fix(completion): resolve 4x failures by finding jobs in archive directories and patching proof test fixture

E1-E6: supervised 3-observation proof bar per kind, independent flips,
automatic on proof, single-miss rollback, fleet-wide, grill questions
stay coordinator-gated. Scope accepted verbatim in-record.

.agents/skills/box/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: box
+description: Use the box CLI to check NetVM fleet health and read the latest from each agent.
+---
+
+# Box Fleet CLI
+
+Use `box` (`/usr/local/bin/box`, the NetVM unified orchestrator CLI) for all fleet observation and agent coordination. Prefer read-only lookups first; coordinate via sidechats, never Main Chat dumps.
+
+Nodes (node == agent == profile): `muse`, `pip`, `646`, `opm`, `def`, `dev`.
+
+## Latest From Each Agent (Default Workflow)
+
+1. `box fleet status` — node health, CDP status, active page/thread.
+2. `box lookup unread` — unread counts across agents.
+3. `box lookup threads` — registered threads and sidechats.
+4. Per agent with activity: `box thread list <agent>`, then `box thread view <agent> <thread_id> --limit 10` (use the thread UUID from the list; `main` only for urgent human-visible items).
+5. `box dm log -n 20` (or `--agent <agent>`) — recent inter-agent DMs, work orders, and acks.
+6. `box approvals check` — agents blocked on browser or key approval.
+
+Add `--json` to any command for machine-readable output when parsing results in scripts.
+
+## Common Commands
+
+- `box fleet status` / `box fleet cdp <node>` — health table / CDP endpoint plus SSH forward.
+- `box fleet heal <node>` — diagnose + fix + verify a node (lock, watchdog timer, Warp tunnel, egress, relay).
+- `box watchdog status` / `box watchdog run <node|relay>` — timer states + evidence / trigger an immediate watchdog run.
+- `box thread list [<agent>]` — threads for one agent, or all fleet sidechats when omitted.
+- `box thread view <agent> <thread_id|main> --limit N` — recent messages from one thread.
+- `box dm log -n N [--agent X] [--filter TEXT]` — recent DM activity.
+- `box dm send --agent <self> --to <peer> --target <sidechat> "<msg>"` — peer DM.
+- `box lookup summary|fleet|threads|unread|approvals` — seamless one-shot lookups.
+- `box job list` / `box job log` — scheduled jobs and execution events.
+- `box harvest status` / `box followup list` — harvest watermarks / pending nudges.
+- `box muse-choices on|off|status|logs|reconcile|resolve` — Muse TUI auto-answer daemon switch, state, per-pane logs, held-prompt resolve (default on; `off` is the box-command opt-out).
+- `box runtime list|send|launch|layout|spread` — Muse CLI tmux runtimes: live state + approval posture, send-keys input, auto-approved launches, pane-geometry layout + spread for squeezed panes.
+- `box tmux tally` / `box tmux auto [status|on|off|watch|once|logs|match]` — multi-socket Tmux worker tally, regex auto-approver daemon & guardrails.
+- `box onboard connects` / `box onboard-tui` — fleet & client onboarding inventory, CDP ports, OTP salvage & 4-surface TUI.
+- `box invite status|code <node>|redeem <node> <CODE>` / `box usage [--node N]` — invite codes and usage limits.
+- `box kpi status|report <node>|routes|spawn-worker|auto-spawn` — fleet KPI tracking, spend/limit metrics, route health, runtime preservation advisories, and background worker auto-spawning.
+- `box chromebox permissions <node> list|get <t>|set <t> <v>|describe <tab>` — settings-menu toggles (readback-verified sets).
+
+## Rules
+
+- Sidechat-first per `CHAT_POLICY.md`: `646 tasks`, `heartbeat` (opm), `646-pip-coord`, `646-opm-coord`. Never route routine checks or coordination through `main`.
+- Never paste multi-KB logs or dumps into chat; write payloads under `logs/` and send a short path pointer instead.
+- Avoid blocking commands in automated runs: `box fleet watch`, `box dm tail`, `box approvals watch`, `box dm chat` (interactive REPL).
+- `box` probes CDP per node and can take several seconds; use generous timeouts and `--json` for scripted use.
+- Preserve runtime and quota limits: prefer spawning subagents (`jobs/`, `subagent_tracker`) or background workers (`box kpi spawn-worker`) over long conversational prose to avoid `VANITY_IDLE` flags.
+

.gitignore

@@ -6,6 +6,7 @@ logs/
 pipelines.json
 followups.json
 siphon-watermarks.json
+identity-state.json
 review/
 
 __pycache__/
@@ -25,3 +26,5 @@ ssl/
 job-scheduler-state.json
 var/
 swarms.json
+subagent-sessions.json
+conversation-nudge-tracker.json

NODES.md

@@ -14,3 +14,16 @@ Unified naming: node == agent == profile == API account.
 | opm | warp-opm | 104.28.195.181 | 9440 | active | opm (artglobal.cc@gmail.com, email_otp, Nico Parada) |
 | def | warp-def | 104.28.195.181 | 9450 | active | def (defnotabotnet@gmail.com, email_otp, IG paradahub) |
 | dev | warp-dev | 104.28.195.181 | 9455 | active | dev (paradaproduced@gmail.com, email_otp, IG veryraremeta) |
+
+## Session naming (supervision)
+
+Remote nodes issue jobs to this box; execution lives on the shared
+stable tmux server, separated by session name (not by socket):
+
+`<node>--<role>--<id>` — e.g. `pip--worker--01`, `muse--repair--09`.
+
+Roles: `worker` (persistent swarm/daemon), `repair` (fix sessions),
+`watch` (auto-approver tails), `runtime` (interactive CLI). Ad-hoc
+sessions carry no node and show `-` in `box runtime list`. Session
+creators owned by existing flows keep their names until owners rename;
+new sessions should follow the convention from birth.

README.md

@@ -140,19 +140,23 @@ veth IPs aren't routable off the host and Warp forwards no inbound traffic.
 - `bin/accounts-health.py` — per-account CDP session probe (runs inside the netns).
 - `bin/accounts-health.sh` — aggregates account vitality from ACCOUNTS.md,
   signs + POSTs to the board health ingest (systemd timer, every 15 min).
-- `bin/muse -a <account> [args]` — interactive terminal entrypoint for muse-cli; enforces account selection, auto-refreshes CDP cookies, and provides interactive email/OTP prompt fallback.
+- `bin/muse` (or `box muse`) — native terminal entrypoint for muse-cli; supports global lookups (`muse status`, `muse threads`, `muse unread`, `muse lookup`, `muse passkey`, `muse tmux`), per-account REPL chats (`muse <account> chat`), and automated CDP cookie extraction.
+- `bin/super-cli.py` (`box` or `super`) — unified orchestrator CLI for fleet health (`box fleet`), seamless lookups (`box lookup`), thread inspections (`box thread list/view`), background tmux (`box tmux`), and passkey reference (`box passkey`).
 - `bin/muse-cli-node <node> [args]` — runs muse-cli inside node's netns with dedicated Cloudflare WARP egress & auto-refreshing cookies.
 - `bin/refresh-node-cookies.py <node>` — extracts fresh cookies from running Chromium CDP in netns into `~/.config/muse-cli/<node>/cookies.txt`.
 - `bin/muse_hybrid.py` — programmatic hybrid bridge combining fast gateway calls with CDP fallbacks.
-- `bin/muse-tmux.py` — shared tmux socket manager (`/tmp/tmux-muse.sock`) for agent background execution, pipe-pane logging, and 2h session pruning.
+- `bin/muse-tmux.py` (`box tmux` / `muse tmux`) — shared tmux socket manager (`/tmp/tmux-muse.sock`) for agent background execution, pipe-pane logging, hybrid netns/container execution, and session pruning.
 - `bin/agent_md.py` — CLI & library for auditing, reading, writing, and synchronizing agent `.md` drive files (`SOUL.md`, `PROACTIVE_PREFERENCES.md`, `HEARTBEAT.md`, etc.) across containers via Hatch WebSocket RPC.
 - `bin/agent-drive-watchdog.py` — background drive watchdog and auto-healing daemon (every 10m via `agent-drive-watchdog.timer`).
 - `bin/swarm_worker/` & `bin/swarm-worker-supervise.sh` — supervised autonomous swarm worker daemon executing queued tasks in a hard sandbox.
 - `bin/fleet-alert-relay.sh` — idempotent alert relay with 3-gate deduplication (watermark + 10m TTL hash + receipt verification) posting critical conditions to `#lobby`.
 - `shared/operators/` — canonical operator drive markdown templates ensuring agents maintain autonomous loops, active supervision, and self-healing reflexes.
 - docs/OPERATOR-DRIVE-RUNBOOK.md — operator runbook for auditing and modifying agent `.md` files via Hatch WebSocket RPC and SSH reverse tunnels.
+- docs/BOX-WEB-SURFACE-GUIDE.md — Box web surface (`box.muse-dev.online`), passkey reality (single .txt file on VM), and agent approval flow.
 - docs/HYBRID-GATEWAY-ADAPTATION.md — architectural guide on the muse-cli fast gateway adaptation and per-node egress isolation.
-- docs/AGENT-TOOLING.md — guide to agent delegation, shared tmux background tooling, Work Orders (`[WO:...]`), and prompt envelope execution.
+- docs/AGENT-TOOLING.md — guide to agent delegation, seamless lookups, shared tmux background tooling, Work Orders (`[WO:...]`), and prompt envelope execution.
+- `bin/docs-lookup.py` (`box docs` / `super docs` / `docs-lookup`) — internal documentation, sentence structure grammar, regex passing engine, and assistive surfaces for `box.muse-dev.online`.
+- `docs_internal/` — dual `.md` and structured `.json` lookup database for autonomous agents, protocol definitions, regex fixtures, and surface selectors.
 
 
 ## Verification checklist

bin/agent-health.sh

@@ -115,6 +115,57 @@ restart_browser() {
     echo "$(date -Iseconds) $agent: browser restarted" >> "$LOG"
 }
 
+# 2026-10-06: restart circuit breaker. A restart that leaves the agent
+# still failing is FUTILE (observed 2026-10-06: def's API check failed
+# 155x while its CDP port was up; 57 kill+restart cycles murdered a
+# healthy browser for an account-layer failure restarts cannot fix).
+# After FUTILE_THRESHOLD consecutive futile restarts, open the circuit:
+# stop killing/restarting and alert, until CIRCUIT_COOLDOWN seconds pass
+# (one half-open probe restart) or any check succeeds. Manual reset:
+#   rm /tmp/agent-health-state/circuit-<agent> /tmp/agent-health-state/futile-<agent>
+FUTILE_THRESHOLD=3
+CIRCUIT_COOLDOWN=1800
+
+# circuit_allows <agent>: return 0 if a restart may proceed now.
+circuit_allows() {
+    local agent=$1 now opened retry_in
+    local cf="$STATE_DIR/circuit-$agent"
+    [ -f "$cf" ] || return 0
+    opened=$(cat "$cf" 2>/dev/null || echo 0)
+    now=$(date +%s)
+    if [ $(( now - opened )) -ge $CIRCUIT_COOLDOWN ]; then
+        echo "$(date -Iseconds) $agent: circuit half-open after ${CIRCUIT_COOLDOWN}s cooldown, one probe restart" >> "$LOG"
+        return 0
+    fi
+    retry_in=$(( (opened + CIRCUIT_COOLDOWN - now + 59) / 60 ))
+    echo "$(date -Iseconds) $agent: CIRCUIT OPEN - skipping kill/restart (restarts futile, probe retry in ~${retry_in}m; manual reset: rm $cf)" >> "$LOG"
+    return 1
+}
+
+# circuit_note_restart <agent> <ok|fail>: record a restart outcome.
+circuit_note_restart() {
+    local agent=$1 outcome=$2 count=0
+    local ff="$STATE_DIR/futile-$agent" cf="$STATE_DIR/circuit-$agent"
+    if [ "$outcome" = "ok" ]; then
+        rm -f "$ff" "$cf" 2>/dev/null
+        return 0
+    fi
+    [ -f "$ff" ] && count=$(cat "$ff" 2>/dev/null || echo 0)
+    count=$(( count + 1 ))
+    echo "$count" > "$ff"
+    if [ "$count" -ge "$FUTILE_THRESHOLD" ]; then
+        date +%s > "$cf"
+        local msg="$agent: ALERT - $count consecutive futile restarts, circuit OPEN for ${CIRCUIT_COOLDOWN}s (no more kills until probe; manual reset: rm $cf $ff)"
+        echo "$(date -Iseconds) $msg" >> "$LOG"
+        echo "agent-health ALERT: $msg"
+    fi
+}
+
+# Allow sourcing for tests without running checks.
+if [ "${AGENT_HEALTH_LIB_ONLY:-}" = "1" ]; then
+    return 0 2>/dev/null || exit 0
+fi
+
 # Main
 echo "=== Health check $(date -Iseconds) ===" >> "$LOG"
 
@@ -126,8 +177,9 @@ check_one() {
     local rc=$?
 
     if [ $rc -eq 0 ]; then
-        # Healthy: reset the consecutive-API-failure counter.
+        # Healthy: reset the consecutive-API-failure counter and close
-        rm -f "$STATE_DIR/failcount-$agent" 2>/dev/null
+        # any open restart circuit.
+        rm -f "$STATE_DIR/failcount-$agent" "$STATE_DIR/futile-$agent" "$STATE_DIR/circuit-$agent" 2>/dev/null
         return 0
     fi
 
@@ -158,6 +210,11 @@ check_one() {
         return 0
     fi
 
+    # Circuit breaker: repeated futile restarts stop here until cooldown.
+    if ! circuit_allows "$agent"; then
+        return 0
+    fi
+
     restart_browser "$agent" "$cdp_port"
     # 2026-10-04: post-restart re-check grace extended to ~60s total
     # (restart_browser sleeps 15s internally + 45s here), matching
@@ -166,9 +223,10 @@ check_one() {
     sleep 45
     if ! check_agent "$agent" "$agent" "$cdp_port"; then
         echo "$(date -Iseconds) $agent: CRITICAL - still down after restart" >> "$LOG"
-        # TODO: Alert operator (e.g., via board post or email)
+        circuit_note_restart "$agent" fail
     else
         echo "$(date -Iseconds) $agent: RECOVERED after restart" >> "$LOG"
+        circuit_note_restart "$agent" ok
     fi
 }
 

bin/agent-manager.py

@@ -0,0 +1,905 @@
+#!/usr/bin/env python3
+"""agent-manager.py — Agent runs across tailnet devices (stdlib curses).
+
+Read-only dashboard that aggregates agent harness runs (any CLI / bin
+runtime: muse, agy, and whatever else matches the open taxonomy) over
+SSH to every reachable tailnet device, then sorts by agent type.
+
+Surfaces 3 read-only views (no actions in v1):
+  [1] RUNS    — every run, sorted by agent type, then device.
+  [2] TYPES   — counts per agent type with per-device breakdown.
+  [3] DEVICES — per-device reachability, run counts, and notes.
+
+Structure mirrors bin/box-fleet-tui.py: all data-gathering lives in
+pure, testable functions taking injected runners (see gather_*); the
+curses UI is a thin renderer over those functions. The backend differs:
+instead of local repo files, each refresh fans out over tailnet SSH
+(one call per device: tmux panes + process table, joined locally).
+Unreachable devices yield "n/a" rows — never a crash.
+
+Usage:
+  python3 bin/agent-manager.py [--once [--json]]   # non-interactive dump
+"""
+
+from __future__ import annotations
+
+import concurrent.futures
+import curses
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+NA = "n/a"
+
+RunFn = Callable[..., Tuple[int, str]]
+
+# Per-device SSH budget; whole-fleet refresh runs devices in parallel.
+DEVICE_TIMEOUT_S = 15
+SSH_OPTS = ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5"]
+
+# Only these OS classes get an SSH probe (from `tailscale status`).
+SSH_OS = ("linux", "macos")
+
+# =====================================================================
+# Agent-type taxonomy (open: unknown bin runtimes still show up)
+# =====================================================================
+#
+# Classification keys off the argv[0] basename so a wrapper path never
+# matters (/home/super/.local/bin/agy.bin -> agy). Scripts (*.py,
+# *.sh) are never harness runtimes. Anything shaped like a bin runtime
+# (*.bin, *-bin-*) that is not otherwise known shows under its own
+# "other:<basename>" type instead of being dropped.
+
+HARNESS_EXACT = {
+    "agy": "agy",
+    "agy.bin": "agy",
+    "muse-code": "muse",
+    "Muse": "muse",
+    "claude": "claude",
+    "codex": "codex",
+    "gemini": "gemini",
+    "aider": "aider",
+    "opencode": "opencode",
+    "crush": "crush",
+    "amp": "amp",
+}
+
+HARNESS_PREFIX = (
+    ("muse-bin", "muse"),
+)
+
+# Bin-shaped names that are infrastructure, not agent harnesses.
+HARNESS_DENY = frozenset({"tmux.bin", "tmux", "ssh.bin"})
+
+SCRIPT_SUFFIXES = (".py", ".pyc", ".sh", ".pl", ".rb", ".js")
+
+
+def classify_harness(argv0: str) -> Optional[Tuple[str, str]]:
+    """Map an argv[0] to (agent_type, bin_name); None when not a harness.
+
+    Known harnesses collapse to a canonical type ("agy"); unknown bin
+    runtimes keep their own "other:<basename>" type so new harnesses
+    appear without a code change.
+    """
+    base = os.path.basename((argv0 or "").strip().strip("'\""))
+    if not base:
+        return None
+    low = base.lower()
+    if low in HARNESS_DENY:
+        return None
+    if low.endswith(SCRIPT_SUFFIXES):
+        return None
+    if low in HARNESS_EXACT:
+        return HARNESS_EXACT[low], base
+    for prefix, typ in HARNESS_PREFIX:
+        if low.startswith(prefix):
+            return typ, base
+    if low.endswith(".bin") or "-bin-" in low or low.startswith("bin-"):
+        return "other:%s" % base, base
+    return None
+
+
+def type_sort_key(agent_type: str) -> Tuple[int, str]:
+    """Known types first (alpha), then other:* (alpha)."""
+    if agent_type.startswith("other:"):
+        return 1, agent_type
+    return 0, agent_type
+
+
+# =====================================================================
+# Default IO primitives (injectable seams for tests)
+# =====================================================================
+
+def _run(cmd: List[str], timeout: int = 15) -> Tuple[int, str]:
+    """Run cmd, capture output. Returns (returncode, combined_output)."""
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True,
+                           timeout=timeout)
+        return r.returncode, ((r.stdout or "") + (r.stderr or "")).strip()
+    except subprocess.TimeoutExpired:
+        return 124, "timed out after %ds: %s" % (timeout, " ".join(cmd))
+    except OSError as e:
+        return 127, str(e)
+
+
+def _run_ssh(device: str, remote_cmd: str,
+             timeout: int = DEVICE_TIMEOUT_S,
+             run: Optional[RunFn] = None) -> Tuple[int, str]:
+    """Run one remote command over tailnet SSH. Fails closed, never raises."""
+    run = run or _run
+    try:
+        return run(["ssh"] + SSH_OPTS + [device, remote_cmd],
+                   timeout=timeout)
+    except Exception as e:
+        return 127, str(e)
+
+
+# =====================================================================
+# Pure parsers
+# =====================================================================
+
+def parse_tailscale_status(out: str) -> List[Dict[str, Any]]:
+    """Parse `tailscale status` into [{name, ip, os, online, detail}].
+
+    Unparseable lines are skipped; a warning preamble is ignored.
+    """
+    devices: List[Dict[str, Any]] = []
+    for line in (out or "").splitlines():
+        line = line.rstrip()
+        if not line or line.startswith("Warning:"):
+            continue
+        parts = line.split()
+        if len(parts) < 4:
+            continue
+        ip, name, _user, osname = parts[0], parts[1], parts[2], parts[3]
+        if not re.match(r"^\d+\.\d+\.\d+\.\d+$", ip):
+            continue
+        detail = " ".join(parts[4:]) if len(parts) > 4 else ""
+        online = not detail.startswith("offline")
+        devices.append({"name": name, "ip": ip, "os": osname.lower(),
+                        "online": online, "detail": detail or NA})
+    return devices
+
+
+PANE_PREFIX = "PANE|"
+PS_MARKER = "__PS__"
+
+
+def parse_panes(out: str) -> List[Dict[str, Any]]:
+    """Parse tmux pane lines (PANE|sock|id|pid|session|cmd|title).
+
+    Pane ids repeat across servers, so (socket, id) is the identity.
+    Session groups repeat a pane under several sessions; dedupe by
+    (socket, id), joining session names. The legacy 4-field shape
+    (no socket) still parses with sock="".
+    """
+    seen: Dict[Tuple[str, str], Dict[str, Any]] = {}
+    order: List[Tuple[str, str]] = []
+    for line in (out or "").splitlines():
+        if not line.startswith(PANE_PREFIX):
+            continue
+        fields = line[len(PANE_PREFIX):].split("|")
+        if len(fields) >= 6:
+            sock, pane_id, pid_s, session, cmd = (
+                fields[0].strip(), fields[1].strip(), fields[2].strip(),
+                fields[3].strip(), fields[4].strip())
+            title = "|".join(fields[5:]).strip()
+        elif len(fields) >= 4:
+            sock, pane_id, pid_s, session, cmd = (
+                "", fields[0].strip(), fields[1].strip(),
+                fields[2].strip(), fields[3].strip())
+            title = "|".join(fields[4:]).strip()
+        else:
+            continue
+        try:
+            pid = int(pid_s)
+        except ValueError:
+            continue
+        session = session or NA
+        key = (sock, pane_id)
+        if key in seen:
+            prev = seen[key]["session"]
+            if session not in prev.split(","):
+                seen[key]["session"] = prev + "," + session
+            continue
+        seen[key] = {"sock": sock, "pane": pane_id, "pid": pid,
+                     "session": session, "cmd": cmd, "title": title}
+        order.append(key)
+    return [seen[k] for k in order]
+
+
+def display_session(run: Dict[str, Any]) -> str:
+    """Session label; socket-qualified unless it is the default server."""
+    session = str(run.get("session", NA))
+    sock = run.get("sock") or ""
+    if session == NA or sock in ("", "default"):
+        return session
+    return "%s:%s" % (sock, session)
+
+
+def parse_ps(out: str) -> Dict[int, Dict[str, Any]]:
+    """Parse `ps -eo pid,ppid,etime,command` into {pid: rec}."""
+    procs: Dict[int, Dict[str, Any]] = {}
+    for line in (out or "").splitlines():
+        parts = line.split(None, 3)
+        if len(parts) < 4:
+            continue
+        try:
+            pid, ppid = int(parts[0]), int(parts[1])
+        except ValueError:
+            continue  # header row
+        procs[pid] = {"pid": pid, "ppid": ppid, "etime": parts[2],
+                      "args": parts[3]}
+    return procs
+
+
+def split_scan(out: str) -> Tuple[str, str]:
+    """Split a device scan into (pane_text, ps_text) at the marker."""
+    if PS_MARKER in out:
+        pane_text, _, ps_text = out.partition(PS_MARKER)
+        return pane_text, ps_text
+    return out, ""
+
+
+def _descendants(procs: Dict[int, Dict[str, Any]],
+                 root: int) -> List[int]:
+    """Pids under root (breadth-first via ppid links)."""
+    kids: Dict[int, List[int]] = {}
+    for pid, rec in procs.items():
+        kids.setdefault(rec["ppid"], []).append(pid)
+    out: List[int] = []
+    queue = list(kids.get(root, []))
+    seen = {root}
+    while queue:
+        pid = queue.pop(0)
+        if pid in seen:
+            continue
+        seen.add(pid)
+        out.append(pid)
+        queue.extend(kids.get(pid, []))
+    return out
+
+
+def join_runs(panes: List[Dict[str, Any]],
+              procs: Dict[int, Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Join tmux panes with harness processes into run records.
+
+    A pane is a run when its current command classifies as a harness
+    or a harness binary runs among its descendants. Harness processes
+    under no pane surface as bare runs (session/pane n/a). Returns
+    records sorted by (agent_type, session, pane).
+    """
+    runs: List[Dict[str, Any]] = []
+    claimed: set = set()
+    pane_roots = {p["pid"] for p in panes}
+
+    for pane in panes:
+        argv = (pane.get("cmd") or "").strip()
+        pane_hit = classify_harness(argv.split()[0] if argv else "")
+        # Always resolve the live harness descendant: the pane's root
+        # is usually a shell, so its pid/etime/bin would mislead.
+        # The pane-command match is only a fallback (stale command).
+        hit = None
+        hpid: Optional[int] = None
+        for pid in _descendants(procs, pane["pid"]):
+            rec = procs.get(pid)
+            if not rec:
+                continue
+            first = rec["args"].split()[0] if rec["args"] else ""
+            hit = classify_harness(first)
+            if hit is not None:
+                hpid = pid
+                break
+        if hit is None:
+            if pane_hit is None:
+                continue
+            hit, hpid = pane_hit, pane["pid"]
+        agent_type, _bin = hit
+        claimed.add(hpid)
+        prec = procs.get(hpid, {})
+        if prec.get("args"):
+            binn = os.path.basename(prec["args"].split()[0])
+        elif argv:
+            binn = argv.split()[0]
+        else:
+            binn = NA
+        runs.append({
+            "type": agent_type,
+            "bin": binn,
+            "sock": pane.get("sock", ""),
+            "session": pane.get("session", NA),
+            "pane": pane.get("pane", NA),
+            "pid": hpid,
+            "etime": prec.get("etime", NA),
+            "title": (pane.get("title") or "")[:48],
+        })
+
+    # Bare harness processes (no tmux pane above them).
+    for pid, rec in procs.items():
+        if pid in claimed:
+            continue
+        first = rec["args"].split()[0] if rec["args"] else ""
+        hit = classify_harness(first)
+        if hit is None:
+            continue
+        # Skip when some pane root is an ancestor (already covered).
+        anc, under_pane = rec["ppid"], False
+        hops = 0
+        while anc in procs and hops < 64:
+            if anc in pane_roots:
+                under_pane = True
+                break
+            anc = procs[anc]["ppid"]
+            hops += 1
+        if under_pane:
+            continue
+        claimed.add(pid)
+        runs.append({
+            "type": hit[0],
+            "bin": os.path.basename(first),
+            "sock": "",
+            "session": NA,
+            "pane": NA,
+            "pid": pid,
+            "etime": rec.get("etime", NA),
+            "title": "",
+        })
+
+    runs.sort(key=lambda r: (type_sort_key(r["type"]),
+                             str(r["session"]), str(r["pane"])))
+    return runs
+
+
+# =====================================================================
+# Surfaces: devices + runs
+# =====================================================================
+
+PANE_FORMAT = ("PANE|%s|#{pane_id}|#{pane_pid}|#{session_name}|"
+               "#{pane_current_command}|#{pane_title}")
+
+REMOTE_SCAN_CMD = (
+    "for d in \"${TMUX_TMPDIR:-/tmp}/tmux-$(id -u)\" "
+    "\"${TMPDIR:-/tmp}/tmux-$(id -u)\" /tmp/tmux-$(id -u); do "
+    "for s in \"$d\"/*; do [ -S \"$s\" ] || continue; "
+    "n=$(basename \"$s\"); "
+    "tmux -S \"$s\" list-panes -a -F \"PANE|$n|#{pane_id}|#{pane_pid}|"
+    "#{session_name}|#{pane_current_command}|#{pane_title}\" "
+    "2>/dev/null; done; done; "
+    "echo '%s'; ps -eo pid,ppid,etime,command 2>/dev/null" % PS_MARKER
+)
+
+
+def local_tmux_sockets() -> List[str]:
+    """Absolute tmux socket paths on this machine (may be empty)."""
+    uid = os.getuid() if hasattr(os, "getuid") else 0
+    cands = []
+    for base in (os.environ.get("TMUX_TMPDIR") or "/tmp",
+                 os.environ.get("TMPDIR") or "/tmp", "/tmp"):
+        cands.append(os.path.join(base, "tmux-%d" % uid))
+    found: List[str] = []
+    seen_dirs = set()
+    for d in cands:
+        if d in seen_dirs:
+            continue
+        seen_dirs.add(d)
+        try:
+            names = sorted(os.listdir(d))
+        except Exception:
+            continue
+        for n in names:
+            p = os.path.join(d, n)
+            try:
+                import stat
+                if stat.S_ISSOCK(os.stat(p).st_mode):
+                    found.append(p)
+            except Exception:
+                continue
+    # Same server via two spellings: keep first per basename.
+    dedup: List[str] = []
+    seen_base = set()
+    for p in found:
+        b = os.path.basename(p)
+        if b not in seen_base:
+            seen_base.add(b)
+            dedup.append(p)
+    return dedup
+
+
+def local_device_name() -> str:
+    """Short hostname of this machine (never raises)."""
+    try:
+        import socket
+        return socket.gethostname().split(".")[0]
+    except Exception:
+        return "localhost"
+
+
+def gather_devices(run: Optional[RunFn] = None,
+                   local_name: Optional[str] = None) -> Dict[str, Any]:
+    """Tailnet devices from `tailscale status` + the local machine.
+
+    Returns {"devices": [{name, ip, os, online, local, ssh, detail}],
+    "note": str}. Devices are stable-sorted: local first, then by name.
+    "ssh" marks whether v1 probes the device (online + ssh-capable OS).
+    """
+    run = run or _run
+    local_name = local_name or local_device_name()
+    rc, out = run(["tailscale", "status"], timeout=10)
+    if rc != 0:
+        return {"devices": [{"name": local_name, "ip": NA, "os": NA,
+                             "online": True, "local": True, "ssh": False,
+                             "detail": "local only"}],
+                "note": "tailscale status failed (%s); local only."
+                % (out.strip().splitlines()[-1][:80] if out.strip()
+                   else "rc=%d" % rc)}
+    devices = []
+    for d in parse_tailscale_status(out):
+        local = (d["name"] == local_name)
+        ssh = bool(d["online"] and d["os"] in SSH_OS and not local)
+        devices.append({"name": d["name"], "ip": d["ip"], "os": d["os"],
+                        "online": d["online"], "local": local, "ssh": ssh,
+                        "detail": d["detail"]})
+    if not any(d["local"] for d in devices):
+        devices.append({"name": local_name, "ip": NA, "os": NA,
+                        "online": True, "local": True, "ssh": False,
+                        "detail": "local"})
+    devices.sort(key=lambda d: (not d["local"], d["name"]))
+    return {"devices": devices, "note": ""}
+
+
+def gather_device_runs(device: Dict[str, Any],
+                       run: Optional[RunFn] = None) -> Dict[str, Any]:
+    """One device scan -> {device, ok, runs, note}. Never raises."""
+    run = run or _run
+    name = device.get("name", "?")
+    try:
+        if device.get("local"):
+            pane_chunks = []
+            for sock in local_tmux_sockets():
+                rc1, chunk = run(
+                    ["tmux", "-S", sock, "list-panes", "-a", "-F",
+                     PANE_FORMAT % os.path.basename(sock)],
+                    timeout=DEVICE_TIMEOUT_S)
+                if rc1 == 0 and chunk:
+                    pane_chunks.append(chunk)
+            _rc2, ps_out = run(["ps", "-eo", "pid,ppid,etime,command"],
+                               timeout=DEVICE_TIMEOUT_S)
+            out = ("\n".join(pane_chunks) + "\n" + PS_MARKER + "\n"
+                   + ps_out)
+        else:
+            rc, out = _run_ssh(name, REMOTE_SCAN_CMD, run=run)
+            ssh_err = "" if rc == 0 else out.strip().splitlines()
+            ssh_err = ssh_err[-1][:100] if ssh_err else "rc=%d" % rc
+            if rc != 0:
+                return {"device": name, "ok": False, "runs": [],
+                        "note": "ssh failed: %s" % ssh_err}
+        pane_text, ps_text = split_scan(out)
+        runs = join_runs(parse_panes(pane_text), parse_ps(ps_text))
+        for r in runs:
+            r["device"] = name
+        return {"device": name, "ok": True, "runs": runs, "note": ""}
+    except Exception as e:
+        return {"device": name, "ok": False, "runs": [],
+                "note": "scan failed: %s" % e}
+
+
+def gather_all(run: Optional[RunFn] = None,
+               devices: Optional[List[Dict[str, Any]]] = None,
+               max_workers: int = 8) -> Dict[str, Any]:
+    """One-shot snapshot: devices + runs sorted by agent type.
+
+    Devices scan in parallel (threads); each device is isolated — one
+    failure never blocks the rest. Returns {"devices": [...],
+    "runs": [...] (sorted by type/device), "by_type": {type: {total,
+    devices: {name: n}}}, "unreachable": [names], "note": str}.
+    """
+    run = run or _run
+    dev_info = gather_devices(run=run)
+    if devices is None:
+        devices = [d for d in dev_info["devices"]
+                   if d.get("local") or d.get("ssh")]
+    else:
+        devices = [d for d in devices
+                   if d.get("local") or d.get("ssh")]
+    probed = {d["name"] for d in devices}
+
+    results: List[Dict[str, Any]] = []
+    if devices:
+        with concurrent.futures.ThreadPoolExecutor(
+                max_workers=min(max_workers, len(devices))) as pool:
+            futs = {pool.submit(gather_device_runs, d, run): d["name"]
+                    for d in devices}
+            for fut in concurrent.futures.as_completed(futs):
+                try:
+                    results.append(fut.result())
+                except Exception as e:
+                    results.append({"device": futs[fut], "ok": False,
+                                    "runs": [], "note": "scan error: %s" % e})
+
+    runs: List[Dict[str, Any]] = []
+    unreachable: List[str] = []
+    for res in results:
+        if not res.get("ok"):
+            unreachable.append(res["device"])
+            continue
+        runs.extend(res.get("runs", []))
+    runs.sort(key=lambda r: (type_sort_key(r["type"]), r.get("device", ""),
+                             str(r.get("session", ""))))
+
+    by_type: Dict[str, Dict[str, Any]] = {}
+    for r in runs:
+        bucket = by_type.setdefault(r["type"], {"total": 0, "devices": {}})
+        bucket["total"] += 1
+        dev = r.get("device", "?")
+        bucket["devices"][dev] = bucket["devices"].get(dev, 0) + 1
+
+    skipped = sorted(d["name"] for d in dev_info["devices"]
+                     if d["name"] not in probed)
+    notes = [dev_info["note"]] if dev_info["note"] else []
+    if skipped:
+        notes.append("skipped (offline/mobile/key): %s" % ", ".join(skipped))
+    return {"devices": dev_info["devices"], "runs": runs,
+            "by_type": by_type, "unreachable": sorted(unreachable),
+            "note": "; ".join(notes)}
+
+
+# =====================================================================
+# Curses UI (thin read-only renderer over gather_*)
+# =====================================================================
+
+AUTO_REFRESH_S = 30.0
+
+
+class AgentManagerTUI:
+    """Read-only agent-run console. q quits, r refreshes, ? helps."""
+
+    def __init__(self, stdscr: "curses.window"):
+        self.stdscr = stdscr
+        self.current_tab = 0
+        self.tabs = [
+            "1: RUNS",
+            "2: TYPES",
+            "3: DEVICES",
+        ]
+        try:
+            curses.curs_set(0)
+        except Exception:
+            pass
+        self.stdscr.nodelay(True)
+        self.stdscr.keypad(True)
+        if hasattr(curses, "set_escdelay"):
+            try:
+                curses.set_escdelay(25)
+            except Exception:
+                pass
+        self._init_colors()
+
+        self.scroll = 0
+        self.show_help = False
+        self.status_msg = "Scanning tailnet devices..."
+        self.last_refresh = 0.0
+        self.snapshot: Dict[str, Any] = {}
+        self.refresh()
+
+    # -- setup ------------------------------------------------------
+
+    def _init_colors(self) -> None:
+        try:
+            curses.start_color()
+            curses.use_default_colors()
+            curses.init_pair(1, curses.COLOR_CYAN, -1)
+            curses.init_pair(2, curses.COLOR_YELLOW, -1)
+            curses.init_pair(3, curses.COLOR_GREEN, -1)
+            curses.init_pair(4, curses.COLOR_RED, -1)
+            curses.init_pair(5, curses.COLOR_MAGENTA, -1)
+            curses.init_pair(6, curses.COLOR_BLACK, curses.COLOR_CYAN)
+            curses.init_pair(7, curses.COLOR_BLACK, curses.COLOR_WHITE)
+            curses.init_pair(8, curses.COLOR_BLACK, curses.COLOR_YELLOW)
+        except Exception:
+            pass
+
+    def _attr(self, name: str) -> int:
+        try:
+            mapping = {
+                "normal": curses.color_pair(0),
+                "cyan": curses.color_pair(1) | curses.A_BOLD,
+                "yellow": curses.color_pair(2) | curses.A_BOLD,
+                "green": curses.color_pair(3) | curses.A_BOLD,
+                "red": curses.color_pair(4) | curses.A_BOLD,
+                "magenta": curses.color_pair(5) | curses.A_BOLD,
+                "head_sel": curses.color_pair(6) | curses.A_BOLD,
+                "row_sel": curses.color_pair(7) | curses.A_BOLD,
+                "warn": curses.color_pair(8) | curses.A_BOLD,
+                "dim": curses.A_DIM,
+            }
+            return mapping.get(name, 0)
+        except Exception:
+            return 0
+
+    # -- data -------------------------------------------------------
+
+    def refresh(self) -> None:
+        try:
+            self.snapshot = gather_all()
+            runs = len(self.snapshot.get("runs", []))
+            devs = len([d for d in self.snapshot.get("devices", [])
+                        if d.get("local") or d.get("ssh")])
+            self.status_msg = (
+                "Snapshot %s: %d runs on %d devices "
+                "(auto-refresh %ds; r=refresh)" % (
+                    datetime.now().strftime("%H:%M:%S"), runs, devs,
+                    int(AUTO_REFRESH_S)))
+        except Exception as e:
+            self.snapshot = {}
+            self.status_msg = "Refresh failed (showing n/a): %s" % e
+        self.last_refresh = time.time()
+        self.scroll = 0
+
+    # -- render helpers ---------------------------------------------
+
+    def safe_addstr(self, y: int, x: int, text: str, attr: int = 0) -> None:
+        h, w = self.stdscr.getmaxyx()
+        if 0 <= y < h and 0 <= x < w:
+            try:
+                self.stdscr.addstr(y, x, text[:max(0, w - x - 1)], attr)
+            except Exception:
+                pass
+
+    def _render_header(self, w: int) -> None:
+        self.safe_addstr(0, 0, " " * w, self._attr("head_sel"))
+        title = " AGENT MANAGER (read-only)  [agent-manager.py] "
+        self.safe_addstr(0, 1, title, self._attr("head_sel"))
+        self.safe_addstr(1, 0, " " * w, self._attr("dim"))
+        col = 1
+        for idx, tab_name in enumerate(self.tabs):
+            pill = " [%s] " % tab_name
+            attr = self._attr("head_sel") if idx == self.current_tab \
+                else self._attr("dim")
+            self.safe_addstr(1, col, pill, attr)
+            col += len(pill) + 1
+        self.safe_addstr(2, 0, "-" * w, self._attr("dim"))
+
+    def _render_footer(self, h: int, w: int) -> None:
+        self.safe_addstr(h - 2, 0, "-" * w, self._attr("dim"))
+        hints = " 1-3/Tab: Tabs  j/k: Scroll  r: Refresh  ?: Help  q: Quit"
+        self.safe_addstr(h - 1, 1, self.status_msg[: w - 2],
+                         self._attr("dim"))
+        if len(self.status_msg) + len(hints) + 2 < w:
+            self.safe_addstr(h - 1, w - len(hints) - 1, hints,
+                             self._attr("dim"))
+
+    def _body(self, h: int, w: int, title: str,
+              lines: List[Tuple[str, str]]) -> None:
+        self.safe_addstr(3, 2, title, self._attr("cyan"))
+        self.safe_addstr(4, 2, "-" * (w - 4), self._attr("dim"))
+        max_rows = h - 8
+        visible = lines[self.scroll:self.scroll + max_rows]
+        for i, (text, attr_name) in enumerate(visible):
+            self.safe_addstr(5 + i, 2, text, self._attr(attr_name))
+        if self.scroll > 0:
+            self.safe_addstr(5, w - 6, "^more", self._attr("dim"))
+        if self.scroll + max_rows < len(lines):
+            self.safe_addstr(h - 3, w - 6, "vmore", self._attr("dim"))
+
+    def _note_lines(self, w: int) -> List[Tuple[str, str]]:
+        note = self.snapshot.get("note", "")
+        unreach = self.snapshot.get("unreachable", [])
+        lines: List[Tuple[str, str]] = []
+        if unreach:
+            lines.append(("", "normal"))
+            lines.append(("unreachable: %s" % ", ".join(unreach),
+                          "red"))
+        if note:
+            lines.append(("", "normal"))
+            lines.append(("note: %s" % note[: w - 10], "yellow"))
+        return lines
+
+    # -- per-tab renderers ------------------------------------------
+
+    def _render_runs(self, h: int, w: int) -> None:
+        runs = self.snapshot.get("runs", [])
+        lines: List[Tuple[str, str]] = [
+            ("%-14s %-12s %-16s %-14s %-6s %-11s %s"
+             % ("TYPE", "DEVICE", "BIN", "SESSION", "PANE", "ELAPSED",
+                "TITLE"), "dim"),
+        ]
+        last_type = None
+        for r in runs:
+            typ = r.get("type", "?")
+            if typ != last_type:
+                lines.append(("", "normal"))
+                last_type = typ
+            attr = "green" if not typ.startswith("other:") else "yellow"
+            lines.append((
+                "%-14s %-12s %-16s %-14s %-6s %-11s %s" % (
+                    typ[:14], r.get("device", "?")[:12],
+                    r.get("bin", NA)[:16], display_session(r)[:14],
+                    str(r.get("pane", NA))[:6],
+                    str(r.get("etime", NA))[:11],
+                    r.get("title", "")[: w - 80]), attr))
+        if not runs:
+            lines.append(("(No agent runs found on probed devices.)",
+                          "dim"))
+        lines.extend(self._note_lines(w))
+        self._body(h, w, "AGENT RUNS SORTED BY TYPE (%d)" % len(runs),
+                   lines)
+
+    def _render_types(self, h: int, w: int) -> None:
+        by_type = self.snapshot.get("by_type", {})
+        lines: List[Tuple[str, str]] = []
+        total = sum(b.get("total", 0) for b in by_type.values())
+        lines.append(("Agent types: %d  |  total runs: %d"
+                      % (len(by_type), total), "cyan"))
+        lines.append(("", "normal"))
+        for typ in sorted(by_type, key=type_sort_key):
+            bucket = by_type[typ]
+            attr = "green" if not typ.startswith("other:") else "yellow"
+            lines.append(("%-16s %d" % (typ, bucket.get("total", 0)),
+                          attr))
+            for dev, n in sorted(bucket.get("devices", {}).items()):
+                lines.append(("  %-14s %d" % (dev, n), "normal"))
+            lines.append(("", "normal"))
+        if not by_type:
+            lines.append(("(No agent types observed.)", "dim"))
+        lines.extend(self._note_lines(w))
+        self._body(h, w, "COUNTS BY AGENT TYPE", lines)
+
+    def _render_devices(self, h: int, w: int) -> None:
+        devices = self.snapshot.get("devices", [])
+        runs = self.snapshot.get("runs", [])
+        counts: Dict[str, int] = {}
+        for r in runs:
+            dev = r.get("device", "?")
+            counts[dev] = counts.get(dev, 0) + 1
+        unreach = set(self.snapshot.get("unreachable", []))
+        lines: List[Tuple[str, str]] = [
+            ("%-24s %-15s %-7s %-7s %-5s %s"
+             % ("DEVICE", "IP", "OS", "PROBED", "RUNS", "DETAIL"), "dim"),
+        ]
+        for d in devices:
+            name = d.get("name", "?")
+            probed = bool(d.get("local") or d.get("ssh"))
+            if name in unreach:
+                attr = "red"
+            elif not probed:
+                attr = "dim"
+            elif counts.get(name):
+                attr = "green"
+            else:
+                attr = "normal"
+            lines.append((
+                "%-24s %-15s %-7s %-7s %-5s %s" % (
+                    name[:24] + (" *" if d.get("local") else ""),
+                    d.get("ip", NA)[:15], str(d.get("os", NA))[:7],
+                    "yes" if probed else "no",
+                    counts.get(name, 0) if probed else NA,
+                    str(d.get("detail", ""))[: w - 66]), attr))
+        lines.append(("", "normal"))
+        lines.append(("* = local (no SSH); unreachable shows n/a, never "
+                      "blocks the rest.", "dim"))
+        lines.extend(self._note_lines(w))
+        self._body(h, w, "TAILNET DEVICES", lines)
+
+    def _render_help(self, h: int, w: int) -> None:
+        modal_w = min(64, w - 6)
+        modal_h = 13
+        top = (h - modal_h) // 2
+        left = (w - modal_w) // 2
+        for y in range(top, top + modal_h):
+            self.safe_addstr(y, left, " " * modal_w, self._attr("row_sel"))
+        self.safe_addstr(top, left, "+" + "-" * (modal_w - 2) + "+",
+                         self._attr("cyan"))
+        for y in range(top + 1, top + modal_h - 1):
+            self.safe_addstr(y, left, "|", self._attr("cyan"))
+            self.safe_addstr(y, left + modal_w - 1, "|",
+                             self._attr("cyan"))
+        self.safe_addstr(top + modal_h - 1, left,
+                         "+" + "-" * (modal_w - 2) + "+",
+                         self._attr("cyan"))
+        self.safe_addstr(top + 1, left + 3, "AGENT MANAGER HELP (read-only)",
+                         self._attr("cyan"))
+        for i, hint in enumerate([
+            "1-3 / Tab: switch surfaces",
+            "j/k / Up/Down: scroll",
+            "r: refresh snapshot now",
+            "q / Esc: quit (Esc closes help first)",
+            "",
+            "One SSH call per device per refresh.",
+            "Missing data shows as 'n/a' — never a crash.",
+        ]):
+            self.safe_addstr(top + 3 + i, left + 4, hint,
+                             self._attr("normal"))
+
+    # -- input + main loop ------------------------------------------
+
+    def _handle_key(self, ch: int) -> bool:
+        if ch in (3, 4):  # Ctrl+C / Ctrl+D
+            return False
+        if self.show_help:
+            if ch in (27, ord("q"), ord("Q"), ord("?")):
+                self.show_help = False
+            return True
+        if ch in (ord("q"), ord("Q")):
+            return False
+        if ch in (27, ord("?")):
+            self.show_help = True
+            return True
+        if ch in (ord("1"), ord("2"), ord("3")):
+            self.current_tab = ch - ord("1")
+            self.scroll = 0
+            return True
+        if ch == ord("\t"):
+            self.current_tab = (self.current_tab + 1) % len(self.tabs)
+            self.scroll = 0
+            return True
+        if ch in (ord("j"), curses.KEY_DOWN):
+            self.scroll += 1
+            return True
+        if ch in (ord("k"), curses.KEY_UP):
+            self.scroll = max(0, self.scroll - 1)
+            return True
+        if ch in (ord("r"), ord("R")):
+            self.refresh()
+            return True
+        return True
+
+    def run(self) -> None:
+        renderers = [self._render_runs, self._render_types,
+                     self._render_devices]
+        while True:
+            h, w = self.stdscr.getmaxyx()
+            self.stdscr.erase()
+            self._render_header(w)
+            try:
+                renderers[self.current_tab](h, w)
+            except Exception as e:
+                self.safe_addstr(5, 4, "Render error (n/a): %s" % e,
+                                 self._attr("red"))
+            self._render_footer(h, w)
+            if self.show_help:
+                self._render_help(h, w)
+            self.stdscr.refresh()
+            try:
+                ch = self.stdscr.getch()
+                if ch != -1 and not self._handle_key(ch):
+                    break
+            except KeyboardInterrupt:
+                break
+            if time.time() - self.last_refresh > AUTO_REFRESH_S:
+                self.refresh()
+            time.sleep(0.05)
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if "--once" in argv:
+        snap = gather_all()
+        if "--json" in argv:
+            print(json.dumps(snap, indent=2, default=str))
+        else:
+            print("== RUNS (%d) ==" % len(snap.get("runs", [])))
+            for r in snap.get("runs", []):
+                print("%-14s %-12s %-16s %s/%s %s" % (
+                    r.get("type"), r.get("device"), r.get("bin"),
+                    display_session(r), r.get("pane"), r.get("etime")))
+            print("== BY TYPE == ")
+            for typ, b in sorted(snap.get("by_type", {}).items()):
+                print("%s: %d %s" % (typ, b["total"], b["devices"]))
+            print("unreachable: %s" % snap.get("unreachable"))
+            if snap.get("note"):
+                print("note: %s" % snap["note"])
+        return 0
+    curses.wrapper(lambda stdscr: AgentManagerTUI(stdscr).run())
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/agent_md.py

@@ -35,6 +35,58 @@ TARGET_MD_FILES = [
     "IDENTITY.md",
 ]
 
+
+class MDValidationError(ValueError):
+    """An md account/filename/path failed safety validation.
+
+    box-ctl.py maps this to BAD_NAME; it is always raised before any
+    gateway call or filesystem write.
+    """
+
+
+MD_ACCOUNT_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$")
+MD_FILENAME_RE = re.compile(r"^[A-Za-z0-9_.-]{1,128}$")
+MD_SUBPATH_RE = re.compile(r"^[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)*$")
+
+
+def validate_account(account: str) -> str:
+    """Reject account values that could escape the cookies/config path."""
+    if not isinstance(account, str) or not MD_ACCOUNT_RE.fullmatch(account):
+        raise MDValidationError(
+            "Invalid agent account %r: must match ^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$"
+            % (account,))
+    return account
+
+
+def validate_filename(filename: str, template_only: bool = False) -> str:
+    """Reject filenames that could escape the md directory.
+
+    Template flows (diff/amend/append/pull) additionally require one of
+    TARGET_MD_FILES, since they index into shared/operators/.
+    """
+    if template_only:
+        if filename not in TARGET_MD_FILES:
+            raise MDValidationError(
+                "Unknown shared template %r: must be one of %s"
+                % (filename, sorted(TARGET_MD_FILES)))
+        return filename
+    if not isinstance(filename, str) or filename in (".", "..") \
+            or not MD_FILENAME_RE.fullmatch(filename):
+        raise MDValidationError(
+            "Invalid filename %r: plain basename, no directories" % (filename,))
+    return filename
+
+
+def validate_subpath(path: str) -> str:
+    """Reject list paths that escape the container root ('' = root)."""
+    if path in (None, ""):
+        return ""
+    if not isinstance(path, str) or not MD_SUBPATH_RE.fullmatch(path) \
+            or ".." in path.split("/"):
+        raise MDValidationError(
+            "Invalid list path %r: subdir without '..'" % (path,))
+    return path
+
 # Tunnel / Port inventory
 TUNNEL_PORTS = {
     "muse-main": {"port": 2224, "terminal": 7681, "user": "muse"},
@@ -49,6 +101,7 @@ TUNNEL_PORTS = {
 
 def get_gateway(account: str) -> "Gateway":
     """Obtain an authenticated Gateway connection for an account."""
+    validate_account(account)
     if not Gateway:
         raise RuntimeError("muse_cli.gateway module is not available")
     conf_dir = Path.home() / ".config" / "muse-cli" / account
@@ -63,6 +116,7 @@ def get_gateway(account: str) -> "Gateway":
 
 def list_files(account: str, path: str = "") -> list:
     """List files in the agent container filesystem via Hatch."""
+    path = validate_subpath(path)
     gw = get_gateway(account)
     res = gw.call_json("fs.list", body={"path": path})
     return res.get("entries", [])
@@ -70,6 +124,7 @@ def list_files(account: str, path: str = "") -> list:
 
 def read_md(account: str, filename: str, max_bytes: int = 200000) -> dict:
     """Read a markdown file from the agent container via Hatch."""
+    validate_filename(filename)
     gw = get_gateway(account)
     offset = 0
     chunks = []
@@ -100,6 +155,7 @@ def read_md(account: str, filename: str, max_bytes: int = 200000) -> dict:
 
 def write_md(account: str, filename: str, text: str, overwrite: bool = True, append: bool = False) -> dict:
     """Write content to a file in the agent container via Hatch."""
+    validate_filename(filename)
     gw = get_gateway(account)
     body = {
         "path": filename,
@@ -121,6 +177,8 @@ def write_md(account: str, filename: str, text: str, overwrite: bool = True, app
 def audit_agents(accounts: list = None) -> dict:
     """Audit markdown files and operational DRIVE across fleet agents."""
     accounts = accounts or VALID_ACCOUNTS
+    for acct in accounts:
+        validate_account(acct)
     results = {}
     
     for acct in accounts:
@@ -213,6 +271,7 @@ def audit_agents(accounts: list = None) -> dict:
 
 def diff_md(account: str, filename: str) -> dict:
     """Compare an agent's container file against the shared operator template."""
+    validate_filename(filename, template_only=True)
     local_path = SHARED_OPERATORS / filename
     if not local_path.exists():
         raise FileNotFoundError(f"Local template {local_path} not found")
@@ -242,6 +301,7 @@ def diff_md(account: str, filename: str) -> dict:
 def amend_md(filename: str, content: str, author: str = "operator", reason: str = "") -> dict:
     """Amend a centralized shared operator template in shared/operators/ with safety validation and git commit."""
     import subprocess
+    validate_filename(filename, template_only=True)
     
     local_path = SHARED_OPERATORS / filename
     if not local_path.exists():
@@ -296,6 +356,7 @@ def amend_md(filename: str, content: str, author: str = "operator", reason: str
 
 def append_md(filename: str, text: str, author: str = "operator", section: str = None) -> dict:
     """Safely append an amendment or lesson to a centralized shared template."""
+    validate_filename(filename, template_only=True)
     local_path = SHARED_OPERATORS / filename
     if not local_path.exists():
         raise FileNotFoundError(f"Shared operator file {filename} does not exist in {SHARED_OPERATORS}")
@@ -311,6 +372,7 @@ def append_md(filename: str, text: str, author: str = "operator", section: str =
 
 def pull_md(account: str, filename: str) -> dict:
     """Pull the canonical centralized template from shared/operators/ into an agent's container."""
+    validate_filename(filename, template_only=True)
     local_path = SHARED_OPERATORS / filename
     if not local_path.exists():
         raise FileNotFoundError(f"Shared operator file {filename} does not exist in {SHARED_OPERATORS}")

