the generator), from plugins/triggers: - deno task check (12 entrypoints incl. services/src/main.ts) — EXIT=0 - deno lint services/src (6 files) — EXIT=0 - deno fmt --check services/src (6 files) — EXIT=0 - deno test --allow-all --unstable-kv services/src/main_test.ts — 1 passed (6 steps), 0 failed (incl. unknown-id → 404 and known-id → ingress webhook assertions) - deno publish --dry-run --allow-dirty (NO --allow-slow-types) — Success No deno.json/deno.lock change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(run-log): record c19ebf59 + 4f66f645 + 45446f3f (#180a/b/c proxy-connector slices) * docs(plugins): #176 dual role-README convergence (connector + -core, all 5 kinds) Converges all ten plugin READMEs to the canonical dual-role shape so the connector↔core split reads identically across workers/sagas/triggers/streams/auth. Authored by per-kind Opus agents under the doc-authoring exception; supervisor independently verified (no source/deno.json/mod.ts touched, fmt-clean, every claim grounded in deno.json exports + deno doc). CONNECTORS (plugins/<kind>/README.md): every tagline now uses the canonical "The deployable <feature> plugin for NetScript. It binds the host plugin system to <specifics> through a single declarative manifest." form (auth/triggers reshaped from "official"/"trigger-processing", sagas "durable"→"deployable"). Every connector now closes Key Capabilities with the explicit core cross-link ("The reusable <X> live in @netscript/plugin-<kind>-core; this package binds them to the host") — newly added to streams + auth, expanded for triggers, already present for workers/sagas. The `netscript plugin add <kind>` command is verbatim in every file (no add->install pre-emption). CORES (packages/plugin-<kind>-core/README.md): every tagline now ends with the mandated "...the core that the deployable @netscript/plugin-<kind> plugin binds to the host" clause (auth-core reframed from "contract layer", sagas/triggers reshaped). Key Capabilities expanded to cover real-but-undocumented subpaths, each verified via deno doc: workers-core (+./presets/./runtime/./streams/./schemas /./config/./abstracts), sagas-core (+./transports/./stores/./middleware /./integration/./agent), triggers-core (+./adapters, ack-then-process two-phase explanation naming TriggerEventStorePort/TriggerProcessorPort, scheduler/verifier/ clock/file-watcher ports). streams-core was already compliant and is unchanged. Accuracy fixes (grounded, not invented): triggers connector inspectTriggers() -> inspectTriggers(triggersPlugin) (real signature), Triggers API service named triggers-api port 8093, capabilities scoped to the BACKED surface only (no fire/test/preview/enable/disable/subscribe advertised, matching the deferred-route reality from #180c); workers connector documents ./contracts. Surgical convergence only — accurate existing prose, examples, install manifests, docs links, and licenses preserved. 9 files changed (streams-core untouched), +74/-43. READMEs only; no framework source. Verified: deno fmt --check on all 9 files EXIT=0; plugin README typescript fences are not doctested (the doctest fixture is packages/service/tests/_fixtures/readme-examples_test.ts, and the single fence edit is the corrected inspectTriggers signature). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(run-log): record #176 dual role-README convergence slice Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * refactor(cli)!: #157 S4 — rename plugin verb `add`→`install`, delete renderPlugin full-source (breaking) Unified S4 of the #157 plugin re-architecture. The plugin verb is now `install` everywhere (zero-compat, no `add` alias) and the full-source `renderPlugin` fallback is deleted so `netscript plugin install` ALWAYS uses the plugin-owned thin scaffold path. - Verb: `FRAMEWORK_VERBS`/`FrameworkVerb`/`isFrameworkVerb` flip `add`→`install` (dispatch-plugin-verb.ts, public-api.ts); public + local `plugins-group.ts` register `install`; `.name('install')` in both command surfaces. - Folder rename `features/plugins/add/`→`install/` (public) and `local/.../plugins/add/`→`install/`; `plan-plugin-add`→`plan-plugin-install`; domain `plugin-add-plan`→`plugin-install-plan`; e2e `plugin-add-gates`→ `plugin-install-gates`. `render-plugin.ts` filename kept; `renderPlugin` export DELETED, `renderPluginSupport` retained. - Sound fallback: when no resolvable plugin package + process runner, the command throws `ScaffoldValidationError` (not a silent full-source render). Config wiring + `copyPluginSchemasToRootDb` preserved. - Skills regenerated via sync-claude-skills.ts (.agents + .claude netscript-cli). - Other verbs (`service add`, `db add`, `contract add`) intentionally untouched. Supervisor-verified independently of the generator: scoped `deno check` GREEN (542 files, 0 errors); `deno publish --dry-run` Success (no `--allow-slow-types`); repo grep clean of `renderPlugin(`/`addPlugin(`/`plan-plugin-add`/`features/plugins/add`. Known follow-up (out of this slice): `packages/plugin` skeleton templates still print `netscript plugin add {{pluginName}}` into generated READMEs/mod headers; fixing needs a `packages/plugin` template + `embedded.generated.ts` regen slice. Refs #157 #163 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): record PLUGIN-RUNTIME-ADAPTER-RELOCATION (#172b/c/d) debt — relocate + migrate KV stores onto @netscript/kv Open, PLAN-EVAL-gated debt for the final #172 thin-connector convergence step. Two coupled defects in the sagas/triggers/workers connectors that still ship runtime stores/adapters under `plugins/<kind>/src/runtime/`: 1. Placement: by the #157→#172 thin-connector law these port→backend adapters belong in `@netscript/plugin-<kind>-core` (`stores/`/`adapters/`). 2. Primitive-bypass / engine lock: sagas + triggers KV stores hardwire raw `Deno.openKv` + the Deno-native fluent atomic, bypassing the engine-agnostic `@netscript/kv` primitive — forfeiting Redis / in-memory / reactive-watch. Workers `KvWorkerIdempotencyStore` already does it right (the reference). Scope = relocate + migrate (not a blind file move): rewrite the sagas/triggers KV stores onto `@netscript/kv` (`KvStore` + `AtomicCheck/Mutation/Result`, injected handle), adding `@netscript/kv`(+`@netscript/cron`+`@netscript/watchers` for triggers) deps to the `-core` packages — which is the ENCOURAGED direction, not a cost. No "minimize -core deps" rule exists; an earlier "D1" framing of that was removed. Net-new vs the PASSed scaffold-surface S1–S7 plan → gated separately. Linked plan: .llm/tmp/run/feat-scaffold-surface-167--adapter-relocation/{plan,research}.md Refs #157 #172 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): #172b/c/d relocation+migration run artifacts (research + plan) for PLAN-EVAL Adds the adapter-relocation run-dir research.md + plan.md so the PR-branch-checkout PLAN-EVAL session can read the canonical plan. Scope = relocate sagas/triggers/workers runtime stores+adapters into their `-core` packages AND migrate the sagas+triggers KV stores off raw `Deno.openKv` onto `@netscript/kv` (engine-agnostic; mirrors the workers `KvWorkerIdempotencyStore` reference). Locked decisions D-KV / D2 / D3 / D4. No "minimize -core deps" rule — depending on `@netscript/*` primitives is the encouraged direction. PLAN-EVAL hard-gate; no implementation slice before PASS. Refs #157 #172 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(openhands): apply agent changes * chore(openhands): record run trace 28412780609-1 * feat(harness)!: #164 S5a — extend arch:check over packages/plugin + 5 plugins; fix A4 detector Unified S5 part 1 (gates-as-gates): bring the doctrine fitness checker to bear on the full #172 thin-connector surface, not just the auth packages. arch:check task (deno.json): appends 5 roots — packages/plugin, plugins/workers, plugins/sagas, plugins/triggers, plugins/streams (plugins/auth already covered). All 10 roots now gate FAIL=0 (warnings/infos only: README fence counts, export default in scaffold-emitted stubs, missing docs/architecture.md — none gate-failing). check-doctrine.ts A4 detector fix (the enabling tooling change): the A4 "base classes are stub-only contracts" detector only matched abstract METHODS, so it false-flagged 13 conformant classes when run over the new roots. Two doctrine-grounded gaps closed (doctrine file 03): 1. Abstract field/accessor declarations now count as abstract members. Doctrine §"The stub-only rule" (line 34) explicitly lists `abstract readonly id/kind/version` identity fields as the contract a spine base imposes. The detector now recognizes `abstract get/set foo()` and `abstract [readonly] name:` alongside abstract methods. Clears the 11 `Plugin*Contribution` spine bases in packages/plugin/src/abstracts/ (each declares `abstract readonly axis`/`name`/`entrypoint`). 