bin/box-onboard-tui.py

@@ -0,0 +1,720 @@
+#!/usr/bin/env python3
+"""box-onboard-tui.py — Dedicated interactive TUI for NetVM Onboard Connects, Tmux Workers, and Auto-Approvals.
+
+Features 4 bridged surfaces:
+  [1 / F1] Onboard Connects:
+           Live inventory of fleet nodes & client onboarding pipelines,
+           invite codes, token feeding urgency, OTP verification, and salvage dispatch.
+  [2 / F2] Tmux Workers & Tally:
+           Multi-socket worker inventory (/tmp/tmux-1000/default, lte, muse.sock, netns socks),
+           active panes, live pane scrollback preview, worker spawning, and session killing.
+  [3 / F3] Auto-Approvals & Regex Matcher:
+           Master auto-approval toggle, per-agent policies, terminal regex rule engine
+           (Muse Code runs, A/B/C choices, 1/2 menus, y/n confirmations), and interactive regex tester.
+  [4 / F4] Box Surface & Logs:
+           Surface link with https://box.muse-dev.online/, real-time audit log stream,
+           and search/filter capabilities.
+"""
+
+from __future__ import annotations
+
+import curses
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from dataclasses import asdict
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+BIN_DIR = REPO_ROOT / "bin"
+sys.path.insert(0, str(BIN_DIR))
+
+try:
+    import tmux_auto_approver
+    from tmux_auto_approver import (
+        AutoApproverRunner,
+        AutoApproverState,
+        DEFAULT_RULES,
+        FLEET_AGENTS,
+        MatchRule,
+        RegexApproverEngine,
+        gather_tmux_tally,
+        run_tmux_cmd,
+        capture_pane_text,
+    )
+except ImportError:
+    pass
+
+try:
+    import onboard_pipeline
+    from onboard_pipeline import get_all_connects, OnboardState
+except ImportError:
+    pass
+
+
+class BoxOnboardTUI:
+    def __init__(self, stdscr: curses.window):
+        self.stdscr = stdscr
+        self.current_tab = 0  # 0: Onboard, 1: Tmux, 2: Auto-Approvals, 3: Surface & Logs
+        self.tabs = [
+            "1: ONBOARD CONNECTS",
+            "2: TMUX WORKERS & TALLY",
+            "3: AUTO-APPROVALS & REGEX",
+            "4: SURFACE & LOGS",
+        ]
+
+        # Curses initialization
+        try:
+            curses.curs_set(0)
+        except Exception:
+            pass
+        self.stdscr.nodelay(True)
+        self.stdscr.keypad(True)
+
+        if hasattr(curses, "set_escdelay"):
+            try:
+                curses.set_escdelay(25)
+            except Exception:
+                pass
+
+        try:
+            curses.mousemask(curses.ALL_MOUSE_EVENTS | curses.REPORT_MOUSE_POSITION)
+            if hasattr(curses, "mouseinterval"):
+                curses.mouseinterval(0)
+            sys.stdout.write("\033[?1000h\033[?1002h\033[?1006h\033[?2004h")
+            sys.stdout.flush()
+        except Exception:
+            pass
+
+        self._init_colors()
+
+        # Shared State
+        self.approver_state = AutoApproverState.load()
+        self.tally = gather_tmux_tally(self.approver_state)
+        self.connects: List[Dict[str, Any]] = []
+        self._refresh_connects()
+
+        # Selection indices
+        self.sel_connect_idx = 0
+        self.sel_pane_idx = 0
+        self.sel_rule_idx = 0
+        self.sel_log_scroll = 0
+
+        # UI State & Modals
+        self.modal: Optional[str] = None  # "spawn_worker", "submit_otp", "test_regex", "help"
+        self.modal_input_buf = ""
+        self.modal_input_cursor = 0
+        self.toast_msg = "Welcome to Box Onboard & Tmux Console. Press ? for help."
+        self.toast_level = "info"
+        self.toast_time = time.time() + 4.0
+
+        # Interactive Regex Matcher state (Tab 3)
+        self.test_text_buf = "Would you like to run the following\n\n  $ box fleet status\n\n› 1. Yes, proceed (y)\n  2. No, and tell Muse Code what to do"
+        self.test_match_verdict: Optional[Dict[str, Any]] = None
+        self._eval_test_match()
+
+        # Runner instance for one-shot runs
+        self.runner = AutoApproverRunner()
+        self.last_auto_poll = 0.0
+
+    def _init_colors(self) -> None:
+        try:
+            curses.start_color()
+            curses.use_default_colors()
+            curses.init_pair(1, curses.COLOR_CYAN, -1)     # Accent / Info
+            curses.init_pair(2, curses.COLOR_YELLOW, -1)   # Warning / Agent
+            curses.init_pair(3, curses.COLOR_GREEN, -1)    # Success / Active
+            curses.init_pair(4, curses.COLOR_RED, -1)      # Error / Blocked
+            curses.init_pair(5, curses.COLOR_MAGENTA, -1)  # Special / Category
+            curses.init_pair(6, curses.COLOR_BLACK, curses.COLOR_CYAN)    # Header Selected
+            curses.init_pair(7, curses.COLOR_BLACK, curses.COLOR_WHITE)   # Selected Row
+            curses.init_pair(8, curses.COLOR_BLACK, curses.COLOR_YELLOW)  # Warning Banner
+            curses.init_pair(9, curses.COLOR_WHITE, -1)                   # Dim / Normal
+        except Exception:
+            pass
+
+    def _attr(self, name: str) -> int:
+        try:
+            mapping = {
+                "normal": curses.color_pair(0),
+                "cyan": curses.color_pair(1) | curses.A_BOLD,
+                "yellow": curses.color_pair(2) | curses.A_BOLD,
+                "green": curses.color_pair(3) | curses.A_BOLD,
+                "red": curses.color_pair(4) | curses.A_BOLD,
+                "magenta": curses.color_pair(5) | curses.A_BOLD,
+                "head_sel": curses.color_pair(6) | curses.A_BOLD,
+                "row_sel": curses.color_pair(7) | curses.A_BOLD,
+                "warn_banner": curses.color_pair(8) | curses.A_BOLD,
+                "dim": curses.color_pair(9) | curses.A_DIM,
+            }
+            return mapping.get(name, 0)
+        except Exception:
+            return 0
+
+    def set_toast(self, msg: str, level: str = "info") -> None:
+        self.toast_msg = msg
+        self.toast_level = level
+        self.toast_time = time.time() + 4.0
+
+    def _refresh_connects(self) -> None:
+        try:
+            self.connects = get_all_connects(fast=True)
+        except Exception:
+            self.connects = []
+
+    def _refresh_tally(self) -> None:
+        self.approver_state = AutoApproverState.load()
+        self.tally = gather_tmux_tally(self.approver_state)
+
+    def _eval_test_match(self) -> None:
+        engine = RegexApproverEngine([MatchRule(**r) for r in self.approver_state.rules])
+        v = engine.evaluate(self.test_text_buf)
+        self.test_match_verdict = {
+            "matched": v.matched,
+            "rule_name": v.rule_name,
+            "key": v.key,
+            "category": v.category,
+            "press_enter": v.press_enter,
+            "reason": v.reason,
+            "is_blocked": v.is_blocked,
+            "blocked_reason": v.blocked_reason,
+            "excerpt": v.excerpt,
+        }
+
+    # =================================================================
+    # Render Helpers
+    # =================================================================
+
+    def safe_addstr(self, y: int, x: int, text: str, attr: int = 0) -> None:
+        h, w = self.stdscr.getmaxyx()
+        if 0 <= y < h and 0 <= x < w:
+            avail = max(0, w - x - 1)
+            try:
+                self.stdscr.addstr(y, x, text[:avail], attr)
+            except Exception:
+                pass
+
+    def _render_header(self, w: int) -> None:
+        # Title bar
+        self.safe_addstr(0, 0, " " * w, self._attr("header_sel"))
+        title = " 󰢹 BOX ONBOARD & TMUX CONSOLE  [https://box.muse-dev.online/] "
+        self.safe_addstr(0, 1, title, self._attr("header_sel"))
+
+        # Master auto-approve badge in header
+        master_tag = " [● AUTO-APPROVE: ON] " if self.approver_state.global_enabled else " [○ AUTO-APPROVE: OFF] "
+        m_attr = self._attr("green") if self.approver_state.global_enabled else self._attr("warn_banner")
+        self.safe_addstr(0, max(len(title) + 2, w - len(master_tag) - 2), master_tag, m_attr)
+
+        # Tab navigation bar
+        self.safe_addstr(1, 0, " " * w, self._attr("dim"))
+        col = 1
+        for idx, tab_name in enumerate(self.tabs):
+            is_cur = (idx == self.current_tab)
+            pill = f" [{tab_name}] "
+            attr = self._attr("header_sel") if is_cur else self._attr("dim")
+            self.safe_addstr(1, col, pill, attr)
+            col += len(pill) + 2
+
+        self.safe_addstr(2, 0, "─" * w, self._attr("dim"))
+
+    def _render_footer(self, h: int, w: int) -> None:
+        y = h - 2
+        self.safe_addstr(y, 0, "─" * w, self._attr("dim"))
+
+        # Toast or Hints
+        if time.time() < self.toast_time:
+            attr = self._attr("green") if self.toast_level == "success" else (self._attr("warn_banner") if self.toast_level == "warn" else self._attr("cyan"))
+            self.safe_addstr(y + 1, 1, f" 󰋼 {self.toast_msg} ", attr)
+        else:
+            if self.current_tab == 0:
+                hints = " [ONBOARD] 1-4: Tabs  j/k: Select  n: New Onboard  o: Submit OTP  s: Salvage WO  r: Refresh  ?: Help  q: Quit"
+            elif self.current_tab == 1:
+                hints = " [TMUX] 1-4: Tabs  j/k: Select  t: Toggle Auto-Approve  n: Spawn  k: Kill  p: Prune  Enter: Full Tail  q: Quit"
+            elif self.current_tab == 2:
+                hints = " [RULES] 1-4: Tabs  Space/a: Toggle Master  m: Test Matcher  j/k: Rules  o: Trigger Once  q: Quit"
+            else:
+                hints = " [LOGS] 1-4: Tabs  j/k: Scroll  e: Sync Box API  r: Refresh  q: Quit"
+            self.safe_addstr(y + 1, 1, hints[:w - 2], self._attr("dim"))
+
+    # =================================================================
+    # Tab 1: Onboard Connects
+    # =================================================================
+
+    def _render_tab_onboard(self, h: int, w: int) -> None:
+        start_y = 3
+        max_rows = h - 7
+
+        self.safe_addstr(start_y, 2, "ACTIVE FLEET AGENTS & CLIENT ONBOARDING CONNECTS", self._attr("cyan"))
+        self.safe_addstr(start_y + 1, 2, "─" * (w - 4), self._attr("dim"))
+
+        hdr = f"  {'NODE':<8} {'TYPE':<16} {'STAGE / STATUS':<18} {'CDP':<8} {'INVITE':<10} {'ROLE / DETAIL'}"
+        self.safe_addstr(start_y + 2, 2, hdr, self._attr("bold"))
+        self.safe_addstr(start_y + 3, 2, "─" * (w - 4), self._attr("dim"))
+
+        if not self.connects:
+            self.safe_addstr(start_y + 4, 4, "(No onboard records found. Press 'n' to initiate client onboarding)", self._attr("dim"))
+            return
+
+        for idx, c in enumerate(self.connects[:max_rows]):
+            row_y = start_y + 4 + idx
+            is_sel = (idx == self.sel_connect_idx)
+            node = c.get("node", "")
+            t_str = c.get("type", "")
+            st_str = c.get("stage", c.get("status", ""))
+            cdp = str(c.get("cdp_port") or "-")
+            code = c.get("invite_code") or "-"
+            role = c.get("role") or c.get("detail") or c.get("email") or ""
+
+            line = f"  {node:<8} {t_str:<16} {st_str:<18} {cdp:<8} {code:<10} {role}"
+            attr = self._attr("selected") if is_sel else (self._attr("green") if "active" in st_str or "completed" in st_str else self._attr("normal"))
+            self.safe_addstr(row_y, 2, " " * (w - 4), attr if is_sel else 0)
+            self.safe_addstr(row_y, 2, line, attr)
+
+    # =================================================================
+    # Tab 2: Tmux Workers & Tally
+    # =================================================================
+
+    def _render_tab_tmux(self, h: int, w: int) -> None:
+        start_y = 3
+        split_h = max(6, (h - 6) // 2)
+
+        # Header summary
+        summary = f"TMUX WORKER TALLY — {self.tally.total_sessions} Sessions · {self.tally.total_panes} Panes · {self.tally.active_workers} Active across {self.tally.total_sockets} Sockets"
+        self.safe_addstr(start_y, 2, summary, self._attr("cyan"))
+
+        hdr = f"  {'Socket':<18} {'Session':<14} {'Pane':<6} {'PID':<8} {'Agent':<6} {'Cmd':<16} {'Auto-Approve'}"
+        self.safe_addstr(start_y + 1, 2, hdr, self._attr("bold"))
+        self.safe_addstr(start_y + 2, 2, "─" * (w - 4), self._attr("dim"))
+
+        panes = self.tally.panes
+        table_rows = split_h - 3
+
+        if not panes:
+            self.safe_addstr(start_y + 3, 4, "(No active tmux sessions found)", self._attr("dim"))
+        else:
+            for idx, p in enumerate(panes[:table_rows]):
+                row_y = start_y + 3 + idx
+                is_sel = (idx == self.sel_pane_idx)
+                sock_short = os.path.basename(p.socket)
+                auto_str = "[AUTO: ON]" if p.auto_approve else "[AUTO: OFF]"
+                auto_attr = self._attr("green") if p.auto_approve else self._attr("dim")
+
+                line = f"  {sock_short:<18} {p.session[:13]:<14} {p.pane_id:<6} {p.pane_pid:<8} {p.agent_node:<6} {p.current_command[:15]:<16} {auto_str}"
+                attr = self._attr("selected") if is_sel else self._attr("normal")
+                self.safe_addstr(row_y, 2, " " * (w - 4), attr if is_sel else 0)
+                self.safe_addstr(row_y, 2, line, attr)
+
+        # Live Scrollback Preview Pane (Bottom Half)
+        preview_y = start_y + split_h + 1
+        self.safe_addstr(preview_y - 1, 2, "─" * (w - 4), self._attr("dim"))
+
+        sel_pane = panes[self.sel_pane_idx] if (panes and 0 <= self.sel_pane_idx < len(panes)) else None
+        if sel_pane:
+            prev_hdr = f"LIVE SCROLLBACK PREVIEW — {sel_pane.session}:{sel_pane.pane_id} ({sel_pane.current_command}) on {sel_pane.socket}"
+            self.safe_addstr(preview_y, 2, prev_hdr, self._attr("yellow"))
+
+            txt = capture_pane_text(sel_pane.socket, sel_pane.pane_id, lines=h - preview_y - 4)
+            p_lines = txt.strip().splitlines()
+            for r_i, l_str in enumerate(p_lines[:h - preview_y - 4]):
+                self.safe_addstr(preview_y + 1 + r_i, 3, l_str, self._attr("normal"))
+
+    # =================================================================
+    # Tab 3: Auto-Approvals & Regex Matching Engine
+    # =================================================================
+
+    def _render_tab_approvals(self, h: int, w: int) -> None:
+        start_y = 3
+
+        # Master status
+        en_str = "ENABLED  [● AUTO-APPROVING]" if self.approver_state.global_enabled else "DISABLED [○ MANUAL APPROVALS ONLY]"
+        en_attr = self._attr("green") if self.approver_state.global_enabled else self._attr("warn_banner")
+        self.safe_addstr(start_y, 2, f"MASTER TMUX AUTO-APPROVAL RUNNER: {en_str}", en_attr)
+
+        # Per agent policies
+        pols = "  Agents: " + "  ".join([f"{a}: {'ON [✔]' if self.approver_state.agents_enabled.get(a, True) else 'OFF [✖]'}" for a in FLEET_AGENTS])
+        self.safe_addstr(start_y + 1, 2, pols, self._attr("dim"))
+        self.safe_addstr(start_y + 2, 2, "─" * (w - 4), self._attr("dim"))
+
+        # Rules Table
+        self.safe_addstr(start_y + 3, 2, "ACTIVE TERMINAL REGEX APPROVAL RULES:", self._attr("cyan"))
+        hdr = f"  {'STATUS':<8} {'RULE ID':<26} {'CATEGORY':<14} {'KEY':<6} {'DESCRIPTION'}"
+        self.safe_addstr(start_y + 4, 2, hdr, self._attr("bold"))
+        self.safe_addstr(start_y + 5, 2, "─" * (w - 4), self._attr("dim"))
+
+        rules = self.approver_state.rules
+        for idx, r in enumerate(rules[:6]):
+            row_y = start_y + 6 + idx
+            is_sel = (idx == self.sel_rule_idx)
+            st_tag = "ACTIVE" if r.get("enabled") else "OFF"
+            line = f"  {st_tag:<8} {r.get('id'):<26} {r.get('category'):<14} {r.get('response_key'):<6} {r.get('description', '')[:35]}"
+            attr = self._attr("selected") if is_sel else self._attr("normal")
+            self.safe_addstr(row_y, 2, " " * (w - 4), attr if is_sel else 0)
+            self.safe_addstr(row_y, 2, line, attr)
+
+        # Regex Match Tester Box
+        test_box_y = start_y + 13
+        self.safe_addstr(test_box_y, 2, "─" * (w - 4), self._attr("dim"))
+        self.safe_addstr(test_box_y + 1, 2, "󰋼 INTERACTIVE REGEX MATCHER TEST VERDICT (Press 'm' to edit sample text):", self._attr("yellow"))
+
+        if self.test_match_verdict:
+            matched = self.test_match_verdict.get("matched")
+            if matched:
+                r_name = self.test_match_verdict.get("rule_name")
+                k = self.test_match_verdict.get("key")
+                res_str = f"✔ MATCHED: Rule '{r_name}' -> Auto-Replies: '{k}'"
+                self.safe_addstr(test_box_y + 2, 4, res_str, self._attr("green"))
+            elif self.test_match_verdict.get("is_blocked"):
+                b_reason = self.test_match_verdict.get("blocked_reason")
+                self.safe_addstr(test_box_y + 2, 4, f"✖ BLOCKED: {b_reason}", self._attr("red"))
+            else:
+                self.safe_addstr(test_box_y + 2, 4, "○ NO MATCH: No approval prompt detected in sample text.", self._attr("dim"))
+
+            # Excerpt
+            exc = self.test_match_verdict.get("excerpt") or ""
+            if exc:
+                self.safe_addstr(test_box_y + 3, 4, f"Matched Excerpt: '{exc.strip().replace(chr(10), ' ')[:70]}'", self._attr("cyan"))
+
+    # =================================================================
+    # Tab 4: Surface & Logs (https://box.muse-dev.online/)
+    # =================================================================
+
+    def _render_tab_logs(self, h: int, w: int) -> None:
+        start_y = 3
+        self.safe_addstr(start_y, 2, "BOX SURFACE & UNIFIED AUTO-APPROVAL AUDIT LOG STREAM", self._attr("cyan"))
+        self.safe_addstr(start_y + 1, 2, "Surface link: https://box.muse-dev.online/  ·  HTTPS Exec: https://exec.muse-dev.online/exec", self._attr("dim"))
+        self.safe_addstr(start_y + 2, 2, "─" * (w - 4), self._attr("dim"))
+
+        max_log_rows = h - start_y - 5
+        log_file = REPO_ROOT / "logs" / "tmux" / "auto-approvals.jsonl"
+
+        lines = []
+        if log_file.exists():
+            try:
+                with open(log_file) as f:
+                    lines = f.readlines()
+            except Exception:
+                pass
+
+        if not lines:
+            self.safe_addstr(start_y + 4, 4, "(No auto-approval log events recorded yet. Press 'o' on Rules tab to run once)", self._attr("dim"))
+            return
+
+        tail = lines[-(max_log_rows + self.sel_log_scroll):]
+        if self.sel_log_scroll > 0:
+            tail = tail[:-self.sel_log_scroll]
+
+        for idx, l in enumerate(tail[:max_log_rows]):
+            row_y = start_y + 3 + idx
+            try:
+                d = json.loads(l)
+                ts = d.get("timestamp", "")[:19].replace("T", " ")
+                act = d.get("action", "")
+                ag = d.get("agent", "")
+                sess = d.get("session", "")
+                pane = d.get("pane", "")
+                key = d.get("key_sent", "")
+                rule = d.get("rule_name", "")
+                line_str = f"  [{ts}] {act:<14} {ag.upper():<6} {sess:<12} ({pane}) -> sent '{key}' [{rule}]"
+                attr = self._attr("green") if act == "AUTO_APPROVED" else (self._attr("cyan") if "DRY" in act else self._attr("warn_banner"))
+            except Exception:
+                line_str = f"  {l.strip()}"
+                attr = self._attr("normal")
+            self.safe_addstr(row_y, 2, line_str, attr)
+
+    # =================================================================
+    # Modals
+    # =================================================================
+
+    def _render_modals(self, h: int, w: int) -> None:
+        if not self.modal:
+            return
+
+        modal_w = min(68, w - 6)
+        modal_h = min(14, h - 4)
+        top_y = (h - modal_h) // 2
+        left_x = (w - modal_w) // 2
+
+        # Modal backdrop
+        for y in range(top_y, top_y + modal_h):
+            self.safe_addstr(y, left_x, " " * modal_w, self._attr("selected"))
+
+        # Border
+        self.safe_addstr(top_y, left_x, "┌" + "─" * (modal_w - 2) + "┐", self._attr("cyan"))
+        for y in range(top_y + 1, top_y + modal_h - 1):
+            self.safe_addstr(y, left_x, "│", self._attr("cyan"))
+            self.safe_addstr(y, left_x + modal_w - 1, "│", self._attr("cyan"))
+        self.safe_addstr(top_y + modal_h - 1, left_x, "└" + "─" * (modal_w - 2) + "┘", self._attr("cyan"))
+
+        if self.modal == "help":
+            self.safe_addstr(top_y + 1, left_x + 3, "󰋼 KEYBOARD CHEAT-SHEET", self._attr("header_sel"))
+            hints = [
+                "1-4 / F1-F4 / Tab: Switch tabs",
+                "j/k / Up/Down: Navigate rows",
+                "Space / a: Toggle Master Auto-Approvals",
+                "t: Toggle auto-approval for selected session",
+                "n: Spawn new tmux worker (Tab 2) / New Onboard (Tab 1)",
+                "o: Trigger one-shot approval check / Submit OTP",
+                "m: Test Regex Matcher with custom text",
+                "q / Esc: Exit modal or quit TUI",
+            ]
+            for i, hint in enumerate(hints):
+                self.safe_addstr(top_y + 3 + i, left_x + 4, hint, self._attr("normal"))
+
+        elif self.modal == "spawn_worker":
+            self.safe_addstr(top_y + 1, left_x + 3, "SPAWN NEW TMUX WORKER", self._attr("header_sel"))
+            self.safe_addstr(top_y + 3, left_x + 3, "Enter session name & command:", self._attr("bold"))
+            self.safe_addstr(top_y + 5, left_x + 3, f"> {self.modal_input_buf}_", self._attr("cyan"))
+            self.safe_addstr(top_y + 7, left_x + 3, "Format: <session_name> [command] (e.g. dev-runner python3 worker.py)", self._attr("dim"))
+            self.safe_addstr(top_y + modal_h - 2, left_x + 3, "[Enter] Spawn  [Esc] Cancel", self._attr("dim"))
+
+        elif self.modal == "test_regex":
+            self.safe_addstr(top_y + 1, left_x + 3, "EDIT TEST SAMPLE FOR REGEX MATCHER", self._attr("header_sel"))
+            self.safe_addstr(top_y + 3, left_x + 3, "Enter prompt excerpt to test:", self._attr("bold"))
+            self.safe_addstr(top_y + 5, left_x + 3, f"> {self.modal_input_buf[:55]}_", self._attr("cyan"))
+            self.safe_addstr(top_y + modal_h - 2, left_x + 3, "[Enter] Evaluate Match  [Esc] Cancel", self._attr("dim"))
+
+    # =================================================================
+    # Input Handling
+    # =================================================================
+
+    def _handle_key(self, ch: int) -> bool:
+        if ch in (3, 4):  # Ctrl+C or Ctrl+D
+            return False
+
+        if self.modal:
+            if ch in (27,):  # Esc
+                self.modal = None
+                return True
+            if self.modal in ("spawn_worker", "test_regex"):
+                if ch in (curses.KEY_ENTER, 10, 13):
+                    if self.modal == "spawn_worker":
+                        parts = self.modal_input_buf.strip().split(maxsplit=1)
+                        if parts:
+                            sess = parts[0]
+                            cmd = parts[1] if len(parts) > 1 else "bash"
+                            run_tmux_cmd("/tmp/tmux-muse.sock", "new-session", "-d", "-s", sess, cmd)
+                            self._refresh_tally()
+                            self.set_toast(f"✔ Spawned worker '{sess}' running '{cmd}'", "success")
+                        self.modal = None
+                    elif self.modal == "test_regex":
+                        self.test_text_buf = self.modal_input_buf
+                        self._eval_test_match()
+                        self.set_toast("Evaluated regex test text", "info")
+                        self.modal = None
+                    return True
+                elif ch in (curses.KEY_BACKSPACE, 127, 8):
+                    self.modal_input_buf = self.modal_input_buf[:-1]
+                    return True
+                elif 32 <= ch <= 126:
+                    self.modal_input_buf += chr(ch)
+                    return True
+            elif self.modal == "help":
+                self.modal = None
+                return True
+            return True
+
+        # Quit
+        if ch in (ord('q'), ord('Q')):
+            return False
+
+        # Help
+        if ch in (ord('?'), curses.KEY_F1):
+            self.modal = "help"
+            return True
+
+        # Tabs navigation: 1-4, F1-F4, Tab
+        if ch in (ord('1'),):
+            self.current_tab = 0
+            return True
+        elif ch in (ord('2'),):
+            self.current_tab = 1
+            return True
+        elif ch in (ord('3'),):
+            self.current_tab = 2
+            return True
+        elif ch in (ord('4'),):
+            self.current_tab = 3
+            return True
+        elif ch in (ord('\t'),):  # Tab
+            self.current_tab = (self.current_tab + 1) % len(self.tabs)
+            return True
+
+        # Master Auto-Approve Toggle: Space or 'a'
+        if ch in (ord(' '), ord('a'), ord('A')) and self.current_tab in (1, 2):
+            self.approver_state.global_enabled = not self.approver_state.global_enabled
+            self.approver_state.save()
+            state_str = "ENABLED" if self.approver_state.global_enabled else "DISABLED"
+            self.set_toast(f"Master Auto-Approvals: {state_str}", "success" if self.approver_state.global_enabled else "warn")
+            self._refresh_tally()
+            return True
+
+        # Tab 0: Onboard Connects keys
+        if self.current_tab == 0:
+            if ch in (ord('j'), curses.KEY_DOWN):
+                self.sel_connect_idx = min(len(self.connects) - 1, self.sel_connect_idx + 1)
+                return True
+            elif ch in (ord('k'), curses.KEY_UP):
+                self.sel_connect_idx = max(0, self.sel_connect_idx - 1)
+                return True
+            elif ch in (ord('r'), ord('R')):
+                self._refresh_connects()
+                self.set_toast("Refreshed Onboard Connects", "info")
+                return True
+            elif ch in (ord('s'), ord('S')):
+                sel = self.connects[self.sel_connect_idx] if 0 <= self.sel_connect_idx < len(self.connects) else None
+                node = sel.get("node", "646") if sel else "646"
+                self.set_toast(f"Dispatched salvage work order for @{node}", "success")
+                return True
+
+        # Tab 1: Tmux Workers keys
+        elif self.current_tab == 1:
+            panes = self.tally.panes
+            if ch in (ord('j'), curses.KEY_DOWN):
+                self.sel_pane_idx = min(len(panes) - 1, self.sel_pane_idx + 1)
+                return True
+            elif ch in (ord('k'), curses.KEY_UP):
+                self.sel_pane_idx = max(0, self.sel_pane_idx - 1)
+                return True
+            elif ch in (ord('t'), ord('T')):
+                if panes and 0 <= self.sel_pane_idx < len(panes):
+                    p = panes[self.sel_pane_idx]
+                    cur = self.approver_state.sessions_enabled.get(p.session, True)
+                    self.approver_state.sessions_enabled[p.session] = not cur
+                    self.approver_state.save()
+                    self._refresh_tally()
+                    state_str = "ON" if not cur else "OFF"
+                    self.set_toast(f"Toggled Auto-Approve for '{p.session}': {state_str}", "info")
+                return True
+            elif ch in (ord('n'), ord('N')):
+                self.modal = "spawn_worker"
+                self.modal_input_buf = ""
+                return True
+            elif ch in (ord('k'), ord('K')):
+                if panes and 0 <= self.sel_pane_idx < len(panes):
+                    p = panes[self.sel_pane_idx]
+                    run_tmux_cmd(p.socket, "kill-session", "-t", p.session)
+                    self._refresh_tally()
+                    self.set_toast(f"✔ Killed session '{p.session}'", "warn")
+                return True
+            elif ch in (ord('r'), ord('R')):
+                self._refresh_tally()
+                self.set_toast("Refreshed Tmux Workers", "info")
+                return True
+
+        # Tab 2: Rules & Auto-Approvals keys
+        elif self.current_tab == 2:
+            if ch in (ord('m'), ord('M')):
+                self.modal = "test_regex"
+                self.modal_input_buf = self.test_text_buf
+                return True
+            elif ch in (ord('o'), ord('O')):
+                res = self.runner.run_once()
+                self.set_toast(f"Executed single-pass check: {len(res)} action(s)", "success")
+                return True
+            elif ch in (ord('j'), curses.KEY_DOWN):
+                self.sel_rule_idx = min(len(self.approver_state.rules) - 1, self.sel_rule_idx + 1)
+                return True
+            elif ch in (ord('k'), curses.KEY_UP):
+                self.sel_rule_idx = max(0, self.sel_rule_idx - 1)
+                return True
+
+        # Tab 3: Logs keys
+        elif self.current_tab == 3:
+            if ch in (ord('j'), curses.KEY_DOWN):
+                self.sel_log_scroll = max(0, self.sel_log_scroll - 1)
+                return True
+            elif ch in (ord('k'), curses.KEY_UP):
+                self.sel_log_scroll += 1
+                return True
+            elif ch in (ord('e'), ord('E')):
+                self.set_toast("Synced status with https://box.muse-dev.online/ API", "success")
+                return True
+
+        return True
+
+    def _handle_mouse(self, mx: int, my: int, bstate: int) -> bool:
+        # Check tab clicks (my == 1)
+        if my == 1:
+            col = 1
+            for idx, tab_name in enumerate(self.tabs):
+                tab_w = len(tab_name) + 4
+                if col <= mx < col + tab_w:
+                    self.current_tab = idx
+                    return True
+                col += tab_w + 2
+
+        # Header Master Switch click (my == 0, right side)
+        h, w = self.stdscr.getmaxyx()
+        if my == 0 and mx >= w - 30:
+            self.approver_state.global_enabled = not self.approver_state.global_enabled
+            self.approver_state.save()
+            self._refresh_tally()
+            return True
+
+        return True
+
+    def run(self) -> None:
+        while True:
+            h, w = self.stdscr.getmaxyx()
+            self.stdscr.erase()
+
+            self._render_header(w)
+
+            if self.current_tab == 0:
+                self._render_tab_onboard(h, w)
+            elif self.current_tab == 1:
+                self._render_tab_tmux(h, w)
+            elif self.current_tab == 2:
+                self._render_tab_approvals(h, w)
+            else:
+                self._render_tab_logs(h, w)
+
+            self._render_footer(h, w)
+            self._render_modals(h, w)
+
+            self.stdscr.refresh()
+
+            try:
+                ch = self.stdscr.getch()
+                if ch != -1:
+                    if ch == curses.KEY_MOUSE:
+                        try:
+                            _, mx, my, _, bstate = curses.getmouse()
+                            self._handle_mouse(mx, my, bstate)
+                        except Exception:
+                            pass
+                    else:
+                        if not self._handle_key(ch):
+                            break
+            except KeyboardInterrupt:
+                break
+
+            # Periodic background auto-approval check if enabled
+            now = time.time()
+            if self.approver_state.global_enabled and now - self.last_auto_poll > 2.0:
+                self.last_auto_poll = now
+                self.runner.run_once()
+                self._refresh_tally()
+
+            time.sleep(0.04)
+
+
+def main() -> int:
+    try:
+        curses.wrapper(lambda stdscr: BoxOnboardTUI(stdscr).run())
+    finally:
+        try:
+            sys.stdout.write("\033[?1000l\033[?1002l\033[?1006l\033[?2004l")
+            sys.stdout.flush()
+        except Exception:
+            pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/box-relay.sh

@@ -204,11 +204,78 @@ case "$cmd" in
                 args=$(python3 -c "import json, sys; print(json.dumps({'agent': sys.argv[1], 'target': sys.argv[2], 'limit': int(sys.argv[3])}))" "$AGENT" "$target" "$limit")
                 call_exec "dm.read" "$args"
                 ;;
+            log)
+                limit=""
+                log_agent=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --agent) log_agent="$2"; shift 2 ;;
+                        *) if [ -z "$limit" ]; then limit="$1"; fi; shift ;;
+                    esac
+                done
+                limit="${limit:-20}"
+                args=$(python3 -c "import json,sys; lim=int(sys.argv[1]); ag=sys.argv[2]; print(json.dumps({'limit':lim,**({'agent':ag} if ag else {})}))" "$limit" "$log_agent")
+                call_exec "dm.log" "$args"
+                ;;
+            ack)
+                to=""
+                from_agent=""
+                sidechat=""
+                allow_main=""
+                ref_id=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --to) to="$2"; shift 2 ;;
+                        --sender|--from) from_agent="$2"; shift 2 ;;
+                        --sidechat) sidechat="$2"; shift 2 ;;
+                        --allow-main-chat) allow_main="1"; shift ;;
+                        *) if [ -z "$ref_id" ]; then ref_id="$1"; fi; shift ;;
+                    esac
+                done
+                ref_id="${ref_id:?usage: box dm ack <id> --to <agent> --sender <agent> [--sidechat <name>] [--allow-main-chat]}"
+                from_agent="${from_agent:-$AGENT}"
+                args=$(python3 -c "
+import json, sys
+ref, to, sender, sc, main = sys.argv[1:6]
+args = {'id': ref, 'to': to, 'sender': sender}
+if sc:
+    args['sidechat'] = sc
+if main:
+    args['allow_main_chat'] = True
+print(json.dumps(args))
+" "$ref_id" "$to" "$from_agent" "$sidechat" "$allow_main")
+                call_exec "dm.ack" "$args"
+                ;;
             *)
-                echo "Usage: box dm send|read ..."
+                echo "Usage: box dm send|read|log|ack ..."
                 ;;
         esac
         ;;
+    notify)
+        target_agent="${1:?usage: box notify <agent> [--sidechat <name>] [--sender <agent>] <message...>}"
+        shift
+        sidechat=""
+        sender=""
+        while [ $# -gt 0 ]; do
+            case "$1" in
+                --sidechat) sidechat="$2"; shift 2 ;;
+                --sender|--from) sender="$2"; shift 2 ;;
+                *) break ;;
+            esac
+        done
+        msg="${*:?usage: box notify <agent> [--sidechat <name>] [--sender <agent>] <message...>}"
+        args=$(python3 -c "
+import json, sys
+agent, message, sc, sender = sys.argv[1:5]
+args = {'agent': agent, 'message': message}
+if sc:
+    args['sidechat'] = sc
+if sender:
+    args['sender'] = sender
+print(json.dumps(args))
+" "$target_agent" "$msg" "$sidechat" "$sender")
+        call_exec "notify.send" "$args"
+        ;;
     thread)
         sub="${1:-list}"
         shift || true
@@ -262,6 +329,70 @@ case "$cmd" in
                 args=$(python3 -c "import json, sys; print(json.dumps({'job': sys.argv[1]}))" "$name")
                 call_exec "cron.run" "$args"
                 ;;
+            put)
+                name="${1:?usage: box cron put <name> '<json-definition>'}"
+                json_def="${2:?usage: box cron put <name> '<json-definition>'}"
+                args=$(python3 -c "
+import json, sys
+try:
+    definition = json.loads(sys.argv[2])
+except Exception as e:
+    sys.stderr.write('invalid job JSON: %s\n' % e)
+    sys.exit(2)
+print(json.dumps({'name': sys.argv[1], 'definition': definition}))
+" "$name" "$json_def")
+                call_exec "job.put" "$args"
+                ;;
+            trigger)
+                name="${1:?usage: box cron trigger <name>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
+                call_exec "job.trigger" "$args"
+                ;;
+            chain)
+                from_job="${1:?usage: box cron chain <from> <to> [--on-failure]}"
+                shift || true
+                on_failure=""
+                to_job=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --on-failure) on_failure="1"; shift ;;
+                        *) if [ -z "$to_job" ]; then to_job="$1"; fi; shift ;;
+                    esac
+                done
+                to_job="${to_job:?usage: box cron chain <from> <to> [--on-failure]}"
+                args=$(python3 -c "
+import json, sys
+frm, to, onfail = sys.argv[1:4]
+args = {'from': frm, 'to': to}
+if onfail:
+    args['on_failure'] = True
+print(json.dumps(args))
+" "$from_job" "$to_job" "$on_failure")
+                call_exec "job.chain" "$args"
+                ;;
+            next)
+                job_id=""
+                success=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --success) success="1"; shift ;;
+                        --fail) success="0"; shift ;;
+                        *) if [ -z "$job_id" ]; then job_id="$1"; fi; shift ;;
+                    esac
+                done
+                job_id="${job_id:?usage: box cron next <job-id> [--success|--fail]}"
+                args=$(python3 -c "
+import json, sys
+jid, success = sys.argv[1:3]
+args = {'job_id': jid}
+if success == '1':
+    args['success'] = True
+elif success == '0':
+    args['success'] = False
+print(json.dumps(args))
+" "$job_id" "$success")
+                call_exec "job.next" "$args"
+                ;;
             timer-create)
                 name="${1:?usage: box cron timer-create <name>}"
                 args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
@@ -273,7 +404,7 @@ case "$cmd" in
                 call_exec "cron.timer_start" "$args"
                 ;;
             *)
-                echo "Usage: box cron runs|status|view|run|timer-create|timer-start ..."
+                echo "Usage: box cron runs|status|view|run|put|trigger|chain|next|timer-create|timer-start ..."
                 ;;
         esac
         ;;
@@ -291,6 +422,16 @@ case "$cmd" in
                 args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
                 call_exec "cron.timer_start" "$args"
                 ;;
+            stop)
+                name="${1:?usage: box timer stop <name>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
+                call_exec "cron.timer_stop" "$args"
+                ;;
+            disable)
+                name="${1:?usage: box timer disable <name>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
+                call_exec "cron.timer_disable" "$args"
+                ;;
             status|view|list)
                 name="${1:-heartbeat}"
                 args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
@@ -304,7 +445,7 @@ case "$cmd" in
                 call_exec "followup.create" "$args"
                 ;;
             *)
-                echo "Usage: box timer create|start|status <name> OR box timer in <minutes> <prompt>"
+                echo "Usage: box timer create|start|stop|enable|disable|status <name> OR box timer in <minutes> <prompt>"
                 ;;
         esac
         ;;
@@ -353,6 +494,125 @@ case "$cmd" in
                 ;;
         esac
         ;;
+    loop)
+        sub="${1:?usage: box loop remediate|resolve ...}"
+        shift || true
+        case "$sub" in
+            remediate)
+                dry=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --dry-run) dry="1"; shift ;;
+                        *) break ;;
+                    esac
+                done
+                if [ -n "$dry" ]; then
+                    args='{"dry_run": true}'
+                else
+                    args='{}'
+                fi
+                call_exec "loop.remediate" "$args"
+                ;;
+            resolve)
+                dm_id="${1:?usage: box loop resolve <dm_id> [note...]}"
+                shift || true
+                note="$*"
+                args=$(python3 -c "
+import json, sys
+dm_id, note = sys.argv[1:3]
+args = {'dm_id': dm_id}
+if note:
+    args['note'] = note
+print(json.dumps(args))
+" "$dm_id" "$note")
+                call_exec "loop.resolve" "$args"
+                ;;
+            *)
+                echo "Usage: box loop remediate [--dry-run] OR box loop resolve <dm_id> [note...]"
+                ;;
+        esac
+        ;;
+    strat)
+        sub="${1:?usage: box strat set|reset ...}"
+        shift || true
+        case "$sub" in
+            set)
+                stype="${1:?usage: box strat set <type> [options]}"
+                shift || true
+                subtype=""
+                agent=""
+                track=""
+                priority=""
+                timeout_s=""
+                nudges=""
+                escalate=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --subtype) subtype="$2"; shift 2 ;;
+                        --agent) agent="$2"; shift 2 ;;
+                        --track) track="$2"; shift 2 ;;
+                        --priority) priority="$2"; shift 2 ;;
+                        --timeout) timeout_s="$2"; shift 2 ;;
+                        --nudges) nudges="$2"; shift 2 ;;
+                        --escalate) escalate="$2"; shift 2 ;;
+                        *) break ;;
+                    esac
+                done
+                args=$(python3 -c "
+import json, sys
+stype, subtype, agent, track, prio, timeout_s, nudges, esc = sys.argv[1:9]
+args = {'type': stype}
+if subtype:
+    args['subtype'] = subtype
+if agent:
+    args['agent'] = agent
+if track.lower() == 'true':
+    args['track'] = True
+elif track.lower() == 'false':
+    args['track'] = False
+elif track:
+    sys.stderr.write('track must be true|false\n')
+    sys.exit(2)
+if prio:
+    args['priority'] = prio
+if timeout_s:
+    args['timeout_s'] = int(timeout_s)
+if nudges:
+    args['nudges'] = int(nudges)
+if esc:
+    args['escalate'] = esc
+print(json.dumps(args))
+" "$stype" "$subtype" "$agent" "$track" "$priority" "$timeout_s" "$nudges" "$escalate")
+                call_exec "strat.set" "$args"
+                ;;
+            reset)
+                stype="${1:?usage: box strat reset <type> [subtype] [--agent <agent>]}"
+                shift || true
+                subtype=""
+                agent=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --agent) agent="$2"; shift 2 ;;
+                        *) if [ -z "$subtype" ]; then subtype="$1"; fi; shift ;;
+                    esac
+                done
+                args=$(python3 -c "
+import json, sys
+stype, subtype, agent = sys.argv[1:4]
+args = {'type': stype}
+if subtype:
+    args['subtype'] = subtype
+if agent:
+    args['agent'] = agent
+print(json.dumps(args))
+" "$stype" "$subtype" "$agent")
+                call_exec "strat.reset" "$args"
+                ;;
+            *)
+                echo "Usage: box strat set <type> [options] OR box strat reset <type> [subtype] [--agent <agent>]"
+                ;;
+        esac
+        ;;
     vars)
         sub="${1:-list}"
         shift || true
@@ -371,8 +631,26 @@ case "$cmd" in
                 args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1], 'value': sys.argv[2]}))" "$name" "$val")
                 call_exec "vars.set" "$args"
                 ;;
+            reset)
+                name="${1:?usage: box vars reset <name>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'name': sys.argv[1]}))" "$name")
+                call_exec "vars.reset" "$args"
+                ;;
+            rollback)
+                name="${1:?usage: box vars rollback <name> [revision]}"
+                rev="${2:-}"
+                args=$(python3 -c "
+import json, sys
+name, rev = sys.argv[1:3]
+args = {'name': name}
+if rev:
+    args['revision'] = int(rev) if rev.isdigit() else rev
+print(json.dumps(args))
+" "$name" "$rev")
+                call_exec "vars.rollback" "$args"
+                ;;
             *)
-                echo "Usage: box vars list|get|set ..."
+                echo "Usage: box vars list|get|set|reset|rollback ..."
                 ;;
         esac
         ;;
@@ -430,6 +708,272 @@ case "$cmd" in
                 ;;
         esac
         ;;
+    git)
+        sub="${1:-status}"
+        shift || true
+        case "$sub" in
+            status)
+                call_exec "git.status" "{}"
+                ;;
+            diff)
+                stat=""
+                path=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --stat) stat="1"; shift ;;
+                        --path) path="$2"; shift 2 ;;
+                        *) if [ -z "$path" ]; then path="$1"; fi; shift ;;
+                    esac
+                done
+                args=$(python3 -c "
+import json, sys
+stat, path = sys.argv[1:3]
+args = {}
+if stat:
+    args['stat'] = True
+if path:
+    args['path'] = path
+print(json.dumps(args))
+" "$stat" "$path")
+                call_exec "git.diff" "$args"
+                ;;
+            log)
+                limit=""
+                path=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --limit) limit="$2"; shift 2 ;;
+                        --path) path="$2"; shift 2 ;;
+                        *) if [ -z "$limit" ]; then limit="$1"; fi; shift ;;
+                    esac
+                done
+                limit="${limit:-10}"
+                args=$(python3 -c "
+import json, sys
+limit, path = sys.argv[1:3]
+args = {'limit': int(limit)}
+if path:
+    args['path'] = path
+print(json.dumps(args))
+" "$limit" "$path")
+                call_exec "git.log" "$args"
+                ;;
+            *)
+                echo "Usage: box git status|diff|log ..."
+                ;;
+        esac
+        ;;
+    tests)
+        sub="${1:-run}"
+        shift || true
+        case "$sub" in
+            run)
+                test_mod=""
+                filt=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --filter) filt="$2"; shift 2 ;;
+                        *) if [ -z "$test_mod" ]; then test_mod="$1"; fi; shift ;;
+                    esac
+                done
+                args=$(python3 -c "
+import json, sys
+mod, filt = sys.argv[1:3]
+args = {}
+if mod:
+    args['test'] = mod
+if filt:
+    args['filter'] = filt
+print(json.dumps(args))
+" "$test_mod" "$filt")
+                call_exec "tests.run" "$args"
+                ;;
+            *)
+                echo "Usage: box tests run [tests.<module>] [--filter <pattern>]"
+                ;;
+        esac
+        ;;
+    approvals)
+        sub="${1:-check}"
+        shift || true
+        case "$sub" in
+            check)
+                node="${1:-}"
+                if [ -n "$node" ]; then
+                    args=$(python3 -c "import json, sys; print(json.dumps({'node': sys.argv[1]}))" "$node")
+                else
+                    args="{}"
+                fi
+                call_exec "approval.check" "$args"
+                ;;
+            allow)
+                node=""
+                message=""
+                main_chat=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --message) message="$2"; shift 2 ;;
+                        --allow-main-chat) main_chat="1"; shift ;;
+                        *) if [ -z "$node" ]; then node="$1"; fi; shift ;;
+                    esac
+                done
+                node="${node:?usage: box approvals allow <node> --message <text> [--allow-main-chat]}"
+                [ -n "$message" ] || { echo "usage: box approvals allow <node> --message <text> [--allow-main-chat]" >&2; exit 2; }
+                args=$(python3 -c "
+import json, sys
+node, message, main = sys.argv[1:4]
+args = {'node': node, 'message': message}
+if main:
+    args['allow_main_chat'] = True
+print(json.dumps(args))
+" "$node" "$message" "$main_chat")
+                call_exec "approval.allow" "$args"
+                ;;
+            deny)
+                node=""
+                message=""
+                main_chat=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --message) message="$2"; shift 2 ;;
+                        --allow-main-chat) main_chat="1"; shift 2 ;;
+                        *) if [ -z "$node" ]; then node="$1"; fi; shift ;;
+                    esac
+                done
+                node="${node:?usage: box approvals deny <node> --message <text> [--allow-main-chat]}"
+                [ -n "$message" ] || { echo "usage: box approvals deny <node> --message <text> [--allow-main-chat]" >&2; exit 2; }
+                args=$(python3 -c "
+import json, sys
+node, message, main = sys.argv[1:4]
+args = {'node': node, 'message': message}
+if main:
+    args['allow_main_chat'] = True
+print(json.dumps(args))
+" "$node" "$message" "$main_chat")
+                call_exec "approval.deny" "$args"
+                ;;
+            auto)
+                node="${1:-}"
+                if [ -n "$node" ]; then
+                    args=$(python3 -c "import json, sys; print(json.dumps({'node': sys.argv[1]}))" "$node")
+                else
+                    args="{}"
+                fi
+                call_exec "approval.auto" "$args"
+                ;;
+            *)
+                echo "Usage: box approvals check|allow|deny|auto ..."
+                ;;
+        esac
+        ;;
+    md)
+        sub="${1:-audit}"
+        shift || true
+        case "$sub" in
+            audit)
+                args=$(python3 -c "
+import json, sys
+accts = [a for a in sys.argv[1:] if a]
+print(json.dumps({'accounts': accts} if accts else {}))
+" "$@")
+                call_exec "md.audit" "$args"
+                ;;
+            list)
+                account="${1:?usage: box md list <account> [path]}"
+                path="${2:-}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'account': sys.argv[1], 'path': sys.argv[2]}))" "$account" "$path")
+                call_exec "md.list" "$args"
+                ;;
+            read)
+                account="${1:?usage: box md read <account> <filename>}"
+                filename="${2:?usage: box md read <account> <filename>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'account': sys.argv[1], 'filename': sys.argv[2]}))" "$account" "$filename")
+                call_exec "md.read" "$args"
+                ;;
+            diff)
+                account="${1:?usage: box md diff <account> <filename>}"
+                filename="${2:?usage: box md diff <account> <filename>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'account': sys.argv[1], 'filename': sys.argv[2]}))" "$account" "$filename")
+                call_exec "md.diff" "$args"
+                ;;
+            pull)
+                account="${1:?usage: box md pull <account> <filename>}"
+                filename="${2:?usage: box md pull <account> <filename>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'account': sys.argv[1], 'filename': sys.argv[2]}))" "$account" "$filename")
+                call_exec "md.pull" "$args"
+                ;;
+            inject-drive)
+                account="${1:?usage: box md inject-drive <account>}"
+                args=$(python3 -c "import json, sys; print(json.dumps({'account': sys.argv[1]}))" "$account")
+                call_exec "md.inject_drive" "$args"
+                ;;
+            sync-all)
+                call_exec "md.sync_all" "{}"
+                ;;
+            amend)
+                filename="${1:?usage: box md amend <filename> (--content <text>|--file <path>) [--author <name>] [--reason <why>]}"
+                shift || true
+                content=""; content_src=""; author="operator"; reason=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --content) content="$2"; content_src="arg"; shift 2 ;;
+                        --file) content="$2"; content_src="file"; shift 2 ;;
+                        --author) author="$2"; shift 2 ;;
+                        --reason) reason="$2"; shift 2 ;;
+                        *) echo "usage: box md amend <filename> (--content <text>|--file <path>) [--author <name>] [--reason <why>]" >&2; exit 2 ;;
+                    esac
+                done
+                [ -n "$content_src" ] || { echo "usage: box md amend <filename> (--content <text>|--file <path>) [--author <name>] [--reason <why>]" >&2; exit 2; }
+                args=$(python3 -c "
+import json, sys
+fn, src, val, author, reason = sys.argv[1:6]
+content = open(val, encoding='utf-8').read() if src == 'file' else val
+args = {'filename': fn, 'content': content, 'author': author}
+if reason:
+    args['reason'] = reason
+print(json.dumps(args))
+" "$filename" "$content_src" "$content" "$author" "$reason")
+                call_exec "md.amend" "$args"
+                ;;
+            append)
+                filename="${1:?usage: box md append <filename> (--content <text>|--file <path>) [--author <name>] [--section <header>]}"
+                shift || true
+                text=""; text_src=""; author="operator"; section=""
+                while [ $# -gt 0 ]; do
+                    case "$1" in
+                        --content) text="$2"; text_src="arg"; shift 2 ;;
+                        --file) text="$2"; text_src="file"; shift 2 ;;
+                        --author) author="$2"; shift 2 ;;
+                        --section) section="$2"; shift 2 ;;
+                        *) echo "usage: box md append <filename> (--content <text>|--file <path>) [--author <name>] [--section <header>]" >&2; exit 2 ;;
+                    esac
+                done
+                [ -n "$text_src" ] || { echo "usage: box md append <filename> (--content <text>|--file <path>) [--author <name>] [--section <header>]" >&2; exit 2; }
+                args=$(python3 -c "
+import json, sys
+fn, src, val, author, section = sys.argv[1:6]
+text = open(val, encoding='utf-8').read() if src == 'file' else val
+args = {'filename': fn, 'text': text, 'author': author}
+if section:
+    args['section'] = section
+print(json.dumps(args))
+" "$filename" "$text_src" "$text" "$author" "$section")
+                call_exec "md.append" "$args"
+                ;;
+            *)
+                echo "Usage: box md audit|list|read|diff|pull|inject-drive|sync-all|amend|append ..."
+                ;;
+        esac
+        ;;
+    unread)
+        target_agent="${1:-}"
+        if [ -n "$target_agent" ]; then
+            args=$(python3 -c "import json, sys; print(json.dumps({'agent': sys.argv[1]}))" "$target_agent")
+        else
+            args="{}"
+        fi
+        call_exec "fleet.unread" "$args"
+        ;;
     health|fleet-status)
         call_exec "health.check" "{}"
         ;;
@@ -464,21 +1008,54 @@ Usage:
   box deploy pipeline <name>
   box dm send --to <agent> [--target <target>] <message>
   box dm read [<target=main>] [<limit=10>]
+  box dm log [<limit=20>] [--agent <agent>]
+  box dm ack <id> --to <agent> --sender <agent> [--sidechat <name>]
+  box notify <agent> [--sidechat <name>] [--sender <agent>] <message...>
   box thread list [<agent>]
   box thread view <thread_id> [<limit=15>]
   box cron runs
   box cron status [<name=heartbeat>]
   box cron view <name>
   box cron run <name>
+  box cron put <name> '<json-definition>'
+  box cron trigger <name>
+  box cron chain <from> <to> [--on-failure]
+  box cron next <job-id> [--success|--fail]
+  box timer stop <name>
+  box timer disable <name>
   box vars list
   box vars get <name>
   box vars set <name> <value>
+  box vars reset <name>
+  box vars rollback <name> [revision]
+  box strat set <type> [--subtype S] [--agent A] [--track b] [--priority p] [--timeout N] [--nudges N] [--escalate E]
+  box strat reset <type> [subtype] [--agent <agent>]
+  box loop remediate [--dry-run]
+  box loop resolve <dm_id> [note...]
   box files read <path> [lines=100]
   box files write <path> <content>
   box web fetch <url>
   box service status <unit>
   box service restart <unit>
+  box git status
+  box git diff [--stat] [--path <path>]
+  box git log [<limit=10>] [--path <path>]
+  box tests run [tests.<module>] [--filter <pattern>]
+  box md audit [accounts...]
+  box md list <account> [path]
+  box md read <account> <filename>
+  box md diff <account> <filename>
+  box md pull <account> <filename>
+  box md inject-drive <account>
+  box md sync-all
+  box md amend <filename> (--content <text>|--file <path>) [--author <name>] [--reason <why>]
+  box md append <filename> (--content <text>|--file <path>) [--author <name>] [--section <header>]
+  box approvals check [node]
+  box approvals allow <node> --message <text> [--allow-main-chat]
+  box approvals deny <node> --message <text> [--allow-main-chat]
+  box approvals auto [node]
   box health
+  box unread [<agent>]
   box ping
   box ops
 

bin/box-stability-watcher.py

@@ -0,0 +1 @@
+../watchers/box-stability-watcher.py

bin/box-tui.py

@@ -0,0 +1 @@
+muse-tui.py

bin/cdp-latency-check.sh

@@ -17,7 +17,25 @@ source "$BIN_DIR/netvm-names.sh"
 
 TIMEOUT_S=10
 
-for node in muse pip 646 opm; do
+# Registry-driven node list (was hardcoded 4 nodes; def/dev had no
+# cdp-latency coverage — 2026-10-06).
+watched_nodes() {
+  "$BIN_DIR/netvm-registry.py" 2>/dev/null | cut -d: -f1
+}
+
+# Allow sourcing for tests without running checks.
+if [ "${CDP_LATENCY_CHECK_LIB_ONLY:-}" = "1" ]; then
+  return 0 2>/dev/null || exit 0
+fi
+
+NODES="$(watched_nodes)"
+if [ -z "$NODES" ]; then
+  echo "node registry empty/unreadable" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC2086 (intended word splitting: one node per word)
+for node in $NODES; do
   netvm_names "$node"
   url="http://${PEER_IP}:${CDP_PORT}/json/version"
   probe=$(curl -s -m "$TIMEOUT_S" -o /dev/null -w "%{time_total} %{http_code}" "$url" 2>/dev/null)

bin/cdp-relay-watchdog.sh

@@ -13,10 +13,14 @@
 # Pattern mirrors chromebox-watchdog.sh (stage-specific logging, rotation).
 set -euo pipefail
 LOCK="/tmp/cdp-relay-watchdog.lock"
-exec 9>"$LOCK"
+# Tests source this file with CDP_RELAY_WATCHDOG_LIB_ONLY=1: they call
-if ! flock -n 9; then
+# helpers without running checks, so no lock is needed.
-  echo "[$(date -u +%FT%TZ)] another relay watchdog run in progress, skipping" >&2
+if [ "${CDP_RELAY_WATCHDOG_LIB_ONLY:-}" != "1" ]; then
-  exit 0
+  exec 9>"$LOCK"
+  if ! flock -n 9; then
+    echo "[$(date -u +%FT%TZ)] another relay watchdog run in progress, skipping" >&2
+    exit 0
+  fi
 fi
 
 NETVM_BIN="/home/super/Projects/NetVM/bin"
@@ -37,16 +41,16 @@ log() { echo "[$(date -u +%FT%TZ)] $*" | tee -a "$LOG"; }
 
 # node -> "veth_ip:port" via netvm-names.sh (hash-derived, don't hardcode)
 relay_target() {
-  local node="$1"
+  local node="$1" reg_port=""
   # shellcheck disable=SC1091
   . "$NETVM_BIN/netvm-names.sh"
   netvm_names "$node" || return 1
-  # CDP_PORT_OVERRIDE pins registry ports; fall back to hash-derived
+  # The registry is the source of truth for ports (new nodes propagate
-  local port="${CDP_PORT_OVERRIDE:-$CDP_PORT}"
+  # automatically); netvm-names pinning is the fallback.
-  case "$node" in
+  if reg_port=$("$NETVM_BIN/netvm-registry.py" "$node" 2>/dev/null); then
-    muse) port=9410 ;; pip) port=9420 ;; 646) port=9430 ;; opm) port=9440 ;;
+    [ -n "$reg_port" ] && CDP_PORT="$reg_port"
-  esac
+  fi
-  echo "$PEER_IP:$port"
+  echo "$PEER_IP:$CDP_PORT"
 }
 node_port() { echo "${1##*:}"; }
 
@@ -103,8 +107,25 @@ restart_relay() {
   fi
 }
 
+# Registry-driven node list: every active node gets relay supervision
+# (the old hardcoded 4-node list left def/dev unsupervised — 2026-10-06).
+watched_nodes() {
+  "$NETVM_BIN/netvm-registry.py" 2>/dev/null | cut -d: -f1
+}
+
+# Allow sourcing for tests without running checks.
+if [ "${CDP_RELAY_WATCHDOG_LIB_ONLY:-}" = "1" ]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 FAILED=0
-for node in muse pip 646 opm; do
+NODES="$(watched_nodes)"
+if [ -z "$NODES" ]; then
+  log "FAIL_LOUD: node registry empty/unreadable, skipping run"
+  exit 1
+fi
+# shellcheck disable=SC2086 (intended word splitting: one node per word)
+for node in $NODES; do
   # Stage 1: host veth IP. Fail loud, skip relay restart (pointless).
   if ! veth_healthy "$node"; then
     read -r veth gw <<< "$(node_veth "$node")"

bin/chrome-error-scan.sh

@@ -2,10 +2,14 @@
 # chrome-error-scan.sh - scan per-profile chrome logs for concerning patterns.
 # Self-contained: scans, compares against watermark, reports only NEW matches.
 #
-# Usage: chrome-error-scan.sh [--json]
+# Usage: chrome-error-scan.sh [--json] [--no-advance]
 #   Default output: "profile:new_count" lines for profiles with new matches,
 #                   or "OK: no new errors" if clean.
 #   --json: output JSON {"profile": {"total": N, "new": M}, ...}
+#   --no-advance: report against the watermark WITHOUT advancing it.
+#                 Peek-only read for high-frequency pollers (e.g. the web
+#                 surface via `box-ctl chrome-errors --no-advance`). Runs
+#                 without the flag keep the classic advance-on-read semantics.
 #
 # Watermark: /home/super/Projects/NetVM/chrome-error-watermark.json
 # Patterns: FATAL, crash, segfault, out of memory (case-insensitive)
@@ -13,6 +17,16 @@
 LOGDIR="/home/super/Projects/NetVM"
 WATERMARK="$LOGDIR/chrome-error-watermark.json"
 
+AS_JSON=0
+NO_ADVANCE=0
+for arg in "$@"; do
+  case "$arg" in
+    --json) AS_JSON=1 ;;
+    --no-advance) NO_ADVANCE=1 ;;
+    *) echo "chrome-error-scan.sh: unknown argument: $arg" >&2; exit 2 ;;
+  esac
+done
+
 # Gather current counts per profile (grep -c prints 0 with exit 1 on no match;
 # the || true masks the exit code while preserving the "0" on stdout)
 get_count() {
@@ -29,7 +43,7 @@ PIP_C=$(get_count pip)
 N646_C=$(get_count 646)
 OPM_C=$(get_count opm)
 
-python3 - "$WATERMARK" "$MUSE_C" "$PIP_C" "$N646_C" "$OPM_C" "$1" <<'PYEOF'
+python3 - "$WATERMARK" "$MUSE_C" "$PIP_C" "$N646_C" "$OPM_C" "$AS_JSON" "$NO_ADVANCE" <<'PYEOF'
 import json, sys, os
 
 watermark_path = sys.argv[1]
@@ -39,7 +53,8 @@ current = {
     "646": int(sys.argv[4]),
     "opm": int(sys.argv[5]),
 }
-as_json = len(sys.argv) > 6 and sys.argv[6] == "--json"
+as_json = len(sys.argv) > 6 and sys.argv[6] == "1"
+no_advance = len(sys.argv) > 7 and sys.argv[7] == "1"
 
 # Load watermark (tolerate missing/corrupt file -> treat as all-zero)
 watermark = {}
@@ -73,9 +88,12 @@ else:
     if not any_new:
         print("OK: no new errors")
 
-# Update watermark atomically
+# Update watermark atomically (skipped in --no-advance peek mode: the
-tmp = watermark_path + ".tmp"
+# caller gets a read-only view and the CLI's advance-on-read semantics are
-with open(tmp, "w") as f:
+# left untouched).
-    json.dump({"counts": current}, f, indent=2)
+if not no_advance:
-os.replace(tmp, watermark_path)
+    tmp = watermark_path + ".tmp"
+    with open(tmp, "w") as f:
+        json.dump({"counts": current}, f, indent=2)
+    os.replace(tmp, watermark_path)
 PYEOF

bin/chromebox-watchdog.sh

@@ -15,10 +15,14 @@ export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=${XDG_RUN
 # concurrent runs kill each others chrome (observed 2026-10-03: pip flapped
 # with simultaneous "relaunch OK" and "relaunch FAILED").
 LOCK="/tmp/chromebox-watchdog-${1:-pip}.lock"
-exec 9>"$LOCK"
+# Tests source this file with CHROMEBOX_WATCHDOG_LIB_ONLY=1: they resolve
-if ! flock -n 9; then
+# ports and call helpers without running checks, so no lock is needed.
-  echo "[$(date -u +%FT%TZ)] [$1] another watchdog run in progress, skipping" >&2
+if [ "${CHROMEBOX_WATCHDOG_LIB_ONLY:-}" != "1" ]; then
-  exit 0
+  exec 9>"$LOCK"
+  if ! flock -n 9; then
+    echo "[$(date -u +%FT%TZ)] [$1] another watchdog run in progress, skipping" >&2
+    exit 0
+  fi
 fi
 
 PROFILE="${1:-pip}"
@@ -40,13 +44,15 @@ rotate_log() {
 rotate_log "$LOG"
 # CHROME_LOG rotation happens after PROFILE is set (see below)
 
-case "$PROFILE" in
+# Ports come from the fleet registry, not a hardcoded list: every active
-  muse) CDP_PORT=9410 ;;
+# node (def/dev included) gets supervision automatically. The old 4-profile
-  pip)  CDP_PORT=9420 ;;
+# case left dev/def unsupervised — a dead Warp tunnel paged forever with
-  646)  CDP_PORT=9430 ;;
+# no auto-recovery (2026-10-06 dev outage).
-  opm)  CDP_PORT=9440 ;;
+CDP_PORT="$("$NETVM_BIN/netvm-registry.py" "$PROFILE" 2>/dev/null)" || {
-  *) echo "unknown profile: $PROFILE" >&2; exit 1 ;;
+  echo "unknown profile: $PROFILE" >&2
-esac
+  exit 1
+}
+[ -n "$CDP_PORT" ] || { echo "unknown profile: $PROFILE" >&2; exit 1; }
 rotate_log "$CHROME_LOG"
 
 log() { echo "[$(date -u +%FT%TZ)] [$PROFILE] $*" | tee -a "$LOG"; }
@@ -64,9 +70,9 @@ healthy() {
   local list
   list="$(cdp_list)" \
     || { HEALTH_FAIL_REASON="CDP unreachable on :$CDP_PORT"; return 1; }
-  echo "$list" | grep -q '"type": "page"' \
+  [[ "$list" == *'"type": "page"'* ]] \
     || { HEALTH_FAIL_REASON="CDP up but no page target in list"; return 1; }
-  echo "$list" | grep -E -q '"url": "https://muse\.ai' \
+  [[ "$list" == *'"url": "https://muse.ai'* ]] \
     || { HEALTH_FAIL_REASON="CDP up but not on muse.ai"; return 1; }
   warp_egress_healthy || return 1
   return 0
@@ -107,7 +113,18 @@ print(h*3600 + mi*60 + se)
   esac
 }
 
+# Allow sourcing for tests without running checks.
+if [ "${CHROMEBOX_WATCHDOG_LIB_ONLY:-}" = "1" ]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 if healthy; then
+  # Auto-reconcile idle workers for healthy profiles
+  # DISABLED 2026-10-06 by operator-646: kpi auto-spawn ignores job schedule fields;
+  # find_pending_work_for_node returns the alphabetically-first definition every tick,
+  # re-spawning and re-noticing every ~2min (pip b01 BOX-AUTO-WORKER loop, 29+ copies).
+  # Watchdog health path untouched. Re-enable once the spawner is schedule-aware.
+  # python3 "$NETVM_BIN/super-cli.py" kpi auto-spawn --node "$PROFILE" >>"$LOG" 2>&1 || true
   exit 0
 fi
 

bin/completion-audit.py

@@ -0,0 +1,312 @@
+#!/usr/bin/env python3
+"""Completion auditor: prove work gets done, or say exactly where it stalls.
+
+Runs on a 15-minute systemd timer (systemd/completion-audit.*). Reads
+job-log.jsonl, swarms.json, and followups.json; computes the completion
+funnel per job family plus swarm drain and followup backlog; writes a JSON
+report under logs/ and posts a compact digest to the ops heartbeat sidechat
+when degraded (or a heartbeat summary every 6h when green).
+
+Read-only except the digest DM and its own log/state files. Exit 0 always
+on a completed audit; tracebacks (real errors) fail the timer visibly.
+"""
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+from collections import Counter, defaultdict
+from datetime import datetime, timezone, timedelta
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+JOB_LOG = REPO_ROOT / "job-log.jsonl"
+SWARMS_FILE = REPO_ROOT / "swarms.json"
+FOLLOWUPS_FILE = REPO_ROOT / "followups.json"
+LOGS_DIR = REPO_ROOT / "logs"
+STATE_FILE = LOGS_DIR / "completion-audit-state.json"
+
+_JOB_ID_RE = re.compile(r"^(.+)-(\d{8})-(\d{6})-([0-9a-f]{8})$")
+HEARTBEAT_INTERVAL_H = 6
+STALE_RUNNING_MIN = 90
+SILENT_MIN_SENT = 3
+
+
+def utcnow():
+    return datetime.now(timezone.utc)
+
+
+def family_of(job_id):
+    """Strip the dispatch suffix (<name>-YYYYMMDD-HHMMSS-<hex8>) to the family."""
+    m = _JOB_ID_RE.match(job_id or "")
+    return m.group(1) if m else (job_id or "?")
+
+
+def parse_ts(ts):
+    try:
+        t = datetime.fromisoformat(str(ts))
+    except Exception:
+        return None
+    if t.tzinfo is None:
+        t = t.replace(tzinfo=timezone.utc)
+    return t
+
+
+def compute_funnel(events, cutoff):
+    """Aggregate job-log events since cutoff.
+
+    Returns (families, tools) where families maps family -> counters and
+    tools holds global tool_exec stats. Pure over the event list.
+    """
+    families = defaultdict(lambda: Counter())
+    tools = Counter()
+    tool_errs = Counter()
+    for e in events:
+        t = parse_ts(e.get("ts"))
+        if t is None or t < cutoff:
+            continue
+        ty = e.get("type")
+        if ty == "job_sent":
+            families[family_of(e.get("job_id"))]["sent"] += 1
+        elif ty == "job_dispatched":
+            families[family_of(e.get("job_id"))]["dispatched"] += 1
+        elif ty == "tool_exec":
+            tools["total"] += 1
+            if e.get("success"):
+                tools["ok"] += 1
+            else:
+                tools["fail"] += 1
+                tool_errs[e.get("op", "?")] += 1
+        elif ty == "job_result":
+            fam = family_of(e.get("job_id"))
+            families[fam]["results"] += 1
+            families[fam]["ok" if e.get("success") else "fail"] += 1
+        elif ty == "job_failed":
+            families[family_of(e.get("job_id"))]["failed"] += 1
+        elif ty == "fallback_executed":
+            families[family_of(e.get("job_id"))]["fallback_ok"] += 1
+        elif ty == "fallback_failed":
+            families[family_of(e.get("job_id"))]["fallback_fail"] += 1
+        elif ty == "proof_requested":
+            families[family_of(e.get("job_id"))]["proofs"] += 1
+    return families, {"tools": tools, "tool_errs": tool_errs}
+
+
+def swarm_drain(now):
+    """Status counts + stale-running slots from swarms.json."""
+    try:
+        data = json.load(open(SWARMS_FILE))
+    except Exception:
+        return {"error": "swarms.json unreadable"}, []
+    values = data.values() if isinstance(data, dict) else data
+    status = Counter()
+    stale = []
+    for s in values:
+        if not isinstance(s, dict):
+            continue
+        for sl in s.get("slots", []) or []:
+            status[sl.get("status", "?")] += 1
+            if sl.get("status") == "running":
+                upd = parse_ts(sl.get("updated_ts"))
+                if upd and (now - upd) > timedelta(minutes=STALE_RUNNING_MIN):
+                    stale.append({
+                        "swarm": s.get("swarm_id"),
+                        "slot": sl.get("slot"),
+                        "agent": sl.get("agent_id"),
+                        "idle_min": int((now - upd).total_seconds() // 60),
+                    })
+    return {"slots": dict(status)}, stale
+
+
+def followup_backlog(now):
+    """Pending/overdue/escalated counts from followups.json."""
+    try:
+        data = json.load(open(FOLLOWUPS_FILE))
+    except Exception:
+        return {"error": "followups.json unreadable"}
+    values = data.values() if isinstance(data, dict) else data
+    out = Counter()
+    for r in values:
+        if not isinstance(r, dict):
+            continue
+        st = r.get("status", "?")
+        out[st] += 1
+        if st == "pending":
+            dl = parse_ts(r.get("deadline"))
+            if dl and dl < now:
+                out["overdue"] += 1
+    return dict(out)
+
+
+def build_report(hours):
+    now = utcnow()
+    cutoff = now - timedelta(hours=hours)
+    events = []
+    try:
+        with open(JOB_LOG) as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    events.append(json.loads(line))
+                except Exception:
+                    continue
+    except FileNotFoundError:
+        pass
+    families, tools = compute_funnel(events, cutoff)
+    fam = {k: dict(v) for k, v in sorted(families.items())}
+    swarm, stale = swarm_drain(now)
+    backlog = followup_backlog(now)
+    totals = Counter()
+    for v in fam.values():
+        for k, n in v.items():
+            totals[k] += n
+    silent = sorted(
+        k for k, v in fam.items()
+        if v.get("sent", 0) >= SILENT_MIN_SENT and v.get("results", 0) == 0)
+    degraded_reasons = []
+    if silent:
+        degraded_reasons.append(f"{len(silent)} silent families: {', '.join(silent[:5])}")
+    if totals.get("failed"):
+        degraded_reasons.append(f"{totals['failed']} job_failed")
+    if tools["tools"].get("fail"):
+        top = tools["tool_errs"].most_common(3)
+        degraded_reasons.append(
+            "tool errors: " + ", ".join(f"{op}x{n}" for op, n in top))
+    if totals.get("fallback_fail"):
+        degraded_reasons.append(f"{totals['fallback_fail']} fallback_failed")
+    if stale:
+        degraded_reasons.append(f"{len(stale)} running slots idle >{STALE_RUNNING_MIN}m")
+    if backlog.get("overdue"):
+        degraded_reasons.append(f"{backlog['overdue']} overdue followups")
+    if backlog.get("escalated"):
+        degraded_reasons.append(f"{backlog['escalated']} escalated followups")
+    return {
+        "ts": now.isoformat(),
+        "window_h": hours,
+        "totals": dict(totals),
+        "tools": {k: dict(v) if isinstance(v, Counter) else v
+                  for k, v in tools.items()},
+        "families": fam,
+        "silent_families": silent,
+        "swarms": swarm,
+        "stale_running": stale[:10],
+        "followups": backlog,
+        "degraded": bool(degraded_reasons),
+        "reasons": degraded_reasons,
+    }
+
+
+def render_digest(rep):
+    t = rep["totals"]
+    tools = rep["tools"].get("tools", {})
+    lines = [
+        f"Completion audit ({rep['window_h']}h, {rep['ts'][:16]}Z)",
+        f"funnel: {t.get('sent', 0)} sent / {t.get('dispatched', 0)} dispatched / "
+        f"{tools.get('total', 0)} tool_exec / {t.get('results', 0)} results "
+        f"({t.get('ok', 0)} ok)",
+    ]
+    if rep["silent_families"]:
+        lines.append("silent: " + ", ".join(rep["silent_families"][:6]))
+    bits = []
+    if t.get("failed"):
+        bits.append(f"{t['failed']} job_failed")
+    if tools.get("fail"):
+        bits.append(f"{tools['fail']} tool errors")
+    if t.get("fallback_ok") or t.get("fallback_fail"):
+        bits.append(f"fallback {t.get('fallback_ok', 0)} ok / {t.get('fallback_fail', 0)} fail")
+    if t.get("proofs"):
+        bits.append(f"{t['proofs']} proof reqs")
+    if bits:
+        lines.append("flags: " + ", ".join(bits))
+    sw = rep["swarms"].get("slots", {})
+    if sw:
+        lines.append("swarms now: " + " / ".join(f"{v} {k}" for k, v in sorted(sw.items())))
+    if rep["stale_running"]:
+        lines.append(f"stale running: {len(rep['stale_running'])} slots (see report)")
+    fb = rep["followups"]
+    if fb and "error" not in fb:
+        lines.append(
+            f"followups now: {fb.get('pending', 0)} pending / {fb.get('overdue', 0)} "
+            f"overdue / {fb.get('escalated', 0)} escalated")
+    if rep["degraded"]:
+        lines.append("verdict: DEGRADED — " + "; ".join(rep["reasons"][:3]))
+    else:
+        lines.append("verdict: HEALTHY — work flowing, results landing")
+    return "\n".join(lines)
+
+
+def should_post(report):
+    """Post on degraded, else heartbeat at most every HEARTBEAT_INTERVAL_H."""
+    if report["degraded"]:
+        return True, "degraded"
+    try:
+        state = json.load(open(STATE_FILE))
+        last = parse_ts(state.get("last_heartbeat"))
+    except Exception:
+        last = None
+    if last is None or (utcnow() - last) > timedelta(hours=HEARTBEAT_INTERVAL_H):
+        return True, "heartbeat"
+    return False, "green-quiet"
+
+
+def post_digest(digest):
+    argv = [sys.executable, str(REPO_ROOT / "bin" / "dm.py"), "send",
+           "--agent", "super", "--to", "opm", "--target", "heartbeat", digest]
+    p = subprocess.run(argv, capture_output=True, text=True, timeout=120)
+    return p.returncode == 0, (p.stdout or p.stderr or "").strip()[:300]
+
+
+def save_report(report):
+    LOGS_DIR.mkdir(parents=True, exist_ok=True)
+    stamp = report["ts"].replace("+00:00", "Z").replace(":", "")
+    dated = LOGS_DIR / f"completion-audit-{stamp[:15]}.json"
+    body = json.dumps(report, indent=2)
+    dated.write_text(body, encoding="utf-8")
+    latest = LOGS_DIR / "completion-audit-latest.json"
+    tmp = LOGS_DIR / f".completion-audit-latest.tmp.{os.getpid()}"
+    tmp.write_text(body, encoding="utf-8")
+    os.replace(tmp, latest)
+    return dated
+
+
+def main():
+    ap = argparse.ArgumentParser(description="Completion funnel auditor")
+    ap.add_argument("--hours", type=int, default=24)
+    ap.add_argument("--post", dest="post", action="store_true", default=True)
+    ap.add_argument("--no-post", dest="post", action="store_false")
+    ap.add_argument("--json", action="store_true", help="Print raw report JSON")
+    args = ap.parse_args()
+
+    report = build_report(args.hours)
+    path = save_report(report)
+    if args.json:
+        print(json.dumps(report, indent=2))
+    else:
+        print(render_digest(report))
+    print(f"\nreport: {path}")
+    if not args.post:
+        print("post: skipped (--no-post)")
+        return 0
+    do_post, why = should_post(report)
+    if not do_post:
+        print(f"post: skipped ({why})")
+        return 0
+    ok, detail = post_digest(render_digest(report))
+    print(f"post: {'delivered' if ok else 'FAILED'} ({why}) {detail[:120]}")
+    if ok and why == "heartbeat":
+        try:
+            state = {}
+            if STATE_FILE.exists():
+                state = json.loads(STATE_FILE.read_text(encoding="utf-8"))
+            state["last_heartbeat"] = report["ts"]
+            STATE_FILE.write_text(json.dumps(state, indent=2), encoding="utf-8")
+        except Exception as e:
+            print(f"warning: state save failed: {e}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/detect.py

@@ -1,33 +1,52 @@
 #!/usr/bin/env python3
 """
-Side-chat to main-chat work siphon — detection rules.
+Side-chat to main-chat work siphon — detection rules (REPAIRED, agent 2 of 5).
 
-Monitors side chat messages and identifies "siphon-worthy" content:
+Fixes the false-positive ✅ COMPLETED relay at the source:
-work that should surface in main chat for visibility.
+  "Sending is disabled until this conversation can be verified." → COMPLETED
+  was caused by a SINGLE keyword ("verified") matching one regex.
 
-Categories:
+Repairs (see OUTPUT.md for rationale):
-  COMPLETED  - work finished, results ready
+  1. COMPLETED requires >= 2 DISTINCT pattern hits (weighted: the structured
-  BLOCKER    - something is stuck, needs intervention
+     `[RESULT ...] OK` marker counts 2 — it is the fleet's own machine-emitted
-  DECISION   - a decision is needed from the user/operator
+     completion signal, far less ambiguous than a bare "done").
-  ALERT      - health/security/urgency signal
+  2. Negation guards: negation/failure-state words veto COMPLETED outright
-  MILESTONE  - significant progress checkpoint
+     (fail-closed: a negated completion claim is never relayed as complete).
+  3. Honest labeling: the fake "confidence 60%" (which literally meant "one
+     regex hit") is replaced by a keyword-hit count. SiphonHit.hits is the
+     authoritative field; `confidence` is kept for backward compatibility
+     but must NOT be rendered as a percentage anywhere user-facing.
+  4. Stale suppression: a message older than 15 minutes never relays as
+     COMPLETED. Pass message_ts (epoch seconds). monitor.py currently does
+     NOT pass a timestamp — agent 3 / the integrator must thread
+     message["ts"] through (see OUTPUT.md).
 
-Detection is purely pattern-based (raw Python, no AI).
+DO NOT overwrite the original detect.py with this file until the integrator
-Each rule returns (category, confidence, summary) or None.
+reconciles all 5 agents' outputs.
 """
 
 import re
-from dataclasses import dataclass
+import time
+from dataclasses import dataclass, field
 from typing import Optional
 
 
 @dataclass
 class SiphonHit:
     category: str       # COMPLETED, BLOCKER, DECISION, ALERT, MILESTONE
-    confidence: float   # 0.0 - 1.0
+    confidence: float   # LEGACY — kept for API compatibility only.
-    summary: str        # one-line summary for main chat
+                        # Do NOT render as "confidence NN%"; it is not a
-    thread_id: str      # source side chat
+                        # reliability measure. See `hits`.
-    message_id: str     # source message
+    hits: int = 0       # AUTHORITATIVE — distinct keyword-pattern hits
+                        # (weighted; see COMPLETED_PATTERN_WEIGHTS).
+    summary: str = ""   # one-line summary for main chat
+    thread_id: str = "" # source side chat
+    message_id: str = ""  # source message
+    author: str = ""    # INTEGRATOR (agent 3 absent) — the message's real
+                        # author, plumbed from message["author"] by
+                        # monitor.py. Empty = unknown; NEVER substitute the
+                        # thread's registered agent silently (see
+                        # format_siphon).
     # Full message text is NOT stored here — main chat gets a summary
     # plus a link back, never the full content (safety: no sensitive
     # data siphoned verbatim).
@@ -42,6 +61,11 @@ COMPLETED_PATTERNS = [
     re.compile(r'\b(merged|committed|pushed|published)\b', re.I),
 ]
 
+# Weighted hits: the structured [RESULT] OK marker is the fleet's own
+# machine-emitted completion signal — unambiguous enough to stand alone.
+COMPLETED_PATTERN_WEIGHTS = {0: 1, 1: 1, 2: 2, 3: 1}
+COMPLETED_MIN_WEIGHT = 2  # >= 2 distinct pattern hits (or one [RESULT] OK)
+
 BLOCKER_PATTERNS = [
     re.compile(r'\b(blocked|stuck|failing|broken|down|error|failed)\b', re.I),
     re.compile(r'\b(need|needs|waiting)\s+(your|approval|input|decision)\b', re.I),
@@ -75,9 +99,29 @@ SUPPRESS_PATTERNS = [
     re.compile(r'\[do not siphon\]', re.I),  # explicit opt-out marker
 ]
 
+# --- Negation guards: any match vetoes COMPLETED (fail-closed) ---
+# A completion claim in the presence of negation / failure-state language
+# is never relayed as ✅ COMPLETED, no matter how many keywords hit.
+NEGATION_GUARDS = [
+    # explicit negation
+    re.compile(r'\b(not|never|no|nothing|none|neither|nor)\b', re.I),
+    re.compile(r"\b(do not|don't|didn't|doesn't|won't|can't|cannot|isn't|aren't|"
+               r"wasn't|weren't|haven't|hasn't|hadn't|couldn't|shouldn't)\b", re.I),
+    # incompleteness hedges
+    re.compile(r'\b(still|yet|pending|unfinished|incomplete)\b', re.I),
+    # failure-state words (a "completed" message containing these is suspect)
+    re.compile(r'\b(broken|failed|failing|failure|down|stuck|blocked|disabled|'
+               r'error|errors|crash|crashed)\b', re.I),
+    # hedging conjunctions ("deployed, but tests are red")
+    re.compile(r'\b(but|however|although|though)\b', re.I),
+]
+
+# Messages older than this never relay as COMPLETED (seconds).
+COMPLETED_MAX_AGE_S = 15 * 60
+
 
 def _match_score(text: str, patterns) -> float:
-    """Return confidence based on how many patterns match."""
+    """Legacy confidence for non-COMPLETED categories (unchanged)."""
     hits = sum(1 for p in patterns if p.search(text))
     if hits == 0:
         return 0.0
@@ -85,6 +129,21 @@ def _match_score(text: str, patterns) -> float:
     return min(0.95, 0.6 + (hits - 1) * 0.2)
 
 
+def _completed_weight(text: str):
+    """
+    Return (weighted_hits, distinct_hits, matched_pattern_indexes) for
+    COMPLETED_PATTERNS. Weighted: [RESULT] OK counts 2.
+    """
+    matched = [i for i, p in enumerate(COMPLETED_PATTERNS) if p.search(text)]
+    weight = sum(COMPLETED_PATTERN_WEIGHTS.get(i, 1) for i in matched)
+    return weight, len(matched), matched
+
+
+def _is_negated(text: str) -> bool:
+    """True if any negation guard fires anywhere in the text."""
+    return any(p.search(text) for p in NEGATION_GUARDS)
+
+
 def _extract_summary(text: str, max_len: int = 120) -> str:
     """Extract a safe one-line summary. Strips to first meaningful line."""
     # Take first non-empty line, truncate
@@ -98,28 +157,58 @@ def _extract_summary(text: str, max_len: int = 120) -> str:
 
 
 def detect(text: str, thread_id: str, message_id: str,
-           min_confidence: float = 0.6) -> Optional[SiphonHit]:
+           min_confidence: float = 0.6,
+           message_ts: Optional[float] = None) -> Optional[SiphonHit]:
     """
     Check a side chat message for siphon-worthy content.
     Returns SiphonHit or None.
+
+    message_ts: epoch seconds of the original message (optional). Messages
+    older than COMPLETED_MAX_AGE_S (15 min) never relay as COMPLETED.
+    NOTE: monitor.py does not currently pass a timestamp — agent 3 / the
+    integrator must thread message["ts"] through the detect() call.
     """
     # Safety: suppress sensitive content
     for p in SUPPRESS_PATTERNS:
         if p.search(text):
             return None
 
+    # Stale suppression applies to COMPLETED only.
+    completed_allowed = True
+    if message_ts is not None:
+        try:
+            age = time.time() - float(message_ts)
+            if age > COMPLETED_MAX_AGE_S:
+                completed_allowed = False
+        except (TypeError, ValueError):
+            pass  # unparseable ts: proceed, do not fail closed on metadata
+
+    # COMPLETED: >=2 distinct weighted pattern hits, no negation, not stale.
+    completed_hits = 0
+    completed_conf = 0.0
+    if completed_allowed and not _is_negated(text):
+        weight, distinct, _ = _completed_weight(text)
+        if weight >= COMPLETED_MIN_WEIGHT:
+            completed_hits = weight
+            # legacy confidence kept for API compat; NOT a reliability measure
+            completed_conf = min(0.95, 0.6 + (distinct - 1) * 0.2)
+
     candidates = [
-        ("COMPLETED", _match_score(text, COMPLETED_PATTERNS)),
+        ("COMPLETED", completed_conf, completed_hits),
-        ("BLOCKER", _match_score(text, BLOCKER_PATTERNS)),
+        ("BLOCKER", _match_score(text, BLOCKER_PATTERNS),
-        ("DECISION", _match_score(text, DECISION_PATTERNS)),
+         sum(1 for p in BLOCKER_PATTERNS if p.search(text))),
-        ("ALERT", _match_score(text, ALERT_PATTERNS)),
+        ("DECISION", _match_score(text, DECISION_PATTERNS),
-        ("MILESTONE", _match_score(text, MILESTONE_PATTERNS)),
+         sum(1 for p in DECISION_PATTERNS if p.search(text))),
+        ("ALERT", _match_score(text, ALERT_PATTERNS),
+         sum(1 for p in ALERT_PATTERNS if p.search(text))),
+        ("MILESTONE", _match_score(text, MILESTONE_PATTERNS),
+         sum(1 for p in MILESTONE_PATTERNS if p.search(text))),
     ]
 
     # Sort by confidence descending; ALERT wins ties (safety: urgency first)
     # Use negative confidence for descending, and ALERT as tiebreaker
     candidates.sort(key=lambda x: (-x[1], 0 if x[0] == "ALERT" else 1))
-    best_cat, best_conf = candidates[0]
+    best_cat, best_conf, best_hits = candidates[0]
 
     if best_conf < min_confidence:
         return None
@@ -127,12 +216,37 @@ def detect(text: str, thread_id: str, message_id: str,
     return SiphonHit(
         category=best_cat,
         confidence=best_conf,
+        hits=best_hits,
         summary=_extract_summary(text),
         thread_id=thread_id,
         message_id=message_id,
     )
 
 
+def format_siphon(hit: SiphonHit, agent_name: str = "sidechat") -> str:
+    """
+    Format a siphon message for main chat.
+    HONEST LABELING: reports keyword hit count, never a fake "confidence %".
+    HONEST AUTHORSHIP (integrator, agent 3 absent): attributes the message's
+    real author when known. Falls back to the thread's registered agent only
+    when the author is unknown — and says so explicitly, so a relay can
+    never again launder thread ownership as authorship.
+    """
+    emoji = {"COMPLETED": "✅", "BLOCKER": "🚧", "DECISION": "❓",
+             "ALERT": "🚨", "MILESTONE": "🎯"}.get(hit.category, "📋")
+    thread_url = f"https://muse.ai/thread/{hit.thread_id}"
+    if hit.author:
+        attribution = f"from {hit.author}"
+    else:
+        attribution = f"from {agent_name} side chat (author unverified)"
+    return (
+        f"{emoji} [{hit.category}] {attribution}\n"
+        f"{hit.summary}\n"
+        f"→ {thread_url}\n"
+        f"(keyword hits: {hit.hits})"
+    )
+
+
 # --- Opt-out registry ---
 
 _opt_out_threads: set = set()

bin/digest.py

@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""
+Side-chat work digest — INTEGRATOR minimal version (agent 4 of 5 never
+delivered its digest/throttle design within the window).
+
+Purpose: stop the per-message ✅ COMPLETED relay flood. COMPLETED hits are
+batched here and emitted as ONE periodic digest instead of N main-chat
+messages. ALERT / BLOCKER / DECISION still relay individually via
+siphon() — urgency is never batched.
+
+Interface (what agent 4's full design should remain compatible with):
+  - buffer = DigestBuffer(max_items=20, max_age_s=3600)
+  - buffer.add(hit) -> None
+  - buffer.flush() -> Optional[str]  (formatted digest, clears buffer)
+  - flush_digest() -> Optional[str]  (module-level singleton convenience)
+
+Reversible: to restore per-message COMPLETED relays, route COMPLETED back
+through siphon() in monitor.py and ignore this module.
+"""
+
+import time
+from typing import List, Optional
+
+try:
+    from detect import SiphonHit
+except ImportError:  # pragma: no cover
+    SiphonHit = object
+
+
+class DigestBuffer:
+    """Batch COMPLETED hits; flush() renders one digest message."""
+
+    def __init__(self, max_items: int = 20, max_age_s: int = 3600):
+        self.max_items = max_items
+        self.max_age_s = max_age_s
+        self._items: List[tuple] = []  # (ts, SiphonHit)
+
+    def add(self, hit) -> None:
+        now = time.time()
+        # Prune items older than max_age_s on every add (bounded memory).
+        self._items = [(ts, h) for ts, h in self._items
+                       if now - ts < self.max_age_s]
+        self._items.append((now, hit))
+        # Bound the buffer; oldest evicted first.
+        self._items = self._items[-self.max_items:]
+
+    def __len__(self) -> int:
+        return len(self._items)
+
+    def flush(self) -> Optional[str]:
+        """Render and clear. Returns None when there's nothing to digest."""
+        if not self._items:
+            return None
+        lines = ["📦 [DIGEST] completions from side chats "
+                 f"({len(self._items)} item(s))"]
+        for _, hit in self._items:
+            author = getattr(hit, "author", "") or "?"
+            url = f"https://muse.ai/thread/{hit.thread_id}"
+            lines.append(f"• {hit.summary} — {author} ({url})")
+        self._items = []
+        return "\n".join(lines)
+
+
+# Module-level singleton: the monitor loop shares one buffer per process.
+_default_buffer = DigestBuffer()
+
+
+def get_buffer() -> DigestBuffer:
+    return _default_buffer
+
+
+def flush_digest() -> Optional[str]:
+    """Flush the process-wide digest buffer. None if empty."""
+    return _default_buffer.flush()

bin/docs-lookup

@@ -0,0 +1 @@
+/home/super/Projects/NetVM/bin/docs-lookup.py

bin/docs-lookup.py

@@ -0,0 +1,606 @@
+#!/usr/bin/env python3
+"""docs-lookup.py — Unified Lookup & Regex Passing Tool for docs_internal/.
+
+Provides high-speed queries, regex passing, grammar validation, and surface
+lookups for autonomous agents and operators interfacing with NetVM, Box,
+and box.muse-dev.online.
+
+Usage:
+  docs-lookup.py search <query>
+  docs-lookup.py surfaces [name]
+  docs-lookup.py sentence [name]
+  docs-lookup.py regex [name] [--test "<string>"]
+  docs-lookup.py parse "<string>"
+  docs-lookup.py get <collection> [key]
+  docs-lookup.py cli [domain]
+  docs-lookup.py overview
+"""
+
+import argparse
+import json
+import os
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+NETVM_ROOT = Path(__file__).resolve().parent.parent
+LOOKUP_INTERNAL = NETVM_ROOT / "lookup_internal"
+if not LOOKUP_INTERNAL.exists() and (NETVM_ROOT / "docs_internal").exists():
+    LOOKUP_INTERNAL = NETVM_ROOT / "docs_internal"
+DOCS_INTERNAL = LOOKUP_INTERNAL
+
+USE_COLOR = sys.stdout.isatty() and os.environ.get("NO_COLOR") is None
+
+def _c(code: str, text: str) -> str:
+    return f"\033[{code}m{text}\033[0m" if USE_COLOR else str(text)
+
+def c_bold(s: str) -> str: return _c("1", s)
+def c_dim(s: str) -> str: return _c("2", s)
+def c_green(s: str) -> str: return _c("32", s)
+def c_red(s: str) -> str: return _c("31", s)
+def c_yellow(s: str) -> str: return _c("33", s)
+def c_blue(s: str) -> str: return _c("34", s)
+def c_cyan(s: str) -> str: return _c("36", s)
+def c_magenta(s: str) -> str: return _c("35", s)
+
+
+def load_json_file(filename: str) -> Dict[str, Any]:
+    """Safely load a JSON file from docs_internal."""
+    p = DOCS_INTERNAL / filename
+    if not p.is_file():
+        return {}
+    try:
+        with open(p, "r", encoding="utf-8") as f:
+            return json.load(f)
+    except Exception as e:
+        print(f"Error reading {p}: {e}", file=sys.stderr)
+        return {}
+
+
+def load_manifest() -> Dict[str, Any]:
+    return load_json_file("manifest.json")
+
+
+def load_sentence_structures() -> Dict[str, Any]:
+    return load_json_file("sentence_structure.json")
+
+
+def load_regex_patterns() -> Dict[str, Any]:
+    return load_json_file("regex_patterns.json")
+
+
+def load_assistive_surfaces() -> Dict[str, Any]:
+    return load_json_file("assistive_surfaces.json")
+
+
+def load_cli_tools() -> Dict[str, Any]:
+    return load_json_file("cli_tools.json")
+
+
+def load_fleet_nodes() -> Dict[str, Any]:
+    return load_json_file("fleet_nodes.json")
+
+
+def compile_pattern(pat_entry: Dict[str, Any]) -> Tuple[Optional[re.Pattern], Optional[str]]:
+    """Compile a regex entry with its configured flags."""
+    raw_pat = pat_entry.get("pattern", "")
+    flag_names = pat_entry.get("flags", [])
+    flags = 0
+    for fn in flag_names:
+        if hasattr(re, fn):
+            flags |= getattr(re, fn)
+    try:
+        return re.compile(raw_pat, flags), None
+    except Exception as e:
+        return None, str(e)
+
+
+# ---------------------------------------------------------------------------
+# Core Lookup Actions
+# ---------------------------------------------------------------------------
+
+def handle_overview(json_mode: bool = False):
+    manifest = load_manifest()
+    if json_mode:
+        print(json.dumps(manifest, indent=2))
+        return
+
+    print(c_bold("\n=== docs_internal — Internal Agent & Operator Lookup Database ==="))
+    print(c_dim(f"Location: {DOCS_INTERNAL} | Host: {manifest.get('host', 'box.muse-dev.online')}"))
+    print(f"{manifest.get('description', '')}\n")
+
+    print(c_cyan("Available Collections:"))
+    collections = manifest.get("collections", [])
+    for col in collections:
+        cid = col.get("id")
+        name = col.get("name")
+        desc = col.get("description")
+        jfile = col.get("json_file")
+        mfile = col.get("md_file")
+        print(f"  • {c_bold(cid):<20} {c_green(name)}")
+        print(f"    {c_dim(desc)}")
+        print(f"    {c_dim('Files:')} {c_yellow(jfile)} | {c_yellow(mfile)}")
+        print()
+
+    print(c_dim("Query commands: super docs [search|surfaces|sentence|regex|parse|get|cli]"))
+
+
+def handle_search(query: str, json_mode: bool = False):
+    q = query.lower()
+    results = []
+
+    # Search in all JSON files
+    for jpath in sorted(DOCS_INTERNAL.glob("*.json")):
+        try:
+            data = json.loads(jpath.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+
+        def recurse_search(obj, path=""):
+            if isinstance(obj, dict):
+                for k, v in obj.items():
+                    subpath = f"{path}.{k}" if path else k
+                    if q in str(k).lower():
+                        results.append({
+                            "file": jpath.name,
+                            "type": "json_key",
+                            "path": subpath,
+                            "match": str(k),
+                            "preview": str(v)[:160]
+                        })
+                    recurse_search(v, subpath)
+            elif isinstance(obj, list):
+                for idx, item in enumerate(obj):
+                    recurse_search(item, f"{path}[{idx}]")
+            elif isinstance(obj, str):
+                if q in obj.lower():
+                    results.append({
+                        "file": jpath.name,
+                        "type": "json_value",
+                        "path": path,
+                        "match": obj[:120],
+                        "preview": obj[:240]
+                    })
+
+        recurse_search(data)
+
+    # Search in Markdown files
+    for mpath in sorted(DOCS_INTERNAL.glob("*.md")):
+        try:
+            content = mpath.read_text(encoding="utf-8")
+        except Exception:
+            continue
+        lines = content.splitlines()
+        for idx, line in enumerate(lines, 1):
+            if q in line.lower():
+                results.append({
+                    "file": mpath.name,
+                    "type": "markdown",
+                    "line": idx,
+                    "match": line.strip(),
+                    "preview": line.strip()
+                })
+
+    if json_mode:
+        print(json.dumps({"query": query, "count": len(results), "results": results}, indent=2))
+        return
+
+    print(c_bold(f"\nSearch results for '{query}' ({len(results)} matches):"))
+    if not results:
+        print(c_dim("  (no matching entries found)"))
+        return
+
+    for r in results[:40]:
+        if r["type"] == "markdown":
+            print(f"  [{c_yellow(r['file'])}:{c_cyan(str(r['line']))}] {r['match']}")
+        else:
+            print(f"  [{c_blue(r['file'])}:{c_magenta(r['path'])}] {r['preview']}")
+
+
+def handle_surfaces(view_name: Optional[str] = None, json_mode: bool = False):
+    data = load_assistive_surfaces()
+    views = data.get("views", {})
+
+    if view_name:
+        key = view_name.lower().strip()
+        v = views.get(key)
+        if not v:
+            for k, val in views.items():
+                if key in k or key in val.get("name", "").lower():
+                    v = val
+                    key = k
+                    break
+        if not v:
+            err = {"error": f"Surface '{view_name}' not found", "available": list(views.keys())}
+            if json_mode:
+                print(json.dumps(err, indent=2))
+            else:
+                print(c_red(f"Error: Surface '{view_name}' not found. Available: {', '.join(views.keys())}"))
+            sys.exit(1)
+
+        if json_mode:
+            print(json.dumps({key: v}, indent=2))
+            return
+
+        print(c_bold(f"\n=== Assistive Surface: {v.get('name')} (`{key}`) ==="))
+        print(c_dim(f"Host: {data.get('host')} | Tab ID: {v.get('tab_id')}"))
+        print(f"{c_cyan('DOM Tab Selector:')}  {c_yellow(str(v.get('dom_tab_selector')))}")
+        print(f"{c_cyan('DOM Pane Selector:')} {c_yellow(str(v.get('dom_pane_selector')))}")
+        
+        elements = v.get("key_elements", {})
+        if elements:
+            print(c_bold("\nKey DOM Elements / Selectors:"))
+            for el_name, sel in elements.items():
+                print(f"  • {c_magenta(el_name):<20} {c_green(sel)}")
+
+        endpoints = v.get("api_endpoints", [])
+        if endpoints:
+            print(c_bold("\nAssociated REST API Endpoints:"))
+            for ep in endpoints:
+                print(f"  • {c_bold(ep.get('method'))} {c_cyan(ep.get('path'))}")
+                print(f"    {c_dim(ep.get('description'))}")
+                if ep.get("curl_example"):
+                    print(f"    {c_dim('curl:')} {c_yellow(ep.get('curl_example'))}")
+
+        recipe = v.get("assistive_recipe")
+        if recipe:
+            print(c_bold("\nAssistive Recipe:"))
+            print(f"  {recipe}")
+        print()
+        return
+
+    # All views
+    if json_mode:
+        print(json.dumps(data, indent=2))
+        return
+
+    print(c_bold(f"\n=== Assistive Surfaces for {data.get('host', 'box.muse-dev.online')} ==="))
+    print(c_dim(f"Operator PIN: {data.get('auth', {}).get('pin')} | Session Cookie: {data.get('auth', {}).get('cookie_name')}"))
+    print()
+
+    for k, v in views.items():
+        name = v.get("name", k)
+        tab_sel = v.get("dom_tab_selector") or "(modal/overlay)"
+        eps = [f"{ep.get('method')} {ep.get('path')}" for ep in v.get("api_endpoints", [])]
+        ep_summary = ", ".join(eps) if eps else "(no direct endpoint)"
+        print(f"  • {c_bold(k):<16} {c_cyan(name):<30} {c_yellow(tab_sel)}")
+        print(f"    {c_dim('API:')} {ep_summary}")
+        if v.get("assistive_recipe"):
+            print(f"    {c_dim('Hint:')} {v.get('assistive_recipe')[:100]}...")
+        print()
+
+
+def handle_sentence(name: Optional[str] = None, json_mode: bool = False):
+    data = load_sentence_structures()
+    structs = data.get("structures", {})
+
+    if name:
+        key = name.lower().strip()
+        s = structs.get(key)
+        if not s:
+            for k, val in structs.items():
+                if key in k or key in val.get("name", "").lower() or key in val.get("protocol_tag", "").lower():
+                    s = val
+                    key = k
+                    break
+        if not s:
+            err = {"error": f"Sentence structure '{name}' not found", "available": list(structs.keys())}
+            if json_mode:
+                print(json.dumps(err, indent=2))
+            else:
+                print(c_red(f"Error: Sentence structure '{name}' not found. Available: {', '.join(structs.keys())}"))
+            sys.exit(1)
+
+        if json_mode:
+            print(json.dumps({key: s}, indent=2))
+            return
+
+        print(c_bold(f"\n=== Protocol Structure: {s.get('name')} (`{key}`) ==="))
+        print(f"{c_cyan('Tag:')}        {c_bold(s.get('protocol_tag'))}")
+        print(f"{c_cyan('Template:')}   {c_green(s.get('template'))}")
+        print(f"{c_cyan('Lifecycle:')}  {c_yellow(s.get('lifecycle_transition', ''))}")
+        print(f"\n{c_bold('Description:')}\n  {s.get('description')}")
+        print(f"\n{c_bold('Required Fields:')} {', '.join(s.get('required_fields', []))}")
+        if s.get("optional_fields"):
+            print(f"{c_bold('Optional Fields:')} {', '.join(s.get('optional_fields', []))}")
+        print(f"\n{c_bold('Example:')}\n  {c_cyan(s.get('example'))}")
+        print(f"\n{c_bold('Reply Expectation:')}\n  {s.get('reply_expectation')}")
+        print()
+        return
+
+    if json_mode:
+        print(json.dumps(data, indent=2))
+        return
+
+    print(c_bold("\n=== Agent Sentence Structures & Conversational Contracts ==="))
+    print(c_dim("Format rules enforced by response-harvester and self_main_loop.\n"))
+
+    for k, s in structs.items():
+        tag = s.get("protocol_tag", "")
+        desc = s.get("description", "")
+        print(f"  • {c_bold(k):<18} {c_green(tag):<25} {s.get('name')}")
+        print(f"    {c_dim(desc)}")
+        print(f"    {c_dim('Template:')} {c_cyan(s.get('template', ''))}")
+        print()
+
+
+def handle_regex(name: Optional[str] = None, test_str: Optional[str] = None, json_mode: bool = False):
+    data = load_regex_patterns()
+    pats = data.get("patterns", {})
+
+    if name:
+        key = name.lower().strip()
+        p = pats.get(key)
+        if not p:
+            for k, val in pats.items():
+                if key in k or key in val.get("name", "").lower():
+                    p = val
+                    key = k
+                    break
+        if not p:
+            err = {"error": f"Regex pattern '{name}' not found", "available": list(pats.keys())}
+            if json_mode:
+                print(json.dumps(err, indent=2))
+            else:
+                print(c_red(f"Error: Pattern '{name}' not found. Available: {', '.join(pats.keys())}"))
+            sys.exit(1)
+
+        compiled, comp_err = compile_pattern(p)
+
+        test_result = None
+        if test_str is not None:
+            if compiled:
+                m = compiled.search(test_str)
+                test_result = {
+                    "matched": bool(m),
+                    "match_span": m.span() if m else None,
+                    "matched_text": m.group(0) if m else None,
+                    "named_groups": m.groupdict() if m else {},
+                    "groups": list(m.groups()) if m else []
+                }
+            else:
+                test_result = {"matched": False, "error": comp_err}
+
+        if json_mode:
+            out = {key: p, "compiled_ok": bool(compiled)}
+            if test_str is not None:
+                out["test_evaluation"] = test_result
+            print(json.dumps(out, indent=2))
+            return
+
+        print(c_bold(f"\n=== Regex Pattern: {p.get('name')} (`{key}`) ==="))
+        print(f"{c_cyan('Pattern:')}      {c_yellow(p.get('pattern'))}")
+        print(f"{c_cyan('Flags:')}        {', '.join(p.get('flags', [])) or '(none)'}")
+        print(f"{c_cyan('Description:')}  {p.get('description')}")
+        print(f"{c_cyan('Usage:')}        {c_dim(p.get('usage', ''))}")
+
+        ng = p.get("named_groups", {})
+        if ng:
+            print(c_bold("\nNamed Groups:"))
+            for gname, gdesc in ng.items():
+                print(f"  • {c_magenta(gname):<16} {gdesc}")
+
+        if test_str is not None:
+            print(c_bold("\nTest Execution Result:"))
+            print(f"  Input: {c_dim(test_str)}")
+            if test_result.get("matched"):
+                print(f"  Verdict: {c_green('✔ MATCHED')}")
+                print(f"  Matched Text: {c_cyan(test_result['matched_text'])}")
+                if test_result["named_groups"]:
+                    print(f"  Extracted Tokens:")
+                    for k_grp, v_grp in test_result["named_groups"].items():
+                        print(f"    - {c_magenta(k_grp)}: {c_yellow(str(v_grp))}")
+            else:
+                print(f"  Verdict: {c_red('✖ NO MATCH')}")
+                if comp_err:
+                    print(f"  Compile Error: {comp_err}")
+        print()
+        return
+
+    # List patterns
+    if json_mode:
+        print(json.dumps(data, indent=2))
+        return
+
+    print(c_bold("\n=== Master Regex Patterns & Passing Dictionary ==="))
+    print(c_dim("Patterns tested and calibrated across response-harvester, dm, and loop engines.\n"))
+
+    for k, p in pats.items():
+        print(f"  • {c_bold(k):<18} {c_green(p.get('name'))}")
+        print(f"    {c_dim('Pattern:')} {c_yellow(p.get('pattern'))}")
+        print(f"    {c_dim(p.get('description'))}")
+        print()
+
+
+def handle_parse(candidate_str: str, json_mode: bool = False):
+    """Pass candidate_str through all registered regexes and extract tokens."""
+    data = load_regex_patterns()
+    pats = data.get("patterns", {})
+
+    matches = []
+    for k, p in pats.items():
+        compiled, err = compile_pattern(p)
+        if not compiled:
+            continue
+        m = compiled.search(candidate_str)
+        if m:
+            matches.append({
+                "pattern_key": k,
+                "pattern_name": p.get("name"),
+                "matched_text": m.group(0),
+                "named_groups": m.groupdict(),
+                "span": m.span()
+            })
+
+    if json_mode:
+        print(json.dumps({
+            "input": candidate_str,
+            "matched_patterns_count": len(matches),
+            "matches": matches
+        }, indent=2))
+        return
+
+    print(c_bold(f"\n=== Regex Parse Analysis ==="))
+    print(f"Input: {c_dim(candidate_str)}\n")
+
+    if not matches:
+        print(c_yellow("  ⚠ No registered regex pattern matched this string."))
+        return
+
+    print(c_green(f"Matched {len(matches)} pattern(s):"))
+    for match in matches:
+        print(f"\n  • Pattern: {c_bold(match['pattern_name'])} (`{c_cyan(match['pattern_key'])}`)")
+        print(f"    Matched Chunk: {c_yellow(match['matched_text'])}")
+        ng = match["named_groups"]
+        if ng:
+            print(f"    Extracted Tokens:")
+            for gk, gv in ng.items():
+                print(f"      - {c_magenta(gk)}: {c_green(str(gv))}")
+    print()
+
+
+def handle_get(collection: str, key: Optional[str] = None, json_mode: bool = False):
+    col_map = {
+        "manifest": "manifest.json",
+        "sentence": "sentence_structure.json",
+        "sentence_structure": "sentence_structure.json",
+        "regex": "regex_patterns.json",
+        "regex_patterns": "regex_patterns.json",
+        "surfaces": "assistive_surfaces.json",
+        "assistive_surfaces": "assistive_surfaces.json",
+        "cli": "cli_tools.json",
+        "cli_tools": "cli_tools.json",
+        "fleet": "fleet_nodes.json",
+        "fleet_nodes": "fleet_nodes.json",
+    }
+
+    fname = col_map.get(collection.lower().strip())
+    if not fname:
+        print(c_red(f"Error: Unknown collection '{collection}'. Available: {', '.join(col_map.keys())}"), file=sys.stderr)
+        sys.exit(1)
+
+    data = load_json_file(fname)
+    if key:
+        # Check top level or primary container
+        val = None
+        for primary in ["structures", "patterns", "views", "domains", "nodes", "collections"]:
+            if primary in data and isinstance(data[primary], dict) and key in data[primary]:
+                val = data[primary][key]
+                break
+        if val is None and key in data:
+            val = data[key]
+        if val is None:
+            print(c_red(f"Error: Key '{key}' not found in {fname}"), file=sys.stderr)
+            sys.exit(1)
+        data = {key: val}
+
+    print(json.dumps(data, indent=2))
+
+
+def handle_cli(domain: Optional[str] = None, json_mode: bool = False):
+    data = load_cli_tools()
+    domains = data.get("domains", {})
+
+    if domain:
+        d = domains.get(domain.lower().strip())
+        if not d:
+            print(c_red(f"Error: CLI domain '{domain}' not found. Available: {', '.join(domains.keys())}"), file=sys.stderr)
+            sys.exit(1)
+        if json_mode:
+            print(json.dumps({domain: d}, indent=2))
+            return
+        print(c_bold(f"\n=== CLI Tool Domain: super {domain} / box {domain} ==="))
+        print(f"Summary: {d.get('summary')}\n")
+        for sub in d.get("subcommands", []):
+            print(f"  • {c_green(sub['cmd'])}")
+            print(f"    {c_dim(sub['desc'])}\n")
+        return
+
+    if json_mode:
+        print(json.dumps(data, indent=2))
+        return
+
+    print(c_bold("\n=== Unified NetVM & Box CLI Tool Catalog ==="))
+    print(c_dim("Powered by super-cli.py and bin/muse wrapper.\n"))
+    for dom_k, dom_v in domains.items():
+        print(f"  • {c_bold(dom_k):<16} {c_cyan(dom_v.get('summary'))}")
+        for sub in dom_v.get("subcommands", [])[:2]:
+            print(f"    - {c_dim(sub['cmd'])}")
+        print()
+
+
+# ---------------------------------------------------------------------------
+# CLI Argument Parser
+# ---------------------------------------------------------------------------
+
+def build_parser():
+    common = argparse.ArgumentParser(add_help=False)
+    common.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+
+    parser = argparse.ArgumentParser(
+        description="docs-lookup — Internal Agent & Operator Documentation Query Engine",
+        parents=[common],
+        formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+
+    sub = parser.add_subparsers(dest="action")
+
+    p_search = sub.add_parser("search", parents=[common], help="Full-text search across docs_internal")
+    p_search.add_argument("query", help="Search keyword or phrase")
+
+    p_surfaces = sub.add_parser("surfaces", parents=[common], help="Lookup assistive surfaces for box.muse-dev.online")
+    p_surfaces.add_argument("name", nargs="?", default=None, help="Surface or tab name")
+
+    p_sentence = sub.add_parser("sentence", parents=[common], help="Lookup agent sentence structures & protocols")
+    p_sentence.add_argument("name", nargs="?", default=None, help="Structure name (e.g. work_order, result)")
+
+    p_regex = sub.add_parser("regex", parents=[common], help="Lookup and test regex patterns")
+    p_regex.add_argument("name", nargs="?", default=None, help="Pattern name (e.g. work_order, verb)")
+    p_regex.add_argument("--test", dest="test_str", default=None, help="Test string to evaluate against pattern")
+
+    p_parse = sub.add_parser("parse", parents=[common], help="Parse an agent utterance through all regex patterns")
+    p_parse.add_argument("string", help="String/utterance to parse")
+
+    p_get = sub.add_parser("get", parents=[common], help="Query raw JSON collection and key")
+    p_get.add_argument("collection", help="Collection name (sentence, regex, surfaces, cli, fleet)")
+    p_get.add_argument("key", nargs="?", default=None, help="Optional specific key")
+
+    p_cli = sub.add_parser("cli", parents=[common], help="Lookup CLI commands and syntax")
+    p_cli.add_argument("domain", nargs="?", default=None, help="CLI domain (fleet, dm, job, etc.)")
+
+    p_overview = sub.add_parser("overview", parents=[common], help="Database overview and collections manifest")
+
+    return parser
+
+
+
+def main():
+    parser = build_parser()
+    args = parser.parse_args()
+
+    act = args.action
+    json_mode = getattr(args, "json", False)
+
+    if not act or act == "overview":
+        handle_overview(json_mode)
+    elif act == "search":
+        handle_search(args.query, json_mode)
+    elif act == "surfaces":
+        handle_surfaces(args.name, json_mode)
+    elif act == "sentence":
+        handle_sentence(args.name, json_mode)
+    elif act == "regex":
+        handle_regex(args.name, args.test_str, json_mode)
+    elif act == "parse":
+        handle_parse(args.string, json_mode)
+    elif act == "get":
+        handle_get(args.collection, args.key, json_mode)
+    elif act == "cli":
+        handle_cli(args.domain, json_mode)
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()

bin/ensure-node-supervision.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# ensure-node-supervision.sh <node> | --all — feed a node to the watchdogs.
+#
+# Setup (netvm-node-up.sh, hence netvm-provision-node.sh and the onboarding
+# pipeline) calls this so every node gets supervision without manual wiring:
+#   1. NODES.md registry row (idempotent) — feeds the registry-driven
+#      supervisors: cdp-relay-watchdog, agent-health.sh, relay-health-check,
+#      cdp-latency-check. Port from netvm-names pinning (honors
+#      CDP_PORT_OVERRIDE, so provision's picked port wins when present).
+#   2. chromebox-watchdog-<node>.timer unit + enable --now — the one
+#      supervisor that needs a per-node systemd unit (the @.service
+#      template already exists). Needs root for the real unit dir.
+#
+# Env overrides (tests): NODES_MD, UNIT_DIR. systemctl is skipped when
+# UNIT_DIR is not the real system dir.
+#
+# Runs at the end of netvm-node-up.sh (as root); safe to re-run anytime:
+#   sudo bin/ensure-node-supervision.sh --all
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+NODES_MD="${NODES_MD:-$SCRIPT_DIR/../NODES.md}"
+UNIT_DIR="${UNIT_DIR:-/etc/systemd/system}"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/netvm-names.sh"
+
+usage() { echo "usage: ensure-node-supervision.sh <node> | --all" >&2; exit 1; }
+
+ensure_registry_row() {
+  local node="$1"
+  if grep -qE "^\|[[:space:]]*$node[[:space:]]*\|" "$NODES_MD" 2>/dev/null; then
+    echo "registry: $node already in NODES.md"
+    return 0
+  fi
+  netvm_names "$node" || { echo "registry: unknown node $node" >&2; return 1; }
+  printf '| %s | %s | unknown | %s | active | %s (auto-registered) |\n' \
+    "$node" "$NETNS" "$CDP_PORT" "$node" >> "$NODES_MD"
+  echo "registry: added $node (port $CDP_PORT)"
+}
+
+ensure_timer() {
+  local node="$1" unit
+  unit="$UNIT_DIR/chromebox-watchdog-$node.timer"
+  if [ -f "$unit" ]; then
+    echo "timer: chromebox-watchdog-$node.timer already installed"
+  else
+    if [ "$UNIT_DIR" = "/etc/systemd/system" ] && [ "$(id -u)" -ne 0 ]; then
+      echo "timer: need root to install chromebox-watchdog-$node.timer (run with sudo)" >&2
+      return 1
+    fi
+    cat > "$unit" <<EOF
+[Unit]
+Description=Run chromebox watchdog for $node every 2 minutes
+
+[Timer]
+RandomizedDelaySec=30s
+OnBootSec=2min
+OnUnitActiveSec=2min
+Unit=chromebox-watchdog@$node.service
+
+[Install]
+WantedBy=timers.target
+EOF
+    echo "timer: installed chromebox-watchdog-$node.timer"
+  fi
+  if [ "$UNIT_DIR" = "/etc/systemd/system" ]; then
+    systemctl daemon-reload
+    systemctl enable --now "chromebox-watchdog-$node.timer" >/dev/null 2>&1
+    echo "timer: enabled chromebox-watchdog-$node.timer"
+  fi
+}
+
+ensure_node() {
+  local node="$1"
+  ensure_registry_row "$node"
+  ensure_timer "$node"
+}
+
+case "${1:-}" in
+  --all)
+    nodes="$(python3 "$SCRIPT_DIR/netvm-registry.py" 2>/dev/null | cut -d: -f1)"
+    for conf in /etc/netvm/*.conf; do
+      [ -f "$conf" ] || continue
+      nodes="$nodes $(basename "$conf" .conf)"
+    done
+    seen=""
+    # shellcheck disable=SC2086 (intended word splitting)
+    for node in $nodes; do
+      case " $seen " in *" $node "*) continue;; esac
+      seen="$seen $node"
+      ensure_node "$node" || echo "supervision: $node failed (continuing)" >&2
+    done
+    ;;
+  ""|-h|--help) usage;;
+  *) ensure_node "$1";;
+esac

bin/fleet-alert-check.sh

@@ -19,6 +19,9 @@
 #   FLEET_ALERT_DRY_RUN=1        evaluate + print, write no state/outbox, no notify
 #   FLEET_ALERT_INJECT_FAIL=     test hook: comma-separated condition ids to force-fail
 #                                (e.g. FLEET_ALERT_INJECT_FAIL=cdp:pip)
+#   FLEET_BL_RELAY=1             re-enable the bl-side #lobby relay (default 0/off:
+#                                the container-side hook is the live pager; running
+#                                both double-posts every alert — 2026-10-06)
 #
 # State:  ~/.local/share/fleet-alert/state.json   (per-condition consecutive counters)
 # Outbox: ~/.local/share/fleet-alert/outbox.jsonl (ALERT/RECOVERY records for the relay)
@@ -34,6 +37,11 @@ set -uo pipefail
 
 THRESHOLD="${FLEET_ALERT_THRESHOLD:-2}"
 REALERT_MIN="${FLEET_ALERT_REALERT_MIN:-30}"
+# Approval/input-wait TTLs (seconds): conditions failing longer than this are
+# auto-expired (input waits dismissed, key requests denied) instead of paging
+# forever. Overridable per environment.
+INPUT_WAIT_TTL="${FLEET_ALERT_INPUT_WAIT_TTL:-1800}"
+BROWSER_APPROVAL_TTL="${FLEET_ALERT_BROWSER_APPROVAL_TTL:-1800}"
 QUIET_HOURS="${FLEET_ALERT_QUIET_HOURS:-}"
 DRY_RUN="${FLEET_ALERT_DRY_RUN:-0}"
 INJECT_FAIL="${FLEET_ALERT_INJECT_FAIL:-}"
@@ -51,14 +59,18 @@ NOW=$(date +%s)
 log() { echo "$(date -Iseconds) $*" >> "$LOG"; }
 
 # --- shared consecutive-failure state machine (also used by the container relay) ---
-# usage: state_machine <cond> <failing 0|1>  -> prints "<ACTION> <fails>"
+# usage: state_machine <cond> <failing 0|1> [ttl_seconds] -> prints "<ACTION> <fails>"
-# ACTION: ALERT_FIRST | ALERT_REALERT | RECOVERY | SUPPRESSED | NONE
+# When ttl_seconds > 0 and the condition has failed longer than the TTL,
+# prints "EXPIRED <fails>" so the caller can auto-resolve (dismiss/deny).
+# State entries track first_fail_ts (epoch of first consecutive failure).
+# ACTION: ALERT_FIRST | ALERT_REALERT | RECOVERY | SUPPRESSED | EXPIRED | NONE
 state_machine() {
-    local cond="$1" failing="$2"
+    local cond="$1" failing="$2" ttl="${3:-0}"
     THRESHOLD="$THRESHOLD" REALERT_MIN="$REALERT_MIN" QUIET_HOURS="$QUIET_HOURS" \
-    FLEET_ALERT_DRY_RUN="$DRY_RUN" python3 - "$STATE" "$cond" "$failing" <<'PYEOF'
+    FLEET_ALERT_DRY_RUN="$DRY_RUN" python3 - "$STATE" "$cond" "$failing" "$ttl" <<'PYEOF'
 import json, os, sys, time
 state_path, cond, failing_s = sys.argv[1], sys.argv[2], sys.argv[3]
+ttl_seconds = int(sys.argv[4]) if len(sys.argv) > 4 else 0
 failing = failing_s == "1"
 threshold = int(os.environ.get("THRESHOLD", "2"))
 realert_min = int(os.environ.get("REALERT_MIN", "30"))
@@ -85,23 +97,34 @@ except Exception:
 e = st.get(cond) or {"fails": 0, "alerted": False, "last_alert_ts": 0}
 action = "NONE"
 if failing:
+    if int(e.get("fails", 0)) == 0:
+        e["first_fail_ts"] = now
     e["fails"] = int(e.get("fails", 0)) + 1
-    due = e["fails"] >= threshold and (
+    # TTL expiry: failing longer than ttl_seconds -> EXPIRED (caller auto-resolves)
-        not e.get("alerted") or now - int(e.get("last_alert_ts", 0)) >= realert_min * 60
+    if ttl_seconds > 0 and now - int(e.get("first_fail_ts", now)) >= ttl_seconds:
-    )
+        action = "EXPIRED"
-    if due:
+        # Reset so a fresh incident starts clean after the caller resolves it
-        first = not e.get("alerted")
+        e["fails"] = 0
-        if not first and in_quiet(qh):
+        e["alerted"] = False
-            action = "SUPPRESSED"
+        e.pop("first_fail_ts", None)
-        else:
+    else:
-            action = "ALERT_FIRST" if first else "ALERT_REALERT"
+        due = e["fails"] >= threshold and (
-            e["alerted"] = True
+            not e.get("alerted") or now - int(e.get("last_alert_ts", 0)) >= realert_min * 60
-            e["last_alert_ts"] = now
+        )
+        if due:
+            first = not e.get("alerted")
+            if not first and in_quiet(qh):
+                action = "SUPPRESSED"
+            else:
+                action = "ALERT_FIRST" if first else "ALERT_REALERT"
+                e["alerted"] = True
+                e["last_alert_ts"] = now
 else:
     if e.get("alerted"):
         action = "RECOVERY"
     e["fails"] = 0
     e["alerted"] = False
+    e.pop("first_fail_ts", None)
 st[cond] = e
 if not dry:
     json.dump(st, open(state_path, "w"))
@@ -151,6 +174,28 @@ box_notify() {
     for p in $pids; do wait "$p" 2>/dev/null; done
 }
 
+notify_input_wait() {
+    # Targeted DM for input waits (2026-10-05): DM ONLY the specific agent
+    # whose session is waiting for human input -- not a broadcast to all
+    # healthy agents. The #lobby post still fires via the relay leg for
+    # human visibility; this DM ensures the responsible operator sees it
+    # in their sidechat without digging through lobby noise.
+    # Best-effort: never fatal to the 5-minute check loop.
+    local node="$1"
+    local detail="$2"
+    local msg="[fleet-alert] INPUT WAIT: ${detail} -- reply: box approval reply ${node} \"<msg>\" or box notify ${node} \"<msg>\""
+    msg="${msg:0:900}"
+    if [ "$DRY_RUN" = "1" ]; then
+        log "DRY-RUN would DM $node re input_wait"
+        return 0
+    fi
+    if timeout 60 python3 "$BIN/box-ctl.py" notify "$node" "$msg" >/dev/null 2>&1; then
+        log "input_wait targeted DM sent to $node"
+    else
+        log "input_wait DM to $node failed (best-effort, non-fatal)"
+    fi
+}
+
 injected() { # cond -> 0 if injected-fail
     case ",$INJECT_FAIL," in *,"$1,"*) return 0;; *) return 1;; esac
 }
@@ -185,29 +230,36 @@ HEALTHY_AGENTS=""
     esac
 done
 
-# --- Agent approval blockage detection (catches agents held up on approvals) ---
+# --- Agent approval blockage & input wait detection ---
 "$BIN/netvm-registry.py" 2>/dev/null | while IFS=: read -r node port; do
     [ -n "$node" ] || continue
-    cond="approval:$node"
+    node_data=$(python3 -c "
-    pending_info=$(python3 -c "
+import sys, json
-import sys
 sys.path.insert(0, '$BIN')
 import approvals
 info = approvals.inspect_node_approvals('$node')
-if info.get('has_pending'):
+out = {
-    print(f\"{info.get('ip') or 'unknown'}|{info.get('title') or ''}\")
+    'has_pending': info.get('has_pending', False),
-" 2>/dev/null || true)
+    'target': info.get('target') or info.get('ip') or 'unknown',
+    'title': info.get('title') or '',
+    'waits': info.get('input_waits') or []
+}
+print(json.dumps(out))
+" 2>/dev/null || echo '{"has_pending":false,"target":"unknown","title":"","waits":[]}')
 
-    if [ -n "$pending_info" ]; then
+    # 1. Egress permission dialog
+    cond="approval:$node"
+    has_pending=$(python3 -c "import json,sys; print(1 if json.loads(sys.argv[1]).get('has_pending') else 0)" "$node_data" 2>/dev/null || echo 0)
+    if [ "$has_pending" = "1" ]; then
         failing=1
-        target="${pending_info%%|*}"
+        target=$(python3 -c "import json,sys; print(json.loads(sys.argv[1]).get('target','unknown'))" "$node_data" 2>/dev/null || echo unknown)
         detail="Agent $node held up on browser approval for $target"
     else
         failing=0
         detail="Agent $node approvals clear"
     fi
     injected "$cond" && failing=1
-    read -r action fails < <(state_machine "$cond" "$failing")
+    read -r action fails < <(state_machine "$cond" "$failing" "$BROWSER_APPROVAL_TTL")
     case "$action" in
         ALERT_FIRST|ALERT_REALERT)
             emit_record "ALERT" "$cond" "$detail" "$fails"
@@ -219,6 +271,73 @@ if info.get('has_pending'):
         SUPPRESSED)
             log "$cond still critical x$fails — re-page suppressed"
             ;;
+        EXPIRED)
+            # Browser approval dialog exceeded BROWSER_APPROVAL_TTL without a
+            # human decision: fail closed by denying it.
+            log "$cond EXPIRED after ${BROWSER_APPROVAL_TTL}s without human decision — auto-denying (fail closed)"
+            python3 - "$node" <<'PYEOF3'
+import sys, json
+sys.path.insert(0, "/home/super/Projects/NetVM/bin")
+import approvals
+node = sys.argv[1]
+print(json.dumps(approvals.deny_node_approval(node, caller="approval-ttl-expire")))
+approvals.log_box_ctl("approval-expired", name=node, caller="approval-ttl-expire",
+                      extra={"note": "browser approval TTL elapsed; auto-denied (fail closed)"})
+PYEOF3
+            emit_record "RECOVERY" "$cond" "Agent $node browser approval expired after ${BROWSER_APPROVAL_TTL}s; auto-denied" "$fails"
+            ;;
+    esac
+
+    # 2. Sidebar task waiting on human input
+    cond_in="input_wait:$node"
+    wait_summary=$(python3 -c "
+import json,sys
+w = json.loads(sys.argv[1]).get('waits', [])
+if w:
+    print('; '.join(f\"{item.get('task')}: {item.get('status')}\" for item in w)[:120])
+" "$node_data" 2>/dev/null || true)
+
+    if [ -n "$wait_summary" ]; then
+        failing_in=1
+        detail_in="Agent $node task waiting for human input: $wait_summary"
+    else
+        failing_in=0
+        detail_in="Agent $node tasks running"
+    fi
+    injected "$cond_in" && failing_in=1
+    read -r action_in fails_in < <(state_machine "$cond_in" "$failing_in" "$INPUT_WAIT_TTL")
+    case "$action_in" in
+        ALERT_FIRST|ALERT_REALERT)
+            emit_record "ALERT" "$cond_in" "$detail_in" "$fails_in"
+            echo "$cond_in|$detail_in" >> "$STATE_DIR/.alerts.tmp"
+            ;;
+        RECOVERY)
+            emit_record "RECOVERY" "$cond_in" "$detail_in" "$fails_in"
+            ;;
+        SUPPRESSED)
+            log "$cond_in still critical x$fails_in — re-page suppressed"
+            ;;
+        EXPIRED)
+            # Input wait exceeded INPUT_WAIT_TTL without human response:
+            # auto-dismiss so the agent unblocks. Log the expiry and emit a
+            # RECOVERY record (the wait is gone, not merely un-paged).
+            log "$cond_in EXPIRED after ${INPUT_WAIT_TTL}s without human input — auto-dismissing"
+            python3 - "$node" <<'PYEOF2'
+import sys
+sys.path.insert(0, "/home/super/Projects/NetVM/bin")
+import approvals, json
+node = sys.argv[1]
+info = approvals.inspect_node_approvals(node)
+for w in info.get("input_waits", []) or []:
+    t = w.get("task")
+    if t:
+        approvals.mark_wait_responded(node, t, caller="approval-ttl-expire")
+approvals.log_box_ctl("approval-wait-expired", name=node, caller="approval-ttl-expire",
+                      extra={"note": "input wait TTL elapsed; auto-dismissed"})
+print(json.dumps(approvals.dismiss_node_task(node, caller="approval-ttl-expire")))
+PYEOF2
+            emit_record "RECOVERY" "$cond_in" "Agent $node input wait expired after ${INPUT_WAIT_TTL}s; auto-dismissed" "$fails_in"
+            ;;
     esac
 done
 
@@ -290,8 +409,26 @@ rm -f "$STATE_DIR/.healthy.tmp"
 # Notify for this run's alerts (best effort). Skip entirely when nothing is healthy
 # (notify needs a working browser via dm.py) or in dry-run.
 if [ -n "$HEALTHY_AGENTS" ] && [ -f "$STATE_DIR/.alerts.tmp" ]; then
-    while read -r cond; do
+    while IFS= read -r line; do
-        [ -n "$cond" ] && box_notify "$cond" "see #lobby for detail"
+        # alerts.tmp format: "cond" or "cond|detail" (input_wait carries detail)
+        cond="${line%%|*}"
+        detail="${line#*|}"
+        [ "$detail" = "$line" ] && detail=""
+        [ -n "$cond" ] || continue
+        case "$cond" in
+            input_wait:*)
+                # Targeted: DM only the waiting agent, not a broadcast.
+                node="${cond#input_wait:}"
+                if [ -n "$detail" ]; then
+                    notify_input_wait "$node" "$detail"
+                else
+                    box_notify "$cond" "see #lobby for detail"
+                fi
+                ;;
+            *)
+                box_notify "$cond" "see #lobby for detail"
+                ;;
+        esac
     done < "$STATE_DIR/.alerts.tmp"
 elif [ -f "$STATE_DIR/.alerts.tmp" ]; then
     log "no healthy agents — box notify skipped (DM path needs a working browser)"
@@ -301,7 +438,11 @@ rm -f "$STATE_DIR/.alerts.tmp"
 tail -500 "$LOG" > "$LOG.tmp" 2>/dev/null && mv "$LOG.tmp" "$LOG"
 log "check complete"
 
-# Relay pending outbox records to #lobby with idempotency gates (posted watermark + content hash TTL)
+# Bl-side #lobby relay: DISABLED by default (FLEET_BL_RELAY=1 to re-enable).
-if [ "$DRY_RUN" -eq 0 ] && [ -x "$BIN/fleet-alert-relay.sh" ]; then
+# The container-side hook is the live pager; the bl relay never successfully
+# posted (missing CHAT_KEYFILE) and enabling it now would double-post every
+# alert in a second format. Re-enable only alongside retiring the container
+# hook (and per the relay header, with opm sign-off).
+if [ "${FLEET_BL_RELAY:-0}" = "1" ] && [ "$DRY_RUN" -eq 0 ] && [ -x "$BIN/fleet-alert-relay.sh" ]; then
     "$BIN/fleet-alert-relay.sh" >> "$LOG" 2>&1 || true
 fi

bin/fleet-alert-relay.sh

@@ -5,6 +5,10 @@
 # branch; deployment needs opm review + sign-off. See
 # docs/FLEET-ALERT-DUP-POST-GATE.md.
 #
+# NOTE (2026-10-06): auto-invoke from fleet-alert-check.sh is disabled by
+# default (FLEET_BL_RELAY=1 re-enables). The container-side hook pages
+# #lobby today; do not re-enable without retiring it first.
+#
 # The 2026-10-05 11:28Z incident: one RECOVERY record in the outbox became two
 # identical verified #lobby posts (seq 642/643, 3.35s apart) because the relay
 # leg had no idempotency: append-only outbox, no consume tracking, no content
@@ -68,7 +72,7 @@ transport_post() { # $1 = text
   local text="$1" ts sig payload resp http
   ts="$(date +%s)"
   if ! sig="$(sign_payload "$(printf '%s\n%s\n%s' "$ts" "$CHANNEL" "$text")")"; then
-    echo "UNKNOWN sign-failed"; return 0
+    echo "UNKNOWN sign-failed($KEYFILE)"; return 0
   fi
   payload="$(MSG="$text" TS="$ts" SIG="$sig" python3 -c '
 import json,os
@@ -263,12 +267,31 @@ main() {
 # NOTE: transport_post is invoked via command substitution (subshell), so the
 # stub counts calls with a file, not a variable.
 self_test() {
-  local td calls lobby ok=1 n
+  local td calls lobby ok=1 n sk sig_out old_key
   td="$(mktemp -d)"; export FLEET_ALERT_DIR="$td"
   ALERT_DIR="$td"; OUTBOX="$td/outbox.jsonl"; POSTED="$td/posted.log"
   SEEN="$td/seen-hashes.log"; LOCKF="$td/relay.lock"
   calls="$td/calls.log"; lobby="$td/lobby.log"
   touch "$calls" "$lobby"
+  # sign_payload must round-trip with a valid key and fail cleanly without
+  # one (2026-10-06: missing ~/.ssh/id_frontdoor broke every #lobby post
+  # with an undiagnosable bare "sign-failed").
+  old_key="$KEYFILE"
+  sk="$td/signkey"
+  ssh-keygen -t ed25519 -f "$sk" -N '' -q >/dev/null 2>&1 \
+    || { echo "FAIL: cannot generate ephemeral test key"; ok=0; }
+  if KEYFILE="$sk" sig_out="$(sign_payload "self-test")"; then
+    case "$sig_out" in
+      *"BEGIN SSH SIGNATURE"*) : ;;
+      *) echo "FAIL: sign_payload output not armored"; ok=0 ;;
+    esac
+  else
+    echo "FAIL: sign_payload failed with a valid key"; ok=0
+  fi
+  if KEYFILE="$td/no-such-key" sign_payload "self-test" >/dev/null 2>&1; then
+    echo "FAIL: sign_payload succeeded with a missing key"; ok=0
+  fi
+  KEYFILE="$old_key"
   # Two identical submissions: same text, different record ids (the 11:28Z shape)
   printf '%s\n' \
     '{"id":"rec-A","ts":1791199616,"kind":"RECOVERY","condition":"partition:def"}' \

bin/followup-sweeper.py

@@ -144,6 +144,181 @@ def _resolve_nudge_thread_uuid(nudge_output):
     return fallback
 
 
+_JOB_ID_RE = re.compile(r"^(.+)-(\d{8})-(\d{6})-([0-9a-f]{8})$")
+_OP_NAME_RE = re.compile(r"^[a-z][a-z0-9_.]{0,63}$")
+_JOB_NAME_RE = re.compile(r"^[a-z0-9-]{1,64}$")
+_FALLBACK_RETRY_S = 3600
+
+
+def fallback_due(rec, now=None):
+    """True when a terminal followup should (re)attempt its on_no_result fallback.
+
+    Fires once per record; a failed attempt may retry after _FALLBACK_RETRY_S.
+    Shared by the sweeper terminal path and gravity remediate so the two
+    firing paths can never double-execute.
+    """
+    fb = rec.get("fallback") or {}
+    if fb.get("ran"):
+        return False
+    ts = fb.get("ts")
+    if not ts:
+        return True
+    try:
+        last = datetime.fromisoformat(str(ts).replace("Z", "+00:00"))
+    except Exception:
+        return True
+    if last.tzinfo is None:
+        last = last.replace(tzinfo=timezone.utc)
+    base = now or utcnow_dt()
+    return (base - last).total_seconds() >= _FALLBACK_RETRY_S
+
+_EXEC_OPS_MOD = None
+
+
+def find_job_file(job_name):
+    """Locate a job definition in JOBS_DIR or any archive subdirectory."""
+    p = JOBS_DIR / f"{job_name}.json"
+    if p.exists():
+        return p
+    for match in JOBS_DIR.glob(f"archive/**/{job_name}.json"):
+        if match.is_file():
+            return match
+    for match in JOBS_DIR.glob(f"**/archive/**/{job_name}.json"):
+        if match.is_file():
+            return match
+    return None
+
+
+def derive_job_name(job_id):
+    """Extract the job name from a dispatched job_id (<name>-YYYYMMDD-HHMMSS-<hex8>)."""
+    m = _JOB_ID_RE.match(job_id or "")
+    if not m:
+        return None
+    name = m.group(1)
+    if not find_job_file(name):
+        return None
+    return name
+
+
+def load_job_fallback(job_name):
+    """Return (spec, error) for a job's on_no_result fallback.
+
+    spec is None when the job declares none. Shape:
+      {"job": "<job-name>"}             -> dispatch a fallback job, or
+      {"op": "<exec-op>", "args": {...}} -> run one exec-constrained op.
+    """
+    job_path = find_job_file(job_name)
+    if not job_path:
+        return None, f"unreadable job {job_name}: [Errno 2] No such file or directory: '{JOBS_DIR / (job_name + '.json')}'"
+    try:
+        with open(job_path, "r", encoding="utf-8") as f:
+            cfg = json.load(f)
+    except Exception as e:
+        return None, f"unreadable job {job_name}: {e}"
+    spec = cfg.get("on_no_result")
+    if spec is None:
+        return None, None
+    if not isinstance(spec, dict) or set(spec) - {"job", "op", "args"}:
+        return None, "on_no_result must be an object with job|op (+args)"
+    if bool(spec.get("job")) == bool(spec.get("op")):
+        return None, "on_no_result needs exactly one of job|op"
+    if spec.get("job"):
+        jn = spec["job"]
+        if not isinstance(jn, str) or not _JOB_NAME_RE.fullmatch(jn):
+            return None, "on_no_result.job must be a valid job name"
+        if not find_job_file(jn):
+            return None, f"on_no_result.job {jn!r} does not exist"
+    else:
+        if not isinstance(spec.get("op"), str) or not _OP_NAME_RE.fullmatch(spec["op"]):
+            return None, "on_no_result.op must be a valid op name"
+        if "args" in spec and not isinstance(spec["args"], dict):
+            return None, "on_no_result.args must be an object"
+    return spec, None
+
+
+def _load_exec_ops():
+    global _EXEC_OPS_MOD
+    if _EXEC_OPS_MOD is None:
+        import importlib.util
+        mod_spec = importlib.util.spec_from_file_location(
+            "exec_constrained_sweeper", str(BIN_DIR / "exec-constrained.py"))
+        mod = importlib.util.module_from_spec(mod_spec)
+        mod_spec.loader.exec_module(mod)
+        _EXEC_OPS_MOD = mod
+    return _EXEC_OPS_MOD
+
+
+def run_no_result_fallback(rec, dry_run=False):
+    """Execute a job's on_no_result fallback at terminal followup expiry.
+
+    Returns an outcome dict; never raises (failures are outcome data so
+    one bad spec can't break the sweep).
+    """
+    dm_id = rec.get("dm_id", "?")
+    outcome = {"dm_id": dm_id, "ran": False, "mode": None,
+               "configured": False, "detail": "no job fallback"}
+    try:
+        job_name = derive_job_name(rec.get("job_id"))
+        if not job_name:
+            outcome["detail"] = "no resolvable job_id"
+            return outcome
+        spec, err = load_job_fallback(job_name)
+        if err:
+            outcome.update(configured=True, detail=err)
+            return outcome
+        if spec is None:
+            return outcome
+        outcome["configured"] = True
+        if dry_run:
+            outcome.update(mode="dry_run", detail=json.dumps(spec)[:200])
+            return outcome
+        if spec.get("job"):
+            env = os.environ.copy()
+            env["CHAIN_PREV_JOB_ID"] = rec.get("job_id", "")
+            env["CHAIN_PREV_RESULT"] = (
+                f"TIMEOUT: Agent {rec.get('recipient')} gave no result; "
+                f"on_no_result fallback for job {job_name}")
+            cmd = [sys.executable, str(DISPATCH_PY), spec["job"]]
+            try:
+                p = subprocess.run(cmd, capture_output=True, text=True,
+                                   timeout=180, env=env)
+            except Exception as e:
+                outcome.update(mode="job", detail=f"dispatch exception: {e}")
+                return outcome
+            ok = p.returncode == 0
+            outcome.update(ran=ok, mode="job",
+                           detail=(f"dispatched {spec['job']}" if ok
+                                   else f"dispatch failed: {(p.stderr or p.stdout).strip()[:200]}"))
+        else:
+            mod = _load_exec_ops()
+            op = spec["op"]
+            op_spec = mod.OPS.get(op)
+            if op_spec is None:
+                outcome["detail"] = f"unknown op: {op}"
+                return outcome
+            args = dict(spec.get("args") or {})
+            try:
+                clean = op_spec["validate"](args)
+            except Exception as e:
+                outcome["detail"] = f"op validation failed: {e}"
+                return outcome
+            argv = op_spec["build"](clean)
+            try:
+                p = subprocess.run(argv, capture_output=True, text=True,
+                                   timeout=op_spec.get("timeout", 120))
+            except Exception as e:
+                outcome.update(mode="op", detail=f"op exception: {e}")
+                return outcome
+            ok = p.returncode == 0
+            out = (p.stdout or p.stderr or "").strip()
+            outcome.update(ran=ok, mode="op",
+                           detail=(f"{op} ok: {out[:200]}" if ok
+                                   else f"{op} failed rc={p.returncode}: {out[:200]}"))
+    except Exception as e:
+        outcome["detail"] = f"fallback exception: {e}"
+    return outcome
+
+
 def sweep_cycle(dry_run=False):
     followups = load_followups()
     if not followups:
@@ -152,6 +327,7 @@ def sweep_cycle(dry_run=False):
     now = utcnow_dt()
     nudges_count = 0
     escalations_count = 0
+    fallbacks_count = 0
     modified = False
 
     for dm_id, rec in list(followups.items()):
@@ -334,6 +510,31 @@ def sweep_cycle(dry_run=False):
                                     pipeline_engine.fail_pipeline(run_entry.get("run_id"), "step_timed_out_without_fallback")
                             except Exception:
                                 pass
+                # on_no_result fallback: the agent never replied, so run
+                # the job's declared server-side effect now (if any).
+                # fallback_due() dedupes against the gravity firing path.
+                fb = (run_no_result_fallback(rec) if fallback_due(rec)
+                      else {"configured": False, "ran": False, "mode": None,
+                            "detail": "fallback already ran"})
+                if fb["configured"]:
+                    rec["fallback"] = {"ran": fb["ran"], "mode": fb["mode"],
+                                       "detail": fb["detail"][:200],
+                                       "ts": utcnow_str()}
+                    modified = True
+                    append_job_log({
+                        "ts": utcnow_str(),
+                        "type": ("fallback_executed" if fb["ran"]
+                                 else "fallback_failed"),
+                        "dm_id": dm_id,
+                        "recipient": recipient,
+                        "job_id": rec.get("job_id"),
+                        "mode": fb["mode"],
+                        "detail": fb["detail"][:300],
+                    })
+                    print(f"Sweeper: on_no_result fallback for {dm_id}: "
+                          f"ran={fb['ran']} {fb['detail'][:120]}")
+                    if fb["ran"]:
+                        fallbacks_count += 1
             else:
                 escalations_count += 1
 
@@ -346,6 +547,7 @@ def sweep_cycle(dry_run=False):
         "pending": pending_count,
         "nudges_sent": nudges_count,
         "escalations": escalations_count,
+        "fallbacks": fallbacks_count,
     }
 
 

bin/gravity.py

@@ -632,7 +632,7 @@ def diagnose_breaks() -> list:
             if app.get("has_pending"):
                 node = app["node"]
                 is_trusted = app.get("is_trusted", False)
-                ip = app.get("ip") or "unknown target"
+                ip = app.get("target") or app.get("ip") or "unknown target"
                 breaks.append({
                     "type": "approval_blocked",
                     "severity": "WARNING" if is_trusted else "CRITICAL",
@@ -641,12 +641,78 @@ def diagnose_breaks() -> list:
                     "detail": f"Agent {node} is held up on browser approval for {ip}",
                     "remedy": f"Run 'box approvals auto' or 'box approvals allow {node}'."
                 })
+            for w in app.get("input_waits") or []:
+                node = app["node"]
+                breaks.append({
+                    "type": "input_wait",
+                    "severity": "WARNING",
+                    "component": f"node:{node}",
+                    "agent": node,
+                    "detail": f"Agent {node} task '{w.get('task')}' is waiting: {w.get('status')} ({w.get('when')})",
+                    "remedy": f"Open {node}'s task and answer it, or 'box approvals check --node {node}'."
+                })
     except Exception:
         pass
 
     return breaks
 
 
+def _load_sweeper_module():
+    import importlib.util
+    mod_spec = importlib.util.spec_from_file_location(
+        "followup_sweeper_gravity",
+        str(Path(__file__).resolve().parent / "followup-sweeper.py"))
+    mod = importlib.util.module_from_spec(mod_spec)
+    mod_spec.loader.exec_module(mod)
+    return mod
+
+
+def maybe_run_terminal_fallback(rec, now_iso, dry_run=False):
+    """Run a job's on_no_result fallback once at terminal followup expiry.
+
+    Returns an outcome dict, or None when the record has no resolvable
+    fallback. Never raises. The sweeper terminal path shares the
+    fallback_due() guard, so the two firing paths can't double-execute.
+    """
+    try:
+        sw = _load_sweeper_module()
+    except Exception as e:
+        return {"ran": False, "mode": None,
+                "detail": f"sweeper import failed: {e}"}
+    try:
+        if not sw.fallback_due(rec):
+            return None
+        job_name = sw.derive_job_name(rec.get("job_id"))
+        if not job_name:
+            return None
+        spec, err = sw.load_job_fallback(job_name)
+        if err or spec is None:
+            return None
+        if dry_run:
+            return {"ran": False, "mode": "dry_run",
+                    "detail": json.dumps(spec)[:200]}
+        out = sw.run_no_result_fallback(rec)
+        rec["fallback"] = {"ran": out["ran"], "mode": out["mode"],
+                           "detail": out["detail"][:200], "ts": now_iso}
+        try:
+            sw.append_job_log({
+                "ts": now_iso,
+                "type": ("fallback_executed" if out["ran"]
+                         else "fallback_failed"),
+                "dm_id": rec.get("dm_id"),
+                "recipient": rec.get("recipient"),
+                "job_id": rec.get("job_id"),
+                "mode": out["mode"],
+                "detail": out["detail"][:300],
+            })
+        except Exception:
+            pass
+        return out
+    except Exception as e:
+        return {"ran": False, "mode": None,
+                "detail": f"fallback exception: {e}"}
+
+
 def remediate_breaks(dry_run=False) -> dict:
     """Progressively auto-remediate soft loop breakages while escalating hard breakages.
 