2. A `protected constructor` marks a deliberate layer-2 / non-instantiable base (doctrine §"Spine versus layer-2 abstracts" / R-BASE-L2) — such bases may carry concrete shared behavior and need not declare abstract members. The stub-only rule applies to the spine, not to layer-2 abstracts. Clears WorkersCliCommand + TriggersCliCommand (CliCommand sub-axis, protected ctor, multiple concretes, delegate to an injected backend not to spine lifecycle methods). The existing "public mutable field on a base" WARN is unchanged and still guards state leakage. No source change to any packages/ or plugins/ file — only harness tooling (.llm/tools/fitness/check-doctrine.ts) + the arch:check task wiring. Verified (supervisor-run): deno check --unstable-kv on the checker GREEN; all 5 new roots FAIL=0; the 5 existing auth roots stay FAIL=0; full `deno task arch:check` EXIT=0 end-to-end (deps:check + all 10 doctrine roots). No deno.lock change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): record S4 (63268439) + S5a (e55a8afa) in commits.md Append-only run-log bookkeeping for the feat/scaffold-surface-167 program. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(harness): #164 S5a-2 — add 3 -core packages to arch:check (PLAN-EVAL #182 fix #4) Extends the arch:check task to also enumerate packages/plugin-sagas-core, packages/plugin-triggers-core, and packages/plugin-workers-core. The #182 PLAN-EVAL flagged that the arch:check denominator did not include the -core packages the #172b/c/d relocation moves stores INTO, so post-relocation layering leakage (connector->core, or a -core taking a forbidden dep) would go unflagged. With S5a (connectors + packages/plugin) this makes arch:check cover the full #172 surface: 13 roots (5 auth + packages/plugin + 4 connectors + 3 non-auth -core). All 13 gate FAIL=0; full `deno task arch:check` EXIT=0 end-to-end. Resolves PLAN-EVAL fix #4 (arch:check denominator) by amending the deno.json task rather than substituting arch:check:repo in slice gates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): #182 #172b/c/d PLAN-EVAL cycle-1 fixes — plan.md + research.md Applies the 4 required fixes from the FAIL_PLAN verdict (cycle 1): 1. D2 doc-fence — research.md "Pre-flight verification" pastes the full connector-path grep: the SOLE first-party importer of a relocated symbol is docs/site/capabilities/durable-sagas.md:331 (resolveSagaStoreBackend). Every other @netscript/plugin-<kind>/runtime reference imports symbols that STAY (createDurableSagaRuntime/createSagaPublisher) or is prose/manifest; reference-page store mentions are PORT interfaces (already in -core/ports), not relocated concrete stores. plan.md S-b.5 splits that one fence's import (no shim) + re-greps to zero. 2. S-c KvTriggerEventStore deconflict — research.md records the collision (testing fixture at packages/plugin-triggers-core/src/testing/kv-trigger-event-store.ts:5 vs relocated production store) and the repo's own taxonomy fix (extension-axes.md:18: Kv* = real store, Memory*/Recording* = test doubles). plan.md S-c.5 renames the fixture to MemoryTriggerEventStore (mandatory, gated by a zero-ref grep). 3. ## Risks block added to plan.md (R1 D2 break, R2 name collision, R3 KV-migration semantic drift + FAIL stop condition, R4 arch:check denominator, R5 lock churn). 4. arch:check denominator — plan.md Gates now reflect that the task enumerates the 3 destination -core packages (deno.json amended in e999a9ea); all 13 roots FAIL=0. Plan + research only — no deno.lock, no source, no packages/ or plugins/ file touched. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): record e999a9ea (S5a-2) + e0d85440 (PLAN-EVAL cycle-1 fixes) in commits.md Append-only commit-log bookkeeping for the two #182 PLAN-EVAL cycle-1 commits: the arch:check -core extension (fix #4) and the plan.md/research.md fixes (#1 D2 doc-fence, #2 KvTriggerEventStore deconflict, #3 ## Risks block). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): #182 record PLAN-EVAL cycle-2 dispatch + applied-fix summary Appends a Cycle-2 dispatch section to the adapter-relocation plan-eval.md: the four cycle-1 required fixes (D2 doc-fence e0d85440, S-c KvTriggerEventStore deconflict e0d85440, ## Risks block e0d85440, arch:check denominator e999a9ea) and the OpenHands minimax-M3 re-dispatch (PR #172 comment 4839015840). Plan-Gate hard stop remains: no S-b/S-c/S-d slice before cycle-2 PASS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): #182 record PLAN-EVAL cycle-2 verdict PASS — gate cleared Cycle-2 OpenHands minimax-M3 returned PASS (PR #172 run 28413720834): all 4 cycle-1 FAIL_PLAN findings RESOLVED; 8 Plan-Gate boxes + 4 decisions PASS. One non-blocking S-c.5 advisory carried to IMPL (rename target MemoryTriggerEventStore also taken in testing/ barrel — implementer picks a distinct name). S-b/S-c/S-d implementation is unblocked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(sagas): relocate runtime stores to core Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(triggers): relocate runtime stores to core Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(workers): relocate