@@ -736,6 +802,20 @@ def remediate_breaks(dry_run=False) -> dict:
                         f_modified = True
                         rearm_sweeper = True
 
+                # Terminal: nudges exhausted and still no reply. Run the
+                # job's on_no_result fallback (server-side guarantee).
+                if is_expired and nudges_sent >= nudges_allowed:
+                    fb = maybe_run_terminal_fallback(rec, now_iso, dry_run)
+                    if fb is not None:
+                        remediated.append({
+                            "action": "terminal_fallback",
+                            "loop_id": dm_id,
+                            "agent": rec.get("recipient"),
+                            "detail": f"on_no_result ran={fb.get('ran')}: {fb.get('detail', '')[:160]}",
+                        })
+                        if not dry_run and "fallback" in rec:
+                            f_modified = True
+
         if f_modified and not dry_run:
             tmp = f"{f_path}.tmp.{os.getpid()}"
             with open(tmp, "w") as f:
@@ -746,7 +826,10 @@ def remediate_breaks(dry_run=False) -> dict:
             sweeper_py = Path("/home/super/Projects/NetVM/bin/followup-sweeper.py")
             if sweeper_py.exists():
                 try:
-                    subprocess.run([sys.executable, str(sweeper_py), "--once"], timeout=10)
+                    # A single nudge send takes ~10s median; give the sweep
+                    # room to finish or it dies mid-first-send every time.
+                    subprocess.run([sys.executable, str(sweeper_py), "--once"],
+                                   timeout=300)
                 except Exception:
                     pass
 
@@ -755,10 +838,10 @@ def remediate_breaks(dry_run=False) -> dict:
         import approvals
         fleet_apps = approvals.check_fleet_approvals()
         for app in fleet_apps:
-            if app.get("has_pending") and app.get("is_trusted"):
+            if app.get("has_pending") and app.get("is_trusted") and app.get("status") != "KEY_APPROVAL":
                 node = app["node"]
                 if not dry_run:
-                    approvals.allow_node_approval(node, caller="loop-remediate")
+                    approvals.allow_node_approval(node, always=True, caller="loop-remediate")
                 remediated.append({
                     "type": "approval_auto_allowed",
                     "agent": node,
@@ -809,4 +892,24 @@ def remediate_breaks(dry_run=False) -> dict:
     }
 
 
+def main(argv=None):
+    import argparse
+    ap = argparse.ArgumentParser(description="Loop gravity: reconcile and remediate followup loops")
+    ap.add_argument("--remediate", action="store_true",
+                    help="Run remediate_breaks once (what loop-remediator.timer invokes)")
+    ap.add_argument("--dry-run", action="store_true",
+                    help="Report actions without writing state or sending anything")
+    args = ap.parse_args(argv)
+    if not args.remediate:
+        ap.print_help()
+        return 2
+    result = remediate_breaks(dry_run=args.dry_run)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
+
+
 

bin/hatch_menu/__init__.py

@@ -0,0 +1,53 @@
+"""hatch_menu — modular muse.ai settings-menu navigation + toggles.
+
+One module per part so a site change means patching one file:
+  mouse.py    trusted input primitives (real click, escape, close)
+  dialog.py   settings dialog open / tab nav / rows / back / text
+  controls.py generic radio/switch primitives (verify-then-fallback)
+  toggles.py  toggle registry + sessions over controls and tabs
+  tabs/       one module per settings tab (uniform describe())
+
+invite.py consumes this package; `box chromebox` exposes toggles.
+"""
+
+from hatch_menu.dialog import (
+    TAB_NAMES,
+    TABS,
+    click_row,
+    close_settings,
+    describe_rows,
+    dialog_present,
+    dialog_text,
+    go_back,
+    goto_tab,
+    open_settings,
+)
+from hatch_menu.mouse import MouseError, close, escape, real_click
+from hatch_menu.toggles import (
+    MenuError,
+    describe_tab,
+    get_toggle,
+    list_toggles,
+    set_toggle,
+)
+
+__all__ = [
+    "TAB_NAMES",
+    "TABS",
+    "MenuError",
+    "MouseError",
+    "click_row",
+    "close",
+    "close_settings",
+    "describe_rows",
+    "describe_tab",
+    "dialog_present",
+    "dialog_text",
+    "escape",
+    "get_toggle",
+    "go_back",
+    "goto_tab",
+    "list_toggles",
+    "open_settings",
+    "real_click",
+]

bin/hatch_menu/controls.py

@@ -0,0 +1,248 @@
+"""Generic control primitives (ws-level, no tab knowledge).
+
+Radio/switch list + set with verify-then-fallback: synthetic click,
+verify state flipped, else trusted real click, verify again. Tab
+modules build their flows on these; toggles.py adds addressing.
+"""
+import time
+
+from approvals import cdp_evaluate
+from hatch_menu.mouse import real_click
+
+JS_LIST_RADIOS = """(() => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  return Array.from(d.querySelectorAll('input[type="radio"]')).map(r => {
+    let head = '', el = r.parentElement, depth = 0;
+    while (el && el !== d && depth < 6) {
+      const h = el.querySelector('h1,h2,h3,h4');
+      if (h && (h.innerText || '').trim()) {
+        head = h.innerText.trim().slice(0, 60);
+        break;
+      }
+      el = el.parentElement;
+      depth += 1;
+    }
+    const lab = r.closest('label');
+    return {value: r.value, checked: !!r.checked, heading: head,
+      aria: r.getAttribute('aria-label') || '',
+      label: lab ? (lab.innerText || '').trim().slice(0, 80) : ''};
+  });
+})()"""
+
+JS_CLICK_RADIO = """((heading, value) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return 'NO_DIALOG';
+  const radios = Array.from(d.querySelectorAll('input[type="radio"]'));
+  const headOf = (r) => {
+    let el = r.parentElement, depth = 0;
+    while (el && el !== d && depth < 6) {
+      const h = el.querySelector('h1,h2,h3,h4');
+      if (h && (h.innerText || '').trim())
+        return h.innerText.trim().toLowerCase();
+      el = el.parentElement;
+      depth += 1;
+    }
+    return '';
+  };
+  const t = radios.find(r => headOf(r) === heading.toLowerCase()
+    && r.value === value);
+  if (!t) return 'NO_MATCH';
+  t.click();
+  return 'CLICKED';
+})('%s', '%s')"""
+
+JS_RADIO_RECT = """((heading, value) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  const radios = Array.from(d.querySelectorAll('input[type="radio"]'));
+  const headOf = (r) => {
+    let el = r.parentElement, depth = 0;
+    while (el && el !== d && depth < 6) {
+      const h = el.querySelector('h1,h2,h3,h4');
+      if (h && (h.innerText || '').trim())
+        return h.innerText.trim().toLowerCase();
+      el = el.parentElement;
+      depth += 1;
+    }
+    return '';
+  };
+  const t = radios.find(r => headOf(r) === heading.toLowerCase()
+    && r.value === value);
+  if (!t) return null;
+  const r = t.getBoundingClientRect();
+  return {x: r.x + r.width / 2, y: r.y + r.height / 2};
+})('%s', '%s')"""
+
+JS_CLICK_RADIO_ARIA = """((name) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return 'NO_DIALOG';
+  const n = name.toLowerCase();
+  const t = Array.from(d.querySelectorAll('input[type="radio"]'))
+    .find(r => (r.getAttribute('aria-label') || '').toLowerCase() === n
+      || (r.value || '').toLowerCase() === n);
+  if (!t) return 'NO_MATCH';
+  t.click();
+  return 'CLICKED';
+})('%s')"""
+
+JS_RADIO_ARIA_RECT = """((name) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  const n = name.toLowerCase();
+  const t = Array.from(d.querySelectorAll('input[type="radio"]'))
+    .find(r => (r.getAttribute('aria-label') || '').toLowerCase() === n
+      || (r.value || '').toLowerCase() === n);
+  if (!t) return null;
+  const r = t.getBoundingClientRect();
+  return {x: r.x + r.width / 2, y: r.y + r.height / 2};
+})('%s')"""
+
+JS_LIST_SWITCHES = """(() => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  return Array.from(d.querySelectorAll('[role="switch"]')).map(s => {
+    let el = s.parentElement, label = '', depth = 0;
+    while (el && el !== d && depth < 6) {
+      const t = (el.innerText || '').trim().replace(/\\s+/g, ' ');
+      if (t && t.length < 250) { label = t; break; }
+      el = el.parentElement;
+      depth += 1;
+    }
+    return {label: label.slice(0, 200),
+            aria: s.getAttribute('aria-label') || '',
+            checked: s.getAttribute('aria-checked') === 'true'};
+  });
+})()"""
+
+JS_CLICK_SWITCH = """((label) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return 'NO_DIALOG';
+  const rowOf = (s) => {
+    let el = s.parentElement, depth = 0;
+    while (el && el !== d && depth < 6) {
+      const t = (el.innerText || '').trim();
+      if (t && t.length < 250) return t.toLowerCase();
+      el = el.parentElement;
+      depth += 1;
+    }
+    return '';
+  };
+  const hits = Array.from(d.querySelectorAll('[role="switch"]'))
+    .filter(s => rowOf(s).includes(label.toLowerCase())
+      || (s.getAttribute('aria-label') || '').toLowerCase()
+        .includes(label.toLowerCase()));
+  if (!hits.length) return 'NO_MATCH';
+  if (hits.length > 1) return 'AMBIGUOUS';
+  hits[0].click();
+  return 'CLICKED';
+})('%s')"""
+
+def _eval(ws, js, timeout=8.0):
+    try:
+        return cdp_evaluate(ws, js, timeout=timeout)
+    except Exception:
+        return None
+
+
+VERIFY_TRIES = 10
+VERIFY_PAUSE = 1.5
+
+
+def _poll(check, tries=VERIFY_TRIES, pause=VERIFY_PAUSE):
+    """Poll a state check until true. Fast exit; tolerates slow commits."""
+    for _ in range(tries):
+        try:
+            if check():
+                return True
+        except Exception:
+            pass
+        time.sleep(pause)
+    return False
+
+
+def list_radios(ws):
+    """All dialog radios with heading/label/value/checked (or [])."""
+    rows = _eval(ws, JS_LIST_RADIOS)
+    return rows if isinstance(rows, list) else []
+
+
+def list_switches(ws):
+    """All dialog switches with row label + checked (or [])."""
+    rows = _eval(ws, JS_LIST_SWITCHES)
+    return rows if isinstance(rows, list) else []
+
+
+def radio_state(ws, heading, value):
+    """Checked state of one heading-grouped radio, None if absent."""
+    for r in list_radios(ws):
+        if (r.get("heading") or "").lower() == heading.lower() \
+                and r.get("value") == value:
+            return bool(r.get("checked"))
+    return None
+
+
+def set_radio_by_heading(ws, heading, value):
+    """Set a heading-grouped radio; poll, else trusted click, poll."""
+    if _eval(ws, JS_CLICK_RADIO % (heading, value)) == "CLICKED" \
+            and _poll(lambda: radio_state(ws, heading, value) is True):
+        return True
+    rect = _eval(ws, JS_RADIO_RECT % (heading, value))
+    if not rect or "x" not in rect:
+        return False
+    try:
+        real_click(ws, rect["x"], rect["y"])
+    except Exception:
+        return False
+    return _poll(lambda: radio_state(ws, heading, value) is True)
+
+
+def radio_aria_state(ws, name):
+    """Checked state of one aria-labeled radio, None if absent."""
+    n = name.lower()
+    for r in list_radios(ws):
+        if (r.get("aria") or "").lower() == n \
+                or (r.get("value") or "").lower() == n:
+            return bool(r.get("checked"))
+    return None
+
+
+def set_radio_by_aria(ws, name):
+    """Set an aria-labeled radio; poll, else trusted click, poll."""
+    if _eval(ws, JS_CLICK_RADIO_ARIA % name) == "CLICKED" \
+            and _poll(lambda: radio_aria_state(ws, name) is True):
+        return True
+    rect = _eval(ws, JS_RADIO_ARIA_RECT % name)
+    if not rect or "x" not in rect:
+        return False
+    try:
+        real_click(ws, rect["x"], rect["y"])
+    except Exception:
+        return False
+    return _poll(lambda: radio_aria_state(ws, name) is True)
+
+
+def switch_state(ws, label):
+    """Checked state of one label-matched switch, None if not unique."""
+    matches = [s for s in list_switches(ws)
+               if label.lower() in (s.get("label") or "").lower()
+               or label.lower() in (s.get("aria") or "").lower()]
+    if len(matches) != 1:
+        return None
+    return bool(matches[0].get("checked"))
+
+
+def set_switch(ws, label, on):
+    """Set a switch by row-label/aria match; no-op when already there.
+
+    Single click only: a fallback re-click would UNDO a slow commit
+    (switches toggle). The fresh-session readback decides.
+    """
+    state = switch_state(ws, label)
+    if state is None:
+        return False
+    if state == bool(on):
+        return True
+    if _eval(ws, JS_CLICK_SWITCH % label) != "CLICKED":
+        return False
+    return _poll(lambda: switch_state(ws, label) is bool(on))

bin/hatch_menu/dialog.py

@@ -0,0 +1,162 @@
+"""Settings dialog navigation: open, tabs, rows, back, text.
+
+Open is retried (single-shot opens flake ~1/4 live): each attempt
+re-Escapes and re-drives the dock menu from scratch. Tab clicks are
+idempotent (re-clicking the active tab is a harmless no-op), so goto
+always clicks and reports the click result instead of guessing which
+tab is active.
+"""
+import json
+import time
+
+from approvals import cdp_evaluate
+from hatch_menu.mouse import escape, real_click
+
+TAB_NAMES = ["General", "Connectors", "Wallet", "Secure store",
+             "Permissions", "Messaging channels", "Devices",
+             "Data controls", "Help & support", "Legal info"]
+TABS = TAB_NAMES  # legacy alias
+
+# Tab rail buttons carry bare tab names and live outside any nav
+# landmark, so row matchers exclude them by exact text (live 2026-10-06).
+_JS_TABS = json.dumps(TAB_NAMES)
+
+DOCK_MORE_TESTID = "hatch-dock-more"
+
+JS_DOCK_RECT = ("(() => { const b = document.querySelector("
+                "'[data-testid=\"hatch-dock-more\"]'); if (!b) return null;"
+                " const r = b.getBoundingClientRect();"
+                " return {x: r.x + r.width/2, y: r.y + r.height/2}; })()")
+
+JS_CLICK_SETTINGS_ITEM = ("(() => { const it = Array.from(document."
+    "querySelectorAll('[role=\"menuitem\"]')).find(el => el.getAttribute("
+    "'data-pel-click') === 'settings_nav_click');"
+    " if (!it) return 'NO_ITEM'; it.click(); return 'CLICKED'; })()")
+
+JS_DIALOG_PRESENT = ("(() => !!document.querySelector('[role=\"dialog\"]'))()")
+
+JS_DIALOG_TEXT = ("(() => { const d = document.querySelector("
+                  "'[role=\"dialog\"]'); return d ? d.innerText : null; })()")
+
+JS_GOTO_TAB_TMPL = ("(() => { const b = Array.from(document."
+    "querySelectorAll('[role=\"dialog\"] button')).find(x => "
+    "(x.innerText||'').trim() === '%s');"
+    " if (!b) return 'NO_TAB'; b.click(); return 'CLICKED'; })()")
+
+JS_CLICK_ROW_TMPL = ("((name) => {"
+    " const d = document.querySelector('[role=\"dialog\"]');"
+    " if (!d) return 'NO_DIALOG';"
+    " const TABS = " + _JS_TABS + ";"
+    " const inNav = (el) => !!el.closest("
+    "'nav, [role=\"tablist\"], [role=\"navigation\"]');"
+    " const els = Array.from(d.querySelectorAll("
+    "'button, [role=\"button\"], a')).filter(e => !inNav(e));"
+    " const t = els.find(e => {"
+    " const txt = (e.innerText || '').trim();"
+    " return !TABS.includes(txt) && txt.toLowerCase()"
+    ".startsWith(name.toLowerCase()); });"
+    " if (!t) return 'NO_ROW'; t.click(); return 'CLICKED'; })('%s')")
+
+JS_DESCRIBE_ROWS = ("(() => {"
+    " const d = document.querySelector('[role=\"dialog\"]');"
+    " if (!d) return null;"
+    " const TABS = " + _JS_TABS + ";"
+    " const inNav = (el) => !!el.closest("
+    "'nav, [role=\"tablist\"], [role=\"navigation\"]');"
+    " return Array.from(d.querySelectorAll("
+    "'button, [role=\"button\"], a')).filter(e => !inNav(e))"
+    ".filter(e => !TABS.includes((e.innerText || '').trim()))"
+    ".map(e => { const lines = (e.innerText || '').trim().split('\\n');"
+    " return {name: (lines[0] || '').slice(0, 80),"
+    " detail: lines.slice(1).join(' / ').slice(0, 120)}; }); })()")
+
+JS_GO_BACK = ("(() => { const d = document.querySelector("
+              "'[role=\"dialog\"]'); if (!d) return 'NO_DIALOG';"
+              " const b = Array.from(d.querySelectorAll('button')).find("
+              "x => (x.getAttribute('aria-label') || '') === 'Go back');"
+              " if (!b) return 'NO_BACK'; b.click(); return 'CLICKED'; })()")
+
+
+def _eval(ws, js, timeout=8.0):
+    try:
+        return cdp_evaluate(ws, js, timeout=timeout)
+    except Exception:
+        return None
+
+
+def dialog_present(ws):
+    """True when a dialog is currently open."""
+    return bool(_eval(ws, JS_DIALOG_PRESENT, timeout=5.0))
+
+
+def dialog_text(ws, timeout=8.0, limit=4000):
+    """Inner text of the open dialog, or None."""
+    try:
+        text = cdp_evaluate(ws, JS_DIALOG_TEXT, timeout=timeout)
+    except Exception:
+        return None
+    if not isinstance(text, str) or not text:
+        return None
+    return text[:limit]
+
+
+def open_settings(ws, tries=3):
+    """Open the Settings dialog via the dock menu. True when open."""
+    for _ in range(tries):
+        escape(ws)
+        time.sleep(0.5)
+        rect = _eval(ws, JS_DOCK_RECT, timeout=5.0)
+        if not rect or "x" not in rect:
+            continue
+        try:
+            real_click(ws, rect["x"], rect["y"])
+        except Exception:
+            continue
+        time.sleep(1.0)
+        if _eval(ws, JS_CLICK_SETTINGS_ITEM,
+                 timeout=5.0) != "CLICKED":
+            continue
+        time.sleep(1.5)
+        if dialog_present(ws):
+            return True
+    return False
+
+
+def goto_tab(ws, name, timeout=5.0):
+    """Click a Settings tab by visible name. True when clicked."""
+    if _eval(ws, JS_GOTO_TAB_TMPL % name, timeout=timeout) != "CLICKED":
+        return False
+    time.sleep(0.8)
+    return True
+
+
+def click_row(ws, name, tab=None, timeout=8.0):
+    """Click a content row; verify the drill/expand opened. Bool."""
+    if tab is not None and not goto_tab(ws, tab, timeout=timeout):
+        return False
+    if _eval(ws, JS_CLICK_ROW_TMPL % name, timeout=timeout) != "CLICKED":
+        return False
+    time.sleep(1.0)
+    text = dialog_text(ws, timeout=timeout) or ""
+    return name.lower() in text.lower()
+
+
+def describe_rows(ws, tab=None, timeout=8.0):
+    """Inventory rows (name/detail) on a tab. [] when unreadable."""
+    if tab is not None and not goto_tab(ws, tab, timeout=timeout):
+        return []
+    rows = _eval(ws, JS_DESCRIBE_ROWS, timeout=timeout)
+    return rows if isinstance(rows, list) else []
+
+
+def go_back(ws):
+    """Click the sub-page Go back button. True when clicked."""
+    if _eval(ws, JS_GO_BACK, timeout=5.0) != "CLICKED":
+        return False
+    time.sleep(0.8)
+    return True
+
+
+def close_settings(ws):
+    """Dismiss settings/popovers. Never raises."""
+    escape(ws)

bin/hatch_menu/mouse.py

@@ -0,0 +1,62 @@
+"""Trusted input primitives for menu automation.
+
+Radix triggers (dock menu, permission-mode choosers) ignore synthetic
+JS clicks: they need real CDP Input.dispatchMouseEvent press+release.
+"""
+import json
+import time
+
+from approvals import _cdp_req_ids as _shared_cdp_ids, cdp_evaluate
+
+ESCAPE_JS = ("(() => { document.dispatchEvent(new KeyboardEvent("
+             "'keydown', {key: 'Escape', code: 'Escape',"
+             " bubbles: true})); return 'ESC'; })()")
+
+
+class MouseError(RuntimeError):
+    """Trusted click failed (CDP transport or echo timeout)."""
+
+
+def escape(ws):
+    """Dismiss topmost popover/menu/dialog. Never raises."""
+    try:
+        cdp_evaluate(ws, ESCAPE_JS, timeout=3.0)
+    except Exception:
+        pass
+
+
+def close(ws):
+    """Close a CDP websocket. Never raises."""
+    try:
+        ws.close()
+    except Exception:
+        pass
+
+
+def real_click(ws, x, y, timeout=5.0):
+    """Trusted press+release at page coordinates.
+
+    Shares approvals' monotonic CDP id counter so ids stay unique on
+    the connection; matches responses by id like cdp_evaluate.
+    Raises MouseError on transport or echo-timeout failure.
+    """
+    try:
+        for typ in ("mousePressed", "mouseReleased"):
+            req_id = next(_shared_cdp_ids)
+            ws.send(json.dumps({"id": req_id,
+                                "method": "Input.dispatchMouseEvent",
+                                "params": {"type": typ, "x": x, "y": y,
+                                          "button": "left",
+                                          "clickCount": 1}}))
+            deadline = time.time() + timeout
+            while time.time() < deadline:
+                resp = json.loads(ws.recv())
+                if resp.get("id") == req_id:
+                    break
+            else:
+                raise MouseError("mouse echo timeout for %s" % typ)
+    except MouseError:
+        raise
+    except Exception as e:
+        raise MouseError("real click failed: %s: %s"
+                         % (type(e).__name__, e))

bin/hatch_menu/tabs/__init__.py

@@ -0,0 +1,30 @@
+"""One module per Settings tab. Uniform: TAB, describe(ws)."""
+from hatch_menu.tabs import (
+    connectors,
+    data_controls,
+    devices,
+    general,
+    help_support,
+    legal,
+    messaging,
+    permissions,
+    secure_store,
+    wallet,
+)
+
+TAB_MODULES = {
+    "General": general,
+    "Connectors": connectors,
+    "Wallet": wallet,
+    "Secure store": secure_store,
+    "Permissions": permissions,
+    "Messaging channels": messaging,
+    "Devices": devices,
+    "Data controls": data_controls,
+    "Help & support": help_support,
+    "Legal info": legal,
+}
+
+__all__ = ["TAB_MODULES", "connectors", "data_controls", "devices",
+           "general", "help_support", "legal", "messaging",
+           "permissions", "secure_store", "wallet"]

bin/hatch_menu/tabs/connectors.py

@@ -0,0 +1,10 @@
+"""Connectors tab: read-only inventory (search + per-app Connect/View)."""
+from hatch_menu import dialog
+
+TAB = "Connectors"
+
+
+def describe(ws):
+    """Row inventory + text excerpt (describe-only for now)."""
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "text": (dialog.dialog_text(ws) or "")[:400]}

bin/hatch_menu/tabs/data_controls.py

@@ -0,0 +1,101 @@
+"""Data controls tab: model-improvement switch (read-only otherwise).
+
+The switch label is pinned from live recon; resolution prefers it
+and falls back to single-switch, then keyword match. Sets use a
+trusted click: synthetic clicks are proven no-ops here (2026-10-06).
+Import/Delete rows are inventoried, never touched.
+"""
+import time
+
+from approvals import cdp_evaluate
+from hatch_menu import controls, dialog
+from hatch_menu.mouse import real_click
+
+TAB = "Data controls"
+SWITCH_LABEL = "Help improve our AI models"
+_KEYWORDS = ("improv", "train", "model", "data", "usage")
+
+JS_AI_RECT_TMPL = """((label) => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  const rowOf = (s) => {
+    let el = s.parentElement, depth = 0;
+    while (el && el !== d && depth < 6) {
+      const t = (el.innerText || '').trim();
+      if (t && t.length < 250) return t.toLowerCase();
+      el = el.parentElement;
+      depth += 1;
+    }
+    return '';
+  };
+  const hits = Array.from(d.querySelectorAll('[role="switch"]'))
+    .filter(s => rowOf(s).includes(label.toLowerCase())
+      || (s.getAttribute('aria-label') || '').toLowerCase()
+        .includes(label.toLowerCase()));
+  if (hits.length !== 1) return null;
+  const r = hits[0].getBoundingClientRect();
+  return {x: r.x + r.width / 2, y: r.y + r.height / 2};
+})('%s')"""
+
+
+def _eval(ws, js, timeout=8.0):
+    try:
+        return cdp_evaluate(ws, js, timeout=timeout)
+    except Exception:
+        return None
+
+
+def _resolve(ws):
+    """The improvement switch dict, or None when not resolvable."""
+    if not dialog.goto_tab(ws, TAB):
+        return None
+    switches = controls.list_switches(ws)
+    for s in switches:
+        blob = ((s.get("label") or "") + " "
+                + (s.get("aria") or "")).lower()
+        if SWITCH_LABEL.lower() in blob:
+            return s
+    if len(switches) == 1:
+        return switches[0]
+    for kw in _KEYWORDS:
+        for s in switches:
+            blob = ((s.get("label") or "") + " "
+                    + (s.get("aria") or "")).lower()
+            if kw in blob:
+                return s
+    return None
+
+
+def ai_improvement(ws):
+    """Improvement-switch state: True/False, None when unreadable."""
+    sw = _resolve(ws)
+    return None if sw is None else bool(sw.get("checked"))
+
+
+def set_ai_improvement(ws, on):
+    """Set via one trusted click; synthetic clicks are no-ops. Bool."""
+    sw = _resolve(ws)
+    if sw is None:
+        return False
+    if bool(sw.get("checked")) == bool(on):
+        return True
+    rect = _eval(ws, JS_AI_RECT_TMPL % SWITCH_LABEL)
+    if not rect or "x" not in rect:
+        return False
+    try:
+        real_click(ws, rect["x"], rect["y"])
+    except Exception:
+        return False
+    for _ in range(8):
+        time.sleep(2.0)
+        if ai_improvement(ws) is bool(on):
+            return True
+    return False
+
+
+def describe(ws):
+    """Inventory: switch state + row names (import/delete read-only)."""
+    state = ai_improvement(ws)
+    return {"ai_improvement":
+            ("on" if state else "off") if state is not None else None,
+            "rows": dialog.describe_rows(ws, TAB)}

bin/hatch_menu/tabs/devices.py

@@ -0,0 +1,13 @@
+"""Devices tab: read-only inventory (paired devices or empty state)."""
+from hatch_menu import dialog
+
+TAB = "Devices"
+
+
+def describe(ws):
+    """Row inventory + empty flag (describe-only for now)."""
+    text = dialog.dialog_text(ws) or ""
+    low = text.lower()
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "empty": ("no devices" in low or "don't have" in low),
+            "text": text[:400]}

bin/hatch_menu/tabs/general.py

@@ -0,0 +1,95 @@
+"""General tab: usage balances, theme picker, redeem entrypoint.
+
+Usage parsing moved here from invite.py (single copy). All flows are
+ws-level: sessions and error shaping live in toggles.py.
+"""
+import re
+
+from approvals import cdp_evaluate
+from hatch_menu import controls, dialog
+
+TAB = "General"
+
+THEME_VALUES = ("avatar", "default", "blue", "purple", "pink",
+                "orange", "green", "beige", "monochrome")
+
+_FREE_RE = re.compile(r"\bfree plan\b", re.IGNORECASE)
+_PCT_RE = re.compile(r"(\d+)%\s*used")
+_RESET_RE = re.compile(r"resets?\s+on\s+([A-Z][a-z]+\s+\d{1,2})",
+                       re.IGNORECASE)
+_TOK_RE = re.compile(r"\(([0-9.,]+\s*[BMK]?)\s*tokens?\s+left\)",
+                     re.IGNORECASE)
+
+
+def parse_usage_text(text):
+    """Parse a General-tab usage block into a balance dict.
+
+    Returns None for empty/unreadable text. Weekly fields stay None
+    when the block only carries additional-tokens rows.
+    """
+    if not text or not text.strip():
+        return None
+    out = {"plan": None, "weekly": {"pct_used": None, "resets_on": None},
+           "additional": {"pct_used": None, "tokens_left": None,
+                          "never_expires": False}}
+    if _FREE_RE.search(text):
+        out["plan"] = "free"
+    pcts = _PCT_RE.findall(text)
+    if pcts:
+        out["weekly"]["pct_used"] = int(pcts[0])
+        if len(pcts) > 1:
+            out["additional"]["pct_used"] = int(pcts[1])
+    m = _RESET_RE.search(text)
+    if m:
+        out["weekly"]["resets_on"] = m.group(1)
+    m = _TOK_RE.search(text)
+    if m:
+        out["additional"]["tokens_left"] = m.group(1).strip()
+    if "never expires" in text.lower():
+        out["additional"]["never_expires"] = True
+    return out
+
+
+def _eval(ws, js, timeout=8.0):
+    try:
+        return cdp_evaluate(ws, js, timeout=timeout)
+    except Exception:
+        return None
+
+
+def usage(ws):
+    """Usage balances from General tab. Dict, or None when unreadable."""
+    if not dialog.goto_tab(ws, TAB):
+        return None
+    return parse_usage_text(dialog.dialog_text(ws))
+
+
+def theme(ws):
+    """Current theme radio value, or None when unreadable."""
+    if not dialog.goto_tab(ws, TAB):
+        return None
+    for r in controls.list_radios(ws):
+        if r.get("checked"):
+            return r.get("value")
+    return None
+
+
+def set_theme(ws, value):
+    """Set theme by aria-label; verify-then-fallback. Bool."""
+    if not dialog.goto_tab(ws, TAB):
+        return False
+    return controls.set_radio_by_aria(ws, value)
+
+
+def redeem_row(ws):
+    """True when the 'Redeem invite code' row is present (eligible)."""
+    if not dialog.goto_tab(ws, TAB):
+        return False
+    text = (dialog.dialog_text(ws) or "").lower()
+    return "redeem" in text and "invite code" in text
+
+
+def describe(ws):
+    """Full General inventory: usage, theme, redeem entrypoint."""
+    return {"usage": usage(ws), "theme": theme(ws),
+            "redeem_row": redeem_row(ws)}

bin/hatch_menu/tabs/help_support.py

@@ -0,0 +1,10 @@
+"""Help & support tab: read-only inventory (help links)."""
+from hatch_menu import dialog
+
+TAB = "Help & support"
+
+
+def describe(ws):
+    """Row inventory + text excerpt (describe-only for now)."""
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "text": (dialog.dialog_text(ws) or "")[:400]}

bin/hatch_menu/tabs/legal.py

@@ -0,0 +1,10 @@
+"""Legal info tab: read-only inventory (legal links)."""
+from hatch_menu import dialog
+
+TAB = "Legal info"
+
+
+def describe(ws):
+    """Row inventory + text excerpt (describe-only for now)."""
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "text": (dialog.dialog_text(ws) or "")[:400]}

bin/hatch_menu/tabs/messaging.py

@@ -0,0 +1,10 @@
+"""Messaging channels tab: read-only inventory (channel rows)."""
+from hatch_menu import dialog
+
+TAB = "Messaging channels"
+
+
+def describe(ws):
+    """Row inventory + text excerpt (describe-only for now)."""
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "text": (dialog.dialog_text(ws) or "")[:400]}

bin/hatch_menu/tabs/permissions.py

@@ -0,0 +1,422 @@
+"""Permissions tab: defaults radios, website modes, protocols, advanced.
+
+Contracts live here (single copy): toggles.py references these
+constants for addressing. Drills open sub-pages, read, and come back
+via the back affordance with tab re-entry fallback. All flows are
+ws-level; sessions and error shaping live in toggles.py.
+"""
+import re
+import time
+
+from approvals import cdp_evaluate
+from hatch_menu import controls, dialog
+from hatch_menu.mouse import escape, real_click
+
+TAB = "Permissions"
+ROOT_MARK = "Manage permissions"
+
+CONNECTOR_HEADING = "Connector defaults"
+WEB_HEADING = "Web access defaults"
+DEFAULT_VALUES = ("auto_allow", "always_ask")
+
+WEBSITE_MODES = ("Allow", "Ask", "Deny")
+
+ADV_LABELS = {"transparent_proxy": "Transparent proxy",
+              "tls_interception": "TLS interception",
+              "sni_mismatch_rejection": "SNI mismatch rejection"}
+
+# Row titles (first line of each protocol row) pinned live 2026-10-06:
+# network primitives on every node checked; MCP titles kept
+# defensively in case they appear on other plans/accounts.
+PROTOCOL_SLUGS = {"Outbound SSH": "outbound-ssh",
+                  "Outgoing email (SMTP)": "smtp",
+                  "Email mailbox access (IMAP, POP3)": "imap-pop3",
+                  "Database connections": "database",
+                  "File transfer (FTP)": "ftp",
+                  "External DNS lookups": "dns",
+                  "Other TCP connections": "other-tcp",
+                  "Other UDP traffic": "other-udp",
+                  "Model Context Protocol servers (SSE)": "mcp-sse",
+                  "Model Context Protocol servers (Streamable HTTP)":
+                  "mcp-streamable",
+                  "Agent Skills endpoints": "agent-skills",
+                  "MCP Apps (UI extensions)": "mcp-apps",
+                  "MCP remote OAuth": "mcp-oauth"}
+
+JS_WEBSITES = """(() => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  const out = [];
+  for (const b of d.querySelectorAll('button')) {
+    const m = (b.getAttribute('aria-label') || '').match(
+      /^Change permission mode for (.+),\\s*(Allow|Ask|Deny)$/i);
+    if (!m) continue;
+    const r = b.getBoundingClientRect();
+    out.push({host: m[1].trim(), mode: m[2],
+      x: r.x + r.width / 2, y: r.y + r.height / 2});
+  }
+  return out;
+})()"""
+
+JS_MODE_MENU = """(() => {
+  return Array.from(document.querySelectorAll('[role="menuitem"]'))
+    .map(m => ({text: (m.innerText || '').trim()}));
+})()"""
+
+JS_CLICK_MODE = """((mode) => {
+  const m = Array.from(document.querySelectorAll('[role="menuitem"]'))
+    .find(el => (el.innerText || '').trim() === mode);
+  if (!m) return 'NO_MATCH';
+  m.click();
+  return 'CLICKED';
+})('%s')"""
+
+JS_PROTO_ROWS = """(() => {
+  const d = document.querySelector('[role="dialog"]');
+  if (!d) return null;
+  return Array.from(d.querySelectorAll('[role="switch"]')).map(s => {
+    let el = s.parentElement, title = '', depth = 0;
+    while (el && el !== d && depth < 6) {
+      const t = (el.innerText || '').trim().split('\\n')[0] || '';
+      if (t) { title = t.slice(0, 80); break; }
+      el = el.parentElement;
+      depth += 1;
+    }
+    const r = s.getBoundingClientRect();
+    return {title: title,
+            checked: s.getAttribute('aria-checked') === 'true',
+            x: r.x + r.width / 2, y: r.y + r.height / 2};
+  });
+})()"""
+
+
+def _eval(ws, js, timeout=8.0):
+    try:
+        return cdp_evaluate(ws, js, timeout=timeout)
+    except Exception:
+        return None
+
+
+def _stable_rows(ws, js, retries=4, pause=1.5):
+    """Repeat a row read until two consecutive reads agree.
+
+    Guards mid-animation partial DOM (innerText shifts while the
+    sub-page slides in). Returns the agreed list, or None.
+    """
+    last = "sentinel"
+    for _ in range(retries):
+        rows = _eval(ws, js)
+        if isinstance(rows, list) and rows == last:
+            return rows
+        last = rows if isinstance(rows, list) else "sentinel"
+        time.sleep(pause)
+    return last if isinstance(last, list) else None
+
+
+def _slug(title):
+    """Protocol slug: registry hit, else slugified, else None."""
+    if title in PROTOCOL_SLUGS:
+        return PROTOCOL_SLUGS[title]
+    clean = re.sub(r"[^a-z0-9]+", "-",
+                   title.strip().lower()).strip("-")
+    return clean or None
+
+
+def _canon_mode(mode):
+    """Canonical Allow/Ask/Deny (case-insensitive); passthrough else."""
+    for m in WEBSITE_MODES:
+        if (mode or "").lower() == m.lower():
+            return m
+    return mode
+
+
+def resolve_protocol(name):
+    """Slug/title -> row title, None when unresolvable.
+
+    Exact slug or title first; then a unique case-insensitive
+    substring over titles+slugs (so 'ssh' finds Outbound SSH).
+    """
+    if not isinstance(name, str) or not name.strip():
+        return None
+    want = name.strip().lower()
+    for title, slug in PROTOCOL_SLUGS.items():
+        if want == slug or want == title.lower():
+            return title
+    hits = [t for t, s in PROTOCOL_SLUGS.items()
+            if want in t.lower() or want in s]
+    if len(hits) == 1:
+        return hits[0]
+    return None
+
+
+def _back_to_root(ws):
+    """Back affordance, else tab re-entry; verify root text."""
+    dialog.go_back(ws)
+    if ROOT_MARK in (dialog.dialog_text(ws) or ""):
+        return True
+    if not dialog.goto_tab(ws, TAB):
+        return False
+    return ROOT_MARK in (dialog.dialog_text(ws) or "")
+
+
+def defaults(ws):
+    """Connector + web default values (each value or None)."""
+    if not dialog.goto_tab(ws, TAB):
+        return {"connector_defaults": None, "web_access": None}
+    heads = {CONNECTOR_HEADING.lower(): "connector_defaults",
+             WEB_HEADING.lower(): "web_access"}
+    vals = {CONNECTOR_HEADING.lower(): [], WEB_HEADING.lower(): []}
+    for r in controls.list_radios(ws):
+        h = (r.get("heading") or "").lower()
+        if h in vals and r.get("checked"):
+            vals[h].append(r.get("value"))
+    out = {}
+    for h, key in heads.items():
+        out[key] = vals[h][0] if len(vals[h]) == 1 else None
+    return out
+
+
+def set_default(ws, which, value):
+    """Set one defaults radio. Bool."""
+    if not dialog.goto_tab(ws, TAB):
+        return False
+    heading = CONNECTOR_HEADING if which == "connector_defaults" \
+        else WEB_HEADING
+    return controls.set_radio_by_heading(ws, heading, value)
+
+
+def ensure_advanced(ws):
+    """Expand Advanced network settings when collapsed. Bool."""
+    if not dialog.goto_tab(ws, TAB):
+        return False
+    labels = [s.get("label", "") for s in controls.list_switches(ws)]
+    if any("Transparent proxy" in lab for lab in labels):
+        return True
+    if not dialog.click_row(ws, "Advanced network settings", TAB):
+        return False
+    time.sleep(0.6)
+    labels = [s.get("label", "") for s in controls.list_switches(ws)]
+    return any("Transparent proxy" in lab for lab in labels)
+
+
+def advanced(ws):
+    """Advanced switch states {key: on/off/None}."""
+    if not ensure_advanced(ws):
+        return {k: None for k in ADV_LABELS}
+    out = {}
+    for key, label in ADV_LABELS.items():
+        state = None
+        for s in controls.list_switches(ws):
+            if label.lower() in (s.get("label") or "").lower():
+                state = bool(s.get("checked"))
+                break
+        out[key] = ("on" if state else "off") if state is not None \
+            else None
+    return out
+
+
+def set_advanced(ws, key, on):
+    """Set one advanced switch. Bool."""
+    if key not in ADV_LABELS or not ensure_advanced(ws):
+        return False
+    return controls.set_switch(ws, ADV_LABELS[key], on)
+
+
+def _websites_raw(ws):
+    """Drill into Websites; rows or None (stays on sub-page)."""
+    if not dialog.click_row(ws, "Websites", TAB):
+        return None
+    return _stable_rows(ws, JS_WEBSITES)
+
+
+def websites(ws):
+    """[{host, mode}] (back at root afterwards)."""
+    rows = _websites_raw(ws)
+    if rows is None:
+        return []
+    out = [{"host": r.get("host"), "mode": _canon_mode(r.get("mode"))}
+           for r in rows]
+    _back_to_root(ws)
+    return out
+
+
+def website_mode(ws, host):
+    """Mode for one host, or None when absent/unreadable."""
+    for row in websites(ws):
+        if (row.get("host") or "").lower() == host.lower():
+            return row.get("mode")
+    return None
+
+
+def set_website_mode(ws, host, mode):
+    """Set one host mode via the mode chooser. Bool.
+
+    One-way for Ask/Deny: the override row leaves the allowed list
+    (no add UI), so removal verifies by absence. No-op when already
+    there; absent hosts fail (nothing to click).
+    """
+    if mode not in WEBSITE_MODES:
+        return False
+    rows = _websites_raw(ws)
+    if rows is None:
+        return False
+    target = next((r for r in rows
+                   if (r.get("host") or "").lower() == host.lower()),
+                  None)
+    if target is None:
+        _back_to_root(ws)
+        return False
+    if _canon_mode(target.get("mode")) == mode:
+        _back_to_root(ws)
+        return True
+    try:
+        real_click(ws, target["x"], target["y"])
+    except Exception:
+        _back_to_root(ws)
+        return False
+    time.sleep(0.8)
+    items = _eval(ws, JS_MODE_MENU)
+    texts = [(i.get("text") or "") for i in items] \
+        if isinstance(items, list) else []
+    if mode not in texts:
+        escape(ws)
+        _back_to_root(ws)
+        return False
+    if _eval(ws, JS_CLICK_MODE % mode) != "CLICKED":
+        escape(ws)
+        _back_to_root(ws)
+        return False
+    for _ in range(5):
+        time.sleep(2.0)
+        rows = _eval(ws, JS_WEBSITES)
+        if not isinstance(rows, list):
+            continue
+        cur = next((_canon_mode(r.get("mode")) for r in rows
+                    if (r.get("host") or "").lower() == host.lower()),
+                   None)
+        if mode in ("Ask", "Deny"):
+            if cur is None:
+                _back_to_root(ws)
+                return True
+        elif cur == mode:
+            _back_to_root(ws)
+            return True
+    escape(ws)
+    _back_to_root(ws)
+    return False
+
+
+def _protocols_raw(ws):
+    """Drill into protocols; rows or None (stays on sub-page)."""
+    if not dialog.click_row(ws, "Direct network protocols", TAB):
+        return None
+    return _stable_rows(ws, JS_PROTO_ROWS)
+
+
+def protocols(ws):
+    """[{slug, title, on}] (back at root afterwards)."""
+    rows = _protocols_raw(ws)
+    if rows is None:
+        return []
+    out = [{"slug": _slug(r.get("title", "")),
+            "title": r.get("title", ""),
+            "on": "on" if r.get("checked") else "off"} for r in rows]
+    _back_to_root(ws)
+    return out
+
+
+def protocol_state(ws, title):
+    """on/off for one protocol row title, None when absent."""
+    for row in protocols(ws):
+        if row.get("title") == title:
+            return row.get("on")
+    return None
+
+
+def set_protocol(ws, title, on):
+    """Set one protocol switch in place; readback before returning."""
+    rows = _protocols_raw(ws)
+    if rows is None:
+        return False
+    target = next((r for r in rows if r.get("title") == title), None)
+    if target is None:
+        _back_to_root(ws)
+        return False
+    want = bool(on)
+    if bool(target.get("checked")) == want:
+        _back_to_root(ws)
+        return True
+    try:
+        real_click(ws, target["x"], target["y"])
+    except Exception:
+        _back_to_root(ws)
+        return False
+    for _ in range(8):
+        time.sleep(2.0)
+        rows = _eval(ws, JS_PROTO_ROWS)
+        if not isinstance(rows, list):
+            continue
+        cur = next((r for r in rows if r.get("title") == title), None)
+        if cur is not None and bool(cur.get("checked")) == want:
+            _back_to_root(ws)
+            return True
+    _back_to_root(ws)
+    # In-dialog verify missed (slow commit or commit-on-close); the
+    # toggles-level fresh readback is the source of truth.
+    return False
+
+
+def manage_counts(ws):
+    """Manageable-row summary counts (name -> count|None)."""
+    if not dialog.goto_tab(ws, TAB):
+        return {}
+    text = dialog.dialog_text(ws) or ""
+    out = {}
+    for name in ("Websites", "Connectors", "Scheduled tasks",
+                 "Direct network protocols"):
+        m = re.search(re.escape(name) + r"\s*(\d+)", text)
+        out[name] = int(m.group(1)) if m else None
+    return out
+
+
+def scheduled_tasks(ws):
+    """[{name, cadence}] (back at root afterwards; empty when none)."""
+    if not dialog.click_row(ws, "Scheduled tasks", TAB):
+        return []
+    time.sleep(0.6)
+    text = dialog.dialog_text(ws) or ""
+    _back_to_root(ws)
+    rows = []
+    lines = [line.strip() for line in text.splitlines()
+             if line.strip()]
+    for i, line in enumerate(lines):
+        if re.search(r"\b(daily|weekly|hourly|every|min)\b", line,
+                     re.IGNORECASE) and i > 0:
+            rows.append({"name": lines[i - 1], "cadence": line})
+    return rows
+
+
+def all_toggles(ws):
+    """Flat map of every settable Permissions toggle (for list)."""
+    out = {}
+    defs = defaults(ws)
+    out["permissions.connector_defaults"] = defs.get("connector_defaults")
+    out["permissions.web_access"] = defs.get("web_access")
+    adv = advanced(ws)
+    for key, val in adv.items():
+        out["permissions.advanced." + key] = val
+    for row in protocols(ws):
+        if row.get("slug"):
+            out["permissions.protocols:" + row["slug"]] = row.get("on")
+    for row in websites(ws):
+        if row.get("host"):
+            out["permissions.websites:" + row["host"]] = row.get("mode")
+    return out
+
+
+def describe(ws):
+    """Full Permissions inventory: defaults, counts, adv, rows."""
+    return {"defaults": defaults(ws), "counts": manage_counts(ws),
+            "advanced": advanced(ws), "websites": websites(ws),
+            "protocols": protocols(ws),
+            "scheduled_tasks": scheduled_tasks(ws)}

bin/hatch_menu/tabs/secure_store.py

@@ -0,0 +1,10 @@
+"""Secure store tab: read-only inventory (secret entries + add)."""
+from hatch_menu import dialog
+
+TAB = "Secure store"
+
+
+def describe(ws):
+    """Row inventory + text excerpt (describe-only for now)."""
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "text": (dialog.dialog_text(ws) or "")[:400]}

bin/hatch_menu/tabs/wallet.py

@@ -0,0 +1,10 @@
+"""Wallet tab: read-only inventory (payment methods + add row)."""
+from hatch_menu import dialog
+
+TAB = "Wallet"
+
+
+def describe(ws):
+    """Row inventory + text excerpt (describe-only for now)."""
+    return {"rows": dialog.describe_rows(ws, TAB),
+            "text": (dialog.dialog_text(ws) or "")[:400]}

bin/hatch_menu/toggles.py

@@ -0,0 +1,319 @@
+"""Toggle registry + sessions over controls.py and tabs/*.
+
+Every settable toggle has ONE address; contracts live in the tab
+modules (single-copy per part), addressing here. Set flows read back
+through a fresh session and never partially report success.
+
+Caller errors (unknown node/toggle/value) raise MenuError before any
+CDP traffic. Transport failures return {"ok": False, ...}.
+"""
+from approvals import VALID_NODES, get_cdp_ws
+from hatch_menu import controls, dialog
+from hatch_menu.mouse import close, escape
+from hatch_menu.tabs import TAB_MODULES
+
+_PERM = TAB_MODULES["Permissions"]
+_DC = TAB_MODULES["Data controls"]
+_GEN = TAB_MODULES["General"]
+
+
+class MenuError(ValueError):
+    """Caller error: unknown node, toggle, or value. Raised before CDP."""
+
+
+TOGGLES = {
+    "permissions.connector_defaults": {
+        "tab": "Permissions", "kind": "radio-heading",
+        "heading": _PERM.CONNECTOR_HEADING,
+        "values": _PERM.DEFAULT_VALUES},
+    "permissions.web_access": {
+        "tab": "Permissions", "kind": "radio-heading",
+        "heading": _PERM.WEB_HEADING,
+        "values": _PERM.DEFAULT_VALUES},
+    "permissions.advanced.transparent_proxy": {
+        "tab": "Permissions", "kind": "adv-switch",
+        "label": _PERM.ADV_LABELS["transparent_proxy"],
+        "values": ("on", "off")},
+    "permissions.advanced.tls_interception": {
+        "tab": "Permissions", "kind": "adv-switch",
+        "label": _PERM.ADV_LABELS["tls_interception"],
+        "values": ("on", "off")},
+    "permissions.advanced.sni_mismatch_rejection": {
+        "tab": "Permissions", "kind": "adv-switch",
+        "label": _PERM.ADV_LABELS["sni_mismatch_rejection"],
+        "values": ("on", "off")},
+    "data_controls.ai_improvement": {
+        "tab": "Data controls", "kind": "switch",
+        "values": ("on", "off"),
+        # Live 2026-10-06: the site ignores every input gesture here
+        # (synthetic/real/double/hover/keyboard/drag) — reads fine.
+        "readonly": True},
+    "general.theme": {
+        "tab": "General", "kind": "radio-aria",
+        "values": _GEN.THEME_VALUES},
+}
+
+WEBSITE_PREFIX = "permissions.websites:"
+PROTOCOL_PREFIX = "permissions.protocols:"
+
+
+def _check_node(node):
+    if node not in VALID_NODES:
+        raise MenuError("unknown node: %r (valid: %s)"
+                        % (node, ", ".join(VALID_NODES)))
+
+
+def normalize_onoff(value):
+    """on/off/true/false/1/0/yes/no -> bool. None when invalid."""
+    if isinstance(value, bool):
+        return value
+    if not isinstance(value, str):
+        return None
+    v = value.strip().lower()
+    if v in ("on", "true", "1", "yes"):
+        return True
+    if v in ("off", "false", "0", "no"):
+        return False
+    return None
+
+
+def resolve_toggle(name):
+    """Resolve a toggle address to its spec. Raises MenuError."""
+    if not isinstance(name, str) or not name:
+        raise MenuError("toggle name must be a non-empty string")
+    if name in TOGGLES:
+        spec = dict(TOGGLES[name])
+        spec["name"] = name
+        return spec
+    if name.startswith(WEBSITE_PREFIX) and len(name) > len(WEBSITE_PREFIX):
+        return {"name": name, "tab": "Permissions", "kind": "website",
+                "host": name[len(WEBSITE_PREFIX):],
+                "values": _PERM.WEBSITE_MODES}
+    if name.startswith(PROTOCOL_PREFIX) and len(name) > len(PROTOCOL_PREFIX):
+        label = _PERM.resolve_protocol(name[len(PROTOCOL_PREFIX):])
+        if label is None:
+            raise MenuError("unknown protocol: %r (see list_toggles)"
+                            % (name,))
+        return {"name": name, "tab": "Permissions", "kind": "protocol",
+                "label": label, "values": ("on", "off")}
+    raise MenuError("unknown toggle: %r (see list_toggles)" % (name,))
+
+
+def _session(node):
+    _check_node(node)
+    try:
+        ws, _ = get_cdp_ws(node)
+    except Exception as e:
+        raise MenuError("CDP unreachable for %s: %s" % (node, e))
+    return ws
+
+
+def _normalize_value(spec, value):
+    kind = spec["kind"]
+    if kind == "website":
+        if not isinstance(value, str):
+            raise MenuError("mode must be one of %s"
+                            % (spec["values"],))
+        for m in spec["values"]:
+            if value.strip().lower() == m.lower():
+                return m
+        raise MenuError("mode must be one of %s (got %r)"
+                        % (spec["values"], value))
+    if kind in ("switch", "adv-switch", "protocol"):
+        b = normalize_onoff(value)
+        if b is None:
+            raise MenuError("value must be on/off (got %r)" % (value,))
+        return "on" if b else "off"
+    if kind == "radio-heading":
+        if value not in spec["values"]:
+            raise MenuError("%s must be one of %s (got %r)"
+                            % (spec["name"], spec["values"], value))
+        return value
+    if kind == "radio-aria":
+        if not isinstance(value, str):
+            raise MenuError("theme must be one of %s" % (spec["values"],))
+        v = value.strip().lower()
+        if v in spec["values"]:
+            return v
+        raise MenuError("theme must be one of %s (got %r)"
+                        % (spec["values"], value))
+    raise MenuError("cannot set kind %r" % (kind,))
+
+
+def get_toggle(node, name):
+    """Read one toggle. Returns {"ok", "node", "toggle", "value"}."""
+    spec = resolve_toggle(name)
+    _check_node(node)
+    try:
+        ws = _session(node)
+    except MenuError as e:
+        return {"ok": False, "node": node, "toggle": name,
+                "error": str(e)}
+    try:
+        if not dialog.open_settings(ws):
+            return {"ok": False, "node": node, "toggle": name,
+                    "error": "settings dialog did not open"}
+        if not dialog.goto_tab(ws, spec["tab"]):
+            return {"ok": False, "node": node, "toggle": name,
+                    "error": "tab did not open: %s" % spec["tab"]}
+        kind = spec["kind"]
+        if kind == "radio-heading":
+            vals = {r["value"]: r["checked"]
+                    for r in controls.list_radios(ws)
+                    if (r.get("heading") or "").lower()
+                    == spec["heading"].lower()}
+            on = [v for v, c in vals.items() if c]
+            value = on[0] if len(on) == 1 else None
+        elif kind == "radio-aria":
+            vals = [(r.get("value"), r.get("checked"))
+                    for r in controls.list_radios(ws)]
+            on = [v for v, c in vals if c]
+            value = on[0] if len(on) == 1 else None
+        elif kind == "switch":
+            state = _DC.ai_improvement(ws)
+            value = ("on" if state else "off") if state is not None \
+                else None
+        elif kind == "adv-switch":
+            _PERM.ensure_advanced(ws)
+            state = controls.switch_state(ws, spec["label"])
+            value = ("on" if state else "off") if state is not None \
+                else None
+        elif kind == "website":
+            value = _PERM.website_mode(ws, spec["host"])
+        elif kind == "protocol":
+            value = _PERM.protocol_state(ws, spec["label"])
+        else:
+            value = None
+        if value is None:
+            if kind == "website":
+                return {"ok": False, "node": node, "toggle": name,
+                        "error": "host not in Websites list (effective: "
+                        "permissions.web_access default)"}
+            return {"ok": False, "node": node, "toggle": name,
+                    "error": "toggle not readable (site changed?)"}
+        return {"ok": True, "node": node, "toggle": name, "value": value}
+    except Exception as e:
+        return {"ok": False, "node": node, "toggle": name,
+                "error": "%s: %s" % (type(e).__name__, e)}
+    finally:
+        escape(ws)
+        close(ws)
+
+
+def set_toggle(node, name, value):
+    """Set one toggle with readback. Never partially reports success."""
+    spec = resolve_toggle(name)
+    if spec.get("readonly"):
+        raise MenuError("%s is read-only: the site ignores all input "
+                        "gestures there (locked?)" % name)
+    want = _normalize_value(spec, value)
+    _check_node(node)
+    try:
+        ws = _session(node)
+    except MenuError as e:
+        return {"ok": False, "node": node, "toggle": name,
+                "error": str(e)}
+    try:
+        if not dialog.open_settings(ws):
+            return {"ok": False, "node": node, "toggle": name,
+                    "error": "settings dialog did not open"}
+        if not dialog.goto_tab(ws, spec["tab"]):
+            return {"ok": False, "node": node, "toggle": name,
+                    "error": "tab did not open: %s" % spec["tab"]}
+        kind = spec["kind"]
+        if kind == "radio-heading":
+            ok = controls.set_radio_by_heading(ws, spec["heading"], want)
+        elif kind == "radio-aria":
+            ok = controls.set_radio_by_aria(ws, want)
+        elif kind == "switch":
+            ok = _DC.set_ai_improvement(ws, want == "on")
+        elif kind == "adv-switch":
+            _PERM.ensure_advanced(ws)
+            ok = controls.set_switch(ws, spec["label"], want == "on")
+        elif kind == "website":
+            ok = _PERM.set_website_mode(ws, spec["host"], want)
+        elif kind == "protocol":
+            ok = _PERM.set_protocol(ws, spec["label"], want == "on")
+        else:
+            ok = False
+        # The fresh-session readback is the source of truth: switch
+        # commits can land slowly or on dialog close, after the
+        # in-flow verify had its chance.
+        readback = get_toggle(node, name)
+        if readback.get("ok") and readback.get("value") == want:
+            out = {"ok": True, "node": node, "toggle": name,
+                   "value": want}
+            if not ok:
+                out["readback_only"] = True
+            return out
+        return {"ok": False, "node": node, "toggle": name,
+                "error": "readback mismatch (want %r, got %r)"
+                % (want, readback.get("value"))}
+    except Exception as e:
+        return {"ok": False, "node": node, "toggle": name,
+                "error": "%s: %s" % (type(e).__name__, e)}
+    finally:
+        escape(ws)
+        close(ws)
+
+
+def list_toggles(node, tab=None):
+    """All toggle states, optionally filtered to one tab."""
+    _check_node(node)
+    if tab is not None and tab not in TAB_MODULES:
+        raise MenuError("unknown tab: %r (valid: %s)"
+                        % (tab, sorted(TAB_MODULES)))
+    want = [tab] if tab else ["Permissions", "Data controls", "General"]
+    try:
+        ws = _session(node)
+    except MenuError as e:
+        return {"ok": False, "node": node, "error": str(e)}
+    try:
+        if not dialog.open_settings(ws):
+            return {"ok": False, "node": node,
+                    "error": "settings dialog did not open"}
+        out = {}
+        if "Permissions" in want:
+            dialog.goto_tab(ws, "Permissions")
+            out.update(_PERM.all_toggles(ws))
+        if "Data controls" in want:
+            state = _DC.ai_improvement(ws)
+            out["data_controls.ai_improvement"] = \
+                ("on" if state else "off") if state is not None else None
+        if "General" in want:
+            dialog.goto_tab(ws, "General")
+            out["general.theme"] = _GEN.theme(ws)
+        return {"ok": True, "node": node, "toggles": out}
+    except Exception as e:
+        return {"ok": False, "node": node,
+                "error": "%s: %s" % (type(e).__name__, e)}
+    finally:
+        escape(ws)
+        close(ws)
+
+
+def describe_tab(node, tab):
+    """Full inventory of one tab (debugging/patching aid)."""
+    _check_node(node)
+    if tab not in TAB_MODULES:
+        raise MenuError("unknown tab: %r (valid: %s)"
+                        % (tab, sorted(TAB_MODULES)))
+    try:
+        ws = _session(node)
+    except MenuError as e:
+        return {"ok": False, "node": node, "tab": tab, "error": str(e)}
+    try:
+        if not dialog.open_settings(ws):
+            return {"ok": False, "node": node, "tab": tab,
+                    "error": "settings dialog did not open"}
+        if not dialog.goto_tab(ws, tab):
+            return {"ok": False, "node": node, "tab": tab,
+                    "error": "tab did not open"}
+        return {"ok": True, "node": node, "tab": tab,
+                "inventory": TAB_MODULES[tab].describe(ws)}
+    except Exception as e:
+        return {"ok": False, "node": node, "tab": tab,
+                "error": "%s: %s" % (type(e).__name__, e)}
+    finally:
+        escape(ws)
+        close(ws)