idempotency store to core Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): record adapter relocation slices Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * fix(harness): unblock auth arch fitness gate Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(openhands): apply agent changes * chore(openhands): record run trace 28416306379-1 * fix(plugin): restore scaffold cli bridge Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * fix(cli): reconcile plugin install list contract Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * docs(harness): runtime-launch-contract research + plan (PLAN-EVAL input) Final #173 chapter: thin-dep plugin runtime-launch contract closing PLUGIN-RUNTIME-DEPENDENCY-ENTRYPOINT-EXPORTS. Hybrid contract (services by package-spec ./services; background via install-generated userland glue importing new public ./runtime export). Grounded slices 0-6. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(openhands): record run trace 28419815466-1 * docs(harness): fold PLAN-EVAL PASS refinements into runtime-launch plan PLAN-EVAL PASS (OpenHands minimax-M3, run 28419815466). Folded 4 non-blocking clarifications: Slice0 sagas option-a is a deno.json re-export; Slice2 standardize via additive shim not rename; Slice4 glue folder = resources/glue/; R5 WithEnvironment env is process-scope and survives jsr:-launch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Add sagas runtime launch export Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Expose workers runtime launch API Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Expose triggers runtime launch shim Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Expose streams service launch export Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Emit plugin runtime launch glue Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Launch plugins through runtime contract Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Honor plugin npm catalog dependencies Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Resolve plugin launch specifiers in generated workspaces Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Stabilize runtime launch generated workspaces Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Resolve plugin service bootstrap through import maps Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Keep workers health alive without streams Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Defer plugin runtime dependencies until after listen Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Return empty sagas read model before startup Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Start triggers API before runtime hydration Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Retry transient Prisma database readiness failures Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Resolve trigger webhook runtime paths * Clean trigger webhook path regression Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Align trigger starter webhook identity * Expose trigger registry to package-launched services * Launch local plugin services from source checkouts Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * Stabilize runtime launch E2E gate * Cover local plugin service appsettings launch Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * feat(cli): follow .netscript-source-root marker for local plugin source discovery Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * fix(triggers): expose registry to package-launched service Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(harness): finalize scaffold runtime evidence Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * test(cli): derive trigger service fixture specifier Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * fix(cli): keep official plugin services package-launched Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * fix(sagas): honor runtime kv path in supervisor tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * chore(harness): record check-test finalization Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct * style(plugins): deno fmt convergence contract + router drift Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: OpenHands Bot <openhands@all-hands.dev>
rickylabs
added a commit
that referenced
this pull request
Jul 3, 2026
…py-as-md (#321) * docs(tooling): AI affordances — per-page Markdown twins + tiered llms.txt + copy-as-md link Adds a Lume build plugin (_plugins/ai-tooling.ts) that emits, at build time: - a clean Markdown twin per page (131 pages) served at each page's index.md - tiered llms.txt (index) + llms-full.txt (full corpus) at the site root - a CSP-safe 'View as Markdown' link in the base layout (no client JS) The unanimous #1 SOTA recommendation for agent/LLM-friendly docs. Docs-only (build config + layout + one plugin); no framework source. Refs #232 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * chore(openhands): record run trace 28632145494-1 --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: OpenHands Bot <openhands@all-hands.dev>
Open
22 tasks
rickylabs
added a commit
that referenced
this pull request
Jul 3, 2026
…e corrections PLAN-EVAL #1 = FAIL_PLAN (4 blocking). Fixes: - add Commit Slices CS-1..CS-5 (ordered, gate+files each) - resolve F-5 export rename (L-7) across all four config barrels - add L-8: explicit z.ZodType<...> on new exports (F-6 slow-type) - resolve stub scope to base+windows only (L-6) - fold in merge-granularity test + comment-prose non-blocking notes Also record impl/eval lane corrections: Opus 4.8 sub-agents implement; eval = separate Opus session or Codex GPT-5.5 xhigh. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN
rickylabs
added a commit
that referenced
this pull request
Jul 3, 2026
* docs(deploy-s1): harness run docs (research + plan) for deploy.targets.* contract Plan phase for [Deploy-S1] #337. ARCHETYPE-1 small-contract; clean-break deploy.windows.* -> deploy.targets.* (D5). No code slice before PLAN-EVAL PASS. Refs #327 Refs #337 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * docs(deploy-s1): revise plan for PLAN-EVAL FAIL findings + record lane corrections PLAN-EVAL #1 = FAIL_PLAN (4 blocking). Fixes: - add Commit Slices CS-1..CS-5 (ordered, gate+files each) - resolve F-5 export rename (L-7) across all four config barrels - add L-8: explicit z.ZodType<...> on new exports (F-6 slow-type) - resolve stub scope to base+windows only (L-6) - fold in merge-granularity test + comment-prose non-blocking notes Also record impl/eval lane corrections: Opus 4.8 sub-agents implement; eval = separate Opus session or Codex GPT-5.5 xhigh. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * feat(config): split deploy schema into deploy.targets.* keyed map Clean break from `deploy.windows.*` to `deploy.targets.windows`. Introduces a shared `DeployTargetBaseSchema`/`DeployTargetBase` (mode, denoPath, compileTarget, concurrency, timeouts, bundle opts, workspace, v8HeapMb, generateEnvFile, logging, health, docker) and a `WindowsDeployTargetSchema`/ `WindowsDeployTarget` that extends it with the Servy fields (servyCliPath, installBase, servicePrefix). `DeployConfigSchema` now exposes `targets: { windows? }` instead of `windows`. Re-pin `denoBaseImage` `denoland/deno:2.5` -> `denoland/deno:2`. Both new Zod exports carry explicit `z.ZodType<...>` annotations (JSR slow-type avoidance). Four-barrel rename: `WindowsDeployConfig*` -> `WindowsDeployTarget*`, add `DeployTargetBase*`. CS-1 and CS-2 land together: the schema imports the derived types and the rename ripples to every barrel, so they are one type-safe unit. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * refactor(cli): re-key deploy resolver to deploy.targets.windows `resolveWindowsDeploy` reads `userDeploy?.targets?.windows` instead of `userDeploy?.windows`, matching the new `deploy.targets.*` config contract. Re-pin the resolver `denoBaseImage` fallback `denoland/deno:2.5` -> `denoland/deno:2` (consistency with the schema default). Comment-prose accuracy fixes: `deploy.windows` -> `deploy.targets.windows` across the deploy background merger, Windows constants, compile-config, and the resolved-config type doc. `ResolvedWindowsDeployConfig` stays windows-shaped this slice. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * test(config): cover deploy.targets contract + merge granularity Adds schema tests: `deploy.targets.windows` is accepted, the legacy `deploy.windows` shape resolves to no target (clean break), and unknown target keys are dropped from the keyed map. Adds a merge test asserting a deploy fragment replaces the whole `targets` map (one-level spread granularity) without mutating the base. Adds a one-line `deploy.windows` -> `deploy.targets.windows` migration note to the deploy how-to (full rewrite is #344). Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * chore(harness): record CS-4/CS-5 gate evidence for deploy-s1 CS-5 root quality reconcile: no code changes required (diff already green). Records fmt/lint/check gate evidence and the CS-1..CS-4 commit shas. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * chore(harness): record adversarial-review PASS for deploy-s1 Adversarial review of built #337 artifact = PASS, zero blocking (separate Opus session; Codex GPT-5.5 attempt failed to invoke). Next: IMPL-EVAL merge-readiness gate. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN * chore(harness): record IMPL-EVAL PASS for deploy-s1 (merge-ready) fmt:check/lint/check exit 0; config tests 9/0; scaffold.runtime e2e exit 0 (48 passed/0 failed, no flake). Separate-session eval. Refs #337 #327 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