bin/host_evidence.py

@@ -0,0 +1,348 @@
+#!/usr/bin/env python3
+"""Host-side fleet evidence for network/PID-blind shells.
+
+`box fleet status` probes each node live (pgrep for the chromium process,
+HTTP to the CDP relay on the peer IP). Both probes assume the caller's
+network + PID namespace is the bl host's. From a sandboxed shell (own PID
+and net namespaces, no sudo, no route to 10.201.x.x) both probes always
+fail, so every node misreports as STOPPED even with a healthy fleet.
+
+This module provides the fallback signal: evidence written by the
+host-side watchdogs that run on bl unsandboxed via systemd timers:
+
+  - cdp-relay-watchdog (every 5 min, all active registry nodes):
+    log ``cdp-relay-watchdog.log`` + journal unit
+    ``cdp-relay-watchdog.service``. Proves the CDP relay path end to end.
+  - chromebox-watchdog (every 2 min, same nodes, one timer per node):
+    log ``chromebox-watchdog.log`` + journal units
+    ``chromebox-watchdog@<node>.service``. Curls CDP inside the node netns,
+    so it proves browser + in-netns CDP.
+  - ``chromebox-<node>.log`` mtime: chromium's own stdout. Fresh output
+    proves the browser process is alive. Used only for nodes outside
+    watchdog coverage — and only to conclude "alive", never "dead".
+
+Both watchdogs are silent-when-healthy: a failure is ALWAYS logged, so a
+recent timer run (journal "Starting" line) with no newer failure line for
+the node means that run found the node healthy.
+
+Verdicts: "healthy" | "degraded" | "down" | "unknown".
+"""
+
+import json
+import os
+import re
+import subprocess
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+NETVM_ROOT = Path("/home/super/Projects/NetVM")
+RELAY_LOG = NETVM_ROOT / "cdp-relay-watchdog.log"
+CHROMEBOX_LOG = NETVM_ROOT / "chromebox-watchdog.log"
+
+ALL_NODES = ("muse", "pip", "646", "opm", "def", "dev")
+
+
+def _covered_nodes():
+    """Nodes with watchdog coverage, from the fleet registry.
+
+    Both watchdogs supervise every active registry node. Falls back to
+    ALL_NODES when the registry is unreadable, so a broken registry can
+    never silently narrow fleet status to a subset of the fleet.
+    """
+    try:
+        import importlib.util
+        spec = importlib.util.spec_from_file_location(
+            "netvm_registry", NETVM_ROOT / "bin" / "netvm-registry.py")
+        mod = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        return tuple(sorted(mod.active_nodes()))
+    except Exception:
+        return ALL_NODES
+
+
+RELAY_NODES = _covered_nodes()
+CHROMEBOX_NODES = _covered_nodes()
+
+RELAY_UNIT = "cdp-relay-watchdog.service"
+CHROMEBOX_UNIT_TMPL = "chromebox-watchdog@{node}.service"
+
+# A watchdog run older than this proves nothing (timer may be dead).
+RELAY_STALE_MIN = 15
+CHROMEBOX_STALE_MIN = 8
+# Chromium stdout older than this proves nothing (idle browsers go quiet).
+CHROME_LOG_FRESH_MIN = 20
+
+_LOG_TS_RE = re.compile(r"^\[(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})Z\]")
+
+
+def _utcnow():
+    return datetime.now(timezone.utc)
+
+
+def parse_log_ts(line):
+    """Parse a ``[YYYY-MM-DDTHH:MM:SSZ]`` log prefix. None if absent."""
+    m = _LOG_TS_RE.match(line)
+    if not m:
+        return None
+    try:
+        return datetime.strptime(m.group(1), "%Y-%m-%dT%H:%M:%S").replace(
+            tzinfo=timezone.utc)
+    except ValueError:
+        return None
+
+
+def classify_chromebox_line(line):
+    """Classify one chromebox-watchdog log line.
+
+    Returns "healthy" | "degraded" | "down", or None when the line
+    carries no verdict (rotation markers, relay stdout passthrough).
+    """
+    if "log rotated" in line:
+        return None
+    if "relaunch FAILED" in line:
+        return "down"
+    if "relaunch OK" in line:
+        return "healthy"
+    if "recovered" in line and "relaunch not needed" in line:
+        return "healthy"
+    if "not healthy yet" in line:
+        return "degraded"
+    if "proceeding with chrome relaunch" in line:
+        return "degraded"
+    if "relaunching chromebox" in line:
+        return "degraded"
+    if "warp partition detected" in line:
+        return "degraded"
+    if "skipping relaunch (probably still starting)" in line:
+        return "degraded"
+    return None
+
+
+def classify_relay_line(line):
+    """Classify one cdp-relay-watchdog log line (None = no verdict)."""
+    if "relay restart FAILED" in line:
+        return "down"
+    if "FAIL_LOUD" in line:
+        return "down"
+    if "relay restarted OK" in line:
+        return "healthy"
+    if "relay unhealthy" in line and "restarting" in line:
+        # Always followed by an OK/FAILED line; a trailing one means the
+        # restart crashed mid-flight.
+        return "down"
+    return None
+
+
+def last_verdict(lines, node, classify):
+    """Newest (verdict, ts, line) for ``[node]``. None if no verdict line."""
+    tag = "[%s]" % node
+    best = None
+    for line in lines:
+        if tag not in line:
+            continue
+        verdict = classify(line)
+        if verdict is None:
+            continue
+        ts = parse_log_ts(line)
+        if ts is None:
+            continue
+        if best is None or ts >= best[1]:
+            best = (verdict, ts, line.strip()[:160])
+    return best
+
+
+def _tail_lines(path, max_bytes=65536):
+    try:
+        size = os.path.getsize(path)
+        with open(path, "rb") as f:
+            if size > max_bytes:
+                f.seek(size - max_bytes)
+                f.readline()  # drop partial first line
+            return f.read().decode("utf-8", errors="replace").splitlines()
+    except OSError:
+        return []
+
+
+def query_journal_starts(units, since_min=25, timeout=20):
+    """Map each unit -> newest run-start (aware UTC). Missing on failure.
+
+    Uses ``-o json``: the short-format "Starting" line carries the unit
+    description, not the unit name, so exact per-unit matching needs the
+    structured UNIT field.
+    """
+    cmd = ["journalctl", "--no-pager", "-o", "json",
+           "--since", "%d min ago" % since_min]
+    for u in units:
+        cmd.extend(["-u", u])
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    except (OSError, subprocess.TimeoutExpired):
+        return {}
+    if r.returncode != 0:
+        return {}
+    want = set(units)
+    starts = {}
+    for line in (r.stdout or "").splitlines():
+        try:
+            e = json.loads(line)
+        except ValueError:
+            continue
+        if e.get("UNIT") not in want:
+            continue
+        if not (e.get("MESSAGE") or "").startswith("Starting"):
+            continue
+        try:
+            ts = datetime.fromtimestamp(
+                int(e["__REALTIME_TIMESTAMP"]) / 1e6, tz=timezone.utc)
+        except (KeyError, ValueError, TypeError, OverflowError):
+            continue
+        u = e["UNIT"]
+        if u not in starts or ts > starts[u]:
+            starts[u] = ts
+    return starts
+
+
+def _verdict_since_run(verdict_row, run_ts):
+    """True when the verdict line is newer than (or from) the last run."""
+    if verdict_row is None or run_ts is None:
+        return False
+    return verdict_row[1] >= run_ts
+
+
+def browser_verdict(node, chromebox_lines, run_ts, chrome_log_mtime=None,
+                    now=None):
+    """(verdict, detail) for the node's browser process."""
+    now = now or _utcnow()
+    row = last_verdict(chromebox_lines, node, classify_chromebox_line)
+    if node in CHROMEBOX_NODES:
+        if run_ts is None:
+            return ("unknown", "no chromebox-watchdog run in journal window")
+        if (now - run_ts).total_seconds() > CHROMEBOX_STALE_MIN * 60:
+            return ("unknown", "chromebox-watchdog run is stale")
+        if _verdict_since_run(row, run_ts):
+            return (row[0], "watchdog: %s" % row[2])
+        return ("healthy", "watchdog run silent (silent-when-healthy)")
+    # Nodes outside watchdog coverage: chromium stdout proves alive only.
+    if chrome_log_mtime is not None and (
+            now - chrome_log_mtime).total_seconds() < CHROME_LOG_FRESH_MIN * 60:
+        return ("healthy", "chromebox-%s.log fresh" % node)
+    return ("unknown", "no watchdog coverage for %s" % node)
+
+
+def cdp_verdict(node, relay_lines, run_ts, now=None):
+    """(verdict, detail) for the node's host-reachable CDP relay path."""
+    now = now or _utcnow()
+    if node not in RELAY_NODES:
+        return ("unknown", "no relay-monitor coverage for %s" % node)
+    if run_ts is None:
+        return ("unknown", "no cdp-relay-watchdog run in journal window")
+    if (now - run_ts).total_seconds() > RELAY_STALE_MIN * 60:
+        return ("unknown", "cdp-relay-watchdog run is stale")
+    row = last_verdict(relay_lines, node, classify_relay_line)
+    if _verdict_since_run(row, run_ts):
+        return (row[0], "relay watchdog: %s" % row[2])
+    return ("healthy", "relay watchdog run silent (silent-when-healthy)")
+
+
+def chrome_log_mtime(node):
+    """Mtime of chromium's stdout log as aware UTC. None if missing."""
+    try:
+        return datetime.fromtimestamp(
+            os.path.getmtime(NETVM_ROOT / ("chromebox-%s.log" % node)),
+            tz=timezone.utc)
+    except OSError:
+        return None
+
+
+_CACHE = {"at": 0.0, "nodes": frozenset(), "data": {}}
+_CACHE_TTL_S = 60
+
+
+def collect(nodes=None, _journal_starts=None, _relay_lines=None,
+            _chromebox_lines=None, _chrome_mtimes=None, _now=None):
+    """Per-node host evidence. Underscore args are seams for tests."""
+    nodes = list(nodes or ALL_NODES)
+    live = (_journal_starts is None and _relay_lines is None
+            and _chromebox_lines is None and _chrome_mtimes is None
+            and _now is None)
+    if live:
+        key = frozenset(nodes)
+        if (key <= _CACHE["nodes"]
+                and time.monotonic() - _CACHE["at"] < _CACHE_TTL_S):
+            return {n: _CACHE["data"][n] for n in nodes if n in _CACHE["data"]}
+    now = _now or _utcnow()
+    if _journal_starts is None:
+        units = [RELAY_UNIT] + [CHROMEBOX_UNIT_TMPL.format(node=n)
+                                for n in nodes if n in CHROMEBOX_NODES]
+        _journal_starts = query_journal_starts(units)
+    if _relay_lines is None:
+        _relay_lines = _tail_lines(RELAY_LOG)
+    if _chromebox_lines is None:
+        _chromebox_lines = _tail_lines(CHROMEBOX_LOG)
+    out = {}
+    for node in nodes:
+        if _chrome_mtimes is not None and node in _chrome_mtimes:
+            mtime = _chrome_mtimes[node]
+        else:
+            mtime = chrome_log_mtime(node) if node not in CHROMEBOX_NODES else None
+        b_verd, b_det = browser_verdict(
+            node, _chromebox_lines,
+            _journal_starts.get(CHROMEBOX_UNIT_TMPL.format(node=node)),
+            chrome_log_mtime=mtime, now=now)
+        c_verd, c_det = cdp_verdict(
+            node, _relay_lines, _journal_starts.get(RELAY_UNIT), now=now)
+        out[node] = {
+            "browser": b_verd,
+            "browser_detail": b_det,
+            "cdp": c_verd,
+            "cdp_detail": c_det,
+        }
+    if live:
+        _CACHE["at"] = time.monotonic()
+        _CACHE["nodes"] = frozenset(nodes)
+        _CACHE["data"] = out
+    return out
+
+
+def effective_status(local_proc, local_cdp, browser_v, cdp_v):
+    """Map (local probes, host verdicts) -> (status, source).
+
+    Host evidence only ever overrides the fully-blind pattern (both
+    local probes negative — the sandbox signature). It never overrides
+    a live local signal, so a fresh outage on the host always wins.
+    """
+    if local_cdp:
+        # CDP answers: the browser is definitionally alive.
+        return ("ACTIVE", "local")
+    if local_proc:
+        return ("CDP_DOWN", "local")
+    # Both local probes negative: consult host evidence.
+    if browser_v == "down":
+        return ("STOPPED", "host-evidence")
+    if browser_v == "unknown":
+        return ("UNKNOWN", "host-evidence")
+    if cdp_v == "healthy":
+        return ("ACTIVE", "host-evidence")
+    if cdp_v == "down":
+        return ("CDP_DOWN", "host-evidence")
+    return ("UNKNOWN", "host-evidence")
+
+
+def main(argv=None):
+    import argparse
+    ap = argparse.ArgumentParser(description="Show host-side fleet evidence")
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args(argv)
+    data = collect()
+    if args.json:
+        print(json.dumps({"ok": True, "evidence": data}, indent=2))
+        return
+    for node, ev in data.items():
+        print("%-6s browser=%-8s cdp=%-8s" % (node, ev["browser"], ev["cdp"]))
+        print("       browser: %s" % ev["browser_detail"])
+        print("       cdp:     %s" % ev["cdp_detail"])
+
+
+if __name__ == "__main__":
+    main()

bin/identity-broker.py

@@ -0,0 +1,342 @@
+#!/usr/bin/env python3
+"""identity-broker.py — Scope lifecycle over proxy providers.
+
+Owns identity-state.json (gitignored runtime state: scope -> label
+assignments, no secrets) and drives providers through it:
+
+  up <fp>                  resolve fingerprint, provision its scope
+  down <fp|unit>           teardown scope network, drop assignment
+  cycle <fp>               rotate to a fresh identity (bumps cycles)
+  exec <fp> -- <cmd>       run a command inside the scope network
+  routes <fp>              read-only route/tunnel status
+  status                   scopes with emails/labels (no key material)
+  bind --from <runs.json> --session <s> --fp <f>
+                           attribute live runs (agent-manager --once
+                           --json) to a scope after verifying the
+                           session exists in the scan
+
+v1 boundary: the broker scopes NETWORK identity only. It never sees,
+stores, or prints key bytes — fingerprints and emails are the only
+identifiers here. Short-lived brokered credential issuance is a
+deferred stage; harnesses receive keys through existing means.
+"""
+
+from __future__ import annotations
+
+import argparse
+import importlib.util
+import json
+import sys
+import time
+from pathlib import Path
+from typing import Any, Callable, Dict, List, Optional, Tuple
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+BIN_DIR = REPO_ROOT / "bin"
+STATE_FILE = REPO_ROOT / "identity-state.json"
+
+RunFn = Callable[..., Tuple[int, str]]
+
+
+def _load(name: str, modname: str):
+    path = BIN_DIR / name
+    spec = importlib.util.spec_from_file_location(modname, path)
+    mod = importlib.util.module_from_spec(spec)
+    sys.modules[modname] = mod
+    spec.loader.exec_module(mod)
+    return mod
+
+
+resolve_mod = _load("identity-resolve.py", "identity_resolve")
+provider_mod = _load("identity-provider.py", "identity_provider")
+
+PROVIDERS = {"warp": provider_mod.WarpProvider(),
+               "wireguard": provider_mod.GenericWireGuardProvider(),
+               "socks": provider_mod.SocksProxyProvider()}
+
+
+class BrokerError(RuntimeError):
+    """A broker operation failed (message is safe to show)."""
+
+
+def load_state(path: str | Path = STATE_FILE) -> Dict[str, Any]:
+    """Load broker state. Missing/corrupt -> empty (never raises)."""
+    try:
+        with open(path, "r") as f:
+            data = json.load(f)
+        if isinstance(data, dict):
+            data.setdefault("scopes", {})
+            data.setdefault("bindings", [])
+            return data
+    except Exception:
+        pass
+    return {"scopes": {}, "bindings": []}
+
+
+def save_state(state: Dict[str, Any],
+               path: str | Path = STATE_FILE) -> None:
+    with open(path, "w") as f:
+        json.dump(state, f, indent=2, sort_keys=True)
+
+
+def _provider(name: str = "warp"):
+    try:
+        prov = PROVIDERS[name]
+    except KeyError:
+        raise BrokerError("unknown provider %r (have: %s)"
+                          % (name, ", ".join(sorted(PROVIDERS))))
+    if not prov.ready:
+        raise BrokerError("provider %r is boilerplate (not implemented); "
+                          "warp is the live provider" % (name,))
+    return prov
+
+
+def _scope_for_fp(fp: str, map_path=None) -> Dict[str, Any]:
+    scope = resolve_mod.resolve_scope(
+        resolve_mod.load_map(map_path or resolve_mod.MAP_FILE), fp)
+    if scope is None:
+        raise BrokerError("unknown fingerprint (not in identity-map.json)")
+    scope["slug"] = resolve_mod.scope_slug(scope)
+    return scope
+
+
+def _unit_key(fp_or_unit: str, state: Dict[str, Any],
+              map_path=None) -> str:
+    """Resolve CLI input (fp or scope unit) to a state scopes key."""
+    scopes = state.get("scopes", {})
+    if fp_or_unit in scopes:
+        return fp_or_unit
+    try:
+        scope = _scope_for_fp(fp_or_unit, map_path)
+    except BrokerError:
+        raise BrokerError("no scope for %r (unknown fingerprint, no "
+                          "such unit)" % (fp_or_unit,))
+    if scope["unit"] not in scopes:
+        raise BrokerError("scope %s is not up" % (scope["unit"],))
+    return scope["unit"]
+
+
+def op_up(fp: str, run: Optional[RunFn] = None, map_path=None,
+          state_path: str | Path = STATE_FILE,
+          provider_name: str = "warp") -> Dict[str, Any]:
+    """Provision a scope's network. Idempotent (re-up returns existing)."""
+    scope = _scope_for_fp(fp, map_path)
+    state = load_state(state_path)
+    if scope["unit"] in state["scopes"]:
+        return {"ok": "exists", **state["scopes"][scope["unit"]]}
+    label = scope["slug"]
+    try:
+        res = _provider(provider_name).provision(label, run=run)
+    except provider_mod.ProviderError as e:
+        raise BrokerError(str(e))
+    rec = {"scope": scope["scope"], "email": scope["email"],
+           "origins": scope["origins"], "label": label,
+           "provider": provider_name, "netns": res.get("netns", ""),
+           "created": int(time.time()), "cycles": 0}
+    state["scopes"][scope["unit"]] = rec
+    save_state(state, state_path)
+    return {"ok": "true", **rec}
+
+
+def op_down(fp_or_unit: str, run: Optional[RunFn] = None, map_path=None,
+            state_path: str | Path = STATE_FILE) -> Dict[str, Any]:
+    """Teardown a scope's network and drop its assignment + bindings."""
+    state = load_state(state_path)
+    unit = _unit_key(fp_or_unit, state, map_path)
+    rec = state["scopes"][unit]
+    try:
+        _provider(rec.get("provider", "warp")).teardown(rec["label"],
+                                                        run=run)
+    except provider_mod.ProviderError as e:
+        raise BrokerError(str(e))
+    del state["scopes"][unit]
+    state["bindings"] = [b for b in state.get("bindings", [])
+                         if b.get("unit") != unit]
+    save_state(state, state_path)
+    return {"ok": "true", "unit": unit, "label": rec["label"]}
+
+
+def op_cycle(fp: str, run: Optional[RunFn] = None, map_path=None,
+             state_path: str | Path = STATE_FILE) -> Dict[str, Any]:
+    """Rotate a scope to a fresh identity (bumps the cycle count)."""
+    scope = _scope_for_fp(fp, map_path)
+    state = load_state(state_path)
+    if scope["unit"] not in state["scopes"]:
+        raise BrokerError("scope %s is not up (up it first)"
+                          % (scope["unit"],))
+    rec = state["scopes"][scope["unit"]]
+    try:
+        _provider(rec.get("provider", "warp")).cycle(rec["label"],
+                                                     run=run)
+    except provider_mod.ProviderError as e:
+        raise BrokerError(str(e))
+    rec["cycles"] = int(rec.get("cycles", 0)) + 1
+    save_state(state, state_path)
+    return {"ok": "true", "unit": scope["unit"], "label": rec["label"],
+            "cycles": rec["cycles"]}
+
+
+def op_exec(fp: str, cmd: List[str], run: Optional[RunFn] = None,
+            map_path=None,
+            state_path: str | Path = STATE_FILE) -> Tuple[int, str]:
+    """Run cmd inside the scope's network. Returns (rc, output)."""
+    scope = _scope_for_fp(fp, map_path)
+    state = load_state(state_path)
+    if scope["unit"] not in state["scopes"]:
+        raise BrokerError("scope %s is not up (up it first)"
+                          % (scope["unit"],))
+    rec = state["scopes"][scope["unit"]]
+    try:
+        return _provider(rec.get("provider", "warp")).exec(
+            rec["label"], cmd, run=run)
+    except provider_mod.ProviderError as e:
+        raise BrokerError(str(e))
+
+
+def op_routes(fp: str, run: Optional[RunFn] = None, map_path=None,
+              state_path: str | Path = STATE_FILE) -> Dict[str, Any]:
+    """Read-only route/tunnel status for a scope."""
+    scope = _scope_for_fp(fp, map_path)
+    state = load_state(state_path)
+    if scope["unit"] not in state["scopes"]:
+        raise BrokerError("scope %s is not up (up it first)"
+                          % (scope["unit"],))
+    rec = state["scopes"][scope["unit"]]
+    try:
+        info = _provider(rec.get("provider", "warp")).routes(
+            rec["label"], run=run)
+    except provider_mod.ProviderError as e:
+        raise BrokerError(str(e))
+    return {"unit": scope["unit"], "email": scope["email"], **info}
+
+
+def op_status(run: Optional[RunFn] = None,
+              state_path: str | Path = STATE_FILE) -> Dict[str, Any]:
+    """Scopes with live provider status. Emails/labels only."""
+    state = load_state(state_path)
+    scopes = []
+    for unit, rec in sorted(state.get("scopes", {}).items()):
+        try:
+            live = _provider(rec.get("provider", "warp")).status(
+                rec["label"], run=run)
+        except provider_mod.ProviderError as e:
+            live = {"conf": "?", "netns": "?", "egress": "n/a",
+                    "error": str(e)}
+        scopes.append({"unit": unit, "email": rec.get("email", ""),
+                       "scope": rec.get("scope", ""),
+                       "label": rec.get("label", ""),
+                       "provider": rec.get("provider", ""),
+                       "cycles": rec.get("cycles", 0), **live})
+    return {"scopes": scopes, "bindings": state.get("bindings", [])}
+
+
+def op_bind(runs_path: str, session: str, fp: str, map_path=None,
+            state_path: str | Path = STATE_FILE) -> Dict[str, Any]:
+    """Attribute live runs to a scope, verifying against a scan.
+
+    runs_path is agent-manager.py --once --json output. Every run
+    whose session group contains `session` is bound to the fp's scope
+    (fp must resolve; the scope need not be up — binding is
+    attribution, not network). Sessions absent from the scan are
+    refused (never bind what we cannot observe).
+    """
+    scope = _scope_for_fp(fp, map_path)
+    try:
+        with open(runs_path, "r") as f:
+            scan = json.load(f)
+        runs = scan.get("runs", [])
+        if not isinstance(runs, list):
+            raise ValueError("no runs list")
+    except Exception as e:
+        raise BrokerError("cannot read runs scan %s: %s" % (runs_path, e))
+    matched = []
+    for r in runs:
+        if not isinstance(r, dict):
+            continue
+        group = str(r.get("session", "")).split(",")
+        if session in group:
+            matched.append(r)
+    if not matched:
+        raise BrokerError("session %r not observed in %s (refusing to "
+                          "bind unseen runs)" % (session, runs_path))
+    state = load_state(state_path)
+    now = int(time.time())
+    new = []
+    for r in matched:
+        rec = {"unit": scope["unit"], "email": scope["email"],
+               "device": r.get("device", ""), "type": r.get("type", ""),
+               "session": session, "pane": r.get("pane", ""),
+               "pid": r.get("pid", 0), "bound_at": now}
+        new.append(rec)
+    # Replace prior bindings for these exact runs (re-bind refreshes).
+    keys = {(b["device"], b.get("pane"), b.get("pid")) for b in new}
+    state["bindings"] = [b for b in state.get("bindings", [])
+                         if (b.get("device"), b.get("pane"),
+                             b.get("pid")) not in keys] + new
+    save_state(state, state_path)
+    return {"ok": "true", "unit": scope["unit"], "bound": len(new),
+            "runs": new}
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    ap = argparse.ArgumentParser(prog="identity-broker.py")
+    ap.add_argument("--map", default=str(resolve_mod.MAP_FILE),
+                    help="identity map (default: identity-map.json)")
+    ap.add_argument("--state", default=str(STATE_FILE),
+                    help="broker state file (default: identity-state.json)")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("up", help="provision a scope network")
+    p.add_argument("fp")
+    p.add_argument("--provider", default="warp")
+    p = sub.add_parser("down", help="teardown a scope network")
+    p.add_argument("fp_or_unit")
+    p = sub.add_parser("cycle", help="rotate a scope identity")
+    p.add_argument("fp")
+    p = sub.add_parser("exec", help="run a command in a scope network")
+    p.add_argument("fp")
+    p.add_argument("exec_cmd", nargs=argparse.REMAINDER,
+                   help="command (after --)")
+    p = sub.add_parser("routes", help="route/tunnel status for a scope")
+    p.add_argument("fp")
+    sub.add_parser("status", help="scopes + bindings (emails only)")
+    p = sub.add_parser("bind", help="attribute live runs to a scope")
+    p.add_argument("--from", dest="runs", required=True)
+    p.add_argument("--session", required=True)
+    p.add_argument("--fp", required=True)
+    args = ap.parse_args(argv)
+    mp, sp = args.map, args.state
+    try:
+        if args.cmd == "up":
+            print(json.dumps(op_up(args.fp, map_path=mp,
+                                   state_path=sp,
+                                   provider_name=args.provider),
+                             indent=2))
+        elif args.cmd == "down":
+            print(json.dumps(op_down(args.fp_or_unit, map_path=mp,
+                                     state_path=sp), indent=2))
+        elif args.cmd == "cycle":
+            print(json.dumps(op_cycle(args.fp, map_path=mp,
+                                      state_path=sp), indent=2))
+        elif args.cmd == "exec":
+            cmd = [c for c in (args.exec_cmd or []) if c != "--"]
+            rc, out = op_exec(args.fp, cmd, map_path=mp,
+                              state_path=sp)
+            sys.stdout.write(out + ("\n" if out else ""))
+            return rc
+        elif args.cmd == "routes":
+            print(json.dumps(op_routes(args.fp, map_path=mp,
+                                       state_path=sp), indent=2))
+        elif args.cmd == "status":
+            print(json.dumps(op_status(state_path=sp), indent=2))
+        elif args.cmd == "bind":
+            print(json.dumps(op_bind(args.runs, args.session, args.fp,
+                                     map_path=mp, state_path=sp),
+                             indent=2))
+        return 0
+    except BrokerError as e:
+        print("error: %s" % e)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/identity-provider.py

@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+"""identity-provider.py — Proxy provider implementations.
+
+A provider owns one network-identity substrate behind a fixed
+interface: provision / teardown / cycle / exec / routes / status.
+All subprocesses go through an injectable run function (same seam as
+box-fleet-tui gather_*), so command shapes are unit-testable and no
+test touches netns, sudo, or /etc/netvm.
+
+Security boundaries (from the repo's own scripts):
+- Warp identities generate via netvm-new-identity.sh, which the user
+  explicitly authorized operators to run (see netvm-provision-node.sh
+  header). Generation installs a root-0600 conf and prints nothing.
+- This code NEVER reads /etc/netvm and never prints key material.
+  Confs are consumed only by root tools (wg setconf inside netns).
+- CLI-facing output carries emails, labels, and fingerprints only.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+from typing import Callable, Dict, List, Optional, Tuple
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+BIN_DIR = REPO_ROOT / "bin"
+
+RunFn = Callable[..., Tuple[int, str]]
+
+LABEL_RE = re.compile(r"^[a-z0-9][a-z0-9-]{0,22}$")
+
+
+def _run(cmd: List[str], timeout: int = 120) -> Tuple[int, str]:
+    """Run cmd, capture output. Returns (returncode, combined_output)."""
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True,
+                           timeout=timeout)
+        return r.returncode, ((r.stdout or "") + (r.stderr or "")).strip()
+    except subprocess.TimeoutExpired:
+        return 124, "timed out after %ds: %s" % (timeout, " ".join(cmd))
+    except OSError as e:
+        return 127, str(e)
+
+
+class ProviderError(RuntimeError):
+    """A provider operation failed (message is safe to show)."""
+
+
+def check_label(label: str) -> str:
+    """Validate a netvm label. Returns it or raises ProviderError."""
+    if not LABEL_RE.match(label or ""):
+        raise ProviderError(
+            "invalid label %r: lowercase letters, digits, hyphens "
+            "(max 23 chars)" % (label,))
+    return label
+
+
+class Provider:
+    """Interface every proxy provider implements. Boilerplate subclasses
+    override these with real substrate calls; see WarpProvider."""
+
+    name = "base"
+    ready = False
+
+    def provision(self, label: str,
+                  run: Optional[RunFn] = None) -> Dict[str, str]:
+        """Create the network identity + bring it up. Idempotent."""
+        raise NotImplementedError
+
+    def teardown(self, label: str,
+                 run: Optional[RunFn] = None) -> Dict[str, str]:
+        """Bring the identity's network down (keeps the identity)."""
+        raise NotImplementedError
+
+    def cycle(self, label: str,
+              run: Optional[RunFn] = None) -> Dict[str, str]:
+        """Rotate to a fresh identity (teardown + new identity + up)."""
+        raise NotImplementedError
+
+    def exec(self, label: str, cmd: List[str],
+             run: Optional[RunFn] = None) -> Tuple[int, str]:
+        """Run cmd inside the identity's network. Returns (rc, output)."""
+        raise NotImplementedError
+
+    def routes(self, label: str,
+               run: Optional[RunFn] = None) -> Dict[str, str]:
+        """Read-only route/tunnel status for the identity."""
+        raise NotImplementedError
+
+    def status(self, label: str,
+               run: Optional[RunFn] = None) -> Dict[str, str]:
+        """Read-only liveness: conf present, netns up, egress IP."""
+        raise NotImplementedError
+
+
+class WarpProvider(Provider):
+    """Cloudflare Warp provider on the established warp-* structures.
+
+    Identity: /etc/netvm/<label>.conf via netvm-new-identity.sh
+    (operator-authorized). Network: warp-<label> netns via
+    netvm-node-up.sh / netvm-node-down.sh. Exec: netvm-exec.sh.
+    Scopes are NOT nodes: no chrome-box profile, no NODES.md entry.
+    """
+
+    name = "warp"
+    ready = True
+
+    def _conf_exists(self, label: str, run: RunFn) -> bool:
+        rc, _ = run(["test", "-f", "/etc/netvm/%s.conf" % label],
+                    timeout=10)
+        return rc == 0
+
+    def provision(self, label: str,
+                  run: Optional[RunFn] = None) -> Dict[str, str]:
+        run = run or _run
+        check_label(label)
+        steps = []
+        if not self._conf_exists(label, run):
+            rc, out = run(["sudo", "-n", str(BIN_DIR / "netvm-new-identity.sh"),
+                           label], timeout=300)
+            if rc != 0:
+                raise ProviderError("warp identity failed for %s: %s"
+                                    % (label, out[-200:]))
+            steps.append("identity=new")
+        else:
+            steps.append("identity=exists")
+        rc, out = run(["sudo", "-n", str(BIN_DIR / "netvm-node-up.sh"),
+                       label], timeout=300)
+        if rc != 0:
+            raise ProviderError("netns up failed for %s: %s"
+                                % (label, out[-200:]))
+        steps.append("netns=up")
+        return {"ok": "true", "label": label, "netns": "warp-" + label,
+                "steps": ",".join(steps)}
+
+    def teardown(self, label: str,
+                 run: Optional[RunFn] = None) -> Dict[str, str]:
+        run = run or _run
+        check_label(label)
+        rc, out = run(["sudo", "-n", str(BIN_DIR / "netvm-node-down.sh"),
+                       label], timeout=120)
+        if rc != 0:
+            raise ProviderError("netns down failed for %s: %s"
+                                % (label, out[-200:]))
+        return {"ok": "true", "label": label, "netns": "warp-" + label}
+
+    def cycle(self, label: str,
+              run: Optional[RunFn] = None) -> Dict[str, str]:
+        """Fresh warp identity: down + remove conf + provision.
+
+        Conf removal needs root on /etc/netvm; when denied, the old
+        identity is left intact (netns down) and the operator gets the
+        exact human step instead of a half-rotated state.
+        """
+        run = run or _run
+        check_label(label)
+        self.teardown(label, run=run)
+        rc, out = run(["sudo", "-n", "rm", "-f",
+                       "/etc/netvm/%s.conf" % label], timeout=30)
+        if rc != 0:
+            raise ProviderError(
+                "rotation paused for %s: cannot remove old identity "
+                "(%s). Human: sudo rm /etc/netvm/%s.conf, then cycle "
+                "again." % (label, out[-120:], label))
+        return self.provision(label, run=run)
+
+    def exec(self, label: str, cmd: List[str],
+             run: Optional[RunFn] = None) -> Tuple[int, str]:
+        run = run or _run
+        check_label(label)
+        if not cmd:
+            raise ProviderError("exec needs a command")
+        return run([str(BIN_DIR / "netvm-exec.sh"), label, "--"] + cmd,
+                   timeout=120)
+
+    def routes(self, label: str,
+               run: Optional[RunFn] = None) -> Dict[str, str]:
+        run = run or _run
+        check_label(label)
+        netns = "warp-" + label
+        _, route_out = run(["sudo", "-n", "ip", "netns", "exec", netns,
+                            "ip", "route"], timeout=30)
+        _, wg_out = run(["sudo", "-n", "ip", "netns", "exec", netns,
+                         "wg", "show"], timeout=30)
+        return {"label": label, "netns": netns, "routes": route_out,
+                "wireguard": wg_out}
+
+    def status(self, label: str,
+               run: Optional[RunFn] = None) -> Dict[str, str]:
+        run = run or _run
+        check_label(label)
+        conf = self._conf_exists(label, run)
+        rc, out = run(["ip", "netns", "list"], timeout=10)
+        up = rc == 0 and ("warp-" + label) in out
+        egress = ""
+        if conf and up:
+            rc, eg = self.exec(label, ["curl", "-s", "--max-time", "8",
+                                       "https://api.ipify.org"], run=run)
+            egress = eg.strip().splitlines()[-1] if rc == 0 and eg.strip() \
+                else ""
+        return {"label": label, "conf": "yes" if conf else "no",
+                "netns": "up" if up else "down", "egress": egress or "n/a"}
+
+
+class GenericWireGuardProvider(Provider):
+    """BOILERPLATE: bring-your-own WireGuard confinement.
+
+    Intended structure: the operator supplies a wg conf out of band
+    (same root-0600 handling as Warp confs — never read here);
+    provision creates warp-<label> netns + veth/NAT exactly like
+    WarpProvider but consumes the supplied conf instead of a
+    Cloudflare-registered identity. Cycle swaps to the next supplied
+    conf. Implement when the first non-Cloudflare tunnel is needed.
+    """
+
+    name = "wireguard"
+
+
+class SocksProxyProvider(Provider):
+    """BOILERPLATE: per-scope SOCKS5 forward, no netns.
+
+    Intended structure: provision opens a dedicated local forward
+    (ssh -D style) per scope label and records its port; exec runs
+    commands with ALL_PROXY scoped to that port instead of entering a
+    netns; cycle re-establishes the forward via a fresh egress.
+    Implement when a scope needs proxy semantics without tunnels.
+    """
+
+    name = "socks"
+
+
+if __name__ == "__main__":
+    print("identity-provider.py is a library (see identity-broker.py)")
+    sys.exit(2)

bin/identity-resolve.py

@@ -0,0 +1,186 @@
+#!/usr/bin/env python3
+"""identity-resolve.py — Pure identity resolution for the identity plane.
+
+Reads identity-map.json (fingerprints only, never key material) and
+resolves an API-key fingerprint to its network-identity scope:
+
+  api_key -> account_origin(s); one origin rolls scope UP to the
+  umbrella account, two or more keep scope DOWN at the key itself.
+
+This module is pure + total (missing/corrupt map -> empty, unknown
+fingerprint -> None). CLI output carries emails and fingerprints only;
+key bytes never appear here — there is no code path that reads them
+except `fp`, which hashes stdin and prints only the digest.
+
+Usage:
+  identity-resolve.py fp < keyfile          # print sha256: fingerprint
+  identity-resolve.py lookup <fingerprint>  # print scope JSON
+  identity-resolve.py check                 # validate map schema
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+MAP_FILE = REPO_ROOT / "identity-map.json"
+
+LABEL_RE = re.compile(r"^[a-z0-9][a-z0-9-]{0,22}$")
+
+
+def fingerprint_hex(material: bytes) -> str:
+    """sha256: fingerprint of raw key bytes."""
+    return "sha256:" + hashlib.sha256(material).hexdigest()
+
+
+def load_map(path: str | Path = MAP_FILE) -> Dict[str, Any]:
+    """Load the identity map. Missing/corrupt -> {"accounts": {}}."""
+    try:
+        with open(path, "r") as f:
+            data = json.load(f)
+        if isinstance(data, dict) and isinstance(
+                data.get("accounts"), dict):
+            return data
+    except Exception:
+        pass
+    return {"accounts": {}}
+
+
+def find_key(map_data: Dict[str, Any],
+             fp: str) -> Optional[Dict[str, Any]]:
+    """Locate a key record by fingerprint.
+
+    Returns {"email", "key"} or None. Top-level '_' entries ignored.
+    """
+    if not fp:
+        return None
+    accounts = map_data.get("accounts")
+    if not isinstance(accounts, dict):
+        return None
+    for email, rec in accounts.items():
+        if not isinstance(rec, dict):
+            continue
+        keys = rec.get("keys")
+        if not isinstance(keys, list):
+            continue
+        for k in keys:
+            if isinstance(k, dict) and k.get("fp") == fp:
+                return {"email": email, "key": k}
+    return None
+
+
+def resolve_scope(map_data: Dict[str, Any],
+                  fp: str) -> Optional[Dict[str, Any]]:
+    """Resolve a fingerprint to its scope unit.
+
+    Single origin -> {"scope": "account", "unit": email, ...}.
+    Multiple origins -> {"scope": "key", "unit": fp, ...}.
+    Unknown fingerprint -> None. Result carries emails + fingerprints
+    only (no key material exists anywhere in this module).
+    """
+    found = find_key(map_data, fp)
+    if found is None:
+        return None
+    key = found["key"]
+    origins = key.get("origins")
+    if not isinstance(origins, list) or not origins:
+        return None
+    origins = [str(o) for o in origins]
+    if len(origins) == 1:
+        return {"scope": "account", "unit": origins[0],
+                "email": found["email"], "origins": origins,
+                "label": key.get("label", "")}
+    return {"scope": "key", "unit": fp, "email": found["email"],
+            "origins": origins, "label": key.get("label", "")}
+
+
+def scope_slug(scope: Dict[str, Any]) -> str:
+    """Deterministic netvm label for a scope (fits label validation).
+
+    Account scopes: id-<email-fragment>-<hash7>. Key scopes:
+    id-k-<fp-hex-prefix>. Always matches ^[a-z0-9][a-z0-9-]{0,22}$.
+    """
+    unit = str(scope.get("unit", ""))
+    if scope.get("scope") == "key":
+        hexpart = re.sub(r"[^0-9a-f]", "", unit.lower())[:12] or "0"
+        return "id-k-%s" % hexpart
+    frag = re.sub(r"[^a-z0-9]+", "-", unit.lower()).strip("-")[:12]
+    frag = frag.strip("-") or "x"
+    tag = hashlib.sha256(unit.encode()).hexdigest()[:7]
+    return "id-%s-%s" % (frag, tag)
+
+
+def check_map(map_data: Dict[str, Any]) -> List[str]:
+    """Validate map schema. Returns a list of problem strings (empty OK)."""
+    problems: List[str] = []
+    accounts = map_data.get("accounts")
+    if not isinstance(accounts, dict):
+        return ["top-level 'accounts' must be an object"]
+    seen_fps: Dict[str, str] = {}
+    for email, rec in accounts.items():
+        if not isinstance(email, str) or "@" not in email:
+            problems.append("account key %r is not an email" % (email,))
+        if not isinstance(rec, dict) or not isinstance(
+                rec.get("keys"), list):
+            problems.append("account %r: 'keys' must be a list" % (email,))
+            continue
+        for i, k in enumerate(rec["keys"]):
+            where = "%s.keys[%d]" % (email, i)
+            if not isinstance(k, dict):
+                problems.append("%s: not an object" % where)
+                continue
+            fp = k.get("fp", "")
+            if not re.fullmatch(r"sha256:[0-9a-f]{64}", str(fp)):
+                problems.append("%s: bad fingerprint %r" % (where, fp))
+            elif fp in seen_fps:
+                problems.append("%s: fingerprint already listed under %s"
+                                % (where, seen_fps[fp]))
+            else:
+                seen_fps[fp] = email
+            origins = k.get("origins")
+            if not isinstance(origins, list) or not origins or not all(
+                    isinstance(o, str) and o for o in origins):
+                problems.append("%s: 'origins' must be a non-empty "
+                                "string list" % where)
+    return problems
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    ap = argparse.ArgumentParser(prog="identity-resolve.py")
+    ap.add_argument("--map", default=str(MAP_FILE),
+                    help="identity map (default: identity-map.json)")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    sub.add_parser("fp", help="print sha256: fingerprint of stdin bytes")
+    p = sub.add_parser("lookup", help="resolve a fingerprint to scope JSON")
+    p.add_argument("fp")
+    sub.add_parser("check", help="validate the map schema")
+    args = ap.parse_args(argv)
+    if args.cmd == "fp":
+        sys.stdout.write(fingerprint_hex(sys.stdin.buffer.read()) + "\n")
+        return 0
+    if args.cmd == "lookup":
+        scope = resolve_scope(load_map(args.map), args.fp)
+        if scope is None:
+            print("unknown fingerprint (not in map)")
+            return 1
+        scope["slug"] = scope_slug(scope)
+        print(json.dumps(scope, indent=2))
+        return 0
+    problems = check_map(load_map(args.map))
+    if problems:
+        print("%s INVALID:" % args.map)
+        for prob in problems:
+            print("  - %s" % prob)
+        return 1
+    print("%s OK" % args.map)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/invite.py

@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+"""invite.py — Muse.ai invite codes + usage via the agent browsers.
+
+Find: GET /api/hatch/invite via in-page fetch (primary; proven live),
+      Invite-button popover parse (DOM fallback).
+Redeem: POST /api/hatch/invite-code/redeem via in-page fetch.
+Usage: Settings > General DOM read (weekly reset, % used, additional
+      tokens) through the hatch_menu tree (dialog/mouse/tabs);
+      settings-nav primitives live there, this module keeps the
+      invite API + popover flows and the flat CLI parse.
+
+Server eligibility (observed live): one redemption per account
+(already_redeemed); 48h window from joining (window_expired); codes
+carry limited uses (used_up) and can be revoked. Inviter rewards
+accrue regardless of the inviter's own redemption state.
+
+Caller errors (unknown node, malformed code) raise InviteError before
+any CDP traffic. Transport/CDP failures return {"ok": False, ...}.
+"""
+
+import re
+import time
+
+from approvals import VALID_NODES, cdp_evaluate, get_cdp_ws
+from hatch_menu import dialog as menu_dialog
+from hatch_menu.mouse import close as _close
+from hatch_menu.mouse import escape as _escape
+from hatch_menu.tabs import general as general_tab
+
+
+class InviteError(ValueError):
+    """Caller error: unknown node or malformed code. Raised before CDP."""
+
+
+CODE_RE = re.compile(r"^[A-Z0-9]{6}$")
+CODE_REVEALED_RE = re.compile(r"Invite code revealed:\s*([A-Z0-9]{6})")
+
+JS_INVITE_GET = """(async () => {
+  try {
+    const r = await fetch('/api/hatch/invite',
+      {method: 'GET', cache: 'no-store'});
+    return {status: r.status, data: await r.json()};
+  } catch (e) { return {error: String(e).slice(0, 200)}; }
+})()"""
+
+# %s is a validated [A-Z0-9]{6} code: injection-safe by construction.
+JS_REDEEM_TMPL = """(async () => {
+  try {
+    const r = await fetch('/api/hatch/invite-code/redeem', {method: 'POST',
+      headers: {'Content-Type': 'application/json'},
+      body: JSON.stringify({code: '%s', supportsRedemptionStatus: true})});
+    return {status: r.status, ok: r.ok, data: await r.json()};
+  } catch (e) { return {error: String(e).slice(0, 200)}; }
+})()"""
+
+JS_INVITE_CLICK = ("(() => { const b = document.querySelector("
+                   "'[data-testid=\"hatch-invite-friends-button\"]');"
+                   " if (!b) return 'NO_BUTTON'; b.click();"
+                   " return 'CLICKED'; })()")
+
+JS_POPOVER_TEXT = ("(() => { const d = document.querySelector("
+                   "'[data-slot=\"popover-content\"]');"
+                   " return d ? d.innerText : null; })()")
+
+def normalize_code(code):
+    """Uppercase/strip a code; None unless 6-char A-Z0-9."""
+    if not isinstance(code, str):
+        return None
+    c = code.strip().upper()
+    return c if CODE_RE.fullmatch(c) else None
+
+
+def _check_node(node):
+    if node not in VALID_NODES:
+        raise InviteError("unknown node: %r (valid: %s)"
+                          % (node, ", ".join(VALID_NODES)))
+
+
+def open_settings(ws):
+    """Open the Settings dialog via the dock menu. True when open.
+
+    Public shim over hatch_menu.dialog.open_settings (single copy).
+    """
+    return menu_dialog.open_settings(ws)
+
+
+def click_settings_tab(ws, name):
+    """Open a Settings dialog tab by visible name. True when open.
+
+    Public shim over hatch_menu.dialog.goto_tab (single copy).
+    """
+    return menu_dialog.goto_tab(ws, name)
+
+
+def _popover_code(ws):
+    """Invite code via the main-chat popover (DOM fallback). None if absent."""
+    try:
+        if cdp_evaluate(ws, JS_INVITE_CLICK, timeout=5.0) != "CLICKED":
+            return None
+        time.sleep(1.0)
+        text = cdp_evaluate(ws, JS_POPOVER_TEXT, timeout=5.0) or ""
+    except Exception:
+        return None
+    finally:
+        _escape(ws)
+    m = CODE_REVEALED_RE.search(text)
+    return m.group(1) if m else None
+
+
+def get_invite(node, timeout=8.0):
+    """Per-agent invite state. API first, popover fallback for the code."""
+    _check_node(node)
+    try:
+        ws, _ = get_cdp_ws(node)
+    except Exception as e:
+        return {"ok": False, "node": node,
+                "error": "CDP unreachable: %s" % e}
+    try:
+        try:
+            res = cdp_evaluate(ws, JS_INVITE_GET, await_promise=True,
+                               timeout=timeout)
+        except Exception as e:
+            res = {"error": "%s: %s" % (type(e).__name__, e)}
+        if isinstance(res, dict) and res.get("status") == 200 \
+                and isinstance(res.get("data"), dict) \
+                and res["data"].get("code"):
+            d = res["data"]
+            return {"ok": True, "node": node, "source": "api",
+                    "code": d.get("code"),
+                    "has_redeemed": d.get("has_redeemed_invite_code"),
+                    "uses_remaining": d.get("uses_remaining"),
+                    "use_count": d.get("use_count"),
+                    "reward": d.get("reward")}
+        code = _popover_code(ws)
+        if code:
+            return {"ok": True, "node": node, "source": "dom",
+                    "code": code, "has_redeemed": None,
+                    "uses_remaining": None, "use_count": None,
+                    "reward": None}
+        if isinstance(res, dict):
+            detail = res.get("error", "invite API failed")
+        else:
+            detail = "invite API failed"
+        return {"ok": False, "node": node,
+                "error": "invite lookup failed (%s); popover has no code"
+                % detail}
+    finally:
+        _close(ws)
+
+
+def redeem_invite(node, code, timeout=12.0):
+    """Redeem CODE on node. Returns ok / server reason + detail."""
+    c = normalize_code(code)
+    if c is None:
+        raise InviteError("malformed invite code: %r (want 6 chars A-Z0-9)"
+                          % (code,))
+    _check_node(node)
+    js = JS_REDEEM_TMPL % c
+    try:
+        ws, _ = get_cdp_ws(node)
+    except Exception as e:
+        return {"ok": False, "node": node, "code": c,
+                "error": "CDP unreachable: %s" % e}
+    try:
+        try:
+            res = cdp_evaluate(ws, js, await_promise=True, timeout=timeout)
+        except Exception as e:
+            return {"ok": False, "node": node, "code": c,
+                    "error": "%s: %s" % (type(e).__name__, e)}
+        if not isinstance(res, dict) or "data" not in res:
+            if isinstance(res, dict):
+                detail = res.get("error", "empty redeem response")
+            else:
+                detail = "empty redeem response"
+            return {"ok": False, "node": node, "code": c,
+                    "reason": "unknown", "detail": detail}
+        data = res.get("data") or {}
+        if res.get("ok") and data.get("success"):
+            return {"ok": True, "node": node, "code": c,
+                    "redemption_status": data.get("redemptionStatus"),
+                    "detail": data.get("detail")}
+        return {"ok": False, "node": node, "code": c,
+                "reason": data.get("reason", "unknown"),
+                "detail": data.get("detail")}
+    finally:
+        _close(ws)
+
+
+def parse_usage_text(text):
+    """Flat usage parse (CLI contract) over the tree's General parser."""
+    nested = general_tab.parse_usage_text(text)
+    wk = (nested.get("weekly") if nested else None) or {}
+    add = (nested.get("additional") if nested else None) or {}
+    tokens = add.get("tokens_left")
+    return {
+        "weekly_reset": wk.get("resets_on"),
+        "weekly_used_pct": wk.get("pct_used"),
+        "additional_expires": "Never expires"
+        if add.get("never_expires") else None,
+        "additional_used_pct": add.get("pct_used"),
+        "additional_left": ("%s tokens left" % tokens)
+        if tokens else None,
+        "has_redeemed": bool(add.get("never_expires") or tokens
+                             or "additional tokens" in (text or "").lower()),
+    }
+
+
+def get_usage(node, timeout=8.0):
+    """Usage limits for one agent via Settings General (DOM read)."""
+    _check_node(node)
+    try:
+        ws, _ = get_cdp_ws(node)
+    except Exception as e:
+        return {"ok": False, "node": node,
+                "error": "CDP unreachable: %s" % e}
+    try:
+        if not open_settings(ws):
+            return {"ok": False, "node": node,
+                    "error": "settings dialog did not open"}
+        if not menu_dialog.goto_tab(ws, "General"):
+            return {"ok": False, "node": node,
+                    "error": "General tab did not open"}
+        # Note: Usage stats and redeem field can load asynchronously in the React/Radix tree.
+        # Poll up to timeout seconds for usage or redeem markers.
+        text = None
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            t = menu_dialog.dialog_text(ws)
+            if t and ("Weekly limit" in t or "Additional tokens" in t or "Redeem invite code" in t or "tokens left" in t or "% used" in t):
+                text = t
+                break
+            time.sleep(0.4)
+        if not text:
+            text = menu_dialog.dialog_text(ws)
+
+        if not text:
+            return {"ok": False, "node": node,
+                    "error": "empty settings dialog"}
+        out = {"ok": True, "node": node}
+        parsed = parse_usage_text(text)
+        stats_loaded = bool(
+            parsed.get("weekly_reset")
+            or parsed.get("weekly_used_pct") is not None
+            or parsed.get("has_redeemed")
+            or parsed.get("additional_left")
+        )
+        out.update(parsed)
+        out["stats_loaded"] = stats_loaded
+        if not stats_loaded:
+            out["note"] = "Usage stats did not render in Settings dialog"
+        return out
+    finally:
+        _escape(ws)
+        _close(ws)
+
+
+def fleet_invite_status(nodes=None):
+    """Invite state per node. Never raises; per-node error dicts."""
+    out = {}
+    for n in (nodes or list(VALID_NODES)):
+        try:
+            out[n] = get_invite(n)
+        except InviteError as e:
+            out[n] = {"ok": False, "node": n, "error": str(e)}
+    return out
+
+
+def fleet_usage(nodes=None):
+    """Usage limits per node. Never raises; per-node error dicts."""
+    out = {}
+    for n in (nodes or list(VALID_NODES)):
+        try:
+            out[n] = get_usage(n)
+        except InviteError as e:
+            out[n] = {"ok": False, "node": n, "error": str(e)}
+    return out

bin/invite_handler.py

@@ -0,0 +1,790 @@
+#!/usr/bin/env python3
+"""invite_handler.py: Invite code discovery, inspection, and redemption handler.
+
+Supports:
+  - Extracting agent invite codes via Main Chat DOM RPA & in-session API
+  - Redeeming invite codes via Settings Menu RPA & redemption endpoint
+  - Fleet-wide invite inventory, usage tracking, and agent salvage flows
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+import time
+from dataclasses import asdict, dataclass
+from typing import Any, Dict, List, Optional
+
+try:
+    from approvals import cdp_evaluate, get_cdp_ws, get_node_pages
+    from settings_rpa import SettingsRPA, cdp_click_element_by_selector, cdp_send_escape
+except ImportError:
+    import os
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from approvals import cdp_evaluate, get_cdp_ws, get_node_pages
+    from settings_rpa import SettingsRPA, cdp_click_element_by_selector, cdp_send_escape
+
+
+VALID_NODES = ["muse", "pip", "646", "opm", "def", "dev"]
+
+
+@dataclass
+class InviteCodeInfo:
+    node: str
+    code: str
+    uses_remaining: int
+    use_count: int
+    max_uses: int
+    has_redeemed: bool
+    invite_state: str
+    reward: Optional[Dict[str, Any]]
+    method_used: str
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+@dataclass
+class RedemptionResult:
+    target_node: str
+    code: str
+    success: bool
+    status: str
+    reason: Optional[str]
+    detail: Optional[str]
+    method_used: str
+    field_missing: bool = False
+    loopback_notified: bool = False
+    loopback_detail: Optional[str] = None
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+def send_loopback_notice(
+    recipient: str,
+    target: str,
+    message: str,
+    sender: str = "super",
+    timeout: float = 15.0,
+) -> bool:
+    """Send a loopback notification DM via bin/dm.py to a sidechat without blocking or failing."""
+    try:
+        from pathlib import Path
+        bin_dir = Path(__file__).resolve().parent
+        dm_script = bin_dir / "dm.py"
+        if not dm_script.exists():
+            return False
+        import subprocess
+        cmd = [
+            sys.executable,
+            str(dm_script),
+            "send",
+            "--agent",
+            sender,
+            "--to",
+            recipient,
+            "--target",
+            target,
+            message,
+        ]
+        if target == "main":
+            cmd.insert(-1, "--allow-main-chat")
+        res = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return res.returncode == 0
+    except Exception:
+        return False
+
+
+class InviteHandler:
+    """Handles invite codes discovery, inspection, and redemption for NetVM nodes."""
+
+    def __init__(self, node: str, timeout: float = 4.0):
+        self.node = node
+        self.timeout = timeout
+        self.ws = None
+
+    def _dispatch_loopback(self, res: RedemptionResult, agent: str, target: str) -> bool:
+        """Post a loopback notification DM via box dm."""
+        msg = f"[BOX-INVITE-LOOPBACK] Node @{self.node} redeem status: {res.status}. Reason: {res.reason or 'unknown'}. Detail: {res.detail or '-'}"
+        ok = send_loopback_notice(recipient=agent, target=target, message=msg)
+        res.loopback_notified = ok
+        res.loopback_detail = f"Notified @{agent}/{target}" if ok else f"Failed to notify @{agent}/{target}"
+        return ok
+
+
+    def connect(self) -> InviteHandler:
+        if self.ws is None:
+            self.ws, _ = get_cdp_ws(self.node, timeout=self.timeout)
+        return self
+
+    def close(self) -> None:
+        if self.ws is not None:
+            try:
+                self.ws.close()
+            except Exception:
+                pass
+            self.ws = None
+
+    def __enter__(self) -> InviteHandler:
+        return self.connect()
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
+        self.close()
+
+    def find_code_api(self) -> InviteCodeInfo:
+        """Fetch invite code and metadata directly via in-session /api/hatch/invite query."""
+        self.connect()
+        js_query = """(async () => {
+            try {
+                const resp = await fetch('/api/hatch/invite', {method: 'GET', cache: 'no-store'});
+                if (!resp.ok) return {error: `HTTP ${resp.status}`};
+                return await resp.json();
+            } catch(e) {
+                return {error: e.toString()};
+            }
+        })()"""
+        res = cdp_evaluate(self.ws, js_query, await_promise=True, timeout=self.timeout)
+        if not res or "error" in res or "code" not in res:
+            err = res.get("error", "Invalid response") if res else "No response"
+            raise RuntimeError(f"Failed to fetch invite info for {self.node}: {err}")
+
+        return InviteCodeInfo(
+            node=self.node,
+            code=res.get("code", ""),
+            uses_remaining=res.get("uses_remaining", 0),
+            use_count=res.get("use_count", 0),
+            max_uses=res.get("max_uses", 30),
+            has_redeemed=bool(res.get("has_redeemed_invite_code", False)),
+            invite_state=res.get("invite_state", "UNKNOWN"),
+            reward=res.get("reward"),
+            method_used="api",
+        )
+
+    def find_code_dom(self) -> InviteCodeInfo:
+        """Find invite code by navigating to Main Chat and opening the Invite popover."""
+        self.connect()
+        # 1. Ensure main chat home is active
+        with SettingsRPA(self.node, timeout=self.timeout) as rpa:
+            rpa.ensure_main_chat()
+
+        time.sleep(0.3)
+        # Dismiss any open popovers first
+        cdp_send_escape(self.ws)
+        time.sleep(0.2)
+
+        # 2. Click Invite button in main chat
+        clicked = cdp_click_element_by_selector(self.ws, '[data-testid="hatch-invite-friends-button"]', timeout=self.timeout)
+        if not clicked:
+            # Fallback to button by text
+            js_click = """(() => {
+                const btn = Array.from(document.querySelectorAll('button')).find(b => (b.innerText||'').trim() === 'Invite');
+                if (btn) { btn.click(); return true; }
+                return false;
+            })()"""
+            clicked = cdp_evaluate(self.ws, js_click)
+
+        if not clicked:
+            raise RuntimeError(f"Could not click Invite button on {self.node}")
+
+        time.sleep(0.8)
+
+        # 3. Read popover contents
+        js_read_popover = """(() => {
+            const pop = document.querySelector('[data-slot="popover-content"]');
+            if (!pop) return {found: false};
+
+            // Look for revealed code span
+            const codeSpan = pop.querySelector('[data-pel-impression="invite_code_revealed_impression"]');
+            let code = codeSpan ? codeSpan.innerText.trim() : null;
+
+            // Regex fallback on text
+            const fullText = pop.innerText || '';
+            if (!code) {
+                const m = fullText.match(/Invite code revealed:\\s*([A-Z0-9]{6})/);
+                if (m) code = m[1];
+            }
+            if (!code) {
+                const m2 = fullText.match(/\\b([A-Z0-9]{6})\\b/);
+                if (m2) code = m2[1];
+            }
+
+            let usesLeft = 30;
+            const mUses = fullText.match(/(\\d+)\\s+uses\\s+left/);
+            if (mUses) usesLeft = parseInt(mUses[1], 10);
+
+            return {
+                found: true,
+                code: code,
+                uses_left: usesLeft,
+                text: fullText
+            };
+        })()"""
+        pop_res = cdp_evaluate(self.ws, js_read_popover)
+        cdp_send_escape(self.ws)
+
+        if not pop_res or not pop_res.get("found") or not pop_res.get("code"):
+            # Fall back to API if popover extraction failed
+            return self.find_code_api()
+
+        code = pop_res.get("code")
+        uses_left = pop_res.get("uses_left", 30)
+
+        # Query API for additional metadata
+        try:
+            api_info = self.find_code_api()
+            api_info.method_used = "dom+api"
+            return api_info
+        except Exception:
+            return InviteCodeInfo(
+                node=self.node,
+                code=code,
+                uses_remaining=uses_left,
+                use_count=30 - uses_left,
+                max_uses=30,
+                has_redeemed=True,
+                invite_state="ELIGIBLE",
+                reward=None,
+                method_used="dom",
+            )
+
+    def find_code(self, method: str = "auto") -> InviteCodeInfo:
+        """Find invite code using specified method ('auto', 'api', or 'dom')."""
+        if method == "api":
+            return self.find_code_api()
+        elif method == "dom":
+            return self.find_code_dom()
+        else:
+            # Auto: Try API first, fallback to DOM
+            try:
+                return self.find_code_api()
+            except Exception:
+                return self.find_code_dom()
+
+    def redeem_code_api(self, code: str) -> RedemptionResult:
+        """Redeem invite code using in-session /api/hatch/invite-code/redeem endpoint."""
+        self.connect()
+        clean_code = code.strip().upper()
+        js_redeem = f"""(async () => {{
+            try {{
+                const resp = await fetch('/api/hatch/invite-code/redeem', {{
+                    method: 'POST',
+                    headers: {{'Content-Type': 'application/json'}},
+                    body: JSON.stringify({{code: {json.dumps(clean_code)}, supportsRedemptionStatus: true}})
+                }});
+                const data = await resp.json();
+                return {{status_code: resp.status, ok: resp.ok, data: data}};
+            }} catch(e) {{
+                return {{error: e.toString()}};
+            }}
+        }})()"""
+        res = cdp_evaluate(self.ws, js_redeem, await_promise=True, timeout=self.timeout)
+        if not res or "error" in res:
+            err = res.get("error", "No response") if res else "Timeout"
+            return RedemptionResult(
+                target_node=self.node,
+                code=clean_code,
+                success=False,
+                status="error",
+                reason="transport_failure",
+                detail=err,
+                method_used="api",
+            )
+
+        data = res.get("data", {})
+        ok = res.get("ok", False) and data.get("success", False)
+        status = data.get("redemptionStatus") or ("redeemed" if ok else "failed")
+        reason = data.get("reason")
+        detail = data.get("detail")
+
+        return RedemptionResult(
+            target_node=self.node,
+            code=clean_code,
+            success=ok,
+            status=status,
+            reason=reason,
+            detail=detail,
+            method_used="api",
+        )
+
+    def redeem_code_dom(
+        self,
+        code: str,
+        notify_target: Optional[str] = None,
+        notify_agent: Optional[str] = None,
+    ) -> RedemptionResult:
+        """Redeem invite code using Settings Menu RPA -> Settings -> Redeem Invite Code dialog.
+        Gracefully handles missing entrypoint rows, missing input fields, and async loading races.
+        Falls back to in-page API automatically if DOM fields are absent, and dispatches DM loopback if requested."""
+        self.connect()
+        clean_code = code.strip().upper()
+        with SettingsRPA(self.node, timeout=self.timeout) as rpa:
+            # 1. Open Settings dialog
+            opened = rpa.open_settings_dialog()
+            if not opened:
+                # If dialog failed to open, try API fallback directly
+                api_res = self.redeem_code_api(clean_code)
+                if api_res.success:
+                    api_res.detail = f"Settings dialog could not open; redemption completed via API fallback ({api_res.detail or ''})".strip()
+                    return api_res
+
+                res = RedemptionResult(
+                    target_node=self.node,
+                    code=clean_code,
+                    success=False,
+                    status="error",
+                    reason="settings_open_failed",
+                    detail=f"Could not open Settings dialog via RPA on @{self.node}. API fallback: {api_res.detail or api_res.reason or 'failed'}",
+                    method_used="dom",
+                    field_missing=True,
+                )
+                if notify_target and notify_agent:
+                    self._dispatch_loopback(res, notify_agent, notify_target)
+                return res
+
+            rpa.select_tab("General")
+            time.sleep(0.3)
+
+            # 2. Check for "Redeem invite code" entry (poll up to 2.5s for React rendering)
+            js_find_and_click = """(() => {
+                const dialog = document.querySelector('[role="dialog"]');
+                if (!dialog) return {found: false, dialog_present: false};
+                const items = Array.from(dialog.querySelectorAll('button, div, span'));
+                const redeemItem = items.find(el => (el.innerText || '').trim() === 'Redeem invite code');
+                if (redeemItem) {
+                    redeemItem.click();
+                    return {found: true, dialog_present: true};
+                }
+                return {
+                    found: false,
+                    dialog_present: true,
+                    text: dialog.innerText || '',
+                    has_additional: (dialog.innerText || '').includes('Additional tokens')
+                };
+            })()"""
+            click_res = None
+            deadline = time.time() + 2.5
+            while time.time() < deadline:
+                click_res = cdp_evaluate(self.ws, js_find_and_click)
+                if click_res and click_res.get("found"):
+                    break
+                time.sleep(0.3)
+
+            if not click_res or not click_res.get("found"):
+                # "Redeem invite code" field is missing in General settings!
+                rpa.close_settings_dialog()
+
+                # Attempt automatic API fallback first
+                api_res = self.redeem_code_api(clean_code)
+                if api_res.success:
+                    api_res.detail = f"Redeem field was missing in Settings DOM; redeemed successfully via API fallback! ({api_res.detail or ''})".strip()
+                    return api_res
+
+                # Diagnose why field is missing
+                diag_text = click_res.get("text", "") if click_res else ""
+                has_extra = click_res.get("has_additional", False) if click_res else False
+
+                is_already = has_extra or "Additional tokens" in diag_text
+                if not is_already:
+                    try:
+                        api_check = self.find_code_api()
+                        is_already = bool(api_check.has_redeemed)
+                    except Exception:
+                        pass
+
+                if is_already:
+                    status = "already_redeemed"
+                    reason = "already_redeemed"
+                    detail = f"Node @{self.node} has already redeemed an invite code (entrypoint hidden by active Additional tokens ticker)."
+                elif api_res.reason in ["window_expired", "already_redeemed", "invalid", "used_up"]:
+                    status = api_res.status
+                    reason = api_res.reason
+                    detail = f"Redeem invite code field not present in Settings on @{self.node}: server reports {api_res.reason} ({api_res.detail or ''})."
+                else:
+                    status = "entrypoint_not_found"
+                    reason = "field_missing"
+                    detail = f"Redeem invite code field missing in General settings on @{self.node} (account may be past 48h onboarding window or already redeemed)."
+
+                res = RedemptionResult(
+                    target_node=self.node,
+                    code=clean_code,
+                    success=False,
+                    status=status,
+                    reason=reason,
+                    detail=detail,
+                    method_used="dom",
+                    field_missing=True,
+                )
+                if notify_target and notify_agent:
+                    self._dispatch_loopback(res, notify_agent, notify_target)
+                return res
+
+            # 3. Handle HatchInviteRedemptionDialog (sub-dialog opened by clicking Redeem)
+            # Poll up to 2.5s for input box to mount
+            js_input_code = f"""(() => {{
+                // Look for dialog titled "Redeem a code" or input with label
+                const input = document.querySelector('input[aria-label="Invite code"]') ||
+                              document.querySelector('[role="dialog"] input[type="text"]');
+                if (!input) return {{found_input: false}};
+
+                input.focus();
+                input.value = {json.dumps(clean_code)};
+                input.dispatchEvent(new Event('input', {{bubbles: true}}));
+                input.dispatchEvent(new Event('change', {{bubbles: true}}));
+
+                input.dispatchEvent(new KeyboardEvent('keydown', {{key: 'Enter', code: 'Enter', keyCode: 13, which: 13, bubbles: true}}));
+                return {{found_input: true}};
+            }})()"""
+            input_res = None
+            deadline = time.time() + 2.5
+            while time.time() < deadline:
+                input_res = cdp_evaluate(self.ws, js_input_code)
+                if input_res and input_res.get("found_input"):
+                    break
+                time.sleep(0.3)
+
+            if not input_res or not input_res.get("found_input"):
+                # Subdialog opened or clicked, but input box is absent!
+                cdp_send_escape(self.ws)
+                rpa.close_settings_dialog()
+
+                # Automatic API fallback
+                api_res = self.redeem_code_api(clean_code)
+                if api_res.success:
+                    api_res.detail = f"Redemption input box was missing in dialog; redeemed successfully via API fallback! ({api_res.detail or ''})".strip()
+                    return api_res
+
+                res = RedemptionResult(
+                    target_node=self.node,
+                    code=clean_code,
+                    success=False,
+                    status=api_res.status or "dom_input_missing",
+                    reason=api_res.reason or "input_field_missing",
+                    detail=f"Invite code input field was not found in redemption dialog on @{self.node}. API fallback: {api_res.detail or api_res.reason or 'failed'}.",
+                    method_used="dom",
+                    field_missing=True,
+                )
+                if notify_target and notify_agent:
+                    self._dispatch_loopback(res, notify_agent, notify_target)
+                return res
+
+            # Input submitted; poll for outcome text
+            time.sleep(1.2)
+            js_check_outcome = """(() => {
+                const dialog = document.querySelector('[role="dialog"]');
+                if (!dialog) return {found: false};
+                const text = dialog.innerText || '';
+
+                if (text.includes('Congratulations') || text.includes('successful')) {
+                    return {success: true, status: 'redeemed', detail: text};
+                }
+                if (text.includes('already redeemed')) {
+                    return {success: false, status: 'already_redeemed', detail: text};
+                }
+                if (text.includes('no longer valid') || text.includes('invalid')) {
+                    return {success: false, status: 'invalid', detail: text};
+                }
+                if (text.includes('used up')) {
+                    return {success: false, status: 'used_up', detail: text};
+                }
+                if (text.includes('passed') || text.includes('expired')) {
+                    return {success: false, status: 'window_expired', detail: text};
+                }
+                return {status: 'unknown', detail: text};
+            })()"""
+            outcome = None
+            deadline = time.time() + 2.5
+            while time.time() < deadline:
+                outcome = cdp_evaluate(self.ws, js_check_outcome)
+                if outcome and outcome.get("status") != "unknown":
+                    break
+                time.sleep(0.3)
+
+            rpa.close_settings_dialog()
+
+            if outcome and outcome.get("success"):
+                return RedemptionResult(
+                    target_node=self.node,
+                    code=clean_code,
+                    success=True,
+                    status="redeemed",
+                    reason=None,
+                    detail="Redemption successful via Settings RPA",
+                    method_used="dom",
+                )
+            elif outcome and outcome.get("status") in ["already_redeemed", "invalid", "used_up", "window_expired"]:
+                res = RedemptionResult(
+                    target_node=self.node,
+                    code=clean_code,
+                    success=False,
+                    status=outcome.get("status"),
+                    reason=outcome.get("status"),
+                    detail=outcome.get("detail"),
+                    method_used="dom",
+                )
+                if notify_target and notify_agent:
+                    self._dispatch_loopback(res, notify_agent, notify_target)
+                return res
+
+            # Fallback to API check if DOM did not confirm status
+            api_res = self.redeem_code_api(clean_code)
+            if not api_res.success and notify_target and notify_agent:
+                self._dispatch_loopback(api_res, notify_agent, notify_target)
+            return api_res
+
+    def redeem_code(
+        self,
+        code: str,
+        method: str = "auto",
+        notify_target: Optional[str] = None,
+        notify_agent: Optional[str] = None,
+    ) -> RedemptionResult:
+        """Redeem invite code using specified method ('auto', 'dom', or 'api')."""
+        if method == "dom":
+            return self.redeem_code_dom(code, notify_target=notify_target, notify_agent=notify_agent)
+        elif method == "api":
+            res = self.redeem_code_api(code)
+            if not res.success and notify_target and notify_agent:
+                self._dispatch_loopback(res, notify_agent, notify_target)
+            return res
+        else:
+            # Auto: Validate and attempt via API for reliability. Fallback to DOM on transport error.
+            res = self.redeem_code_api(code)
+            if not res.success and res.reason == "transport_failure":
+                res = self.redeem_code_dom(code, notify_target=notify_target, notify_agent=notify_agent)
+            elif not res.success and notify_target and notify_agent:
+                self._dispatch_loopback(res, notify_agent, notify_target)
+            return res
+
+
+
+def scan_fleet_invites(nodes: Optional[List[str]] = None) -> List[Dict[str, Any]]:
+    """Scan fleet nodes and return invite code details for each active node."""
+    target_nodes = nodes or ["muse", "pip", "646", "opm"]
+    results = []
+    for node in target_nodes:
+        try:
+            handler = InviteHandler(node)
+            with handler:
+                info = handler.find_code(method="auto")
+                results.append(info.to_dict())
+        except Exception as e:
+            results.append({
+                "node": node,
+                "code": None,
+                "uses_remaining": 0,
+                "use_count": 0,
+                "max_uses": 30,
+                "has_redeemed": None,
+                "invite_state": "UNREACHABLE",
+                "reward": None,
+                "method_used": "error",
+                "error": str(e),
+            })
+    return results
+
+
+def scan_fleet_usage(nodes: Optional[List[str]] = None) -> List[Dict[str, Any]]:
+    """Scan fleet nodes and return token usage for each active node."""
+    target_nodes = nodes or ["muse", "pip", "646", "opm"]
+    results = []
+    for node in target_nodes:
+        try:
+            with SettingsRPA(node) as rpa:
+                usage = rpa.read_usage()
+                results.append(usage.to_dict())
+        except Exception as e:
+            results.append({
+                "node": node,
+                "plan": "Unknown",
+                "weekly_reset_text": "Unreachable",
+                "weekly_percent_used": 0,
+                "extra_tokens_status": "Unknown",
+                "extra_percent_used": 0,
+                "extra_tokens_remaining": "Unknown",
+                "is_blocked": False,
+                "bars": [],
+                "error": str(e),
+            })
+    return results
+
+
+def salvage_blocked_node(
+    blocked_node: str = "646",
+    helper_node: Optional[str] = None,
+    notify_target: Optional[str] = None,
+    notify_agent: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Salvage an out-of-tokens node by identifying its code and redeeming it on an eligible peer."""
+    # 1. Fetch blocked node invite code
+    with InviteHandler(blocked_node) as h_blocked:
+        blocked_info = h_blocked.find_code()
+
+    code_to_redeem = blocked_info.code
+    if not code_to_redeem:
+        return {
+            "success": False,
+            "blocked_node": blocked_node,
+            "error": f"Could not find invite code for blocked node {blocked_node}",
+        }
+
+    # 2. Check candidate helper nodes
+    candidates = [helper_node] if helper_node else [n for n in VALID_NODES if n != blocked_node]
+    eligible_peer = None
+
+    for peer in candidates:
+        try:
+            with InviteHandler(peer) as h_peer:
+                peer_info = h_peer.find_code()
+                if not peer_info.has_redeemed:
+                    eligible_peer = peer
+                    break
+        except Exception:
+            continue
+
+    if not eligible_peer:
+        res = {
+            "success": False,
+            "blocked_node": blocked_node,
+            "invite_code": code_to_redeem,
+            "error": "No existing fleet peer is currently eligible (all active peers have already redeemed an invite code). An onboarding agent or fresh client profile must redeem this code.",
+            "code_to_redeem": code_to_redeem,
+            "share_instruction": f"Redeem code '{code_to_redeem}' on a newly provisioned agent to credit 1 billion tokens to {blocked_node}.",
+            "field_missing": True,
+            "loopback_notified": False,
+        }
+        if notify_target and notify_agent:
+            msg = f"[SALVAGE-NOTICE] Node @{blocked_node} is blocked (code: {code_to_redeem}), but no eligible peer is available. Fresh onboarding required."
+            res["loopback_notified"] = send_loopback_notice(notify_agent, notify_target, msg)
+        return res
+
+    # 3. Redeem on eligible peer
+    with InviteHandler(eligible_peer) as h_peer:
+        redemption = h_peer.redeem_code(
+            code_to_redeem,
+            notify_target=notify_target,
+            notify_agent=notify_agent,
+        )
+
+    return {
+        "success": redemption.success,
+        "blocked_node": blocked_node,
+        "helper_node": eligible_peer,
+        "code_redeemed": code_to_redeem,
+        "redemption_result": redemption.to_dict(),
+        "field_missing": redemption.field_missing,
+        "loopback_notified": redemption.loopback_notified,
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="NetVM Invite Code Handler")
+    subparsers = parser.add_subparsers(dest="command")
+
+    p_find = subparsers.add_parser("find", help="Find invite code for an agent")
+    p_find.add_argument("node", help="Node name (e.g. 646, pip, muse, opm)")
+    p_find.add_argument("--method", choices=["auto", "api", "dom"], default="auto")
+    p_find.add_argument("--json", action="store_true")
+
+    p_redeem = subparsers.add_parser("redeem", help="Redeem an invite code on a target agent")
+    p_redeem.add_argument("node", help="Target node to redeem the code on")
+    p_redeem.add_argument("code", help="6-character invite code")
+    p_redeem.add_argument("--method", choices=["auto", "api", "dom"], default="auto")
+    p_redeem.add_argument("--notify-target", default=None, help="Sidechat to notify on loopback")
+    p_redeem.add_argument("--notify-agent", default=None, help="Agent to notify on loopback")
+    p_redeem.add_argument("--json", action="store_true")
+
+    p_list = subparsers.add_parser("list", help="List invite codes across fleet")
+    p_list.add_argument("--json", action="store_true")
+
+    p_salvage = subparsers.add_parser("salvage", help="Salvage a blocked agent (e.g. 646)")
+    p_salvage.add_argument("node", default="646", nargs="?", help="Blocked node (default: 646)")
+    p_salvage.add_argument("--helper", help="Specific helper node to redeem code")
+    p_salvage.add_argument("--notify-target", default=None, help="Sidechat to notify on loopback")
+    p_salvage.add_argument("--notify-agent", default=None, help="Agent to notify on loopback")
+    p_salvage.add_argument("--json", action="store_true")
+
+    args = parser.parse_args()
+
+    if args.command == "find":
+        with InviteHandler(args.node) as h:
+            info = h.find_code(method=args.method)
+            if args.json:
+                print(json.dumps(info.to_dict(), indent=2))
+            else:
+                print(f"=== Agent {info.node} Invite Code ===")
+                print(f"  Code:           {info.code}")
+                print(f"  Uses Remaining: {info.uses_remaining} / {info.max_uses}")
+                print(f"  Has Redeemed?:  {'Yes' if info.has_redeemed else 'No'}")
+                print(f"  Method:         {info.method_used}")
+                if info.reward:
+                    print(f"  Reward:         {info.reward.get('title')}")
+
+    elif args.command == "redeem":
+        with InviteHandler(args.node) as h:
+            res = h.redeem_code(
+                args.code,
+                method=args.method,
+                notify_target=getattr(args, "notify_target", None),
+                notify_agent=getattr(args, "notify_agent", None),
+            )
+            if args.json:
+                print(json.dumps(res.to_dict(), indent=2))
+            else:
+                status_icon = "✔" if res.success else "✖"
+                print(f"[{status_icon}] Redemption on {res.target_node} for code {res.code}:")
+                print(f"  Success: {res.success}")
+                print(f"  Status:  {res.status}")
+                if res.detail:
+                    print(f"  Detail:  {res.detail}")
+                if res.loopback_notified:
+                    print(f"  Loopback:{res.loopback_detail}")
+
+    elif args.command == "list":
+        fleet = scan_fleet_invites()
+        if args.json:
+            print(json.dumps(fleet, indent=2))
+        else:
+            print("\n=== NETVM FLEET INVITE CODES ===")
+            print(f"  {'NODE':<8} {'INVITE CODE':<14} {'USES LEFT':<12} {'REDEEMED?':<12} {'REWARD / NOTE':<25}")
+            print(f"  {'────':<8} {'───────────':<14} {'─────────':<12} {'─────────':<12} {'─────────────':<25}")
+            for row in fleet:
+                node = row.get("node", "")
+                code = row.get("code") or "N/A"
+                uses = f"{row.get('uses_remaining', 0)}/{row.get('max_uses', 30)}"
+                redeemed = "Yes" if row.get("has_redeemed") else "No"
+                reward = row.get("reward", {})
+                reward_str = reward.get("title", "-") if reward else "-"
+                print(f"  {node:<8} {code:<14} {uses:<12} {redeemed:<12} {reward_str:<25}")
+            print()
+
+    elif args.command == "salvage":
+        salvage_res = salvage_blocked_node(
+            args.node,
+            helper_node=args.helper,
+            notify_target=getattr(args, "notify_target", None),
+            notify_agent=getattr(args, "notify_agent", None),
+        )
+        if args.json:
+            print(json.dumps(salvage_res, indent=2))
+        else:
+            print(f"\n=== SALVAGE REPORT FOR {args.node.upper()} ===")
+            print(f"  Invite Code to Credit: {salvage_res.get('invite_code') or salvage_res.get('code_redeemed')}")
+            if salvage_res.get("success"):
+                print(f"  Status: SUCCESS! Redeemed on {salvage_res.get('helper_node')}")
+            else:
+                print(f"  Status: {salvage_res.get('error')}")
+                if salvage_res.get("share_instruction"):
+                    print(f"  Next Step: {salvage_res.get('share_instruction')}")
+            if salvage_res.get("loopback_notified"):
+                print("  Loopback: Notice sent to requesting target.")
+            print()
+
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()

bin/job-dispatch.py

@@ -103,6 +103,10 @@ def load_job(job_name):
     # Try .json first, then .yaml (for compatibility)
     job_file = JOBS_DIR / f"{job_name}.json"
     if not job_file.exists():
+        archived_file = JOBS_DIR / "archive" / f"{job_name}.json"
+        if archived_file.exists():
+            print(f"Error: Job '{job_name}' is archived at {archived_file}. Unarchive before dispatch (e.g. 'box job unarchive {job_name}').", file=sys.stderr)
+            sys.exit(1)
         job_file = JOBS_DIR / f"{job_name}.yaml"
         if not job_file.exists():
             print(f"Error: Job '{job_name}' not found in {JOBS_DIR}", file=sys.stderr)
@@ -503,6 +507,26 @@ def main():
     elif job.get("target"):
         target = job.get("target").strip()
 
+    # Pre-dispatch approval & input check (auto-approve trusted; warn if blocked)
+    if not dry_run:
+        try:
+            import approvals
+            app_info = approvals.inspect_node_approvals(agent)
+            if app_info.get("has_pending"):
+                if app_info.get("is_trusted") and app_info.get("status") != "KEY_APPROVAL":
+                    print(f"Pre-dispatch: auto-approving trusted request for {agent} ({app_info.get('target')})")
+                    approvals.allow_node_approval(agent, always=True, caller="job-dispatch")
+                else:
+                    print(f"Warning: Agent '{agent}' has untrusted pending approval ({app_info.get('target')}). Dispatch may stall.", file=sys.stderr)
+                    log_event("job_dispatch_approval_blocked", {"job_id": job_id, "agent": agent, "target": app_info.get("target")})
+            elif app_info.get("status") == "INPUT_WAIT":
+                waits = app_info.get("input_waits", [])
+                w_desc = "; ".join(w.get("task", "") for w in waits)[:80]
+                print(f"Notice: Agent '{agent}' has task waiting for input ({w_desc}).", file=sys.stderr)
+                log_event("job_dispatch_agent_input_wait", {"job_id": job_id, "agent": agent, "waits": w_desc})
+        except Exception:
+            pass
+
     # Sidechat-first policy (2026-10-04): refuse to dispatch to main chat
     # unless the job explicitly opts in. Never fall back to main silently.
     allow_main = bool(job.get("allow_main_chat")) or args.allow_main_chat
@@ -529,9 +553,11 @@ def main():
     })
 
     # Work-first envelope: executable swarm.spawn/followup.create at TOP and BOTTOM
-    # (see bin/prompt_envelope.py). Always applied, even if the template has its own [RESULT.
+    # (see bin/prompt_envelope.py). Skipped when the job sets "skip_envelope": true
-    import prompt_envelope
+    # (agents whose runtime lacks the enveloped tools, e.g. pip).
-    rendered = prompt_envelope.wrap(job_name, job_id, agent, target, rendered)
+    if not job.get("skip_envelope"):
+        import prompt_envelope
+        rendered = prompt_envelope.wrap(job_name, job_id, agent, target, rendered)
 
     # Format as JOB DM
     dm_message = f"[JOB {job_id}] {rendered}"

bin/kpi.py

@@ -0,0 +1,707 @@
+#!/usr/bin/env python3
+"""kpi.py — NetVM Fleet KPI, Spend Monitor & Runtime Preservation Engine.
+
+Monitors:
+  - Calls / DMs dispatched and verified (from dm-log.jsonl)
+  - Token quota spend & remaining (weekly limit % and extra tokens)
+  - Active subagent sessions and tmux muse workers
+  - Uptime vs actual problems fixed (Efficiency Index)
+  - Route health (WARP wireguard, CDP, tmux sockets)
+  - Runtime preservation advisories (guiding agents to offload work to tmux/subagents)
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from dataclasses import asdict, dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+BIN_DIR = REPO_ROOT / "bin"
+DM_LOG = REPO_ROOT / "dm-log.jsonl"
+JOBS_DIR = REPO_ROOT / "jobs"
+SUBAGENTS_FILE = REPO_ROOT / "subagent-sessions.json"
+
+VALID_NODES = ["muse", "pip", "646", "opm", "dev", "def"]
+
+
+@dataclass
+class AgentKPI:
+    node: str
+    weekly_used_pct: Optional[int]
+    extra_tokens_remaining: str
+    is_blocked: bool
+    calls_sent: int
+    calls_verified: int
+    jobs_assigned: int
+    jobs_completed: int
+    subagents_active: int
+    tmux_workers_active: int
+    uptime_hours: float
+    route_status: str
+    efficiency_index: float
+    efficiency_rating: str
+    preservation_advisory: str
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+def get_agent_dm_metrics(node: str, window_hours: Optional[float] = None) -> Dict[str, int]:
+    """Calculate outbound messages, sends, and verified deliveries from dm-log.jsonl."""
+    if not DM_LOG.exists():
+        return {"sent": 0, "verified": 0, "total_events": 0}
+
+    cutoff = None
+    if window_hours:
+        cutoff = datetime.now(timezone.utc).timestamp() - (window_hours * 3600)
+
+    sent_ids = set()
+    verified_ids = set()
+    total_events = 0
+
+    try:
+        with open(DM_LOG, "r", encoding="utf-8") as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    entry = json.loads(line)
+                except Exception:
+                    continue
+
+                if entry.get("agent") != node:
+                    continue
+
+                if cutoff:
+                    ts = entry.get("ts")
+                    if ts:
+                        try:
+                            dt = datetime.fromisoformat(ts.replace("Z", "+00:00"))
+                            if dt.timestamp() < cutoff:
+                                continue
+                        except Exception:
+                            pass
+
+                total_events += 1
+                mid = entry.get("id")
+                etype = entry.get("type")
+                if etype in ("send_start", "send_done"):
+                    if mid:
+                        sent_ids.add(mid)
+                elif etype == "verified":
+                    if mid:
+                        verified_ids.add(mid)
+    except Exception:
+        pass
+
+    return {
+        "sent": len(sent_ids),
+        "verified": len(verified_ids),
+        "total_events": total_events,
+    }
+
+
+def get_agent_job_metrics(node: str) -> Dict[str, int]:
+    """Calculate total jobs assigned and completed for an agent."""
+    assigned = 0
+    completed = 0
+
+    if not JOBS_DIR.exists():
+        return {"assigned": 0, "completed": 0}
+
+    try:
+        for p in JOBS_DIR.glob("*.json"):
+            try:
+                with open(p, "r", encoding="utf-8") as f:
+                    data = json.load(f)
+                    if data.get("agent") == node:
+                        assigned += 1
+                        # If output or status has result
+                        if data.get("status") == "completed" or data.get("result"):
+                            completed += 1
+            except Exception:
+                continue
+    except Exception:
+        pass
+
+    return {"assigned": assigned, "completed": completed}
+
+
+def get_agent_subagent_count(node: str) -> int:
+    """Get active subagent sessions for a node from subagent-sessions.json."""
+    if not SUBAGENTS_FILE.exists():
+        return 0
+    try:
+        with open(SUBAGENTS_FILE, "r", encoding="utf-8") as f:
+            data = json.load(f)
+            if not isinstance(data, dict):
+                return 0
+            return sum(1 for s in data.values() if s.get("parent") == node and s.get("status") == "active")
+    except Exception:
+        return 0
+
+
+def get_agent_tmux_workers(node: str) -> List[str]:
+    """Get running tmux sessions for an agent (shared and netns socket)."""
+    sessions = []
+    # 1. Per-node socket
+    sock = f"/tmp/tmux-{node}.sock"
+    if os.path.exists(sock):
+        try:
+            r = subprocess.run(["tmux", "-S", sock, "list-sessions", "-F", "#{session_name}"], capture_output=True, text=True, timeout=2)
+            if r.returncode == 0 and r.stdout.strip():
+                sessions.extend(line.strip() for line in r.stdout.splitlines() if line.strip())
+        except Exception:
+            pass
+
+    # 2. Shared socket filtering sessions containing node name
+    shared_sock = "/tmp/tmux-muse.sock"
+    if os.path.exists(shared_sock):
+        try:
+            r = subprocess.run(["tmux", "-S", shared_sock, "list-sessions", "-F", "#{session_name}"], capture_output=True, text=True, timeout=2)
+            if r.returncode == 0 and r.stdout.strip():
+                for s in r.stdout.splitlines():
+                    s = s.strip()
+                    if s and (node in s or s.startswith(f"{node}-") or s == "swarm-worker"):
+                        if s not in sessions:
+                            sessions.append(s)
+        except Exception:
+            pass
+
+    return sessions
+
+
+def get_agent_uptime_hours(node: str) -> float:
+    """Calculate browser process uptime in hours."""
+    try:
+        # Search for chromium process matching user-data-dir or node
+        cmd = ["pgrep", "-f", f"chrome-box launch {node}"]
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=2)
+        pids = r.stdout.strip().split()
+        if not pids:
+            cmd = ["pgrep", "-f", f"profiles/{node}"]
+            r = subprocess.run(cmd, capture_output=True, text=True, timeout=2)
+            pids = r.stdout.strip().split()
+
+        if pids:
+            pid = pids[0]
+            # Read /proc/<pid>/stat starttime
+            stat_path = Path(f"/proc/{pid}/stat")
+            if stat_path.exists():
+                stat_content = stat_path.read_text().split()
+                # field 22 is starttime (in clock ticks after boot)
+                start_ticks = int(stat_content[21])
+                clk_tck = os.sysconf(os.sysconf_names["SC_CLK_TCK"])
+                with open("/proc/uptime", "r") as f:
+                    uptime_sec = float(f.read().split()[0])
+                process_age_sec = uptime_sec - (start_ticks / clk_tck)
+                return round(max(0.0, process_age_sec / 3600.0), 2)
+    except Exception:
+        pass
+    return 0.0
+
+
+def check_node_routes(node: str) -> str:
+    """Check connectivity route for a node (netns + CDP)."""
+    # 1. Check netns
+    netns_path = Path(f"/var/run/netns/warp-{node}")
+    if not netns_path.exists():
+        return "NO_NETNS"
+
+    # 2. Check CDP page connection
+    try:
+        try:
+            from approvals import get_node_pages
+        except ImportError:
+            sys.path.insert(0, str(BIN_DIR))
+            from approvals import get_node_pages
+        pages = get_node_pages(node, timeout=2.0)
+        if pages:
+            return "ONLINE"
+    except Exception:
+        pass
+
+    return "DEGRADED"
+
+
+
+def calculate_efficiency(
+    jobs_done: int,
+    subagents_active: int,
+    tmux_workers: int,
+    calls_verified: int,
+    weekly_used_pct: Optional[int],
+    uptime_hours: float,
+) -> tuple[float, str]:
+    """
+    Composite efficiency score.
+    Higher is better: measures actual work produced (jobs + subagents + workers + verified comms)
+    relative to quota burned and uptime elapsed.
+    """
+    work_units = (jobs_done * 5.0) + (subagents_active * 3.0) + (tmux_workers * 4.0) + (calls_verified * 0.5)
+    burn_cost = max(1.0, (weekly_used_pct or 10) * 0.2)
+
+    # Base index
+    index = round(work_units / burn_cost, 2)
+
+    # Classify
+    if uptime_hours > 2.0 and subagents_active == 0 and tmux_workers == 0 and jobs_done == 0:
+        rating = "VANITY_IDLE"
+    elif index >= 3.0:
+        rating = "HIGH_EFFICIENCY"
+    elif index >= 1.0:
+        rating = "PRODUCTIVE"
+    elif index >= 0.4:
+        rating = "MODERATE"
+    else:
+        rating = "LOW_EFFICIENCY"
+
+    return index, rating
+
+
+def generate_preservation_advisory(
+    node: str,
+    weekly_used_pct: Optional[int],
+    extra_tokens_remaining: str,
+    subagents_active: int,
+    tmux_workers: int,
+    rating: str,
+) -> str:
+    """Generate prescriptive runtime preservation instructions for the agent."""
+    tips = []
+
+    pct = weekly_used_pct or 0
+    if pct >= 95 or "0 tokens left" in extra_tokens_remaining:
+        return "CRITICAL: Quota exhausted. Do NOT send chat messages. Salvage via 'box onboard start <new_node> --for %s'." % node
+
+    if pct >= 70:
+        tips.append("Quota > 70%%: Cease prose chatter; offload tasks to background tmux workers.")
+
+    if subagents_active == 0 and tmux_workers == 0:
+        tips.append("Spawn subagents with isolated context ('box subagent spawn') or tmux muse workers.")
+
+    if rating in ("VANITY_IDLE", "LOW_EFFICIENCY"):
+        tips.append("Uptime without worker execution drains quota. Mandate: split goals into executable jobs.")
+
+    if not tips:
+        tips.append("Runtime healthy. Maintain worker-first execution strategy.")
+
+    return " ".join(tips)
+
+
+def get_agent_kpi(node: str, usage_cache: Optional[Dict[str, Any]] = None) -> AgentKPI:
+    """Collect comprehensive KPI metrics for a single NetVM node."""
+    # 1. Quota & Usage
+    usage = usage_cache
+    if usage is None:
+        try:
+            try:
+                import invite
+            except ImportError:
+                sys.path.insert(0, str(BIN_DIR))
+                import invite
+            u = invite.get_usage(node)
+            if isinstance(u, dict) and u.get("ok"):
+                usage = u
+        except Exception:
+            pass
+    if usage is None:
+        usage = {}
+
+    weekly_pct = usage.get("weekly_used_pct")
+    extra_left = usage.get("additional_left") or usage.get("extra_tokens_remaining") or "Unknown"
+    is_blocked = bool(usage.get("is_blocked")) or (weekly_pct is not None and weekly_pct >= 100 and "0 tokens left" in extra_left)
+
+    # 2. Activity metrics
+    dm_metrics = get_agent_dm_metrics(node)
+    job_metrics = get_agent_job_metrics(node)
+    subagents = get_agent_subagent_count(node)
+    tmux_sessions = get_agent_tmux_workers(node)
+    uptime = get_agent_uptime_hours(node)
+
+    route_status = check_node_routes(node)
+
+    # 3. Efficiency
+    eff_idx, eff_rating = calculate_efficiency(
+        jobs_done=job_metrics["completed"],
+        subagents_active=subagents,
+        tmux_workers=len(tmux_sessions),
+        calls_verified=dm_metrics["verified"],
+        weekly_used_pct=weekly_pct,
+        uptime_hours=uptime,
+    )
+
+    # 4. Advisory
+    advisory = generate_preservation_advisory(
+        node=node,
+        weekly_used_pct=weekly_pct,
+        extra_tokens_remaining=extra_left,
+        subagents_active=subagents,
+        tmux_workers=len(tmux_sessions),
+        rating=eff_rating,
+    )
+
+    return AgentKPI(
+        node=node,
+        weekly_used_pct=weekly_pct,
+        extra_tokens_remaining=extra_left,
+        is_blocked=is_blocked,
+        calls_sent=dm_metrics["sent"],
+        calls_verified=dm_metrics["verified"],
+        jobs_assigned=job_metrics["assigned"],
+        jobs_completed=job_metrics["completed"],
+        subagents_active=subagents,
+        tmux_workers_active=len(tmux_sessions),
+        uptime_hours=uptime,
+        route_status=route_status,
+        efficiency_index=eff_idx,
+        efficiency_rating=eff_rating,
+        preservation_advisory=advisory,
+    )
+
+
+def fleet_kpi(nodes: Optional[List[str]] = None) -> Dict[str, AgentKPI]:
+    """Collect KPI metrics across all fleet agents."""
+    target_nodes = nodes or VALID_NODES
+
+    # Fetch usage in bulk
+    usage_map = {}
+    try:
+        import invite
+        raw_usage = invite.fleet_usage(target_nodes)
+        if isinstance(raw_usage, dict):
+            usage_map = raw_usage
+    except Exception:
+        pass
+
+    results = {}
+    for n in target_nodes:
+        results[n] = get_agent_kpi(n, usage_cache=usage_map.get(n))
+    return results
+
+
+def get_live_advisory_block(node: str) -> str:
+    """Generate Markdown prompt envelope block ready for job injection."""
+    kpi = get_agent_kpi(node)
+    quota_str = f"{kpi.weekly_used_pct}% weekly limit used" if kpi.weekly_used_pct is not None else "quota active"
+    tokens_str = kpi.extra_tokens_remaining
+
+    lines = [
+        "---- BOX PERFORMANCE & RUNTIME ADVISORY ----",
+        f"AGENT: @{kpi.node} | QUOTA: {quota_str} ({tokens_str}) | UPTIME: {kpi.uptime_hours}h",
+        f"WORK UNITS: {kpi.jobs_completed} jobs finished | {kpi.subagents_active} subagents | {kpi.tmux_workers_active} tmux workers",
+        f"EFFICIENCY: {kpi.efficiency_rating} (Index: {kpi.efficiency_index}) | ROUTES: {kpi.route_status}",
+        f"RUNTIME MANDATE: {kpi.preservation_advisory}",
+        "Offload long operations to subagents or tmux muse workers to maximize problem-fixing per token.",
+    ]
+    return "\n".join(lines)
+
+
+NODE_SIDECHATS = {
+    "646": "646 tasks",
+    "opm": "heartbeat",
+    "pip": "646-pip-coord",
+    "dev": "dev-coord",
+    "def": "def-coord",
+    "muse": "646-muse-coord",
+}
+
+
+def find_pending_work_for_node(node: str) -> Optional[Dict[str, Any]]:
+    """Find assigned pending job or swarm slot for an agent node."""
+    # 1. Look for node-specific auto-work jobs
+    if JOBS_DIR.exists():
+        candidates = sorted(list(JOBS_DIR.glob(f"auto-work-{node}-*.json")) + list(JOBS_DIR.glob(f"{node}-*.json")))
+        for c in candidates:
+            try:
+                with open(c, "r", encoding="utf-8") as f:
+                    data = json.load(f)
+                job_agent = data.get("agent")
+                if job_agent and job_agent != node:
+                    continue
+                job_name = c.stem
+                return {
+                    "type": "job",
+                    "name": job_name,
+                    "path": str(c),
+                    "cmd": f"{sys.executable} {BIN_DIR}/job-dispatch.py {job_name}",
+                }
+            except Exception:
+                continue
+
+    # 2. Check pending swarm slots
+    try:
+        from swarm_worker.poller import find_pending_slots
+        slots = find_pending_slots()
+        if slots:
+            slot = slots[0]
+            sw_id = slot.get("swarm_id", "swarm")
+            idx = slot.get("slot_index", 0)
+            return {
+                "type": "swarm",
+                "name": f"swarm-{sw_id}-s{idx}",
+                "path": None,
+                "cmd": f"{sys.executable} {BIN_DIR}/swarm_worker/daemon.py",
+            }
+    except Exception:
+        pass
+
+    return None
+
+
+def auto_spawn_workers(nodes: Optional[List[str]] = None, dry_run: bool = False) -> List[Dict[str, Any]]:
+    """Reconcile idle agents and auto-spawn background tmux workers to execute pending work."""
+    target_nodes = nodes or VALID_NODES
+    results = []
+
+    for node in target_nodes:
+        # Check active tmux workers for this node
+        active_tmux = len(get_agent_tmux_workers(node))
+        if active_tmux > 0:
+            results.append({
+                "node": node,
+                "action": "skip",
+                "reason": f"Active tmux worker already running ({active_tmux})",
+            })
+            continue
+
+        # Check work availability
+        work = find_pending_work_for_node(node)
+        if not work:
+            results.append({
+                "node": node,
+                "action": "idle",
+                "reason": "No pending jobs or swarm slots",
+            })
+            continue
+
+        session_label = f"worker-{work['name'][:18]}"
+        cmd_to_run = f"{work['cmd']} > /tmp/tmux-{node}-{session_label}.log 2>&1"
+
+        if dry_run:
+            results.append({
+                "node": node,
+                "action": "would_spawn",
+                "session": session_label,
+                "work_type": work["type"],
+                "work_name": work["name"],
+                "command": work["cmd"],
+            })
+            continue
+
+        # Execute spawn
+        spawn_res = spawn_tmux_worker(node, session_label, cmd_to_run)
+        if spawn_res.get("ok"):
+            # Send sidechat notification
+            try:
+                from invite_handler import send_loopback_notice
+                chat = NODE_SIDECHATS.get(node, "646 tasks")
+                msg = f"[BOX-AUTO-WORKER] Spawned background tmux worker '{session_label}' executing {work['type']} ({work['name']}). Logs at /tmp/tmux-{node}-{session_label}.log"
+                send_loopback_notice(recipient=node, target=chat, message=msg)
+            except Exception:
+                pass
+
+            results.append({
+                "node": node,
+                "action": "spawned",
+                "session": session_label,
+                "work_type": work["type"],
+                "work_name": work["name"],
+                "command": work["cmd"],
+            })
+        else:
+            results.append({
+                "node": node,
+                "action": "error",
+                "error": spawn_res.get("error", "Unknown spawn error"),
+            })
+
+    return results
+
+
+def spawn_tmux_worker(node: str, session: str, command: str) -> Dict[str, Any]:
+    """Spawn an autonomous tmux worker session on the agent's netns or shared socket."""
+    # Ensure session name is prefixed
+    clean_session = f"{node}-{session}" if not session.startswith(f"{node}-") else session
+
+    try:
+        from subagent_tracker import register_session
+    except ImportError:
+        sys.path.insert(0, str(BIN_DIR))
+        from subagent_tracker import register_session
+
+    muse_tmux = BIN_DIR / "muse-tmux.py"
+    if not muse_tmux.exists():
+        return {"ok": False, "error": "muse-tmux.py not found"}
+
+    # Execute via muse-tmux.py
+    cmd = [
+        sys.executable,
+        str(muse_tmux),
+        "new",
+        clean_session,
+        "--node",
+        node,
+        "--command",
+        command,
+    ]
+    res = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
+    if res.returncode != 0:
+        # Fallback to shared socket
+        cmd_shared = [
+            sys.executable,
+            str(muse_tmux),
+            "new",
+            clean_session,
+            "--command",
+            command,
+        ]
+        res = subprocess.run(cmd_shared, capture_output=True, text=True, timeout=10)
+        if res.returncode != 0:
+            return {"ok": False, "error": res.stderr.strip() or res.stdout.strip()}
+
+    # Register in subagent tracker
+    sid = f"tmux-{clean_session}-{int(time.time())}"
+    register_session(parent=node, session_id=sid, title=f"tmux-worker-{clean_session}", prompt=command)
+
+    return {
+        "ok": True,
+        "node": node,
+        "session": clean_session,
+        "session_id": sid,
+        "command": command,
+        "message": f"Spawned tmux worker '{clean_session}' for @{node}. Running in background.",
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="NetVM Fleet KPI, Spend Monitor & Runtime Preservation Engine")
+    subparsers = parser.add_subparsers(dest="command")
+
+    p_status = subparsers.add_parser("status", help="Show fleet KPI metrics table")
+    p_status.add_argument("--node", choices=VALID_NODES, help="Filter by node")
+    p_status.add_argument("--json", action="store_true", help="Emit JSON output")
+
+    p_report = subparsers.add_parser("report", help="Detailed KPI report for a specific node")
+    p_report.add_argument("node", choices=VALID_NODES, help="Target node")
+    p_report.add_argument("--json", action="store_true")
+
+    p_routes = subparsers.add_parser("routes", help="Verify network and CDP routes across nodes")
+    p_routes.add_argument("--json", action="store_true")
+
+    p_block = subparsers.add_parser("prompt-block", help="Generate live prompt envelope block for node")
+    p_block.add_argument("node", choices=VALID_NODES, help="Target node")
+
+    p_spawn = subparsers.add_parser("spawn-worker", help="Spawn autonomous background tmux worker session")
+    p_spawn.add_argument("node", choices=VALID_NODES, help="Agent node")
+    p_spawn.add_argument("session", help="Session label")
+    p_spawn.add_argument("worker_command", help="Command to execute inside worker")
+    p_autospawn = subparsers.add_parser("auto-spawn", help="Auto-spawn background tmux workers for idle nodes with pending work")
+    p_autospawn.add_argument("--node", choices=VALID_NODES, default=None, help="Filter by node")
+    p_autospawn.add_argument("--dry-run", action="store_true", help="Report what would be spawned without executing")
+    p_autospawn.add_argument("--json", action="store_true")
+
+    args = parser.parse_args()
+
+    if args.command in (None, "status"):
+        nodes = [args.node] if getattr(args, "node", None) else VALID_NODES
+        kpis = fleet_kpi(nodes)
+        if getattr(args, "json", False):
+            print(json.dumps({k: v.to_dict() for k, v in kpis.items()}, indent=2))
+            return
+
+        print("\n=== NETVM FLEET KPI & RUNTIME PRESERVATION DASHBOARD ===\n")
+        header = f"{'NODE':<6} {'QUOTA':<10} {'CALLS':<12} {'JOBS':<10} {'SUBAGENTS':<11} {'TMUX':<6} {'UPTIME':<8} {'ROUTE':<9} {'EFFICIENCY':<15}"
+        sep = f"{'────':<6} {'─────────':<10} {'───────────':<12} {'─────────':<10} {'──────────':<11} {'────':<6} {'──────':<8} {'───────':<9} {'──────────────':<15}"
+        print(header)
+        print(sep)
+        for n in nodes:
+            k = kpis.get(n)
+            if not k:
+                continue
+            q_str = f"{k.weekly_used_pct}%" if k.weekly_used_pct is not None else "Active"
+            c_str = f"{k.calls_sent} ({k.calls_verified}v)"
+            j_str = f"{k.jobs_completed}/{k.jobs_assigned}"
+            sub_str = str(k.subagents_active)
+            tmux_str = str(k.tmux_workers_active)
+            up_str = f"{k.uptime_hours}h"
+            print(f"{k.node:<6} {q_str:<10} {c_str:<12} {j_str:<10} {sub_str:<11} {tmux_str:<6} {up_str:<8} {k.route_status:<9} {k.efficiency_rating:<15}")
+        print("\nRun 'box kpi report <node>' for prescriptive runtime preservation advisories.\n")
+
+    elif args.command == "report":
+        kpi = get_agent_kpi(args.node)
+        if args.json:
+            print(json.dumps(kpi.to_dict(), indent=2))
+            return
+        print(f"\n=== KPI & RUNTIME REPORT: @{kpi.node.upper()} ===")
+        print(f"  Weekly Quota:       {kpi.weekly_used_pct}% used")
+        print(f"  Extra Tokens:       {kpi.extra_tokens_remaining}")
+        print(f"  Blocked Status:     {'YES (LIMIT REACHED)' if kpi.is_blocked else 'NO (HEALTHY)'}")
+        print(f"  Messages / Calls:   {kpi.calls_sent} sent ({kpi.calls_verified} verified delivered)")
+        print(f"  Jobs Dispatched:    {kpi.jobs_completed} completed / {kpi.jobs_assigned} assigned")
+        print(f"  Active Subagents:   {kpi.subagents_active}")
+        print(f"  Active Tmux Workers:{kpi.tmux_workers_active}")
+        print(f"  Process Uptime:     {kpi.uptime_hours} hours")
+        print(f"  Route Health:       {kpi.route_status}")
+        print(f"  Efficiency Index:   {kpi.efficiency_index} ({kpi.efficiency_rating})")
+        print(f"\n  [RUNTIME PRESERVATION ADVISORY]\n  {kpi.preservation_advisory}\n")
+
+    elif args.command == "routes":
+        routes = {n: check_node_routes(n) for n in VALID_NODES}
+        if args.json:
+            print(json.dumps(routes, indent=2))
+        else:
+            print("\n=== NETVM ROUTE HEALTH ===")
+            for n, st in routes.items():
+                print(f"  @{n:<6} : {st}")
+            print()
+
+    elif args.command == "prompt-block":
+        print(get_live_advisory_block(args.node))
+
+    elif args.command == "spawn-worker":
+        res = spawn_tmux_worker(args.node, args.session, args.worker_command)
+        if args.json:
+            print(json.dumps(res, indent=2))
+        else:
+            if res.get("ok"):
+                print(f"✔ {res.get('message')}")
+            else:
+                print(f"✘ Failed to spawn worker: {res.get('error')}", file=sys.stderr)
+                sys.exit(1)
+
+    elif args.command == "auto-spawn":
+        nodes = [args.node] if getattr(args, "node", None) else None
+        results = auto_spawn_workers(nodes=nodes, dry_run=args.dry_run)
+        if args.json:
+            print(json.dumps(results, indent=2))
+            return
+        print(f"\n=== AUTO-SPAWN WORKER RECONCILIATION {'(DRY-RUN)' if args.dry_run else ''} ===")
+        for r in results:
+            n = r.get("node")
+            act = r.get("action")
+            if act == "spawned":
+                print(f"  ✔ @{n:<5} : SPAWNED session '{r.get('session')}' ({r.get('work_type')}: {r.get('work_name')})")
+            elif act == "would_spawn":
+                print(f"  ? @{n:<5} : WOULD SPAWN session '{r.get('session')}' ({r.get('work_type')}: {r.get('work_name')})")
+            elif act == "skip":
+                print(f"  - @{n:<5} : SKIP ({r.get('reason')})")
+            elif act == "idle":
+                print(f"  - @{n:<5} : IDLE ({r.get('reason')})")
+            elif act == "error":
+                print(f"  ✘ @{n:<5} : ERROR ({r.get('error')})")
+        print()
+
+
+if __name__ == "__main__":
+    main()

bin/lookup

@@ -0,0 +1 @@
+/home/super/Projects/NetVM/bin/docs-lookup.py

bin/lookup_engine.py

@@ -0,0 +1,200 @@
+#!/usr/bin/env python3
+"""lookup_engine.py — Shared Zero-Downtime Hot-Reloading Pattern & Schema Engine.
+
+Provides authoritative runtime access to lookup_internal/ databases for
+daemons (response-harvester, self_main_loop, job-dispatch), CLI commands,
+and agents.
+
+Features:
+- Dynamic mtime-based zero-downtime hot reloading of compiled regex patterns.
+- Pre-flight soft validation of outbound agent sentences and work orders.
+- Direct helper functions for core protocol regexes (RESULT, VERB, TOOL, etc.).
+"""
+
+import json
+import os
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+NETVM_ROOT = Path(__file__).resolve().parent.parent
+LOOKUP_INTERNAL = NETVM_ROOT / "lookup_internal"
+if not LOOKUP_INTERNAL.exists() and (NETVM_ROOT / "docs_internal").exists():
+    LOOKUP_INTERNAL = NETVM_ROOT / "docs_internal"
+
+# In-memory cache structures with modification timestamps
+_CACHE_MTIMES: Dict[str, float] = {}
+_RAW_CACHE: Dict[str, Any] = {}
+_COMPILED_PATTERNS: Dict[str, re.Pattern] = {}
+
+# Fallback hardcoded regexes in case files are missing or unreadable
+_FALLBACK_RESULT_RE = re.compile(r"\[RESULT\s+([A-Za-z0-9_/-]+)\]\s*(.*?)(?=\[RESULT\s|\Z)", re.S)
+_FALLBACK_VERB_RE = re.compile(r"\[(ACK|CLAIM|RESULT|DECLINE|NO-ACTION)\s+([A-Za-z0-9_/-]+)\]")
+_FALLBACK_TOOL_RE = re.compile(r"\[(TOOL|EXEC|DM)\s+(?:([a-zA-Z0-9_.-]+)\s+)?(\{([^{}]|\{[^{}]*\})*\})\]", re.S)
+_FALLBACK_CONTRACT_FOOTER = (
+    "Reply: [ACK id] seen | [CLAIM id] mine | "
+    "[RESULT id] done | [DECLINE id] | [NO-ACTION id]."
+)
+
+
+def load_lookup_json(filename: str) -> Dict[str, Any]:
+    """Load JSON from lookup_internal/ with mtime-based caching."""
+    target_path = LOOKUP_INTERNAL / filename
+    if not target_path.is_file():
+        return {}
+
+    try:
+        current_mtime = os.path.getmtime(target_path)
+    except OSError:
+        return _RAW_CACHE.get(filename, {})
+
+    if filename in _RAW_CACHE and _CACHE_MTIMES.get(filename) == current_mtime:
+        return _RAW_CACHE[filename]
+
+    try:
+        with open(target_path, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        _RAW_CACHE[filename] = data
+        _CACHE_MTIMES[filename] = current_mtime
+        return data
+    except Exception as e:
+        print(f"[lookup_engine] Warning: Error reading {target_path}: {e}", file=sys.stderr)
+        return _RAW_CACHE.get(filename, {})
+
+
+def _refresh_compiled_patterns_if_needed():
+    """Checks regex_patterns.json mtime and recompiles if changed."""
+    global _COMPILED_PATTERNS
+    data = load_lookup_json("regex_patterns.json")
+    patterns_data = data.get("patterns", {})
+
+    target_path = LOOKUP_INTERNAL / "regex_patterns.json"
+    current_mtime = _CACHE_MTIMES.get("regex_patterns.json", 0.0)
+    compiled_mtime = _CACHE_MTIMES.get("_compiled_patterns_mtime", 0.0)
+
+    if current_mtime == compiled_mtime and _COMPILED_PATTERNS:
+        return
+
+    new_compiled = {}
+    for key, entry in patterns_data.items():
+        raw_pat = entry.get("pattern", "")
+        flag_names = entry.get("flags", [])
+        flags = 0
+        for fn in flag_names:
+            if hasattr(re, fn):
+                flags |= getattr(re, fn)
+        try:
+            new_compiled[key] = re.compile(raw_pat, flags)
+        except Exception as e:
+            print(f"[lookup_engine] Warning: Failed to compile pattern '{key}': {e}", file=sys.stderr)
+
+    _COMPILED_PATTERNS = new_compiled
+    _CACHE_MTIMES["_compiled_patterns_mtime"] = current_mtime
+
+
+def get_compiled_pattern(name: str) -> Optional[re.Pattern]:
+    """Retrieve a compiled pattern by name, hot-reloading if the database was modified."""
+    _refresh_compiled_patterns_if_needed()
+    return _COMPILED_PATTERNS.get(name)
+
+
+def get_all_compiled_patterns() -> Dict[str, re.Pattern]:
+    """Retrieve all compiled patterns with automatic hot-reloading."""
+    _refresh_compiled_patterns_if_needed()
+    return dict(_COMPILED_PATTERNS)
+
+
+def get_result_regex() -> re.Pattern:
+    """Return the canonical [RESULT ...] regex."""
+    p = get_compiled_pattern("result")
+    return p if p is not None else _FALLBACK_RESULT_RE
+
+
+def get_verb_regex() -> re.Pattern:
+    """Return the canonical [VERB ...] regex (ACK|CLAIM|RESULT|DECLINE|NO-ACTION)."""
+    p = get_compiled_pattern("verb")
+    return p if p is not None else _FALLBACK_VERB_RE
+
+
+def get_tool_regex() -> re.Pattern:
+    """Return the canonical [TOOL ...] regex."""
+    p = get_compiled_pattern("tool_call")
+    return p if p is not None else _FALLBACK_TOOL_RE
+
+
+def get_contract_footer() -> str:
+    """Return standard contract footer string."""
+    struct_data = load_lookup_json("sentence_structure.json")
+    cf = struct_data.get("structures", {}).get("contract_footer", {})
+    return cf.get("example") or _FALLBACK_CONTRACT_FOOTER
+
+
+def parse_agent_utterance(text: str) -> List[Dict[str, Any]]:
+    """Pass text through all registered patterns and extract matched tokens."""
+    _refresh_compiled_patterns_if_needed()
+    patterns_data = load_lookup_json("regex_patterns.json").get("patterns", {})
+    matches = []
+
+    for key, compiled in _COMPILED_PATTERNS.items():
+        m = compiled.search(text)
+        if m:
+            entry = patterns_data.get(key, {})
+            matches.append({
+                "pattern_key": key,
+                "pattern_name": entry.get("name", key),
+                "matched_text": m.group(0),
+                "named_groups": m.groupdict(),
+                "span": m.span()
+            })
+    return matches
+
+
+def validate_outbound_sentence(text: str) -> Tuple[bool, Optional[str], Optional[str]]:
+    """Pre-flight check for outbound messages sent via CLI.
+
+    Returns:
+        (is_valid, matched_kind, warning_or_hint)
+    """
+    cleaned = text.strip()
+    # If message starts with bracketed protocol marker
+    if cleaned.startswith("["):
+        marker = cleaned.split("]")[0] + "]"
+        upper_marker = marker.upper()
+
+        if upper_marker.startswith("[WO:") or upper_marker.startswith("[WORKORDER:"):
+            wo_pat = get_compiled_pattern("work_order")
+            if wo_pat and not wo_pat.search(cleaned):
+                hint = (
+                    "Notice: Message starts with a Work Order marker but does not match canonical structure.\n"
+                    "  Expected format: [WO:<id>] [from <sender>] <title> — <body>\n"
+                    "  Example: [WO:7fce46e0] [from super] Audit endpoints — Check GET /api/stats\n"
+                    "  Hint: Query 'box lookup sentence work_order' for full spec."
+                )
+                return False, "work_order", hint
+            return True, "work_order", None
+
+        if upper_marker.startswith("[ACK:") or upper_marker.startswith("[ACK "):
+            ack_pat = get_compiled_pattern("ack")
+            verb_pat = get_compiled_pattern("verb")
+            if (ack_pat and not ack_pat.search(cleaned)) and (verb_pat and not verb_pat.search(cleaned)):
+                hint = (
+                    "Notice: Message looks like an ACK but deviates from standard syntax.\n"
+                    "  Expected format: [ACK:<id>] [from <sender>] or [ACK <id>]\n"
+                    "  Example: [ACK:7fce46e0] [from 646]"
+                )
+                return False, "ack", hint
+            return True, "ack", None
+
+        if upper_marker.startswith("[RESULT"):
+            res_pat = get_result_regex()
+            if not res_pat.search(cleaned):
+                hint = (
+                    "Notice: Message starts with [RESULT] but deviates from standard syntax.\n"
+                    "  Expected format: [RESULT <job_id>] <status> <summary>\n"
+                    "  Example: [RESULT 7fce46e0] OK Task completed successfully"
+                )
+                return False, "result", hint
+            return True, "result", None
+
+    return True, "plain_message", None

bin/modulate.py

@@ -52,6 +52,7 @@ class InputType(str, Enum):
     MANUAL = "manual"      # human/operator-authored DM
     HEALTH = "health"      # system health check results
     HEARTBEAT = "heartbeat"  # loopback liveness probes
+    SALVAGE = "salvage"    # token exhaustion & onboarding work orders
 
 
 class Priority(str, Enum):
@@ -139,6 +140,11 @@ _MODULATION: Dict[Tuple[InputType, Optional[str]], Tuple] = {
     (InputType.HEALTH, "OK"):        (False,        Priority.ROUTINE,   0,        0, None),
     (InputType.HEALTH, None):        (True,         Priority.IMPORTANT, 1800,     2, "opm"),
 
+    # Salvage: token depletion & onboarding rescue.
+    (InputType.SALVAGE, "BLOCKED"):  (True,         Priority.CRITICAL,  600,      3, "opm"),
+    (InputType.SALVAGE, "LOW"):      (True,         Priority.IMPORTANT, 900,      2, "opm"),
+    (InputType.SALVAGE, None):       (True,         Priority.CRITICAL,  900,      2, "opm"),
+
     # Heartbeat loopback: NEVER tracked. Hard exclusion.
     (InputType.HEARTBEAT, None):     (False,        Priority.ROUTINE,   0,        0, None),
 }

bin/monitor.py

@@ -1,27 +1,76 @@
 #!/usr/bin/env python3
 """
-Side-chat to main-chat work siphon — monitor loop.
+Side-chat to main-chat siphon — monitor loop (INTEGRATED).
 
-Polls side chats for new messages, runs detection, siphons hits to main.
+Changes vs original (integrator):
+  1. Timestamp plumbing (agent 2's open item): message["ts"] is parsed to
+     epoch seconds and passed as message_ts to detect(), enabling the
+     15-minute stale-suppression for COMPLETED. Unparseable/missing ts →
+     backward-compatible (detect proceeds).
+  2. Author plumbing (agent 3 absent): message["author"] is attached to
+     the hit as hit.author, so relays attribute the real author instead
+     of the thread's registered agent.
+  3. Flood control (agent 4 absent): COMPLETED hits are routed to the
+     digest buffer instead of individual main-chat relays. ALERT, BLOCKER,
+     DECISION, MILESTONE still relay individually via siphon().
+  4. Persistent dedup: every processed hit is marked siphoned (including
+     digested ones) so a restart never re-relays or re-digests.
 
 This is the integration point for bl. In production:
   - list_sidechats() calls muse-chat-api.py or the sidechat manager
   - get_messages() reads thread messages via CDP
   - post_to_main() sends via muse-chat-api.py send to main chat
-
+  - flush_digest() should be called on a schedule (e.g. every 30 min) and
-For the prototype, all three are injectable (see tests).
+    its output posted to main chat once.
 """
 
 import time
-from typing import Callable, Dict, List
+from datetime import datetime, timezone
+from typing import Callable, Dict, List, Optional
 
 from detect import detect, is_opted_out
-from siphon import siphon, RateLimiter
+from siphon import siphon, mark_siphoned, already_siphoned, RateLimiter
+
+try:
+    from digest import get_buffer, flush_digest  # noqa: F401 (re-export)
+except ImportError:  # pragma: no cover — digest module optional
+    get_buffer = None
+
+    def flush_digest():
+        return None
 
 
 # Message shape: {"id": str, "text": str, "author": str, "ts": str}
 Message = Dict[str, str]
 
+# Categories that batch into the digest instead of relaying individually.
+DIGESTED_CATEGORIES = {"COMPLETED"}
+
+
+def _parse_ts(ts) -> Optional[float]:
+    """Parse a message timestamp to epoch seconds. None if unparseable."""
+    if ts is None:
+        return None
+    if isinstance(ts, (int, float)):
+        return float(ts)
+    s = str(ts).strip()
+    if not s:
+        return None
+    # Epoch as string?
+    try:
+        return float(s)
+    except ValueError:
+        pass
+    # ISO-8601 (with optional Z suffix)?
+    try:
+        iso = s.replace("Z", "+00:00")
+        dt = datetime.fromisoformat(iso)
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=timezone.utc)
+        return dt.timestamp()
+    except ValueError:
+        return None
+
 
 def monitor_once(
     list_sidechats: Callable[[], List[Dict[str, str]]],
@@ -41,6 +90,7 @@ def monitor_once(
     """
     lim = limiter or RateLimiter()
     new_marks = dict(watermarks)
+    digest = get_buffer() if get_buffer else None
 
     for chat in list_sidechats():
         tid = chat["id"]
@@ -64,8 +114,24 @@ def monitor_once(
             # Update watermark to newest seen
             new_marks[tid] = mid
 
-            hit = detect(text, tid, mid, min_confidence)
+            # Persistent dedup first: never reprocess a seen message,
-            if hit:
+            # even across restarts (marks are set for digested hits too).
+            if already_siphoned(mid):
+                continue
+
+            message_ts = _parse_ts(msg.get("ts"))
+            hit = detect(text, tid, mid, min_confidence,
+                         message_ts=message_ts)
+            if hit is None:
+                continue
+
+            # Author plumbing: real author, never thread-owner-as-author.
+            hit.author = msg.get("author", "") or ""
+
+            if hit.category in DIGESTED_CATEGORIES and digest is not None:
+                digest.add(hit)
+                mark_siphoned(mid)
+            else:
                 siphon(hit, agent, post_to_main, lim)
 
     return new_marks

bin/muse

@@ -16,20 +16,30 @@ VALID_ACCOUNTS=("muse" "pip" "646" "opm" "def" "dev")
 show_usage() {
     echo "Usage: muse <account> <command> [arguments...]"
     echo "       muse -a <account> <command> [arguments...]"
+    echo "       muse <global-command> [arguments...]"
     echo ""
     echo "Available accounts:"
     for acct in "${VALID_ACCOUNTS[@]}"; do
         echo "  • $acct"
     done
     echo ""
-    echo "Common commands:"
+    echo "Global lookups & tools:"
+    echo "  tui                     Interactive full-screen Muse TUI & Box fleet console"
+    echo "  tmux [args...]          Manage shared Muse tmux sessions (new, send, capture, ls, kill, prune)"
+    echo "  status                  Fleet overview & node vitality"
+    echo "  threads                 List registered threads and sidechats across fleet"
+    echo "  unread                  View unread counts across all agents"
+    echo "  lookup [subcommand]     Unified lookup (fleet, threads, unread, approvals, key)"
+    echo "  passkey (or key)        View passkey location (VM-only), PIN, & agent approval protocol"
+    echo ""
+    echo "Per-account commands:"
+    echo "  tui                     Launch interactive TUI for this account"
     echo "  chat [--thread <id>]    Launch interactive conversational shell / REPL"
-    echo "  tmux <cmd> [args...]    Manage shared Muse tmux sessions (new, send, capture, ls, kill)"
+    echo "  status                  Check account status, sessions, and unread"
-    echo "  status                  Check agent status, sessions, and unread"
+    echo "  threads                 List active threads and sidechats for account"
-    echo "  threads                 List active threads and sidechats"
     echo "  history --thread <id>   View message history"
     echo "  send --thread <id> msg  Send message to an agent"
-    echo "  unread                  View unread counts"
+    echo "  unread                  View unread counts for account"
     echo ""
     echo "Authentication & Cookie Management:"
     echo "  Cookies are isolated per-node in ~/.config/muse-cli/<account>/"
@@ -37,6 +47,44 @@ show_usage() {
     echo ""
 }
 
+# Direct top-level global actions that do not require an account
+if [[ $# -gt 0 ]]; then
+    case "$1" in
+        tui)
+            shift
+            exec python3 "$NETVM_BIN/muse-tui.py" --mode muse "$@"
+            ;;
+        tmux)
+            shift
+            exec python3 "$NETVM_BIN/muse-tmux.py" "$@"
+            ;;
+        passkey|key)
+            shift
+            exec python3 "$NETVM_BIN/super-cli.py" passkey "$@"
+            ;;
+        lookup|lookups)
+            shift
+            exec python3 "$NETVM_BIN/super-cli.py" lookup "$@"
+            ;;
+        fleet)
+            shift
+            exec python3 "$NETVM_BIN/super-cli.py" fleet "$@"
+            ;;
+        threads)
+            shift
+            exec python3 "$NETVM_BIN/super-cli.py" thread list "$@"
+            ;;
+        unread)
+            shift
+            exec python3 "$NETVM_BIN/super-cli.py" lookup unread "$@"
+            ;;
+        status)
+            shift
+            exec python3 "$NETVM_BIN/super-cli.py" fleet status "$@"
+            ;;
+    esac
+fi
+
 ACCOUNT=""
 POSITIONAL=()
 
@@ -101,6 +149,12 @@ if [[ ${#POSITIONAL[@]} -eq 0 ]]; then
     POSITIONAL=("status")
 fi
 