rickylabs
added a commit
that referenced
this pull request
Jul 11, 2026
…atrix (#679) * docs(web-layer): type the query.md fetch examples + coverage matrix Replace all three raw-fetch queryFn/mutationFn examples in web-layer/query.md with the typed contract chain (createServiceClient -> createServiceQueryUtils -> queryOptions()/mutationOptions() spread into useIslandQuery/useIslandMutation), add a single lib/api-clients.ts module, and keep one raw fetch under an explicit 'endpoints without a NetScript contract' heading. Cross-link sdk.md <-> query.md (the 'hand-rolled fetch wrapper tax'). Add the unpublished web-layer coverage matrix under _plan/. Proposals #1, #16. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * docs(web-layer): connect form.md to a typed service mutation Add a 'Posting the validated payload through a typed mutation' section: the server handler writes through the typed SDK client, and an enhanced island drives the same contract write with useIslandMutation + mutationOptions() — closing the read/write asymmetry with query.md. Proposal #14. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * docs(web-layer): tie interactive/examples/testing to the typed surface interactive.md and examples.md each gain a typed route reference + QueryIsland + contract-derived queryOptions() example; testing.md gains Deno.tests exercising a bound route contract's parseSearch/safeParsePath. Proposal #13. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM * docs(run): web-layer #660a worklog Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VifzAytcxBk5odEMaCXihM --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Initial public producer repo generated by S0 from
rickylabs/netscript-start, plus the carried release-program harness state needed for S1–S6 to execute in this repo.packages/(23) and first-partyplugins/(4).0.0.1-alpha.0..agents/rules/*.mdc.examples/playgroundemitted through the public init path.0c9b8a0): the masterpublic-release-programrun and the canonicalpackage-jsr-alpharun carried in, the S1 (feat-package-quality--supervisor) scaffold prepared,DOCS-STRUCTURE.mdcarried intodocs/architecture/, and the master context-pack refreshed to S0-complete.S0 Gate Evidence
deno task checkPASS.deno publish --dry-run --allow-dirty --allow-slow-typesPASS (slow-type cleanup is S1 scope).passed=9 failed=0.deno task checkanddeno task testPASS.Independent evaluation (post-S0) — verdict: PASS
Reviewed as a separate pass from the S0 generator, against the S0 exit gate in
RELEASE-PROGRAM.md§ 10 and the S0 supervisorplan.md:examples/playground; every publishable member declares@netscript/*@0.0.1-alpha.0(lockstep holds, fixes the old CLI1.0.0drift).Initial commit → genesis eject → agent rules → connect branch— no playground history or.gitleaked.deno publishrewrites tojsr:at publish.tools/fitness/*(27 scripts),.agents/rules/*.mdc(6), skills (5),.llm/harness/(workflow + archetypes + gates + templates + evaluator +debt/arch-debt.md), anddocs/architecture/{STANDARDS,PUBLIC-SURFACE-PATTERNS,doctrine/01..10}.deno.json:isolatedDeclarations: true, lintjsr+no-node-globals,publish: false— part of S2 already pre-applied.One gap found and corrected here: the eject carried
.llm/harness/but not.llm/tmp/run/, so the program authority (master--public-release-program) and the canonical S1 plan (…package-jsr-alpha-release) were absent — both are required for S1–S6 to run in this repo. Carried in0c9b8a0, alongside the prepared S1 scaffold and theDOCS-STRUCTURE.mdcompleteness fix.Corrections applied in this PR (
0c9b8a0).llm/tmp/run/master--public-release-program/(RELEASE-PROGRAM +notes/TOOLCHAIN-2.8.md+ASPIRE-13.4-13.5.md)..llm/tmp/run/copilot-evaluate-every-package-jsr-release--package-jsr-alpha-release/(the canonical S1 plan S1 nests; includesharmonisation/PR84-COMPATIBILITY.md)..llm/tmp/run/feat-package-quality--supervisor/{plan.md,phase-registry.md}— the S1 supervisor scaffold, reconciled to the current 27-unit surface (old runtime packages →*-core;hello-worldremoved).docs/architecture/DOCS-STRUCTURE.md; refreshed the master context-pack to S0-complete.Next
S1 begins on
feat/package-quality(off this freshly mergedmain) — see new-repo draft PR for S1 andnetscript-starttracker PR #97. Slow-type remediation is intentionally deferred to S1.