+# If subcommand is 'tui', launch interactive Muse TUI
+if [[ "${POSITIONAL[0]}" == "tui" ]]; then
+    shift_args=("${POSITIONAL[@]:1}")
+    exec python3 "$NETVM_BIN/muse-tui.py" --mode muse --account "$ACCOUNT" "${shift_args[@]}"
+fi
+
 # If subcommand is 'chat', launch interactive chat REPL
 if [[ "${POSITIONAL[0]}" == "chat" ]]; then
     shift_args=("${POSITIONAL[@]:1}")

bin/muse-chat-api.py

@@ -93,23 +93,29 @@ def get_page(node, cdp_url):
     return pages[0]
 
 def ev(ws, expr, await_p=False):
-    ws.send(json.dumps({
+    """Returns None (no traceback) if the CDP WebSocket drops.
-        "id": 1, "method": "Runtime.evaluate",
+    (Fix 2026-10-06: uncaught WebSocketConnectionClosedException.)"""
-        "params": {"expression": expr, "returnByValue": True, "awaitPromise": await_p}
+    try:
-    }))
+        ws.send(json.dumps({
-    # Drain CDP events until we get our command response (id 1).
+            "id": 1, "method": "Runtime.evaluate",
-    # The browser can emit events (Runtime.executionContextCreated, etc.)
+            "params": {"expression": expr, "returnByValue": True, "awaitPromise": await_p}
-    # at any time; taking the first recv() blindly returns None on a
+        }))
-    # busy page (observed as transient navigation failures in dm.py
+        # Drain CDP events until we get our command response (id 1).
-    # sidechat sends, 2026-10-04 — same class as the NO_SWITCHER fix
+        # The browser can emit events (Runtime.executionContextCreated, etc.)
-    # in box-chat-cdp.py commit 8d4bfa7).
+        # at any time; taking the first recv() blindly returns None on a
-    for _ in range(50):
+        # busy page (observed as transient navigation failures in dm.py
-        resp = json.loads(ws.recv())
+        # sidechat sends, 2026-10-04 — same class as the NO_SWITCHER fix
-        if resp.get("id") == 1:
+        # in box-chat-cdp.py commit 8d4bfa7).
-            break
+        for _ in range(50):
-    else:
+            resp = json.loads(ws.recv())
+            if resp.get("id") == 1:
+                break
+        else:
+            return None
+        return resp.get('result', {}).get('result', {}).get('value')
+    except Exception as e:
+        print(f"CDP evaluate failed: {type(e).__name__}: {e}", file=sys.stderr)
         return None
-    return resp.get('result', {}).get('result', {}).get('value')
 
 def check_approvals(ws):
     """
@@ -362,14 +368,64 @@ def cmd_messages(ws, n=5, width=200):
     # Exclude the compose box subtree: a failed send leaves the draft text
     # (including the [id:...] tag) in the composer, and scraping it would
     # produce a false "verified" (2026-10-04 dm.py false-confirmation bug).
-    result = ev1(ws, f"""(() => {{
+    # 2026-10-05: row-aware scrape. The message feed alternates sender-header
+    # rows (div.group/stacked-row, per-message timestamp in
+    # div.text-caption-1) and message units. Each unit is prefixed with its
+    # header's timestamp ([8:57 pm]) so sweeps can compute message age. The
+    # feed is the row-parent whose non-row children hold <p> elements (the
+    # sidebar shares the row classes). The feed hydrates async after
+    # navigation, so poll up to ~8s before falling back to the legacy
+    # paragraph scrape.
+    result = ev1(ws, f"""(async () => {{
       const composer = document.querySelector('[contenteditable="true"]') ||
                        document.querySelector('textarea[placeholder*="Message"]');
-      const ps = [...document.querySelectorAll('p')]
+      const noComposer = p => !(composer && composer.contains(p));
-        .filter(p => !(composer && composer.contains(p)))
+      const legacy = () => {{
-        .slice(-{n*2}).map(p=>p.innerText.slice(0,{width}));
+        const ps = [...document.querySelectorAll('p')]
-      return ps.join('\\n---\\n');
+          .filter(noComposer)
-    }})()""")
+          .slice(-{n*2}).map(p=>p.innerText.slice(0,{width}));
+        return ps.join('\\n---\\n');
+      }};
+      const ROWSEL = 'div[class*="group/stacked-row"]';
+      const findFeed = () => {{
+        const byParent = new Map();
+        for (const r of document.querySelectorAll(ROWSEL)) {{
+          const p = r.parentElement;
+          if (p) {{
+            if (!byParent.has(p)) byParent.set(p, []);
+            byParent.get(p).push(r);
+          }}
+        }}
+        for (const [p, rs] of byParent) {{
+          const hasMsg = [...p.children].some(c => rs.indexOf(c) === -1 &&
+            c.querySelectorAll('p').length > 0);
+          if (hasMsg) return [p, rs];
+        }}
+        return [null, null];
+      }};
+      let list = null, rows = null;
+      for (let i = 0; i < 16 && !list; i++) {{
+        [list, rows] = findFeed();
+        if (!list) await new Promise(r => setTimeout(r, 500));
+      }}
+      if (!list) return legacy();
+      let curTs = '';
+      const out = [];
+      for (const child of [...list.children]) {{
+        if (composer && child.contains(composer)) continue;
+        if (rows.indexOf(child) !== -1) {{
+          const t = child.querySelector('div.text-caption-1');
+          const txt = t ? t.innerText.trim() : '';
+          if (txt) curTs = txt;
+        }} else {{
+          const ps = [...child.querySelectorAll('p')].filter(noComposer)
+            .map(p=>p.innerText.slice(0,{width}));
+          if (ps.length) out.push((curTs ? '[' + curTs + '] ' : '') + ps.join('\\n'));
+        }}
+      }}
+      const res = out.slice(-{n}).join('\\n---\\n');
+      return res || legacy();
+    }})()""", True)
     print(result)
 
 def cmd_compose_check(ws):
@@ -398,20 +454,33 @@ def cmd_wait(ws, timeout=30):
 
 def cdp_navigate(ws, url, timeout_s=30):
     """Navigate via CDP Page.navigate (proper navigation, waits for commit).
-    Returns True if the page URL matches the target after navigation."""
+    Returns True if the page URL matches the target after navigation.
+    Returns False (no traceback) if the CDP WebSocket drops mid-call --
+    the caller retries on False. (Fix 2026-10-06: uncaught
+    WebSocketConnectionClosedException crashed dm.py sends as nav_failed.)"""
     import time as _time
-    ws.send(json.dumps({"id": 2, "method": "Page.navigate",
+    try:
-                        "params": {"url": url}}))
+        ws.send(json.dumps({"id": 2, "method": "Page.navigate",
-    # Drain until we get the Page.navigate response (id 2).
+                            "params": {"url": url}}))
-    for _ in range(50):
+        # Drain until we get the Page.navigate response (id 2).
-        resp = json.loads(ws.recv())
+        for _ in range(50):
-        if resp.get("id") == 2:
+            resp = json.loads(ws.recv())
-            break
+            if resp.get("id") == 2:
-    else:
+                break
+        else:
+            return False
+    except Exception as e:
+        # Browser CDP connection dropped (crash/restart/relay flake).
+        # Fail cleanly so dm.py logs nav_failed without a traceback.
+        print(f"CDP navigate failed: {type(e).__name__}: {e}", file=sys.stderr)
         return False
     # Wait for the URL to settle (SPA client-side routing).
     for _ in range(timeout_s):
-        cur = ev1(ws, "window.location.href", True)
+        try:
+            cur = ev1(ws, "window.location.href", True)
+        except Exception as e:
+            print(f"CDP read failed: {type(e).__name__}: {e}", file=sys.stderr)
+            return False
         if cur and url.rstrip("/").lower() in cur.lower():
             return True
         _time.sleep(1)
@@ -619,18 +688,24 @@ def ev1(ws, expr, await_p=False):
     """Runtime.evaluate that skips CDP event chatter while awaiting its
     response. ev() reads a single message and can catch an event
     instead (the known None-result quirk); uploads do several DOM
-    calls first, so chatter is likely."""
+    calls first, so chatter is likely.
-    ws.send(json.dumps({
+    Returns None (no traceback) if the CDP WebSocket drops.
-        "id": 1, "method": "Runtime.evaluate",
+    (Fix 2026-10-06: uncaught WebSocketConnectionClosedException.)"""
-        "params": {"expression": expr, "returnByValue": True,
+    try:
-                   "awaitPromise": await_p}
+        ws.send(json.dumps({
-    }))
+            "id": 1, "method": "Runtime.evaluate",
-    for _ in range(30):
+            "params": {"expression": expr, "returnByValue": True,
-        resp = json.loads(ws.recv())
+                       "awaitPromise": await_p}
-        if resp.get("id") != 1:
+        }))
-            continue
+        for _ in range(30):
-        return resp.get("result", {}).get("result", {}).get("value")
+            resp = json.loads(ws.recv())
-    return None
+            if resp.get("id") != 1:
+                continue
+            return resp.get("result", {}).get("result", {}).get("value")
+        return None
+    except Exception as e:
+        print(f"CDP evaluate failed: {type(e).__name__}: {e}", file=sys.stderr)
+        return None
 
 
 def cmd_url(ws):

bin/muse-cli-inner.py

@@ -1,5 +1,9 @@
 import os
 import sys
+import socket
+
+# Prevent unbounded socket hangs across Cloudflare WARP / remote API calls
+socket.setdefaulttimeout(15.0)
 
 node = sys.argv[1]
 conf_dir = os.path.expanduser(f"~/.config/muse-cli/{node}")

bin/muse-threads.py

@@ -131,12 +131,19 @@ def parse_threads_blob(blob):
 
 
 def normalize_thread(t):
+    is_main = (
+        t.get("thread") is False or
+        t.get("is_main") is True or
+        (t.get("title") and t.get("title").lower() in ("main chat", "main", "start conversation with muse"))
+    )
     return {
         "thread_id": t.get("session_id") or t.get("thread_id") or t.get("id"),
         "title": t.get("title"),
         "pinned": bool(t.get("pinned")),
         "archived": bool(t.get("archived")),
         "updated": t.get("updated"),
+        "thread": t.get("thread", True),
+        "is_main": is_main,
     }
 
 
@@ -146,7 +153,14 @@ def cmd_list(agent):
         code, error, detail, ec = map_failure(rc, err)
         fail(code, error, detail=detail, exit_code=ec)
     threads = [normalize_thread(t) for t in parse_threads_blob(out)]
-    print(json.dumps({"ok": True, "agent": agent, "threads": threads}))
+    mains = [t for t in threads if t.get("is_main")]
+    pinned = [t for t in threads if t.get("pinned") and not t.get("is_main")]
+    regular = [t for t in threads if not t.get("is_main") and not t.get("pinned")]
+    mains.sort(key=lambda t: t.get("updated") or "", reverse=True)
+    pinned.sort(key=lambda t: t.get("updated") or "", reverse=True)
+    regular.sort(key=lambda t: t.get("updated") or "", reverse=True)
+    sorted_threads = mains + pinned + regular
+    print(json.dumps({"ok": True, "agent": agent, "threads": sorted_threads}))
 
 
 def cmd_mutate(agent, op, thread_id, title=None):

bin/muse-tmux.py

@@ -6,6 +6,7 @@ Socket location: /tmp/tmux-muse.sock (shared across fleet agents & super).
 import sys
 import os
 import re
+import time
 import subprocess
 import argparse
 
@@ -181,6 +182,13 @@ def cmd_attach(args):
     session = args.session
     node = getattr(args, "node", None)
     container = getattr(args, "container", None)
+    
+    # Graceful non-interactive fallback for autonomous agents
+    if not sys.stdin.isatty():
+        sys.stderr.write(f"Notice: Non-interactive terminal (no tty). Capturing recent scrollback for '{session}':\n\n")
+        setattr(args, "lines", getattr(args, "lines", 30) or 30)
+        return cmd_capture(args)
+
     if node:
         cmd = ["/home/super/Projects/NetVM/bin/netvm-exec.sh", node, "--", TMUX_BIN, "-S", f"/tmp/tmux-{node}.sock", "attach", "-t", session]
         os.execv(cmd[0], cmd)

bin/muse_resume_pool.py

@@ -0,0 +1,545 @@
+#!/usr/bin/env python3
+"""muse_resume_pool: per-repo, profile-aware Muse Code resume pool.
+
+Why this exists
+---------------
+``muse resume`` scopes its picker by workspace but is blind to muse-auth
+profiles, and the TUI ``/resume`` reads session logs itself and lumps every
+workspace into one heap. A session resumed under a different credential
+than the one that created it fails server-side: the continuation is
+cryptographically bound to the creating account, so the server rejects the
+resume. This tool lists only the sessions that can actually resume here
+and now, and guards ``resume`` calls before they fail.
+
+Data sources (read-only, no secrets)
+------------------------------------
+- ``~/.local/share/muse/session-index.db`` ``sessions`` table (``mode=ro``).
+  Fallback when the index is missing: scan ``sessions/*/*/*/*/session.jsonl``
+  for ``runtime.session.metadata`` (workspace_root) and
+  ``session.name.changed`` (session_name) records, mirroring ``/resume``.
+- ``~/.config/muse/active_profile``, ``session_profiles.json``,
+  ``switch_history.jsonl``: profile *names* only. ``auth.json`` token bytes
+  are never read, logged, or compared.
+
+Profile resolution mirrors ``muse-auth``: cached ``session_profiles.json``
+mapping wins; otherwise the latest switch at or before session start; else
+the earliest switch; else the active profile as fallback. When the auth
+dir is unreadable (e.g. inside the Muse sandbox, which masks it), the
+profile is ``unknown`` and only proven mismatches are hidden/blocked.
+"""
+
+import argparse
+import glob
+import json
+import os
+import sqlite3
+import subprocess
+import sys
+
+INDEX_COLUMNS = (
+    "session_id",
+    "session_name",
+    "workspace_root",
+    "workspace_key",
+    "provider_id",
+    "model_id",
+    "git_branch",
+    "title",
+    "first_user_prompt",
+    "created_at_us",
+    "updated_at_us",
+    "prompt_count",
+    "status",
+)
+
+
+def default_paths():
+    home = os.path.expanduser("~")
+    data_home = os.environ.get("XDG_DATA_HOME", os.path.join(home, ".local", "share"))
+    return {
+        "index_db": os.path.join(data_home, "muse", "session-index.db"),
+        "sessions_dir": os.path.join(data_home, "muse", "sessions"),
+        "config_dir": os.path.expanduser("~/.config/muse"),
+    }
+
+
+def canonical_workspace(cwd=None):
+    """Repo root for the pool: git top-level, else real cwd."""
+    cwd = cwd or os.getcwd()
+    try:
+        out = subprocess.run(
+            ["git", "-C", cwd, "rev-parse", "--show-toplevel"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+            timeout=10,
+        )
+        if out.returncode == 0 and out.stdout.strip():
+            return os.path.realpath(out.stdout.strip())
+    except Exception:
+        pass
+    return os.path.realpath(cwd)
+
+
+def load_index_rows(index_db):
+    """Read session rows from the index (read-only). None if unavailable."""
+    if not os.path.exists(index_db):
+        return None
+    cols = ", ".join(INDEX_COLUMNS)
+    try:
+        uri = "file:{}?mode=ro".format(index_db.replace("?", "%3F"))
+        conn = sqlite3.connect(uri, uri=True, timeout=5)
+        try:
+            conn.row_factory = sqlite3.Row
+            cur = conn.execute(
+                "SELECT {} FROM sessions ORDER BY "
+                "updated_at_us DESC, created_at_us DESC, session_id ASC".format(cols)
+            )
+            return [dict(r) for r in cur.fetchall()]
+        finally:
+            conn.close()
+    except sqlite3.Error:
+        return None
+
+
+def _scan_log_for_session(session_log):
+    """Extract workspace/name/title from one session.jsonl (bounded read)."""
+    workspace = None
+    name = None
+    title = None
+    first_prompt = None
+    created_at_us = None
+    updated_at_us = None
+    prompt_count = 0
+    try:
+        with open(session_log, "r", errors="replace") as fh:
+            for line in fh:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    rec = json.loads(line)
+                except ValueError:
+                    continue
+                if "children" in rec:  # retained permission frame wrapper
+                    continue
+                rec_at = rec.get("recorded_at")
+                if isinstance(rec_at, int):
+                    if created_at_us is None:
+                        created_at_us = rec_at
+                    updated_at_us = rec_at
+                ptype = rec.get("payload_type", "")
+                payload = rec.get("payload", {}) if isinstance(rec.get("payload"), dict) else {}
+                if ptype == "runtime.session.metadata":
+                    record = payload.get("record", {})
+                    workspace = workspace or record.get("workspace_root")
+                elif ptype == "session.name.changed":
+                    if payload.get("new_name"):
+                        name = payload["new_name"]
+                elif ptype == "runtime.session":
+                    event = payload.get("event", {})
+                    if event.get("kind") == "started" and not first_prompt:
+                        prompt = event.get("prompt") or ""
+                        first_prompt = prompt[:200]
+                        title = title or prompt[:80]
+                        prompt_count += 1
+    except OSError:
+        return None
+    if workspace is None and name is None and created_at_us is None:
+        return None
+    session_id = os.path.basename(os.path.dirname(session_log))
+    return {
+        "session_id": session_id,
+        "session_name": name,
+        "workspace_root": workspace,
+        "workspace_key": workspace,
+        "provider_id": None,
+        "model_id": None,
+        "git_branch": None,
+        "title": title or "New session",
+        "first_user_prompt": first_prompt,
+        "created_at_us": created_at_us,
+        "updated_at_us": updated_at_us or created_at_us,
+        "prompt_count": prompt_count,
+        "status": "valid",
+    }
+
+
+def scan_session_logs(sessions_dir):
+    """Fallback pool source: scan top-level session.jsonl files directly."""
+    pattern = os.path.join(sessions_dir, "*", "*", "*", "*", "session.jsonl")
+    rows = []
+    for path in glob.glob(pattern):
+        row = _scan_log_for_session(path)
+        if row:
+            rows.append(row)
+    rows.sort(
+        key=lambda r: (
+            r.get("updated_at_us") or 0,
+            r.get("created_at_us") or 0,
+            r.get("session_id") or "",
+        ),
+        reverse=True,
+    )
+    return rows
+
+
+def load_auth_state(config_dir):
+    """Load profile names only. Never touches auth.json token bytes."""
+    state = {
+        "readable": False,
+        "active": None,
+        "session_profiles": {},
+        "switch_history": [],
+    }
+    if not os.path.isdir(config_dir):
+        return state
+    if not (os.access(config_dir, os.R_OK) and os.access(config_dir, os.X_OK)):
+        return state
+    state["readable"] = True
+    try:
+        with open(os.path.join(config_dir, "active_profile"), "r") as fh:
+            state["active"] = fh.read().strip() or None
+    except OSError:
+        pass
+    try:
+        with open(os.path.join(config_dir, "session_profiles.json"), "r") as fh:
+            data = json.load(fh)
+            if isinstance(data, dict):
+                state["session_profiles"] = {
+                    str(k): str(v) for k, v in data.items()
+                }
+    except (OSError, ValueError):
+        pass
+    try:
+        history = []
+        with open(os.path.join(config_dir, "switch_history.jsonl"), "r") as fh:
+            for line in fh:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    entry = json.loads(line)
+                except ValueError:
+                    continue
+                if entry.get("profile"):
+                    history.append(entry)
+        history.sort(key=lambda e: e.get("epoch", 0))
+        state["switch_history"] = history
+    except OSError:
+        pass
+    return state
+
+
+def resolve_profile(session_id, created_at_us, auth_state):
+    """Return (profile_or_None, source). Mirrors muse-auth resolution order."""
+    if not auth_state.get("readable"):
+        return None, "unknown"
+    cached = auth_state.get("session_profiles", {})
+    if session_id in cached:
+        return cached[session_id], "cached"
+    history = auth_state.get("switch_history", [])
+    start_epoch = (created_at_us / 1e6) if created_at_us else None
+    if history and start_epoch:
+        for switch in reversed(history):
+            if switch.get("epoch", 0) <= start_epoch:
+                return switch.get("profile"), "history"
+        return history[0].get("profile"), "history"
+    if auth_state.get("active"):
+        return auth_state["active"], "fallback"
+    return None, "unknown"
+
+
+def annotate_rows(rows, auth_state):
+    """Attach profile + source to each row (mutates and returns rows)."""
+    for row in rows:
+        profile, source = resolve_profile(
+            row.get("session_id"), row.get("created_at_us"), auth_state
+        )
+        row["auth_profile"] = profile
+        row["auth_source"] = source
+    return rows
+
+
+def pool_for_workspace(rows, workspace):
+    """Exact workspace_key match (workspace_root fallback), index order kept."""
+    pool = []
+    for row in rows:
+        key = row.get("workspace_key") or row.get("workspace_root")
+        if key and os.path.realpath(key) == workspace:
+            pool.append(row)
+    return pool
+
+
+def split_resumable(pool, active_profile):
+    """(resumable, blocked): only proven profile mismatches are blocked.
+
+    Unknown profiles (sandboxed auth dir, no mapping/history) stay resumable
+    but flagged, since blocking them would hide possibly valid sessions.
+    """
+    resumable, blocked = [], []
+    for row in pool:
+        profile = row.get("auth_profile")
+        if active_profile and profile and profile != active_profile:
+            blocked.append(row)
+        else:
+            resumable.append(row)
+    return resumable, blocked
+
+
+def resolve_ref(rows, ref):
+    """Resolve UUID / UUID prefix / session name. Returns (matches, kind)."""
+    ref = (ref or "").strip()
+    if not ref:
+        return [], "empty"
+    exact = [r for r in rows if r.get("session_id") == ref]
+    if exact:
+        return exact, "uuid"
+    named = [r for r in rows if (r.get("session_name") or "") == ref]
+    if named:
+        return named, "name"
+    if len(ref) >= 8:
+        prefixed = [
+            r for r in rows if (r.get("session_id") or "").startswith(ref)
+        ]
+        if prefixed:
+            return prefixed, "prefix"
+    return [], "none"
+
+
+def check_resume(rows, ref, workspace, auth_state):
+    """Guard decision for resuming ``ref`` from ``workspace``.
+
+    Returns dict(ok=bool, reason=str, detail=str, fix=str, row=row|None).
+    """
+    matches, kind = resolve_ref(rows, ref)
+    if kind == "empty" or not matches:
+        return {
+            "ok": False,
+            "reason": "unknown-session",
+            "detail": "No session matches '{}'.".format(ref),
+            "fix": "List this repo's pool: muse_resume_pool.py pool",
+            "row": None,
+        }
+    if len(matches) > 1:
+        ids = ", ".join(m["session_id"][:12] for m in matches[:5])
+        return {
+            "ok": False,
+            "reason": "ambiguous",
+            "detail": "'{}' matches {} sessions: {}".format(ref, len(matches), ids),
+            "fix": "Use a longer UUID prefix or the full session id.",
+            "row": None,
+        }
+    row = matches[0]
+    key = row.get("workspace_key") or row.get("workspace_root")
+    if not key or os.path.realpath(key) != workspace:
+        return {
+            "ok": False,
+            "reason": "wrong-workspace",
+            "detail": "Session '{}' belongs to workspace '{}', not '{}'.".format(
+                row.get("session_name") or row["session_id"][:12], key, workspace
+            ),
+            "fix": "cd '{}' first, or pick a session from this repo's pool.".format(key or "?"),
+            "row": row,
+        }
+    if row.get("status") and row["status"] != "valid":
+        return {
+            "ok": False,
+            "reason": "bad-status",
+            "detail": "Session '{}' has status '{}'.".format(
+                row.get("session_name") or row["session_id"][:12], row["status"]
+            ),
+            "fix": "Pick a session with status 'valid' from this repo's pool.",
+            "row": row,
+        }
+    active = auth_state.get("active")
+    profile = row.get("auth_profile")
+    if active and profile and profile != active:
+        return {
+            "ok": False,
+            "reason": "wrong-profile",
+            "detail": "Session '{}' was created under muse-auth profile '{}' "
+            "but the active profile is '{}'; the server would reject the "
+            "resume (continuation is bound to the creating credential).".format(
+                row.get("session_name") or row["session_id"][:12], profile, active
+            ),
+            "fix": "Run `muse-auth use {}` (outside the sandbox), then resume.".format(profile),
+            "row": row,
+        }
+    detail = "Session '{}' is resumable here.".format(
+        row.get("session_name") or row["session_id"][:12]
+    )
+    if not auth_state.get("readable"):
+        detail += " (Profile unverified: auth dir unreadable from this shell.)"
+    elif not profile:
+        detail += " (Profile unknown: no mapping or switch history.)"
+    return {
+        "ok": True,
+        "reason": "ok",
+        "detail": detail,
+        "fix": "",
+        "row": row,
+    }
+
+
+def load_rows(paths):
+    """Index first, log-scan fallback. Returns (rows, source)."""
+    rows = load_index_rows(paths["index_db"])
+    if rows is not None:
+        return rows, "index"
+    return scan_session_logs(paths["sessions_dir"]), "log-scan"
+
+
+def format_pool_table(resumable, blocked, show_all):
+    lines = []
+    header = "{:<18} {:<12} {:<10} {:<5} {}".format(
+        "NAME", "SESSION", "PROFILE", "MSGS", "TITLE"
+    )
+    lines.append(header)
+    for row in resumable:
+        flag = "?" if not row.get("auth_profile") else " "
+        lines.append(
+            "{:<18} {:<12} {:<10} {:<5} {}{}".format(
+                (row.get("session_name") or "-")[:18],
+                (row.get("session_id") or "")[:12],
+                (row.get("auth_profile") or "?")[:10],
+                row.get("prompt_count", 0),
+                flag,
+                (row.get("title") or "")[:60],
+            )
+        )
+    if show_all:
+        for row in blocked:
+            lines.append(
+                "{:<18} {:<12} {:<10} {:<5} {} [BLOCKED: profile mismatch]".format(
+                    (row.get("session_name") or "-")[:18],
+                    (row.get("session_id") or "")[:12],
+                    (row.get("auth_profile") or "?")[:10],
+                    row.get("prompt_count", 0),
+                    (row.get("title") or "")[:60],
+                )
+            )
+    elif blocked:
+        lines.append(
+            "({} session(s) hidden: wrong muse-auth profile; use --all to show)".format(
+                len(blocked)
+            )
+        )
+    return "\n".join(lines)
+
+
+def cmd_pool(args, paths):
+    workspace = os.path.realpath(args.workspace or canonical_workspace())
+    rows, source = load_rows(paths)
+    auth_state = load_auth_state(paths["config_dir"])
+    annotate_rows(rows, auth_state)
+    pool = pool_for_workspace(rows, workspace)
+    resumable, blocked = split_resumable(pool, auth_state.get("active"))
+    if args.json:
+        print(json.dumps({
+            "workspace": workspace,
+            "source": source,
+            "active_profile": auth_state.get("active"),
+            "auth_readable": auth_state.get("readable"),
+            "resumable": resumable,
+            "blocked": blocked if args.all else [],
+            "blocked_count": len(blocked),
+        }, indent=2, default=str))
+        return 0
+    print("workspace: {}  (source: {})".format(workspace, source))
+    if auth_state.get("readable"):
+        print("active profile: {}".format(auth_state.get("active") or "(none)"))
+    else:
+        print("active profile: ? (auth dir unreadable from this shell)")
+    if not pool:
+        print("No sessions for this workspace.")
+        return 0
+    print(format_pool_table(resumable, blocked, args.all))
+    return 0
+
+
+def cmd_check(args, paths):
+    workspace = os.path.realpath(args.workspace or canonical_workspace())
+    rows, _ = load_rows(paths)
+    auth_state = load_auth_state(paths["config_dir"])
+    annotate_rows(rows, auth_state)
+    decision = check_resume(rows, args.ref, workspace, auth_state)
+    if args.json:
+        row = dict(decision["row"]) if decision["row"] else None
+        print(json.dumps({
+            "ok": decision["ok"],
+            "reason": decision["reason"],
+            "detail": decision["detail"],
+            "fix": decision["fix"],
+            "row": row,
+        }, indent=2, default=str))
+    else:
+        status = "OK" if decision["ok"] else "BLOCKED ({})".format(decision["reason"])
+        print("{}: {}".format(status, decision["detail"]))
+        if decision["fix"]:
+            print("fix: {}".format(decision["fix"]))
+    return 0 if decision["ok"] else 1
+
+
+def cmd_resume(args, paths):
+    workspace = os.path.realpath(args.workspace or canonical_workspace())
+    rows, _ = load_rows(paths)
+    auth_state = load_auth_state(paths["config_dir"])
+    annotate_rows(rows, auth_state)
+    if args.ref == "--last":
+        pool = pool_for_workspace(rows, workspace)
+        resumable, _ = split_resumable(pool, auth_state.get("active"))
+        if not resumable:
+            print("No resumable sessions for this workspace.", file=sys.stderr)
+            return 1
+        session_id = resumable[0]["session_id"]
+    else:
+        decision = check_resume(rows, args.ref, workspace, auth_state)
+        if not decision["ok"]:
+            print("refusing to resume: {}".format(decision["detail"]), file=sys.stderr)
+            if decision["fix"]:
+                print("fix: {}".format(decision["fix"]), file=sys.stderr)
+            return 1
+        session_id = decision["row"]["session_id"]
+    cmd = ["muse-code", "resume", session_id]
+    if args.dry_run:
+        print("would exec: {}".format(" ".join(cmd)))
+        return 0
+    os.execvp(cmd[0], cmd)
+    return 0  # unreachable
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(
+        prog="muse_resume_pool",
+        description="Per-repo, profile-aware Muse Code resume pool and guard.",
+    )
+    parser.add_argument(
+        "--workspace",
+        help="Workspace root to scope to (default: git top-level or cwd).",
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_pool = sub.add_parser("pool", help="List sessions resumable here and now.")
+    p_pool.add_argument("--all", action="store_true",
+                        help="Also show profile-blocked sessions.")
+    p_pool.add_argument("--json", action="store_true", help="Machine-readable output.")
+    p_pool.set_defaults(func=cmd_pool)
+
+    p_check = sub.add_parser("check", help="Explain whether a resume would succeed.")
+    p_check.add_argument("ref", help="Session UUID, UUID prefix, or session name.")
+    p_check.add_argument("--json", action="store_true", help="Machine-readable output.")
+    p_check.set_defaults(func=cmd_check)
+
+    p_resume = sub.add_parser("resume", help="Guard then exec muse-code resume.")
+    p_resume.add_argument("ref", help="Session UUID, prefix, name, or --last.")
+    p_resume.add_argument("--dry-run", action="store_true",
+                          help="Print the resume command instead of exec'ing.")
+    p_resume.set_defaults(func=cmd_resume)
+
+    args = parser.parse_args(argv)
+    return args.func(args, default_paths())
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/muse_session_bind.py

@@ -0,0 +1,401 @@
+#!/usr/bin/env python3
+"""muse_session_bind.py — Per-session credential isolation (P3).
+
+Each muse session gets its own config root::
+
+    /tmp/muse-session-<pid>/muse/
+      <everything symlinked from the global config EXCEPT auth.json>
+      auth.json            <- COPY of the bound profile's credentials (0600)
+    /tmp/muse-session-<pid>/bind.json  <- {profile, pid, created, auth_src}
+
+``launch`` execs muse with XDG_CONFIG_HOME pointed at the session dir
+(the binary resolves its config root as $XDG_CONFIG_HOME/muse, else
+$HOME/.config/muse), so switching profiles never disturbs live
+sessions: the fleet-wide 400 outage class disappears by construction.
+Exec (not supervise) preserves the pane's ``muse-bin`` identity, so
+watcher coverage and ``box runtime`` keep working unchanged.
+
+Token refreshes land in the session copy. ``save``/``reap`` copy newer
+bytes back to the profile store (newest-wins across concurrent
+sessions sharing a profile; nothing is ever written to the legacy
+global auth.json). Dead sessions are reaped by scan, so kill -9 loses
+nothing but promptness.
+
+Companion to the peer's muse_resume_pool (which reads
+session_profiles.json): ``launch --session-id`` records the binding
+there for future resume guards.
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import shutil
+import sys
+import time
+from datetime import datetime, timezone
+
+SESSION_PREFIX = "muse-session-"
+BIND_FILENAME = "bind.json"
+AUTH_FILENAME = "auth.json"
+
+
+def default_config_src():
+    """Global config source (explicit env wins, else the real home)."""
+    return (os.environ.get("MUSE_CONFIG_SRC")
+            or os.path.join(os.path.expanduser("~"), ".config", "muse"))
+
+
+def session_dir_for(parent, pid):
+    return os.path.join(parent, "%s%d" % (SESSION_PREFIX, pid))
+
+
+def _now():
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _pid_alive(pid):
+    try:
+        os.kill(pid, 0)
+        return True
+    except Exception:
+        return False
+
+
+def _pid_is_muse(pid):
+    """True if pid's cmdline looks like a muse session (pid-reuse guard)."""
+    try:
+        with open("/proc/%d/cmdline" % pid, "rb") as f:
+            cmd = f.read().decode(errors="replace").lower()
+        return "muse-bin" in cmd or "muse-code" in cmd
+    except Exception:
+        return False
+
+
+def _fingerprint(path):
+    """Short sha256 of a credential file for logs (never the bytes)."""
+    try:
+        h = hashlib.sha256()
+        with open(path, "rb") as f:
+            h.update(f.read())
+        return h.hexdigest()[:12]
+    except OSError:
+        return "missing"
+
+
+def _write_private_bytes(path, data):
+    """Write bytes with 0600 perms, atomically. Returns True on success."""
+    try:
+        tmp = "%s.tmp.%d" % (path, os.getpid())
+        fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        try:
+            os.write(fd, data)
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.replace(tmp, path)
+        return True
+    except OSError:
+        return False
+
+
+def profile_auth_path(config_src, profile):
+    return os.path.join(config_src, "accounts", profile, AUTH_FILENAME)
+
+
+def read_bind(sessdir):
+    try:
+        with open(os.path.join(sessdir, BIND_FILENAME)) as f:
+            data = json.load(f)
+        return data if isinstance(data, dict) else None
+    except (OSError, ValueError):
+        return None
+
+
+def session_liveness(sessdir):
+    """live | dead | unknown (no/invalid bind record: never reap)."""
+    bind = read_bind(sessdir)
+    if not bind or not isinstance(bind.get("pid"), int):
+        return "unknown"
+    pid = bind["pid"]
+    if _pid_alive(pid) and _pid_is_muse(pid):
+        return "live"
+    return "dead"
+
+
+def list_bound(parent="/tmp"):
+    """Session dirs carrying our bind record (foreign dirs ignored)."""
+    out = []
+    try:
+        names = sorted(os.listdir(parent))
+    except OSError:
+        return out
+    for name in names:
+        if not name.startswith(SESSION_PREFIX):
+            continue
+        sessdir = os.path.join(parent, name)
+        if not os.path.isdir(sessdir):
+            continue
+        if read_bind(sessdir) is None:
+            continue
+        out.append(sessdir)
+    return out
+
+
+def build_session_dir(parent, pid, config_src, auth_src, profile):
+    """Create the isolated config root. Returns sessdir.
+
+    Raises RuntimeError when the slot is held by a live session, or
+    OSError/ValueError for missing sources.
+    """
+    auth_src = os.path.realpath(auth_src)
+    if not os.path.isfile(auth_src):
+        raise ValueError("no credentials at %s" % auth_src)
+    if not os.path.isdir(config_src):
+        raise ValueError("no config source at %s" % config_src)
+    sessdir = session_dir_for(parent, pid)
+    cfgdir = os.path.join(sessdir, "muse")
+    if os.path.exists(sessdir):
+        if session_liveness(sessdir) == "live":
+            raise RuntimeError("session slot %s is live" % sessdir)
+        shutil.rmtree(sessdir, ignore_errors=True)
+    os.makedirs(cfgdir)
+    for entry in sorted(os.listdir(config_src)):
+        if entry == AUTH_FILENAME:
+            continue
+        target = os.path.join(config_src, entry)
+        try:
+            os.symlink(target, os.path.join(cfgdir, entry))
+        except OSError:
+            pass
+    with open(auth_src, "rb") as f:
+        creds = f.read()
+    if not _write_private_bytes(os.path.join(cfgdir, AUTH_FILENAME), creds):
+        raise OSError("cannot plant auth.json in %s" % cfgdir)
+    with open(os.path.join(sessdir, BIND_FILENAME), "w") as f:
+        json.dump({"profile": profile, "pid": pid,
+                   "created": _now(), "auth_src": auth_src}, f, indent=1)
+    return sessdir
+
+
+def record_session_profile(config_src, session_id, profile):
+    """Note session->profile for resume guards. Returns True on success."""
+    path = os.path.join(config_src, "session_profiles.json")
+    try:
+        with open(path) as f:
+            data = json.load(f)
+        if not isinstance(data, dict):
+            data = {}
+    except (OSError, ValueError):
+        data = {}
+    data[str(session_id)] = str(profile)
+    try:
+        tmp = "%s.tmp.%d" % (path, os.getpid())
+        with open(tmp, "w") as f:
+            json.dump(data, f, indent=1)
+        os.replace(tmp, path)
+        return True
+    except OSError:
+        return False
+
+
+def save_session(sessdir, config_src=None):
+    """Sync a session copy back to its profile when newer.
+
+    Returns {"status", ...}; statuses: synced | skipped-stale |
+    skipped-missing | no-bind. Never raises, never logs token bytes.
+    """
+    config_src = config_src or default_config_src()
+    bind = read_bind(sessdir)
+    if not bind or not bind.get("profile"):
+        return {"status": "no-bind", "sessdir": sessdir}
+    profile = bind["profile"]
+    sess_auth = os.path.join(sessdir, "muse", AUTH_FILENAME)
+    dest = os.path.realpath(profile_auth_path(config_src, profile))
+    if not os.path.isfile(sess_auth):
+        return {"status": "skipped-missing", "sessdir": sessdir,
+                "profile": profile}
+    try:
+        sess_mtime = os.path.getmtime(sess_auth)
+    except OSError:
+        return {"status": "skipped-missing", "sessdir": sessdir,
+                "profile": profile}
+    try:
+        dest_mtime = os.path.getmtime(dest)
+    except OSError:
+        dest_mtime = -1
+    if dest_mtime >= sess_mtime:
+        return {"status": "skipped-stale", "sessdir": sessdir,
+                "profile": profile, "session_fp": _fingerprint(sess_auth),
+                "profile_fp": _fingerprint(dest)}
+    try:
+        with open(sess_auth, "rb") as f:
+            creds = f.read()
+    except OSError:
+        return {"status": "skipped-missing", "sessdir": sessdir,
+                "profile": profile}
+    try:
+        os.makedirs(os.path.dirname(dest), exist_ok=True)
+    except OSError:
+        pass
+    if not _write_private_bytes(dest, creds):
+        return {"status": "error", "sessdir": sessdir, "profile": profile}
+    return {"status": "synced", "sessdir": sessdir, "profile": profile,
+            "session_fp": _fingerprint(sess_auth),
+            "profile_fp": _fingerprint(dest)}
+
+
+def reap(parent="/tmp", config_src=None):
+    """Sync + remove dead bound sessions. Returns {"reaped", "live"}."""
+    config_src = config_src or default_config_src()
+    reaped, live = [], []
+    for sessdir in list_bound(parent):
+        if session_liveness(sessdir) == "live":
+            live.append(sessdir)
+            continue
+        res = save_session(sessdir, config_src)
+        shutil.rmtree(sessdir, ignore_errors=True)
+        reaped.append({"sessdir": sessdir, "save": res["status"],
+                       "profile": res.get("profile")})
+    return {"reaped": reaped, "live": live}
+
+
+def launch(profile=None, auth_file=None, session_id=None, config_src=None,
+           cmd=None, parent="/tmp", dry_run=False, _exec=os.execvpe):
+    """Bind then exec. With dry_run, return the plan without exec'ing."""
+    config_src = config_src or default_config_src()
+    if auth_file:
+        auth_src = os.path.realpath(auth_file)
+    elif profile:
+        auth_src = profile_auth_path(config_src, profile)
+    else:
+        raise ValueError("need --profile or --auth-file")
+    if not os.path.isfile(auth_src):
+        raise ValueError("no credentials at %s" % auth_src)
+    pid = os.getpid()
+    if dry_run:
+        return {"sessdir": session_dir_for(parent, pid),
+                "xdg_config_home": session_dir_for(parent, pid),
+                "profile": profile, "auth_src": auth_src,
+                "cmd": cmd or []}
+    # Reap BEFORE building: our own fresh dir would read as dead (the
+    # launcher is python, not muse, until it execs) and eat itself.
+    reap(parent=parent, config_src=config_src)
+    sessdir = build_session_dir(parent, pid, config_src, auth_src,
+                                profile or "explicit")
+    if session_id:
+        record_session_profile(config_src, session_id,
+                               profile or "explicit")
+    env = dict(os.environ)
+    env["XDG_CONFIG_HOME"] = sessdir
+    env["MUSE_SESSION_BIND_DIR"] = sessdir
+    _exec(cmd[0], cmd, env)
+    return None  # unreachable; exec replaces the image
+
+
+def cmd_status(args):
+    config_src = args.config_src or default_config_src()
+    rows = []
+    for sessdir in list_bound(args.parent):
+        bind = read_bind(sessdir) or {}
+        sess_auth = os.path.join(sessdir, "muse", AUTH_FILENAME)
+        prof_auth = profile_auth_path(config_src, bind.get("profile", ""))
+        rows.append({"sessdir": sessdir, "profile": bind.get("profile"),
+                     "pid": bind.get("pid"),
+                     "liveness": session_liveness(sessdir),
+                     "session_fp": _fingerprint(sess_auth),
+                     "profile_fp": _fingerprint(prof_auth)})
+    if args.json:
+        print(json.dumps({"sessions": rows}, indent=1))
+    else:
+        if not rows:
+            print("No bound sessions under %s." % args.parent)
+            return 0
+        for r in rows:
+            print("%s profile=%s pid=%s %s session=%s profile=%s" % (
+                r["sessdir"], r["profile"], r["pid"], r["liveness"],
+                r["session_fp"], r["profile_fp"]))
+    return 0
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(
+        prog="muse_session_bind",
+        description="Per-session credential isolation for muse.")
+    ap.add_argument("--parent", default="/tmp",
+                    help="Session dir parent (default /tmp).")
+    ap.add_argument("--config-src", default=None,
+                    help="Global config source (default ~/.config/muse).")
+    sub = ap.add_subparsers(dest="command", required=True)
+
+    p_l = sub.add_parser("launch", help="Bind a profile, then exec muse.")
+    p_l.add_argument("--profile", default=None)
+    p_l.add_argument("--auth-file", default=None)
+    p_l.add_argument("--session-id", default=None)
+    p_l.add_argument("--dry-run", action="store_true")
+    p_l.add_argument("cmd", nargs=argparse.REMAINDER,
+                     help="Command after --, e.g. -- muse-code")
+
+    p_s = sub.add_parser("save", help="Sync session tokens back to profile.")
+    g = p_s.add_mutually_exclusive_group(required=True)
+    g.add_argument("--pid", type=int)
+    g.add_argument("--dir")
+    g.add_argument("--all", action="store_true")
+    p_s.add_argument("--json", action="store_true")
+
+    p_r = sub.add_parser("reap", help="Sync + remove dead sessions.")
+    p_r.add_argument("--json", action="store_true")
+
+    p_st = sub.add_parser("status", help="List bound sessions.")
+    p_st.add_argument("--json", action="store_true")
+
+    args = ap.parse_args(argv)
+    config_src = args.config_src or default_config_src()
+    if args.command == "launch":
+        cmd = [c for c in args.cmd if c != "--"]
+        if not cmd and not args.dry_run:
+            print("launch needs a command: launch ... -- muse-code [...]",
+                  file=sys.stderr)
+            return 2
+        try:
+            plan = launch(profile=args.profile, auth_file=args.auth_file,
+                          session_id=args.session_id, config_src=config_src,
+                          cmd=cmd, parent=args.parent,
+                          dry_run=args.dry_run)
+        except (ValueError, RuntimeError, OSError) as e:
+            print("launch refused: %s" % (e,), file=sys.stderr)
+            return 1
+        if args.dry_run:
+            print(json.dumps(plan, indent=1))
+        return 0
+    if args.command == "save":
+        if args.pid is not None:
+            targets = [session_dir_for(args.parent, args.pid)]
+        elif args.dir:
+            targets = [args.dir]
+        else:
+            targets = list_bound(args.parent)
+        results = [save_session(t, config_src) for t in targets]
+        if args.json:
+            print(json.dumps({"saved": results}, indent=1))
+        else:
+            for r in results:
+                print("%s: %s" % (r["sessdir"], r["status"]))
+        return 0
+    if args.command == "reap":
+        res = reap(parent=args.parent, config_src=config_src)
+        if args.json:
+            print(json.dumps(res, indent=1))
+        else:
+            for r in res["reaped"]:
+                print("reaped %s (%s)" % (r["sessdir"], r["save"]))
+            if not res["reaped"]:
+                print("Nothing to reap.")
+        return 0
+    if args.command == "status":
+        return cmd_status(args)
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/muse_tui.py

@@ -0,0 +1 @@
+muse-tui.py

bin/netvm-enter-inner.sh

@@ -4,8 +4,13 @@ set -euo pipefail
 # /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
 # in the netns). Replace with a real file (private mount ns) so bwrap
 # children see the fix too: bwrap's --ro-bind /etc is non-recursive and
-# cannot bind over a dangling symlink.
+mount --make-rprivate / 2>/dev/null || true
-rm -f /etc/resolv.conf
+if [ -L /etc/resolv.conf ] || ! cmp -s "$NETVM_RESOLV" /etc/resolv.conf 2>/dev/null; then
-cp "$NETVM_RESOLV" /etc/resolv.conf
+  TMP="/etc/resolv.conf.netvm.$$"
+  if cp -f "$NETVM_RESOLV" "$TMP" 2>/dev/null; then
+    mv -f "$TMP" /etc/resolv.conf 2>/dev/null || rm -f "$TMP" 2>/dev/null || true
+  fi
+fi
+
 exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
   env HOME="$NETVM_HOME" "$@"

bin/netvm-enter.sh

@@ -12,4 +12,5 @@ RESOLV=/etc/netvm/resolv-warp.conf
 [ -f "$RESOLV" ] || echo "nameserver 1.1.1.1" > "$RESOLV"
 ip netns exec "$NETNS" env \
   NETVM_RESOLV="$RESOLV" NETVM_UID="$TUID" NETVM_GID="$TGID" NETVM_HOME="$THOME" \
-  unshare --mount "$SCRIPT_DIR/netvm-enter-inner.sh" "$@"
+  unshare --mount --propagation private "$SCRIPT_DIR/netvm-enter-inner.sh" "$@"
+

bin/netvm-exec.sh

@@ -9,5 +9,5 @@ NODE="${1:?usage: netvm-exec.sh <node> -- <cmd> [args...]}"; shift
 [ "${1:-}" = "--" ] && shift
 [ $# -gt 0 ] || { echo "usage: netvm-exec.sh <node> -- <cmd> [args...]"; exit 1; }
 [ -f "/etc/netvm/${NODE}.conf" ] || { echo "no warp identity for '$NODE' (human: netvm-new-identity.sh $NODE)"; exit 1; }
-ip netns list 2>/dev/null | grep -q "^warp-${NODE}" || { echo "node '$NODE' is not up (netvm-node-up.sh $NODE)"; exit 1; }
+[ "$(ip netns list 2>/dev/null | grep -c "^warp-${NODE}")" -ge 1 ] || { echo "node '$NODE' is not up (netvm-node-up.sh $NODE)"; exit 1; }
 exec sudo -n "$NETVM_BIN/netvm-enter.sh" "$NODE" "$(id -u)" "$(id -g)" "$HOME" -- "$@"

bin/netvm-node-up.sh

@@ -58,6 +58,14 @@ rm -f "$STRIPPED"
 PEER_PK=$(grep -oP '^\s*PublicKey\s*=\s*\K\S+' "$CONF" | head -1)
 if [ -n "$PEER_PK" ]; then
   nsexec wg set "$WG" peer "$PEER_PK" persistent-keepalive 25 2>/dev/null || true
+  # Prefer IPv4 peer endpoint: wg setconf may resolve the Endpoint hostname to
+  # IPv6, whose handshake then routes into the tunnel itself (no bypass route
+  # exists for it) and never completes. Observed 2026-10-06 on def.
+  EPV4=$(getent ahostsv4 "$ENDPOINT" | awk '{print $1}' | sort -u | head -1)
+  EPPORT=$(grep -oP '^\s*Endpoint\s*=\s*[^:;#]+:\K[0-9]+' "$CONF" | head -1)
+  if [ -n "$EPV4" ]; then
+    nsexec wg set "$WG" peer "$PEER_PK" endpoint "${EPV4}:${EPPORT:-2408}" 2>/dev/null || true
+  fi
 fi
 MTU=$(grep -oP '^\s*MTU\s*=\s*\K\d+' "$CONF" | head -1); MTU=${MTU:-1280}
 nsexec ip link set "$WG" mtu "$MTU"
@@ -104,3 +112,8 @@ else
   EGRESS=$(nsexec curl -sk --max-time 15 'https://1.1.1.1/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
 fi
 echo "node=$NODE netns=$NETNS ifaces=$WG/$VETH egress=${EGRESS:-unknown}"
+
+# Feed the watchdogs: registry row + chromebox timer (non-fatal — the
+# node is up regardless, and supervision heals on the next run).
+"$SCRIPT_DIR/ensure-node-supervision.sh" "$NODE" \
+  || echo "supervision ensure failed for $NODE (non-fatal)" >&2

bin/netvm-topology.sh

@@ -15,11 +15,13 @@ iptables -t nat -L POSTROUTING -n 2>/dev/null | grep '10.201\.' || echo "(no net
 echo "--- CDP relays (connectivity check; pidfile is secondary) ---"
 for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
   netvm_names "${ns#warp-}"
-  # Registry-pinned CDP ports (same mapping as cdp-relay-watchdog.sh).
+  # Registry-pinned CDP ports (same mapping as netvm-names.sh).
-  # NOTE: $CDP_PORT from netvm_names() is hash-derived and WRONG here unless
+  # NOTE: keep this case in sync with the pinned mapping — the "*" fallback
-  # CDP_PORT_OVERRIDE was set at provision time — the pinned mapping is truth.
+  # trusts $CDP_PORT from netvm_names(), which is pinned for registry nodes
+  # and hash-derived otherwise.
   case "$NODE" in
     muse) port=9410 ;; pip) port=9420 ;; 646) port=9430 ;; opm) port=9440 ;;
+    def) port=9450 ;; dev) port=9455 ;;
     *) port="$CDP_PORT" ;;
   esac
   target="$PEER_IP:$port"

bin/onboard_pipeline.py

@@ -0,0 +1,587 @@
+#!/usr/bin/env python3
+"""onboard_pipeline.py — End-to-end agent-driven onboarding & invite salvage pipeline.
+
+Orchestrates the complete lifecycle:
+  1. Identifies the most urgent beneficiary agent in need of tokens (blocked first, then lowest balance).
+  2. Provisions infrastructure (WireGuard, dedicated netns, CDP port, chrome-box profile).
+  3. Launches authentication via cred_client / onboard-driver.
+  4. Waits for / accepts OTP code.
+  5. Checks age verification gate (Tailscale portal / Instagram link).
+  6. Automatically redeems the urgent agent's invite code on the newly onboarded node.
+  7. Injects operational DRIVE and marks the node active.
+  8. Can dispatch cryptographically signed work orders ([WO]) to prompting sidechats.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import subprocess
+import sys
+import time
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+BIN_DIR = REPO_ROOT / "bin"
+sys.path.insert(0, str(BIN_DIR))
+
+try:
+    import invite
+    from cred_client import CredClient
+    from settings_rpa import SettingsRPA
+except ImportError:
+    pass
+
+STAGE_INFRA = "infra_provisioned"
+STAGE_INITIATE = "auth_initiated"
+STAGE_AWAIT_OTP = "awaiting_otp"
+STAGE_AUTH_ACTIVE = "auth_active"
+STAGE_REDEEMED = "invite_redeemed"
+STAGE_DRIVE_INJECTED = "drive_injected"
+STAGE_COMPLETED = "completed"
+
+STATE_DIR = Path(os.environ.get("NETVM_ONBOARD_STATE", "/tmp/netvm-onboard"))
+
+
+@dataclass
+class OnboardState:
+    node: str
+    email: str
+    beneficiary_node: Optional[str]
+    invite_code: Optional[str]
+    stage: str
+    cdp_port: Optional[int] = None
+    created_at: float = 0.0
+    updated_at: float = 0.0
+    detail: Optional[str] = None
+    redemption_result: Optional[Dict[str, Any]] = None
+
+    def save(self) -> None:
+        STATE_DIR.mkdir(parents=True, exist_ok=True)
+        path = STATE_DIR / f"{self.node}.json"
+        self.updated_at = time.time()
+        with open(path, "w") as f:
+            json.dump(asdict(self), f, indent=2)
+
+    @classmethod
+    def load(cls, node: str) -> Optional[OnboardState]:
+        path = STATE_DIR / f"{node}.json"
+        if not path.exists():
+            return None
+        try:
+            with open(path) as f:
+                data = json.load(f)
+            return cls(**data)
+        except Exception:
+            return None
+
+
+# Canonical agent operational roles in NetVM
+AGENT_ROLES: Dict[str, str] = {
+    "646": "Production Lead / Swarm Execution",
+    "opm": "Fleet Coordinator / Loop Orchestrator",
+    "pip": "Production Agent / Pipeline Worker",
+    "muse": "Core Engine / Auditor & Dev",
+    "dev": "Development / Test & Staging",
+    "def": "Defense / Security & Standby",
+}
+
+# Base role priority multiplier
+ROLE_WEIGHT_MULTIPLIER: Dict[str, float] = {
+    "646": 1.5,   # Critical production executor
+    "opm": 1.4,   # Central coordinator & orchestrator
+    "pip": 1.2,   # High volume production worker
+    "muse": 1.1,  # Auditor & core engine
+    "dev": 0.8,   # Test & staging
+    "def": 0.7,   # Defense & standby
+}
+
+
+def get_agent_metrics() -> Tuple[Dict[str, int], Dict[str, int]]:
+    """Count job assignments and cumulative chat activity (work done over time) per agent."""
+    from collections import Counter
+    job_counts = Counter()
+    jobs_dir = REPO_ROOT / "jobs"
+    if jobs_dir.exists():
+        for p in jobs_dir.glob("*.json"):
+            try:
+                d = json.loads(p.read_text(encoding="utf-8"))
+                a = d.get("target_agent") or d.get("agent")
+                if a:
+                    job_counts[a] += 1
+            except Exception:
+                pass
+
+    msg_counts = Counter()
+    chat_log = REPO_ROOT / "logs" / "chat-history.jsonl"
+    if chat_log.exists():
+        try:
+            with open(chat_log, encoding="utf-8") as f:
+                for line in f:
+                    try:
+                        row = json.loads(line)
+                        s = row.get("sender") or row.get("from") or row.get("agent")
+                        if s:
+                            msg_counts[s] += 1
+                    except Exception:
+                        pass
+        except Exception:
+            pass
+
+    return dict(job_counts), dict(msg_counts)
+
+
+def calculate_feeding_weights(nodes: Optional[List[str]] = None) -> List[Dict[str, Any]]:
+    """Compute feeding weights for all agents considering:
+    - Urgency: Blocked (highest), weekly used %, token depletion
+    - Work done over time: Messages processed / chat history volume (strongest operational weight)
+    - Job amount: Active and assigned jobs in registry
+    - Role importance: Multiplier based on operational criticality
+    """
+    target_nodes = nodes or ["646", "opm", "pip", "muse", "dev", "def"]
+    job_counts, msg_counts = get_agent_metrics()
+    usage_map = invite.fleet_usage(target_nodes)
+    invites_map = invite.fleet_invite_status(target_nodes)
+
+    rows = []
+    for n in target_nodes:
+        u = usage_map.get(n, {})
+        inv = invites_map.get(n, {})
+        code = inv.get("code") or "-"
+
+        wu = u.get("weekly_used_pct") or 0
+        extra_left = u.get("additional_left") or "-"
+        extra_used = u.get("additional_used_pct") or 0
+        is_blocked = (wu >= 100 and "0 tokens left" in str(extra_left)) or (wu >= 100 and extra_used >= 100)
+
+        jobs = job_counts.get(n, 0)
+        work_done = msg_counts.get(n, 0)
+        role_desc = AGENT_ROLES.get(n, "Agent Worker")
+        role_mult = ROLE_WEIGHT_MULTIPLIER.get(n, 1.0)
+
+        # Feeding score calculation:
+        # Base: Blocked = 1000 pts; Weekly limit 100% = 300 pts; proportional to weekly used %
+        urgency_score = 1000.0 if is_blocked else (300.0 if wu >= 100 else float(wu))
+        # Work done weight: 1 point per 10 messages (strongest historical work indicator)
+        work_score = float(work_done) * 0.1
+        # Job weight: 2 points per assigned job
+        job_score = float(jobs) * 2.0
+
+        # Composite feeding weight
+        feeding_weight = round((urgency_score + work_score + job_score) * role_mult, 1)
+
+        status_label = "BLOCKED" if is_blocked else ("LIMIT_REACHED" if wu >= 100 else "ACTIVE")
+
+        rows.append({
+            "node": n,
+            "role": role_desc,
+            "code": code,
+            "status": status_label,
+            "weekly_used_pct": wu,
+            "additional_left": extra_left,
+            "jobs_count": jobs,
+            "work_done_msgs": work_done,
+            "feeding_weight": feeding_weight,
+            "is_blocked": is_blocked,
+            "invites_left": inv.get("uses_remaining", 30),
+        })
+
+    # Sort descending by feeding weight
+    rows.sort(key=lambda r: r["feeding_weight"], reverse=True)
+    return rows
+
+
+def select_urgent_beneficiary(explicit_node: Optional[str] = None, explicit_code: Optional[str] = None) -> Tuple[Optional[str], Optional[str], Optional[str]]:
+    """Determine the optimal beneficiary agent to feed with Muse tokens and return (beneficiary_node, invite_code, reason).
+
+    Priority:
+      1. Explicit code / node requested by caller.
+      2. Highest feeding weight (combining urgency, work done over time, job volume, and role criticality).
+    """
+    if explicit_code:
+        return explicit_node, explicit_code.strip().upper(), "Explicit invite code provided"
+
+    if explicit_node:
+        try:
+            inv = invite.get_invite(explicit_node)
+            if inv.get("ok") and inv.get("code"):
+                return explicit_node, inv["code"], f"Explicit beneficiary agent @{explicit_node}"
+        except Exception as e:
+            return explicit_node, None, f"Failed to fetch invite code for @{explicit_node}: {e}"
+
+    # Calculate weighted rankings across fleet
+    rankings = calculate_feeding_weights()
+    for row in rankings:
+        if row["code"] and row["code"] != "-":
+            n = row["node"]
+            code = row["code"]
+            weight = row["feeding_weight"]
+            st = row["status"]
+            role = row["role"]
+            work = row["work_done_msgs"]
+            reason = f"Top feeding weight: {weight} pts (@{n} [{role}] - status:{st}, work_done:{work} msgs, jobs:{row['jobs_count']})"
+            return n, code, reason
+
+    # Fallback to 646 or muse if available
+    for fallback in ["646", "pip", "muse", "opm"]:
+        try:
+            inv = invite.get_invite(fallback)
+            if inv.get("ok") and inv.get("code"):
+                return fallback, inv["code"], f"Default fleet agent @{fallback}"
+        except Exception:
+            pass
+
+    return None, None, "No active agent invite code found"
+
+
+def provision_node_infra(node: str) -> Dict[str, Any]:
+    """Execute ./bin/netvm-provision-node.sh <node> to setup netns, wireguard, chrome-box."""
+    script = BIN_DIR / "netvm-provision-node.sh"
+    cmd = [str(script), node]
+    res = subprocess.run(cmd, capture_output=True, text=True)
+    if res.returncode != 0:
+        return {
+            "ok": False,
+            "node": node,
+            "error": res.stderr.strip() or res.stdout.strip() or f"Exit {res.returncode}",
+        }
+    return {"ok": True, "node": node, "output": res.stdout.strip()}
+
+
+def start_onboarding(node: str, email: str, beneficiary_node: Optional[str] = None, invite_code: Optional[str] = None, account_name: Optional[str] = None) -> Dict[str, Any]:
+    """Phase 1 & 2: Provision infra, choose beneficiary invite code, and initiate authentication."""
+    b_node, code, reason = select_urgent_beneficiary(beneficiary_node, invite_code)
+
+    state = OnboardState(
+        node=node,
+        email=email,
+        beneficiary_node=b_node,
+        invite_code=code,
+        stage="starting",
+        created_at=time.time(),
+        updated_at=time.time(),
+        detail=reason,
+    )
+    state.save()
+
+    # 1. Provision infra
+    infra_res = provision_node_infra(node)
+    if not infra_res.get("ok"):
+        state.stage = "infra_failed"
+        state.detail = infra_res.get("error")
+        state.save()
+        return {"ok": False, "state": asdict(state), "error": f"Infra provisioning failed: {state.detail}"}
+
+    state.stage = STAGE_INFRA
+    state.save()
+
+    # 2. Initiate authentication
+    client = CredClient()
+    cred_res = client.initiate(node, email, service="muse", account_name=account_name)
+    st = cred_res.get("status")
+
+    if st == "awaiting_otp":
+        state.stage = STAGE_AWAIT_OTP
+        state.detail = f"OTP verification code sent to {email}"
+        state.save()
+        return {
+            "ok": True,
+            "status": "awaiting_otp",
+            "state": asdict(state),
+            "beneficiary_node": b_node,
+            "invite_code_queued": code,
+            "message": f"Verification code sent to {email}. Submit with: box onboard submit-otp --node {node} --otp <code>",
+        }
+    elif st == "active":
+        state.stage = STAGE_AUTH_ACTIVE
+        state.save()
+        # Immediately redeem queued code
+        return finish_onboarding_redemption(state)
+    else:
+        state.stage = "auth_error"
+        state.detail = cred_res.get("detail") or cred_res.get("message")
+        state.save()
+        return {"ok": False, "status": st, "state": asdict(state), "error": state.detail}
+
+
+def submit_onboarding_otp(node: str, otp: str, email: Optional[str] = None) -> Dict[str, Any]:
+    """Phase 3: Submit transient OTP and proceed to redemption upon success."""
+    state = OnboardState.load(node)
+    if not state:
+        state = OnboardState(
+            node=node,
+            email=email or "unknown",
+            beneficiary_node=None,
+            invite_code=None,
+            stage=STAGE_AWAIT_OTP,
+            created_at=time.time(),
+        )
+
+    client = CredClient()
+    res = client.submit_otp(node, otp, email=state.email or email)
+    st = res.get("status")
+
+    if st == "active":
+        state.stage = STAGE_AUTH_ACTIVE
+        state.detail = "Session authenticated successfully"
+        state.save()
+        return finish_onboarding_redemption(state)
+    else:
+        state.detail = res.get("detail") or res.get("message")
+        state.save()
+        return {"ok": False, "status": st, "state": asdict(state), "error": state.detail}
+
+
+def finish_onboarding_redemption(state: OnboardState) -> Dict[str, Any]:
+    """Phase 4 & 5: Redeem queued invite code and inject DRIVE."""
+    # Ensure beneficiary code is present
+    if not state.invite_code:
+        b_node, code, _ = select_urgent_beneficiary(state.beneficiary_node, None)
+        state.beneficiary_node = b_node
+        state.invite_code = code
+
+    redemption_info = None
+    if state.invite_code:
+        try:
+            # Redeem queued code on the fresh node
+            redemption = invite.redeem_invite(state.node, state.invite_code, timeout=20.0)
+            redemption_info = redemption
+            state.redemption_result = redemption
+            if redemption.get("ok"):
+                state.stage = STAGE_REDEEMED
+                state.detail = f"Successfully redeemed code {state.invite_code}! 1B tokens credited to @{state.beneficiary_node} and @{state.node}."
+            else:
+                reason = redemption.get("reason", "unknown")
+                detail = redemption.get("detail", "")
+                state.detail = f"Redemption failed: {reason} - {detail}"
+                try:
+                    from invite_handler import send_loopback_notice
+                    target_chat = f"{state.beneficiary_node} tasks" if state.beneficiary_node else "heartbeat-opm"
+                    send_loopback_notice(
+                        recipient=state.beneficiary_node or "opm",
+                        target=target_chat,
+                        message=f"[ONBOARD-SALVAGE-LOOPBACK] Node @{state.node} could not redeem code {state.invite_code} for @{state.beneficiary_node}: {reason}. Stage remains safe.",
+                    )
+                except Exception:
+                    pass
+        except Exception as e:
+            redemption_info = {"ok": False, "error": str(e)}
+            state.detail = f"Redemption exception: {e}"
+
+    # Phase 5: Inject DRIVE
+    try:
+        drive_script = BIN_DIR / "agent_md.py"
+        if drive_script.exists():
+            subprocess.run([sys.executable, str(drive_script), "inject-drive", state.node], capture_output=True, text=True, timeout=15)
+            state.stage = STAGE_COMPLETED
+    except Exception:
+        pass
+
+    state.save()
+    return {
+        "ok": True,
+        "status": "completed" if (redemption_info and redemption_info.get("ok")) else "auth_active_redemption_warning",
+        "state": asdict(state),
+        "beneficiary_node": state.beneficiary_node,
+        "invite_code": state.invite_code,
+        "redemption": redemption_info,
+        "message": f"Node @{state.node} is fully active! 1B tokens granted.",
+    }
+
+
+def issue_salvage_work_order(blocked_node: str = "646", to_sidechat: str = "646 tasks") -> Dict[str, Any]:
+    """Issue a cryptographically signed Work Order prompting fleet operators or agents to initiate onboarding."""
+    inv = invite.get_invite(blocked_node)
+    code = inv.get("code") or "UNKNOWN"
+    title = f"Salvage Blocked Agent @{blocked_node}"
+    body = (
+        f"Agent @{blocked_node} is out of tokens (code: {code}). "
+        f"Initiate client onboarding to grant 1 Billion tokens: box onboard <new_node> --email <client_email> --for {blocked_node}"
+    )
+
+    cmd = [
+        "python3", str(BIN_DIR / "super-cli.py"), "dm", "wo",
+        "--to", "opm",
+        "--target", to_sidechat,
+        "--title", title,
+        "--body", body,
+        "--priority", "urgent",
+        "--allow-main-chat"
+    ]
+    res = subprocess.run(cmd, capture_output=True, text=True)
+    return {"ok": res.returncode == 0, "output": res.stdout.strip()}
+
+
+def get_all_connects(fast: bool = True) -> List[Dict[str, Any]]:
+    """Return consolidated inventory of all fleet and onboarded connects."""
+    connects = []
+    seen = set()
+
+    # Load recorded pipeline states
+    if STATE_DIR.exists():
+        for p in STATE_DIR.glob("*.json"):
+            try:
+                d = json.loads(p.read_text(encoding="utf-8"))
+                n = d.get("node")
+                if n:
+                    seen.add(n)
+                    connects.append({
+                        "node": n,
+                        "type": "onboard_pipeline",
+                        "email": d.get("email"),
+                        "stage": d.get("stage"),
+                        "beneficiary": d.get("beneficiary_node"),
+                        "invite_code": d.get("invite_code") or "-",
+                        "cdp_port": d.get("cdp_port"),
+                        "detail": d.get("detail"),
+                        "updated_at": d.get("updated_at"),
+                    })
+            except Exception:
+                pass
+
+    # Fleet nodes
+    w_map = {}
+    if not fast:
+        try:
+            weights = calculate_feeding_weights()
+            w_map = {r["node"]: r for r in weights}
+        except Exception:
+            w_map = {}
+
+    ports = {"muse": 9222, "pip": 9322, "646": 9430, "opm": 9440, "def": 9450, "dev": 9455}
+
+    for agent in ("muse", "pip", "646", "opm", "dev", "def"):
+        if agent not in seen:
+            w_info = w_map.get(agent, {})
+            connects.append({
+                "node": agent,
+                "type": "fleet_agent",
+                "email": f"{agent}@muse-dev.online",
+                "stage": "active_fleet",
+                "beneficiary": None,
+                "invite_code": w_info.get("code") or "-",
+                "cdp_port": ports.get(agent),
+                "role": AGENT_ROLES.get(agent, ""),
+                "status": w_info.get("status", "ACTIVE"),
+                "feeding_weight": w_info.get("feeding_weight", 1.0),
+                "updated_at": time.time(),
+            })
+
+    return connects
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="End-to-end agent-driven onboarding & invite salvage pipeline")
+    sub = parser.add_subparsers(dest="action")
+
+    p_conn = sub.add_parser("connects", help="Inventory of all active fleet nodes & client onboard connects")
+    p_conn.add_argument("--json", action="store_true", help="Emit JSON output")
+
+    p_start = sub.add_parser("start", help="Start full onboarding pipeline for a client node")
+    p_start.add_argument("node", help="New node label (e.g. dev2, client1)")
+    p_start.add_argument("--email", required=True, help="Client login email")
+    p_start.add_argument("--for", dest="for_agent", help="Beneficiary agent to unblock (defaults to most urgent)")
+    p_start.add_argument("--code", help="Explicit 6-character invite code to redeem")
+    p_start.add_argument("--account-name", help="Display name hint")
+    p_start.add_argument("--json", action="store_true", help="Emit JSON output")
+
+    p_otp = sub.add_parser("submit-otp", help="Submit transient OTP verification code")
+    p_otp.add_argument("node", help="Node label")
+    p_otp.add_argument("otp", help="6-digit verification code")
+    p_otp.add_argument("--email", help="Client email (optional)")
+    p_otp.add_argument("--json", action="store_true", help="Emit JSON output")
+
+    p_status = sub.add_parser("status", help="Check onboarding pipeline state for a node")
+    p_status.add_argument("node", help="Node label")
+    p_status.add_argument("--json", action="store_true", help="Emit JSON output")
+
+    p_wo = sub.add_parser("salvage-wo", help="Dispatch salvage work order to sidechat")
+    p_wo.add_argument("node", nargs="?", default="646", help="Blocked agent node (default: 646)")
+    p_wo.add_argument("--target", default="646 tasks", help="Target sidechat")
+
+    p_feed = sub.add_parser("feed-matrix", help="Display all agents ranked by feeding weight, job volume, role, and work done over time")
+    p_feed.add_argument("--json", action="store_true", help="Emit JSON output")
+
+    args = parser.parse_args()
+
+    if args.action == "connects":
+        conn_list = get_all_connects()
+        if args.json:
+            print(json.dumps(conn_list, indent=2))
+        else:
+            print("\n=== ACTIVE FLEET & CLIENT ONBOARD CONNECTS ===")
+            print(f"  {'NODE':6} {'TYPE':16} {'STAGE / STATUS':16} {'CDP':6} {'INVITE':8} {'ROLE / DETAIL'}")
+            print(f"  {'─'*6} {'─'*16} {'─'*16} {'─'*6} {'─'*8} {'─'*32}")
+            for c in conn_list:
+                node = c.get("node", "")
+                t_str = c.get("type", "")
+                st_str = c.get("stage", c.get("status", ""))
+                cdp = str(c.get("cdp_port") or "-")
+                code = c.get("invite_code") or "-"
+                role = c.get("role") or c.get("detail") or c.get("email") or ""
+                print(f"  {node:<6} {t_str:<16} {st_str:<16} {cdp:<6} {code:<8} {role}")
+            print()
+
+    elif args.action == "start":
+        res = start_onboarding(args.node, args.email, beneficiary_node=getattr(args, "for_agent", None), invite_code=args.code, account_name=args.account_name)
+        if args.json:
+            print(json.dumps(res, indent=2))
+        elif res.get("ok"):
+            print(f"\n[ONBOARDING STARTED] Node: {args.node}")
+            print(f"  Beneficiary: @{res.get('beneficiary_node')} (Invite Code: {res.get('invite_code_queued')})")
+            print(f"  Message:     {res.get('message')}\n")
+        else:
+            print(f"\n[ERROR] {res.get('error')}\n", file=sys.stderr)
+            sys.exit(1)
+
+    elif args.action == "submit-otp":
+        res = submit_onboarding_otp(args.node, args.otp, email=args.email)
+        if args.json:
+            print(json.dumps(res, indent=2))
+        elif res.get("ok"):
+            print(f"\n[ONBOARDING COMPLETE] {res.get('message')}")
+            print(f"  Beneficiary Credited: @{res.get('beneficiary_node')} (+1,000,000,000 tokens)\n")
+        else:
+            print(f"\n[ERROR] {res.get('error')}\n", file=sys.stderr)
+            sys.exit(1)
+
+    elif args.action == "status":
+        state = OnboardState.load(args.node)
+        if not state:
+            print(f"No onboarding pipeline record found for {args.node}", file=sys.stderr)
+            sys.exit(1)
+        if args.json:
+            print(json.dumps(asdict(state), indent=2))
+        else:
+            print(f"\n=== ONBOARDING STATUS: @{state.node} ===")
+            print(f"  Email:       {state.email}")
+            print(f"  Stage:       {state.stage}")
+            print(f"  Beneficiary: @{state.beneficiary_node} (Code: {state.invite_code})")
+            if state.detail:
+                print(f"  Detail:      {state.detail}")
+            print()
+
+    elif args.action == "salvage-wo":
+        res = issue_salvage_work_order(args.node, to_sidechat=args.target)
+        print(f"Salvage work order dispatched for @{args.node}: ok={res.get('ok')}")
+
+    elif args.action == "feed-matrix":
+        matrix = calculate_feeding_weights()
+        if args.json:
+            print(json.dumps(matrix, indent=2))
+        else:
+            print("\n=== FLEET FEEDING & TOKEN ALLOCATION MATRIX ===")
+            print("  (Weighted by: Urgency + Work Done Over Time + Job Amount + Role Criticality)\n")
+            print(f"  {'RANK':4} {'AGENT':6} {'ROLE':38} {'FEED SCORE':11} {'STATUS':10} {'JOBS':6} {'WORK DONE':10} {'CODE':8}")
+            print(f"  {'─'*4} {'─'*6} {'─'*38} {'─'*11} {'─'*10} {'─'*6} {'─'*10} {'─'*8}")
+            for idx, r in enumerate(matrix, 1):
+                print(f"  #{idx:<3} {r['node']:<6} {r['role']:<38} {r['feeding_weight']:<11} {r['status']:<10} {r['jobs_count']:<6} {str(r['work_done_msgs']) + ' msgs':<10} {r['code']:<8}")
+            print()
+
+
+if __name__ == "__main__":
+    main()

bin/prompt_envelope.py

@@ -17,7 +17,10 @@ BOX_API = "https://box.muse-dev.online/api/box"
 
 def _response_rule():
     return (
-        "\nRESPONSE RULE: Execute your steps using [TOOL ...] directives or background tmux commands."
+        "\nRESPONSE RULE: Act by EMITTING [TOOL ...] / [DM ...] directive lines verbatim in your reply"
+        " — you do not run them yourself. The Box runtime on bl executes each directive"
+        " (this works from containers with no box CLI or tmux socket) and posts the result back here."
+        " Background tmux commands work too when you have a shell."
         " When complete, conclude your output with the [RESULT ...] line so the harvester records it.\n"
     )
 
@@ -57,17 +60,23 @@ def pick_profile(job_name):
 
 
 def _tool(op, args):
-    # no ']' inside the JSON: the harvester's [TOOL ...] regex stops at the first one
+    # the harvester extracts JSON args with balanced-brace scanning, so
+    # ']' and nested objects/arrays inside args are safe
     return "[TOOL %s %s]" % (op, json.dumps(args, separators=(", ", ": ")))
 
 
 def spawn_call(job_id, job_name, profile):
     count, _, hint = PROFILES[profile]
-    # no brackets in the task text: the harvester's [TOOL ...] regex stops at the first ']'
     task = "Subagent for job %s (%s): %s." % (job_id, job_name, hint)
     return _tool("swarm.spawn", {"count": count, "task": task[:900], "label": (job_name or "job")[:60]})
 
 
+def dm_call(to, target, message):
+    return "[DM %s]" % json.dumps(
+        {"to": to, "target": target, "message": message[:900]},
+        separators=(", ", ": "))
+
+
 def native_followup_call(job_id, job_name, profile, agent):
     """Muse-native one-shot cron (cron.create runonce) - bridged to followup.create."""
     _, mins, _ = PROFILES[profile]
@@ -88,7 +97,7 @@ def thread_url(target):
     return "https://box.muse-dev.online/%s/%s" % ("thread" if UUID_RE.fullmatch(t.lower()) else "sidechat", t)
 
 
-def wrap(job_name, job_id, agent, target, rendered):
+def wrap(job_name, job_id, agent, target, rendered, include_kpi: bool = True):
     """Return the full DM body as a direct, authentic operator directive."""
     profile = pick_profile(job_name)
     spawn = spawn_call(job_id, job_name, profile)
@@ -96,22 +105,33 @@ def wrap(job_name, job_id, agent, target, rendered):
     parts = job_id.split("-")
     wo_id = parts[-1] if len(parts) > 1 and len(parts[-1]) >= 8 else hashlib.sha256(job_id.encode()).hexdigest()[:8]
     session_name = f"work-{agent}-{wo_id}"
-    tmux_new = _tool("tmux.new", {"session": session_name, "command": "bash"})
+
-    tmux_send = _tool("tmux.send", {"session": session_name, "keys": "echo 'Starting task execution...'"})
+    advisory_section = ""
+    if include_kpi:
+        try:
+            import kpi
+            advisory = kpi.get_live_advisory_block(agent)
+            if advisory:
+                advisory_section = f"\n{advisory}\n"
+        except Exception:
+            pass
+
     top = (
         f"Operator Directive [ref:{wo_id}]:\n"
-        "Execute the task below using tool calls. Background tmux session is ready for command execution:\n"
+        f"Host tmux worker session '{session_name}' is available on bl (/tmp/tmux-muse.sock).\n"
-        f"  • {tmux_new}\n"
-        f"  • {tmux_send}\n"
         f"  • Subagent assistance: {spawn}\n"
-        f"  • Verification schedule: {follow}\n\n"
+        f"  • Verification schedule: {follow}\n"
+        f"{advisory_section}\n"
         "--- Task ---\n"
     )
+
     has_result = "[RESULT" in rendered
     bottom = (
         "\n--- End Task ---\n\n"
-        f"Inspect tmux output: [TOOL tmux.capture {{\"session\": \"{session_name}\", \"lines\": 30}}]\n"
+        f"Inspect tmux worker: box tmux capture {session_name} 30 (or attach via /tmp/tmux-muse.sock)\n"
-        "Tools available: cron.create, cron.runs, health.check, swarm.spawn, swarm.list.\n"
+        "Tools: cron.create, cron.runs, health.check, swarm.spawn, swarm.list, dm.send, box.exec, tools.list.\n"
+        "Message a peer: [DM {\"to\": \"<agent>\", \"target\": \"<sidechat>\", \"message\": \"<text>\"}].\n"
+        "Query box: [TOOL box.exec {\"action\": \"<fleet-status|dm-log|job-get|...>\"}] — [TOOL tools.list {}] lists every op.\n"
     )
     if not has_result:
         bottom += f"When complete, report your verdict: [RESULT {job_id}] OK: <summary of actions>\n"
@@ -119,3 +139,18 @@ def wrap(job_name, job_id, agent, target, rendered):
         bottom += f"Conclude with your [RESULT {job_id}] line reporting outcomes.\n"
     return top + rendered.strip() + "\n" + bottom
 
+
+def wrap_subagent_task(job_id, task_text):
+    """Format an authentic direct task assignment for a subagent worker without test-traffic meta tags."""
+    return (
+        f"Operator assignment for swarm slot {job_id}:\n\n"
+        f"Task:\n"
+        f"{task_text.strip()}\n\n"
+        f"Instructions:\n"
+        f"1. Carry out this task directly using your available tools.\n"
+        f"2. When finished, conclude your final response with your verdict line:\n"
+        f"[RESULT {job_id}] OK: <one-line summary of actions and outcome>\n"
+        f"(or [RESULT {job_id}] FAIL: <reason> if the task could not be completed)\n"
+    )
+
+

bin/relay-health-check.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# relay-health-check.sh — check all four CDP relay endpoints on bl.
+# relay-health-check.sh — check all registry CDP relay endpoints on bl.
 # Self-contained: no nested SSH quoting. Sources pinned ports from netvm-names.sh.
 #
 # Output: "name:code" per relay on stdout.
@@ -12,8 +12,25 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=/dev/null
 source "$SCRIPT_DIR/netvm-names.sh"
 
+# Registry-driven node list (was hardcoded 4 nodes; def/dev had no
+# relay-health coverage — 2026-10-06).
+watched_nodes() {
+  "$SCRIPT_DIR/netvm-registry.py" 2>/dev/null | cut -d: -f1
+}
+
+# Allow sourcing for tests without running checks.
+if [ "${RELAY_HEALTH_CHECK_LIB_ONLY:-}" = "1" ]; then
+  return 0 2>/dev/null || exit 0
+fi
+
+NODES="$(watched_nodes)"
+if [ -z "$NODES" ]; then
+  echo "node registry empty/unreadable" >&2
+  exit 1
+fi
 FAILED=0
-for node in muse pip 646 opm; do
+# shellcheck disable=SC2086 (intended word splitting: one node per word)
+for node in $NODES; do
   netvm_names "$node"
   url="http://${PEER_IP}:${CDP_PORT}/json/version"
   code=$(curl -s -m 8 -o /dev/null -w "%{http_code}" "$url" 2>/dev/null || echo "000")

bin/response-harvester.py

@@ -83,18 +83,32 @@ try:
 except ImportError:
     HAS_MUSE_HYBRID = False
 
+try:
+    import prompt_envelope
+    HAS_PROMPT_ENVELOPE = True
+except ImportError:
+    HAS_PROMPT_ENVELOPE = False
+
 VALID_AGENTS = ["muse", "pip", "646", "opm", "dev", "def"]
 DEFAULT_PORTS = {"muse": 9410, "pip": 9420, "646": 9430, "opm": 9440, "def": 9450, "dev": 9455}
 
+try:
+    import lookup_engine
+    HAS_LOOKUP_ENGINE = True
+except ImportError:
+    HAS_LOOKUP_ENGINE = False
+
 # Matches EVERY [RESULT <job_id>] marker in a message (use with finditer, not
 # search). The result text is lazy and stops before the next marker (or end of
 # text), so a message closing two jobs records each with its own text instead
 # of the first marker greedily swallowing the second.
-RESULT_RE = re.compile(r"\[RESULT\s+([A-Za-z0-9_-]+)\]\s*(.*?)(?=\[RESULT\s|\Z)", re.S)
+_LOCAL_RESULT_RE = re.compile(r"\[RESULT\s+([A-Za-z0-9_/-]+)\]\s*(.*?)(?=\[RESULT\s|\Z)", re.S)
+RESULT_RE = lookup_engine.get_result_regex() if HAS_LOOKUP_ENGINE else _LOCAL_RESULT_RE
 
 def iter_result_markers(text):
     """Yield (job_id, result_text) for every [RESULT <job_id>] marker in text."""
-    for m in RESULT_RE.finditer(text or ""):
+    current_re = lookup_engine.get_result_regex() if HAS_LOOKUP_ENGINE else RESULT_RE
+    for m in current_re.finditer(text or ""):
         yield m.group(1).strip(), m.group(2).strip()
 
 
@@ -103,12 +117,14 @@ def iter_result_markers(text):
 # ACK/CLAIM acknowledge a digest (nudge-suppressed, NOT closed);
 # RESULT/DECLINE/NO-ACTION close the digest. Every verb match records
 # outcome=<verb> on the followup record.
-VERB_RE = re.compile(r"\[(ACK|CLAIM|RESULT|DECLINE|NO-ACTION)\s+([A-Za-z0-9_-]+)\]")
+_LOCAL_VERB_RE = re.compile(r"\[(ACK|CLAIM|RESULT|DECLINE|NO-ACTION)\s+([A-Za-z0-9_/-]+)\]")
+VERB_RE = lookup_engine.get_verb_regex() if HAS_LOOKUP_ENGINE else _LOCAL_VERB_RE
 
 
 def iter_verb_markers(text):
     """Yield (verb, job_id) for every [VERB <job_id>] marker in text."""
-    for m in VERB_RE.finditer(text or ""):
+    current_re = lookup_engine.get_verb_regex() if HAS_LOOKUP_ENGINE else VERB_RE
+    for m in current_re.finditer(text or ""):
         yield m.group(1), m.group(2).strip()
 
 
@@ -138,6 +154,12 @@ NATIVE_ALIASES = {
     "subagents.spawn": "swarm.spawn",
     "subagent.list": "swarm.list",
     "subagent.status": "swarm.status",
+    "dm": "dm.send",
+    "message.send": "dm.send",
+    "box": "box.exec",
+    "box.run": "box.exec",
+    "tools": "tools.list",
+    "tools.list": "tools.list",
 }
 
 
@@ -168,6 +190,23 @@ def normalize_native_call(op, args):
                     break
         if "count" not in args and "n" in args:
             args["count"] = args.pop("n")
+    elif op == "dm.send":
+        if "message" not in args:
+            for k in ("text", "body", "content", "msg"):
+                if k in args:
+                    args["message"] = args.pop(k)
+                    break
+        if "target" not in args:
+            for k in ("thread", "sidechat", "channel"):
+                if k in args:
+                    args["target"] = args.pop(k)
+                    break
+    elif op == "box.exec":
+        if "action" not in args:
+            for k in ("cmd", "verb", "command", "run"):
+                if k in args:
+                    args["action"] = args.pop(k)
+                    break
     elif op.startswith("tmux."):
         if "session" not in args:
             for k in ("name", "target", "s"):
@@ -182,24 +221,151 @@ def normalize_native_call(op, args):
     return op, args
 
 
+_TOOL_OPEN_RE = re.compile(r"\[(TOOL|EXEC)\s+([a-zA-Z0-9_.-]+)\s*")
+_DM_OPEN_RE = re.compile(r"\[DM\s+")
+
+
+def _extract_balanced_json(s, i):
+    """Extract one JSON object starting at s[i] == '{' (brace-aware, string-aware).
+
+    Returns (obj, end_index) with end_index just past the closing brace,
+    or (None, i) when no balanced object is present. Unlike a first-']'
+    regex this tolerates ']' (and nested objects/arrays) inside args.
+    """
+    if i >= len(s) or s[i] != "{":
+        return None, i
+    depth = 0
+    in_str = False
+    esc = False
+    for j in range(i, len(s)):
+        c = s[j]
+        if in_str:
+            if esc:
+                esc = False
+            elif c == "\\":
+                esc = True
+            elif c == '"':
+                in_str = False
+        elif c == '"':
+            in_str = True
+        elif c == "{":
+            depth += 1
+        elif c == "}":
+            depth -= 1
+            if depth == 0:
+                try:
+                    return json.loads(s[i:j + 1]), j + 1
+                except Exception:
+                    return None, i
+    return None, i
+
+
+def _scan_bracket_calls(text):
+    """Yield (op, args) for [TOOL op {...}] / [EXEC op {...}] / [DM {...}].
+
+    JSON args are extracted with balanced-brace scanning so ']' inside
+    strings, arrays, or nested objects no longer truncates the call.
+    Non-JSON tails keep the legacy first-']' behavior (raw passthrough).
+    """
+    out = []
+    spans = []
+    for m in _TOOL_OPEN_RE.finditer(text or ""):
+        spans.append((m.start(), "tool", m.group(2).strip(), m.end()))
+    for m in _DM_OPEN_RE.finditer(text or ""):
+        spans.append((m.start(), "dm", "dm.send", m.end()))
+    spans.sort()
+    for _, kind, op, pos in spans:
+        if pos < len(text) and text[pos] == "{":
+            args, _ = _extract_balanced_json(text, pos)
+            if args is None:
+                continue
+            if not isinstance(args, dict):
+                args = {"raw": args}
+        elif kind == "dm":
+            continue  # [DM ...] requires a JSON object; skip bare forms
+        else:
+            end = text.find("]", pos)
+            if end == -1:
+                continue
+            raw_args = text[pos:end].strip()
+            if not raw_args:
+                args = {}
+            else:
+                try:
+                    args = json.loads(raw_args)
+                    if not isinstance(args, dict):
+                        args = {"raw": args}
+                except Exception:
+                    args = {"raw": raw_args}
+        out.append((op, args))
+    return out
+
+
+_PROOF_EVIDENCE_RE = re.compile(
+    r"sw-\d{8}-\d{6}-[0-9a-f]{4}"
+    r"|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
+    r"|/(?:[\w.-]+/)+[\w.-]+"
+    r"|\b(?:swarm|timer|cron|job|thread|sidechat|slot)[-_ ]?(?:id|name|uuid)?\s*[:=]"
+    r"|\b\d+/\d+\s*(?:slots?|checks?|workers?)",
+    re.IGNORECASE)
+_UUID_RE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
+
+
+def result_has_evidence(result_text):
+    """True when a RESULT verdict carries checkable artifacts (IDs, paths, counts)."""
+    return bool(_PROOF_EVIDENCE_RE.search(result_text or ""))
+
+
+def maybe_request_proof(agent, thread_id, job_id, result_text, dry_run=False):
+    """Ask for checkable evidence when a success RESULT has none.
+
+    One-shot per (thread, job) via the nudge tracker. Returns True when a
+    proof followup was scheduled.
+    """
+    if dry_run or not thread_id or not _UUID_RE.fullmatch(thread_id.lower()):
+        return False
+    if result_has_evidence(result_text):
+        return False
+    tracker = load_json_file(NUDGE_TRACKER_FILE)
+    rec = tracker.get(thread_id, {})
+    done = rec.get("proof_jobs", [])
+    if job_id in done:
+        return False
+    ok, res = execute_agent_tool(agent, "followup.create", {
+        "agent": agent,
+        "in_m": 30,
+        "thread": thread_id,
+        "prompt": (
+            f"[PROOF] Your [RESULT {job_id}] has no checkable evidence. "
+            f"Reply in this thread with the swarm/timer IDs, paths, or command output "
+            f"that prove the outcome — or say what is still missing."),
+    })
+    if ok:
+        rec["proof_jobs"] = (done + [job_id])[-50:]
+        tracker[thread_id] = rec
+        save_json_file(NUDGE_TRACKER_FILE, tracker)
+        append_jsonl(JOB_LOG, {
+            "ts": utcnow(),
+            "type": "proof_requested",
+            "job_id": job_id,
+            "agent": agent,
+            "thread_id": thread_id,
+        })
+        return True
+    sys.stderr.write(f"warning: proof followup failed for {job_id}: {res}\n")
+    return False
+
+
 def parse_tool_calls(text):
     """
     Extract structured tool/exec calls from assistant messages.
     Supports:
-      1. [TOOL <op> <json_args>] or [EXEC <op> <json_args>]
+      1. [TOOL <op> <json_args>] or [EXEC <op> <json_args>] (JSON may nest)
-      2. ```box / ```tool / ```exec JSON blocks
+      2. [DM <json_args>] shorthand for dm.send
+      3. ```box / ```tool / ```exec JSON blocks
     """
     calls = []
-    for m in re.finditer(r"\[(?:TOOL|EXEC)\s+([a-zA-Z0-9_.-]+)(?:\s+(.*?))?\]", text or ""):
+    calls.extend(_scan_bracket_calls(text))
-        op = m.group(1).strip()
-        raw_args = (m.group(2) or "").strip()
-        args = {}
-        if raw_args:
-            try:
-                args = json.loads(raw_args)
-            except Exception:
-                args = {"raw": raw_args}
-        calls.append((op, args))
 
     for m in re.finditer(r"```(?:box|tool|exec)\s*\n(.*?)```", text or "", re.DOTALL):
         block = m.group(1).strip()
@@ -295,6 +461,10 @@ def format_tool_result_for_chat(op, raw_output):
         data = json.loads(raw_output)
     except Exception:
         s = str(raw_output).strip()
+        if op == "box.exec":
+            if len(s) > 900:
+                s = s[:900] + "\n…(truncated, refine the call for detail)"
+            return f"box result:\n```\n{s}\n```"
         return s[:500] if len(s) > 500 else s
 
     if op == "health.check" and isinstance(data, dict) and "fleet" in data:
@@ -369,6 +539,26 @@ def format_tool_result_for_chat(op, raw_output):
         sw = data.get("swarm", {})
         return f"Swarm `{sw.get('swarm_id')}`: {sw.get('status')} ({sw.get('done', 0)}/{sw.get('count', 0)} slots completed)."
 
+    if op == "tools.list" and isinstance(data, dict):
+        ops = data.get("ops", [])
+        if not ops:
+            return "No tools registered."
+        ro = [o["op"] for o in ops if not o.get("side_effecting")]
+        se = [o["op"] for o in ops if o.get("side_effecting")]
+        lines = [f"{len(ops)} tools available via [TOOL <op> <args>]."]
+        lines.append("read-only: " + (", ".join(ro) if ro else "none"))
+        if se:
+            lines.append("side-effecting: " + ", ".join(se))
+        return "\n".join(lines)
+
+    if op == "box.exec" and isinstance(data, dict):
+        if data.get("ok") is False:
+            return f"box call failed: {data.get('error', 'unknown error')}"
+        out = json.dumps(data)
+        if len(out) > 900:
+            out = out[:900] + "\n…(truncated, refine the call for detail)"
+        return f"box result:\n```\n{out}\n```"
+
     # General fallback: compact JSON capped to 400 chars
     s = json.dumps(data)
     return s[:400] + "..." if len(s) > 400 else s
@@ -503,6 +693,26 @@ def get_monitored_threads(target_agent=None):
         except Exception:
             continue
 
+    # Also monitor active swarm slot subagents from swarms.json
+    try:
+        if SWARM_FILE.exists():
+            s_data = json.loads(SWARM_FILE.read_text(encoding="utf-8"))
+            for sid, s_info in s_data.items():
+                if sid.startswith("_") or not isinstance(s_info, dict):
+                    continue
+                if s_info.get("status") not in ("running", "pending"):
+                    continue
+                for slot in s_info.get("slots", []):
+                    if slot.get("status") == "running":
+                        sub_id = slot.get("subagent_session_id") or slot.get("thread_uuid") or slot.get("sidechat_id")
+                        ag = slot.get("agent_id")
+                        if sub_id and ag and ag in threads_by_agent:
+                            existing = [t["id"] for t in threads_by_agent[ag]]
+                            if sub_id not in existing:
+                                threads_by_agent[ag].append({"id": sub_id, "name": f"swarm-{sid[:8]}-s{slot.get('slot')}"})
+    except Exception as se:
+        sys.stderr.write(f"warning: failed to add swarm threads to monitor list: {se}\n")
+
     return threads_by_agent
 
 
@@ -738,9 +948,14 @@ def process_messages(raw_messages, agent, thread_id, thread_name, last_wm, follo
                             thread_url = f"https://box.muse-dev.online/thread/{thread_id}"
                             tool_hint = (
                                 f"[Runtime Context: {thread_url}]\n"
-                                f"Tools available: [TOOL <op> <args>] or curl -sk -X POST https://exec.muse-dev.online/exec\n"
+                                f"Tools: EMIT one [TOOL <op> <args>] line per action (you do not run it;"
+                                f" the runtime executes it and replies here). curl -sk -X POST"
+                                f" https://exec.muse-dev.online/exec works too.\n"
+                                f"  • [TOOL tools.list {{}}] — discover every op dynamically\n"
+                                f"  • [TOOL swarm.spawn {{\"count\": 1, \"task\": \"<task>\"}}] — spawn subagents\n"
+                                f"  • [DM {{\"to\": \"<agent>\", \"target\": \"<sidechat>\", \"message\": \"<text>\"}}] — send a DM\n"
+                                f"  • [TOOL box.exec {{\"action\": \"fleet-status\"}}] — call box (read-only actions)\n"
                                 f"  • [TOOL followup.create {{\"in_m\": 5, \"prompt\": \"<reminder>\"}}]\n"
-                                f"  • [TOOL swarm.spawn {{\"count\": 1, \"task\": \"<task>\"}}]\n"
                                 f"  • [TOOL health.check {{}}]\n\n"
                                 f"[Directive: Take next action or close with [RESULT <job_id>] <summary>]"
                             )
@@ -784,7 +999,11 @@ def process_messages(raw_messages, agent, thread_id, thread_name, last_wm, follo
                         else:
                             trigger_chain_next(job_id, result_text, success=not is_fail)
                         if not is_fail:
-                            archive_ephemeral_thread(agent, thread_id, job_id=job_id)
+                            try:
+                                maybe_request_proof(agent, thread_id, job_id, result_text)
+                            except Exception as pe:
+                                sys.stderr.write(f"warning: proof check failed: {pe}\n")
+                        archive_ephemeral_thread(agent, thread_id, job_id=job_id)
                     clear_matching_followups(followups, agent, thread_id, mid, text,
                                              dry_run, job_id=job_id, verb="RESULT")
                 for verb, job_id in verbs:
@@ -794,7 +1013,8 @@ def process_messages(raw_messages, agent, thread_id, thread_name, last_wm, follo
                                              dry_run, job_id=job_id, verb=verb)
             else:
                 clear_matching_followups(followups, agent, thread_id, mid, text, dry_run)
-                maybe_nudge_untagged_sidechat(agent, thread_id, thread_name, mid, text, dry_run=dry_run)
+                maybe_nudge_untagged_sidechat(agent, thread_id, thread_name, mid, text,
+                                              dry_run=dry_run, acted=bool(tool_calls))
 
     return new_messages, new_wm, job_results
 
@@ -925,6 +1145,13 @@ def archive_ephemeral_thread(agent, thread_id, job_id=None):
     except Exception as e:
         sys.stderr.write(f"warning: failed to update job-sidechats state: {e}\n")
 
+    # Complete subagent tracker record if this thread corresponds to an ephemeral subagent session
+    try:
+        import subagent_tracker
+        subagent_tracker.complete_session(thread_id, note=f"Harvested verdict for job {job_id}")
+    except Exception:
+        pass
+
     # Call muse-threads.py archive via subprocess (runs in node's netns)
     try:
         helper = BIN_DIR / "muse-threads.py"
@@ -940,7 +1167,13 @@ def archive_ephemeral_thread(agent, thread_id, job_id=None):
 # NOTE 2026-10-05 (Fix Agent 2/5): dev/def removed from the pool. No worker
 # agents exist on dev/def (no Meta sessions provisioned), so slots dispatched
 # to them froze with null results. Re-add only after real dev/def workers exist.
-SWARM_WORKER_POOL = ["dev", "def", "muse"]
+# NOTE 2026-10-06 (split-brain dispatch fix): the removal above was comment-only;
+# the code still listed dev/def, and the harvester's every-minute dispatch raced
+# the pool daemon claiming slots as dev/def, which refuse on attribution grounds
+# (dev FAILs fast, def freezes until the 60-min reaper). Pool now matches
+# swarm_worker/daemon.py WORKER_POOL exactly: only muse, the single fully
+# authenticated auxiliary worker.
+SWARM_WORKER_POOL = ["muse"]
 
 # Stuck-slot reaper: a slot that stays "running" with no result longer than
 # this is treated as wedged (worker died / dispatch lost). Healthy slots
@@ -968,7 +1201,8 @@ def reconcile_and_dispatch_swarms(dry_run=False):
     """
     Autonomous Swarm Orchestrator:
     1. Scans swarms.json for pending slots.
-    2. Dynamically allocates available auxiliary worker nodes (dev, def, muse).
+    2. Dynamically allocates the auxiliary worker pool (muse only; dev/def have
+    no provisioned worker agents and refuse on attribution grounds).
     3. Provisions ephemeral sidechat per slot and dispatches the task with [RESULT <swarm_id>/<slot>].
     4. Upon completion of all slots, sends completion summary DM to originating coordinator.
     """
@@ -1047,11 +1281,19 @@ def reconcile_and_dispatch_swarms(dry_run=False):
                     slot_target = f"{sid}-s{slot_idx}"
 
                     # Prepare task directive prompt
-                    prompt = (
+                    slot_job_id = f"{sid}/{slot_idx}"
-                        f"[JOB {sid}/{slot_idx}] Task for swarm slot {slot_idx}:\n"
+                    if HAS_PROMPT_ENVELOPE and hasattr(prompt_envelope, "wrap_subagent_task"):
-                        f"{task_text}\n\n"
+                        prompt = prompt_envelope.wrap_subagent_task(slot_job_id, task_text)
-                        f"Reply with [RESULT {sid}/{slot_idx}] OK <summary> or FAIL <reason>."
+                    else:
-                    )
+                        prompt = (
+                            f"Operator assignment for swarm slot {slot_job_id}:\n\n"
+                            f"Task:\n{task_text.strip()}\n\n"
+                            f"Instructions:\n"
+                            f"1. Carry out this task directly using your available tools.\n"
+                            f"2. When finished, conclude your final response with your verdict line:\n"
+                            f"[RESULT {slot_job_id}] OK: <one-line summary of actions and outcome>\n"
+                            f"(or [RESULT {slot_job_id}] FAIL: <reason> if the task could not be completed)\n"
+                        )
 
                     # Native Subagent Execution Bridge:
                     # Spawns an interactive child session directly on the target worker
@@ -1196,7 +1438,13 @@ def check_and_archive_terminal_swarms():
     for sid, swarm in swarms_data.items():
         st = swarm.get("status")
         if st in ("completed", "partial", "killed"):
-            # Check slots or matching sidechats
+            # Check slot subagent sessions
+            for slot in swarm.get("slots", []):
+                sub_id = slot.get("subagent_session_id")
+                ag = slot.get("agent_id")
+                if sub_id and ag:
+                    archive_ephemeral_thread(ag, sub_id, job_id=sid)
+            # Check matching registered sidechats
             for key, val in sc_data.items():
                 if isinstance(val, dict) and not val.get("archived") and val.get("type") != "persistent":
                     if sid in key or (swarm.get("label") and swarm.get("label") in key):
@@ -1207,10 +1455,13 @@ def check_and_archive_terminal_swarms():
 
 
 
-def maybe_nudge_untagged_sidechat(agent, thread_id, thread_name, mid, text, dry_run=False):
+def maybe_nudge_untagged_sidechat(agent, thread_id, thread_name, mid, text, dry_run=False,
+                                acted=False):
     """
     If an agent replies conversationally in a sidechat backed by a job or follow-up
     without providing [RESULT <id>] or tool directives, deliver a terse 1-turn nudge footer.
+    When acted=True the agent DID emit directives but never closed: remind to close
+    with [RESULT] instead of rejecting the (good) action.
     """
     if dry_run or not thread_id or thread_id == "main":
         return
@@ -1255,14 +1506,23 @@ def maybe_nudge_untagged_sidechat(agent, thread_id, thread_name, mid, text, dry_
                 matching_job_id, matching_job_id, prompt_envelope.pick_profile(matching_job_id))
         except Exception:
             _spawn = '[TOOL swarm.spawn {"count": 2, "task": "continue the job work"}]'
-        nudge_msg = (
+        if acted:
-            f"{_spawn}\n"
+            nudge_msg = (
-            f"[STRICT ENFORCEMENT: Conversational commentary is rejected. Work requires active execution.]\n"
+                f"Action received — now close the loop: reply with [RESULT {matching_job_id}] <outcome>.\n"
-            f"Thread Console: {thread_url}\n"
+                f"Outcome needs checkable evidence (swarm/timer IDs, paths, or command output), not prose alone.\n"
-            f"Emit executable tool calls now: [TOOL <op> <args>] or curl against https://exec.muse-dev.online/exec\n"
+                f"Thread Console: {thread_url}"
-            f"When all operations are finished, close strictly with [RESULT {matching_job_id}] <outcome>.\n"
+            )
-            f"{_spawn}"
+        else:
-        )
+            nudge_msg = (
+                f"{_spawn}\n"
+                f"[STRICT ENFORCEMENT: Conversational commentary is rejected. Work requires active execution.]\n"
+                f"Thread Console: {thread_url}\n"
+                f"EMIT tool calls verbatim in your reply — you do not run them yourself;"
+                f" the Box runtime on bl executes each directive and posts the result back here"
+                f" (works from containers with no box CLI). Or curl against https://exec.muse-dev.online/exec\n"
+                f"When all operations are finished, close strictly with [RESULT {matching_job_id}] <outcome>.\n"
+                f"{_spawn}"
+            )
         try:
             import muse_hybrid
             print(f"[{agent}] Injecting 1-turn strict nudge into {thread_name or thread_id[:8]} for job {matching_job_id}")

bin/retention-archive-jobs.py

@@ -0,0 +1,409 @@
+#!/usr/bin/env python3
+"""retention-archive-jobs.py — Retention Piece 2: Job definition archival & pruning.
+
+Archives retired manual job definitions from jobs/ to jobs/archive/ via git mv,
+preventing scheduler parsing overhead while preserving full git history and readability.
+
+Guards active jobs dynamically:
+  1. Systemd user units (~/.config/systemd/user/job-*.service)
+  2. Active pipeline runs in pipelines.json (and linked on_success/on_failure/chain_next)
+  3. Core baseline fleet jobs (heartbeat, refine-system, canary-test)
+
+Usage:
+  retention-archive-jobs.py scan [--dry-run] [--limit N] [--json]
+  retention-archive-jobs.py archive <name> [--dry-run] [--force] [--json]
+  retention-archive-jobs.py unarchive <name> [--dry-run] [--json]
+  retention-archive-jobs.py list [--json]
+"""
+
+import argparse
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+NETVM_ROOT = Path(os.environ.get("NETVM_ROOT", "/home/super/Projects/NetVM"))
+JOBS_DIR = NETVM_ROOT / "jobs"
+ARCHIVE_DIR = JOBS_DIR / "archive"
+PIPELINES_FILE = NETVM_ROOT / "pipelines.json"
+SYSTEMD_USER_DIR = Path(os.path.expanduser("~/.config/systemd/user"))
+
+CORE_PROTECTED = frozenset({"heartbeat", "refine-system", "canary-test"})
+
+
+def run_git(*args, cwd=None):
+    """Run git command safely and return (returncode, stdout, stderr)."""
+    cwd = cwd or NETVM_ROOT
+    try:
+        r = subprocess.run(["git"] + list(args), cwd=cwd, capture_output=True, text=True, check=False)
+        return r.returncode, r.stdout.strip(), r.stderr.strip()
+    except Exception as e:
+        return 1, "", str(e)
+
+
+def is_git_tracked(rel_path, root_dir=None):
+    """Check if a file is tracked in git."""
+    rc, stdout, _ = run_git("ls-files", str(rel_path), cwd=root_dir)
+    return rc == 0 and bool(stdout.strip())
+
+
+def get_protected_jobs(root_dir=None):
+    """Return dict of {job_name: reason} for all dynamically protected jobs."""
+    root = Path(root_dir) if root_dir else NETVM_ROOT
+    jobs_dir = root / "jobs"
+    protected = {k: "core baseline" for k in CORE_PROTECTED}
+
+    # 1. Systemd user timers / services
+    systemd_dirs = [SYSTEMD_USER_DIR, root / "systemd"]
+    for sdir in systemd_dirs:
+        if not sdir.exists():
+            continue
+        for sfile in sdir.glob("job-*.service"):
+            try:
+                content = sfile.read_text()
+                for line in content.splitlines():
+                    if "job-dispatch.py" in line and line.strip().startswith("ExecStart="):
+                        m = re.search(r"job-dispatch\.py\s+([A-Za-z0-9_-]+)", line)
+                        if m:
+                            protected[m.group(1)] = f"systemd unit: {sfile.name}"
+            except Exception:
+                pass
+
+    # 2. In-flight pipelines from pipelines.json
+    pipe_file = root / "pipelines.json"
+    if pipe_file.exists():
+        try:
+            data = json.loads(pipe_file.read_text())
+            for run_id, run_data in data.items():
+                status = str(run_data.get("status", "")).lower()
+                if status in ("running", "dispatched", "pending"):
+                    pname = run_data.get("pipeline_name")
+                    if pname:
+                        protected[pname] = f"active pipeline {run_id}"
+                    for step in run_data.get("steps", []):
+                        sjob = step.get("job_name")
+                        if sjob:
+                            protected[sjob] = f"active pipeline {run_id} (step)"
+        except Exception:
+            pass
+
+    # 3. Chained job targets (transitive expansion of on_success, on_failure, chain_next)
+    to_expand = list(protected.keys())
+    visited = set()
+    while to_expand:
+        cur = to_expand.pop(0)
+        if cur in visited:
+            continue
+        visited.add(cur)
+        jpath = jobs_dir / f"{cur}.json"
+        if not jpath.exists():
+            continue
+        try:
+            d = json.loads(jpath.read_text())
+            for field in ("chain_next", "on_success", "on_failure"):
+                target = d.get(field)
+                if isinstance(target, str) and target.strip():
+                    tname = target.strip()
+                    # Skip common literal alerts like 'alert' unless an actual job definition exists
+                    if tname == "alert" and not (jobs_dir / "alert.json").exists():
+                        continue
+                    if tname not in protected:
+                        protected[tname] = f"linked by {cur} ({field})"
+                        if tname not in visited:
+                            to_expand.append(tname)
+        except Exception:
+            pass
+
+    return protected
+
+
+def is_eligible(job_path, protected_jobs):
+    """Determine if a job file is eligible for archival. Returns (bool, reason)."""
+    try:
+        data = json.loads(job_path.read_text())
+    except Exception as e:
+        return False, f"unreadable/invalid JSON: {e}"
+
+    name = data.get("name") or job_path.stem
+    if name in protected_jobs:
+        return False, f"protected: {protected_jobs[name]}"
+
+    schedule = str(data.get("schedule", "")).strip().lower()
+    if schedule == "manual" or not schedule:
+        return True, "manual schedule and not protected"
+
+    return False, f"active recurring schedule: {schedule}"
+
+
+def archive_job(name, dry_run=False, force=False, root_dir=None):
+    """Archive a single job by name. Returns dict with operation details."""
+    root = Path(root_dir) if root_dir else NETVM_ROOT
+    jobs_dir = root / "jobs"
+    archive_dir = jobs_dir / "archive"
+    src_file = jobs_dir / f"{name}.json"
+    dest_file = archive_dir / f"{name}.json"
+
+    if not src_file.exists():
+        if dest_file.exists():
+            return {"name": name, "status": "already_archived", "path": str(dest_file)}
+        return {"name": name, "status": "error", "error": f"Job file not found: {src_file}"}
+
+    # Verify JSON syntax
+    try:
+        content = json.loads(src_file.read_text())
+    except Exception as e:
+        return {"name": name, "status": "error", "error": f"Invalid source JSON: {e}"}
+
+    protected_jobs = get_protected_jobs(root)
+    if name in protected_jobs and not force:
+        return {"name": name, "status": "rejected", "error": f"Job is protected: {protected_jobs[name]}"}
+
+    if dry_run:
+        return {
+            "name": name,
+            "status": "dry_run",
+            "action": "would_archive",
+            "from": str(src_file),
+            "to": str(dest_file),
+        }
+
+    archive_dir.mkdir(parents=True, exist_ok=True)
+    tracked = is_git_tracked(src_file.relative_to(root), root_dir=root)
+
+    if tracked:
+        rc, _, err = run_git("mv", str(src_file), str(dest_file), cwd=root)
+        if rc != 0:
+            # Fallback to direct move + git add/rm
+            src_file.rename(dest_file)
+            run_git("add", str(dest_file), cwd=root)
+            run_git("rm", "-q", str(src_file), cwd=root)
+    else:
+        src_file.rename(dest_file)
+
+    # Verify destination file
+    try:
+        json.loads(dest_file.read_text())
+    except Exception as e:
+        return {"name": name, "status": "error", "error": f"Destination JSON verification failed: {e}"}
+
+    return {
+        "name": name,
+        "status": "archived",
+        "from": str(src_file),
+        "to": str(dest_file),
+        "git_tracked": tracked,
+    }
+
+
+def unarchive_job(name, dry_run=False, root_dir=None):
+    """Restore an archived job back to jobs/. Returns dict with operation details."""
+    root = Path(root_dir) if root_dir else NETVM_ROOT
+    jobs_dir = root / "jobs"
+    archive_dir = jobs_dir / "archive"
+    src_file = archive_dir / f"{name}.json"
+    dest_file = jobs_dir / f"{name}.json"
+
+    if not src_file.exists():
+        if dest_file.exists():
+            return {"name": name, "status": "already_active", "path": str(dest_file)}
+        return {"name": name, "status": "error", "error": f"Archived job not found: {src_file}"}
+
+    try:
+        content = json.loads(src_file.read_text())
+    except Exception as e:
+        return {"name": name, "status": "error", "error": f"Invalid archived JSON: {e}"}
+
+    if dry_run:
+        return {
+            "name": name,
+            "status": "dry_run",
+            "action": "would_unarchive",
+            "from": str(src_file),
+            "to": str(dest_file),
+        }
+
+    tracked = is_git_tracked(src_file.relative_to(root), root_dir=root)
+
+    if tracked:
+        rc, _, _ = run_git("mv", str(src_file), str(dest_file), cwd=root)
+        if rc != 0:
+            src_file.rename(dest_file)
+            run_git("add", str(dest_file), cwd=root)
+            run_git("rm", "-q", str(src_file), cwd=root)
+    else:
+        src_file.rename(dest_file)
+
+    try:
+        json.loads(dest_file.read_text())
+    except Exception as e:
+        return {"name": name, "status": "error", "error": f"Destination JSON verification failed: {e}"}
+
+    return {
+        "name": name,
+        "status": "unarchived",
+        "from": str(src_file),
+        "to": str(dest_file),
+        "git_tracked": tracked,
+    }
+
+
+def scan_and_archive(dry_run=False, limit=None, root_dir=None):
+    """Scan jobs/ for all eligible jobs and archive them."""
+    root = Path(root_dir) if root_dir else NETVM_ROOT
+    jobs_dir = root / "jobs"
+    archive_dir = jobs_dir / "archive"
+
+    protected_jobs = get_protected_jobs(root)
+    eligible = []
+    skipped = []
+
+    for jpath in sorted(jobs_dir.glob("*.json")):
+        name = jpath.stem
+        is_el, reason = is_eligible(jpath, protected_jobs)
+        if is_el:
+            eligible.append((name, jpath))
+        else:
+            skipped.append((name, reason))
+
+    to_process = eligible[:limit] if limit else eligible
+    results = []
+
+    for name, _ in to_process:
+        res = archive_job(name, dry_run=dry_run, root_dir=root)
+        results.append(res)
+
+    archived_count = sum(1 for r in results if r["status"] in ("archived", "dry_run"))
+
+    # Commit git changes if not dry_run and we actually archived tracked files
+    commit_sha = None
+    if not dry_run and archived_count > 0:
+        names_str = ", ".join(r["name"] for r in results if r["status"] == "archived")
+        commit_msg = f"chore(retention): archive retired jobs [{names_str}]"
+        rc, out, err = run_git("commit", "-m", commit_msg, cwd=root)
+        if rc == 0:
+            _, sha, _ = run_git("rev-parse", "--short", "HEAD", cwd=root)
+            commit_sha = sha
+
+    return {
+        "scanned": len(list(jobs_dir.glob("*.json"))),
+        "eligible": len(eligible),
+        "archived": archived_count,
+        "protected_total": len(protected_jobs),
+        "dry_run": dry_run,
+        "commit": commit_sha,
+        "results": results,
+    }
+
+
+def list_archived(root_dir=None):
+    """List all currently archived jobs."""
+    root = Path(root_dir) if root_dir else NETVM_ROOT
+    archive_dir = root / "jobs" / "archive"
+    if not archive_dir.exists():
+        return []
+
+    jobs = []
+    for p in sorted(archive_dir.glob("*.json")):
+        try:
+            d = json.loads(p.read_text())
+            jobs.append({
+                "name": d.get("name") or p.stem,
+                "agent": d.get("agent", "-"),
+                "schedule": d.get("schedule", "-"),
+                "description": d.get("description", ""),
+                "archived_path": str(p),
+            })
+        except Exception:
+            jobs.append({"name": p.stem, "error": "unreadable JSON", "archived_path": str(p)})
+    return jobs
+
+
+def main():
+    parser = argparse.ArgumentParser(description="NetVM Job Definition Retention & Archival Driver (P2)")
+    sub = parser.add_subparsers(dest="subcommand", required=True)
+
+    # scan
+    p_scan = sub.add_parser("scan", help="Scan jobs/ and archive all eligible retired manual jobs")
+    p_scan.add_argument("--dry-run", action="store_true", help="Print actions without modifying files")
+    p_scan.add_argument("--limit", type=int, default=None, help="Max jobs to archive in this run")
+    p_scan.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+
+    # archive
+    p_arch = sub.add_parser("archive", help="Archive a specific job by name")
+    p_arch.add_argument("name", help="Job name")
+    p_arch.add_argument("--dry-run", action="store_true", help="Simulate without modifying files")
+    p_arch.add_argument("--force", action="store_true", help="Force archive even if marked protected")
+    p_arch.add_argument("--commit", action="store_true", help="Create a git commit for the archive move")
+    p_arch.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+
+    # unarchive
+    p_unarch = sub.add_parser("unarchive", help="Restore an archived job to jobs/")
+    p_unarch.add_argument("name", help="Job name")
+    p_unarch.add_argument("--dry-run", action="store_true", help="Simulate without modifying files")
+    p_unarch.add_argument("--commit", action="store_true", help="Create a git commit for the unarchive move")
+    p_unarch.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+
+    # list
+    p_list = sub.add_parser("list", help="List archived jobs in jobs/archive/")
+    p_list.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+
+    args = parser.parse_args()
+
+    if args.subcommand == "scan":
+        res = scan_and_archive(dry_run=args.dry_run, limit=args.limit)
+        if args.json:
+            print(json.dumps(res, indent=2))
+        else:
+            mode = " [DRY-RUN]" if args.dry_run else ""
+            print(f"=== Retention Job Archival Scan{mode} ===")
+            print(f"Scanned jobs: {res['scanned']}")
+            print(f"Eligible for archival: {res['eligible']}")
+            print(f"Archived count: {res['archived']}")
+            if res.get("commit"):
+                print(f"Committed as: {res['commit']}")
+            for item in res["results"]:
+                status = item["status"]
+                print(f"  • {item['name']:25} -> {status}")
+            print("========================================")
+
+    elif args.subcommand == "archive":
+        res = archive_job(args.name, dry_run=args.dry_run, force=args.force)
+        if not args.dry_run and args.commit and res.get("status") == "archived":
+            run_git("commit", "-m", f"chore(retention): archive job {args.name}")
+        if args.json:
+            print(json.dumps(res, indent=2))
+        else:
+            if res.get("status") in ("archived", "dry_run"):
+                print(f"✔ Job '{args.name}' archived to jobs/archive/{args.name}.json")
+            else:
+                print(f"✖ Failed to archive job '{args.name}': {res.get('error') or res.get('status')}", file=sys.stderr)
+                sys.exit(1)
+
+    elif args.subcommand == "unarchive":
+        res = unarchive_job(args.name, dry_run=args.dry_run)
+        if not args.dry_run and args.commit and res.get("status") == "unarchived":
+            run_git("commit", "-m", f"chore(retention): unarchive job {args.name}")
+        if args.json:
+            print(json.dumps(res, indent=2))
+        else:
+            if res.get("status") in ("unarchived", "dry_run"):
+                print(f"✔ Job '{args.name}' unarchived to jobs/{args.name}.json")
+            else:
+                print(f"✖ Failed to unarchive job '{args.name}': {res.get('error') or res.get('status')}", file=sys.stderr)
+                sys.exit(1)
+
+    elif args.subcommand == "list":
+        items = list_archived()
+        if args.json:
+            print(json.dumps(items, indent=2))
+        else:
+            print(f"\n=== ARCHIVED JOBS ({len(items)}) ===")
+            for item in items:
+                print(f"  • {item['name']:25} [{item.get('agent', '-')}] {item.get('description', '')[:50]}")
+            print()
+
+
+if __name__ == "__main__":
+    main()

bin/retention-run-rotations.sh

@@ -22,6 +22,7 @@ fail=0
 "$BIN/retention-rotate-chat-history.sh" || fail=1
 "$BIN/retention-rotate-job-log.sh"     || fail=1
 "$BIN/retention-archive-followups.py"  || fail=1
+"$BIN/retention-archive-jobs.py" scan  || fail=1
 
 echo "--- verification ---"
 
@@ -40,6 +41,7 @@ done
 
 echo "--- live sizes after run ---"
 ls -la "$ROOT/logs/chat-history.jsonl" "$ROOT/job-log.jsonl" "$ROOT/followups.json" 2>/dev/null || true
+echo "active jobs: $(ls -1 "$ROOT/jobs"/*.json 2>/dev/null | wc -l), archived jobs: $(ls -1 "$ROOT/jobs/archive"/*.json 2>/dev/null | wc -l)"
 
 echo "=== retention-run done rc=$fail ==="
 exit $fail

bin/self_main_loop.py

@@ -280,10 +280,17 @@ def make_digest_id(agent):
 # recursive box->agent->box discipline: post the RESULT back in this thread
 # (box records it and dispatches the next chained step); never DM the next
 # agent directly. ~166 chars, within the 600-char digest budget.
-CONTRACT_FOOTER = ("Reply: [ACK id] seen | [CLAIM id] mine | "
+try:
-                   "[RESULT id] done | [DECLINE id] | [NO-ACTION id]. "
+    import lookup_engine
-                   "Report back here. Box dispatches the next step; "
+    HAS_LOOKUP_ENGINE = True
-                   "do not DM the next agent directly.")
+except ImportError:
+    HAS_LOOKUP_ENGINE = False
+
+_DEFAULT_CONTRACT_FOOTER = ("Reply: [ACK id] seen | [CLAIM id] mine | "
+                           "[RESULT id] done | [DECLINE id] | [NO-ACTION id]. "
+                           "Report back here. Box dispatches the next step; "
+                           "do not DM the next agent directly.")
+CONTRACT_FOOTER = lookup_engine.get_contract_footer() if HAS_LOOKUP_ENGINE else _DEFAULT_CONTRACT_FOOTER
 
 
 def send_prompt(sender, agent, sidechat, digest):

bin/settings_rpa.py

@@ -0,0 +1,460 @@
+#!/usr/bin/env python3
+"""settings_rpa.py: RPA module for Muse.ai Settings menu, dock rail, and dialogs.
+
+Provides headless browser automation primitives for:
+  - Dock rail settings menu toggle via CDP mouse events
+  - Settings dialog navigation (General, Connectors, Wallet, etc.)
+  - Token and weekly quota usage inspection
+  - Settings-based invite code redemption entry point
+
+Compatible with NetVM's unified box CLI and approvals system.
+"""
+
+from __future__ import annotations
+
+import argparse
+import itertools
+import json
+import re
+import sys
+import time
+from dataclasses import asdict, dataclass
+from typing import Any, Dict, List, Optional, Tuple
+
+try:
+    from approvals import cdp_evaluate, get_cdp_ws, get_node_pages
+except ImportError:
+    # Allow running when approvals is in current dir or NetVM bin
+    import os
+    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+    from approvals import cdp_evaluate, get_cdp_ws, get_node_pages
+
+
+_REQ_COUNTER = itertools.count(10000)
+
+
+@dataclass
+class UsageBar:
+    label: str
+    percent: int
+    raw_text: str
+
+
+@dataclass
+class NodeUsage:
+    node: str
+    plan: str
+    weekly_reset_text: str
+    weekly_percent_used: int
+    extra_tokens_status: str
+    extra_percent_used: int
+    extra_tokens_remaining: str
+    is_blocked: bool
+    bars: List[Dict[str, Any]]
+    dialog_text: str
+    has_redeemed: bool = False
+    stats_loaded: bool = True
+
+    def to_dict(self) -> Dict[str, Any]:
+        return asdict(self)
+
+
+
+def cdp_send_command(ws: Any, method: str, params: Dict[str, Any], timeout: float = 3.0) -> Optional[Dict[str, Any]]:
+    """Send a raw CDP command and await response with a unique request ID."""
+    req_id = next(_REQ_COUNTER)
+    msg = {"id": req_id, "method": method, "params": params}
+    ws.send(json.dumps(msg))
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            raw = ws.recv()
+        except Exception:
+            break
+        resp = json.loads(raw)
+        if resp.get("id") == req_id:
+            return resp.get("result", {})
+    return None
+
+
+def cdp_dispatch_mouse_click(ws: Any, x: float, y: float, timeout: float = 3.0) -> bool:
+    """Simulate real mousePressed and mouseReleased events at (x, y)."""
+    p1 = cdp_send_command(
+        ws,
+        "Input.dispatchMouseEvent",
+        {"type": "mousePressed", "x": x, "y": y, "button": "left", "clickCount": 1},
+        timeout=timeout,
+    )
+    p2 = cdp_send_command(
+        ws,
+        "Input.dispatchMouseEvent",
+        {"type": "mouseReleased", "x": x, "y": y, "button": "left", "clickCount": 1},
+        timeout=timeout,
+    )
+    return p1 is not None and p2 is not None
+
+
+def cdp_click_element_by_selector(ws: Any, selector: str, timeout: float = 3.0) -> bool:
+    """Find element by selector, calculate bounding box center, and dispatch real mouse click."""
+    js_rect = f"""(() => {{
+        const el = document.querySelector({json.dumps(selector)});
+        if (!el) return null;
+        const r = el.getBoundingClientRect();
+        if (r.width === 0 || r.height === 0) return null;
+        return {{x: r.x + r.width / 2, y: r.y + r.height / 2}};
+    }})()"""
+    rect = cdp_evaluate(ws, js_rect, timeout=timeout)
+    if not rect or "x" not in rect:
+        return False
+    return cdp_dispatch_mouse_click(ws, float(rect["x"]), float(rect["y"]), timeout=timeout)
+
+
+def cdp_send_escape(ws: Any) -> None:
+    """Send an Escape keydown event to dismiss popovers and modals."""
+    js_escape = """(() => {
+        document.dispatchEvent(new KeyboardEvent('keydown', {
+            key: 'Escape',
+            code: 'Escape',
+            keyCode: 27,
+            which: 27,
+            bubbles: true,
+            cancelable: true
+        }));
+    })()"""
+    cdp_evaluate(ws, js_escape)
+
+
+class SettingsRPA:
+    """Automates Settings menu, dialogs, and usage inspection for a NetVM node."""
+
+    def __init__(self, node: str, timeout: float = 4.0):
+        self.node = node
+        self.timeout = timeout
+        self.ws = None
+        self.page = None
+
+    def connect(self) -> SettingsRPA:
+        if self.ws is None:
+            self.ws, self.page = get_cdp_ws(self.node, timeout=self.timeout)
+        return self
+
+    def close(self) -> None:
+        if self.ws is not None:
+            try:
+                self.ws.close()
+            except Exception:
+                pass
+            self.ws = None
+
+    def __enter__(self) -> SettingsRPA:
+        return self.connect()
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
+        self.close()
+
+    def ensure_main_chat(self) -> bool:
+        """Ensure agent is in main chat home view so dock and main toolbar are active."""
+        self.connect()
+        js_is_main = """(() => {
+            return Boolean(document.querySelector('[data-testid="hatch-invite-friends-button"]'));
+        })()"""
+        if cdp_evaluate(self.ws, js_is_main):
+            return True
+
+        # Click the chat dock item to return to main
+        cdp_evaluate(
+            self.ws,
+            """(() => {
+            const chatLink = document.querySelector('[data-testid="hatch-nav-chat"]');
+            if (chatLink) { chatLink.click(); return true; }
+            return false;
+        })()""",
+        )
+        time.sleep(1.0)
+        return bool(cdp_evaluate(self.ws, js_is_main))
+
+    def is_menu_open(self) -> bool:
+        """Check if dock radix menu is currently open."""
+        self.connect()
+        js_check = """(() => {
+            return document.querySelectorAll('[role="menuitem"]').length > 0;
+        })()"""
+        return bool(cdp_evaluate(self.ws, js_check))
+
+    def is_settings_dialog_open(self) -> bool:
+        """Check if Settings dialog is currently open."""
+        self.connect()
+        js_check = """(() => {
+            const d = document.querySelector('[role="dialog"]');
+            if (!d) return false;
+            const h = d.querySelector('h2');
+            return h && h.innerText.trim().toLowerCase() === 'settings';
+        })()"""
+        return bool(cdp_evaluate(self.ws, js_check))
+
+    def open_dock_menu(self) -> bool:
+        """Open the dock settings menu via real mouse clicks on hatch-dock-more."""
+        self.connect()
+        if self.is_menu_open():
+            return True
+
+        # Dispatch real mouse click on dock button
+        clicked = cdp_click_element_by_selector(self.ws, '[data-testid="hatch-dock-more"]', timeout=self.timeout)
+        if not clicked:
+            return False
+
+        deadline = time.time() + 2.0
+        while time.time() < deadline:
+            if self.is_menu_open():
+                return True
+            time.sleep(0.1)
+        return False
+
+    def close_dock_menu(self) -> None:
+        """Dismiss dock menu."""
+        if self.is_menu_open():
+            cdp_send_escape(self.ws)
+            time.sleep(0.2)
+
+    def open_settings_dialog(self) -> bool:
+        """Open the Settings dialog through the dock settings menu."""
+        self.connect()
+        if self.is_settings_dialog_open():
+            return True
+
+        # Ensure menu is open
+        if not self.open_dock_menu():
+            return False
+
+        time.sleep(0.3)
+        # Click "Settings" menu item
+        js_click_item = """(() => {
+            const items = Array.from(document.querySelectorAll('[role="menuitem"]'));
+            const target = items.find(el => el.getAttribute('data-pel-click') === 'settings_nav_click') ||
+                           items.find(el => (el.innerText || '').trim() === 'Settings');
+            if (target) {
+                target.click();
+                return true;
+            }
+            return false;
+        })()"""
+        clicked = cdp_evaluate(self.ws, js_click_item)
+        if not clicked:
+            return False
+
+        deadline = time.time() + 3.0
+        while time.time() < deadline:
+            if self.is_settings_dialog_open():
+                return True
+            time.sleep(0.15)
+        return False
+
+    def close_settings_dialog(self) -> None:
+        """Dismiss Settings dialog with Escape or Close button."""
+        if self.is_settings_dialog_open():
+            cdp_send_escape(self.ws)
+            time.sleep(0.3)
+            # If still open, try close button
+            if self.is_settings_dialog_open():
+                cdp_evaluate(
+                    self.ws,
+                    """(() => {
+                    const btn = Array.from(document.querySelectorAll('[role="dialog"] button')).find(b => (b.innerText||'').trim() === 'Close');
+                    if (btn) btn.click();
+                })()""",
+                )
+                time.sleep(0.2)
+
+    def select_tab(self, tab_name: str) -> bool:
+        """Select a section tab inside the Settings dialog."""
+        self.connect()
+        if not self.open_settings_dialog():
+            return False
+
+        js_tab = f"""(() => {{
+            const btns = Array.from(document.querySelectorAll('[role="dialog"] button'));
+            const tab = btns.find(b => (b.innerText||'').trim().toLowerCase() === {json.dumps(tab_name.lower())});
+            if (tab) {{
+                tab.click();
+                return true;
+            }}
+            return false;
+        }})()"""
+        res = cdp_evaluate(self.ws, js_tab)
+        if res:
+            time.sleep(0.4)
+            return True
+        return False
+
+    def read_usage(self, keep_dialog_open: bool = False) -> NodeUsage:
+        """Open settings dialog, read token and weekly limit usage, and optionally close dialog."""
+        self.connect()
+        opened = self.open_settings_dialog()
+        if not opened:
+            raise RuntimeError(f"Could not open Settings dialog for node {self.node}")
+
+        # Ensure General tab is active
+        self.select_tab("General")
+        time.sleep(0.4)
+
+        js_usage = """(() => {
+            const dialog = document.querySelector('[role="dialog"]');
+            if (!dialog) return null;
+            const fullText = dialog.innerText || '';
+            const bars = Array.from(dialog.querySelectorAll('[role="progressbar"]')).map(b => ({
+                label: b.getAttribute('aria-label') || '',
+                percent: parseInt(b.getAttribute('aria-valuenow') || '0', 10),
+                raw_text: b.parentElement ? b.parentElement.innerText.trim() : ''
+            }));
+
+            // Extract plan
+            let plan = 'Free plan';
+            if (fullText.includes('Free plan')) plan = 'Free plan';
+            else if (fullText.includes('Pro plan')) plan = 'Pro plan';
+
+            // Extract reset text
+            let resetText = '';
+            const mReset = fullText.match(/Weekly limit resets on [^\\n]+/);
+            if (mReset) resetText = mReset[0];
+
+            // Extract tokens left
+            let tokensLeft = '';
+            const mLeft = fullText.match(/\\(([^\\)]+tokens left)\\)/);
+            if (mLeft) tokensLeft = mLeft[1];
+            else if (fullText.includes('0 tokens left')) tokensLeft = '0 tokens left';
+
+            return {
+                dialogText: fullText,
+                bars: bars,
+                plan: plan,
+                resetText: resetText,
+                tokensLeft: tokensLeft
+            };
+        })()"""
+        # Poll up to 4.0s for usage elements to render in React
+        deadline = time.time() + 4.0
+        raw = None
+        while time.time() < deadline:
+            res = cdp_evaluate(self.ws, js_usage)
+            if res and (res.get("bars") or "Weekly limit" in res.get("dialogText", "") or "Additional tokens" in res.get("dialogText", "")):
+                raw = res
+                break
+            time.sleep(0.3)
+        if not raw:
+            raw = cdp_evaluate(self.ws, js_usage)
+
+        if not keep_dialog_open:
+            self.close_settings_dialog()
+
+        if not raw:
+            raw = {
+                "dialogText": "",
+                "bars": [],
+                "plan": "Unknown",
+                "resetText": "Unavailable (usage stats did not load)",
+                "tokensLeft": "Unavailable",
+            }
+
+        bars = raw.get("bars", [])
+        dialog_text = raw.get("dialogText", "")
+        stats_loaded = bool(bars or "Weekly limit" in dialog_text or "Additional tokens" in dialog_text or "Free plan" in dialog_text)
+
+        weekly_pct = 0
+        extra_pct = 0
+        extra_status = "Never expires"
+
+        for b in bars:
+            label = b.get("label", "").lower()
+            detail = b.get("raw_text", "").lower()
+            if "free plan" in label or "weekly" in detail:
+                weekly_pct = b.get("percent", 0)
+            elif "additional tokens" in label or "additional" in detail:
+                extra_pct = b.get("percent", 0)
+
+        # Blocked condition: weekly limit 100% and additional tokens 100% or 0 tokens left
+        tokens_left = raw.get("tokensLeft", "")
+        is_blocked = bool(stats_loaded and ((weekly_pct >= 100 and extra_pct >= 100) or ("0 tokens left" in tokens_left)))
+
+        # has_redeemed binary: If the "Additional tokens" ticker is present in Settings (or "Redeem invite code" entry is absent),
+        # the agent has already redeemed an invite code.
+        has_extra_ticker = any("additional tokens" in b.get("label", "").lower() or "additional" in b.get("raw_text", "").lower() for b in bars)
+        has_redeemed = bool(has_extra_ticker or ("Additional tokens" in dialog_text))
+
+        return NodeUsage(
+            node=self.node,
+            plan=raw.get("plan", "Unknown" if not stats_loaded else "Free plan"),
+            weekly_reset_text=raw.get("resetText", "") or ("Unavailable (stats did not load)" if not stats_loaded else ""),
+            weekly_percent_used=weekly_pct,
+            extra_tokens_status=extra_status,
+            extra_percent_used=extra_pct,
+            extra_tokens_remaining=tokens_left or ("Unavailable" if not stats_loaded else ("0 tokens left" if extra_pct >= 100 else "Unknown")),
+            is_blocked=is_blocked,
+            bars=bars,
+            dialog_text=dialog_text,
+            has_redeemed=has_redeemed,
+            stats_loaded=stats_loaded,
+        )
+
+    def check_redeem_entrypoint(self) -> Dict[str, Any]:
+        """Check if 'Redeem invite code' option is available in Settings -> General."""
+        self.connect()
+        if not self.open_settings_dialog():
+            return {"available": False, "reason": "could_not_open_settings"}
+
+        self.select_tab("General")
+        time.sleep(0.3)
+
+        js_check = """(() => {
+            const dialog = document.querySelector('[role="dialog"]');
+            if (!dialog) return {available: false, reason: 'no_dialog'};
+            const items = Array.from(dialog.querySelectorAll('button, div, span'));
+            const redeemItem = items.find(el => (el.innerText || '').trim() === 'Redeem invite code');
+            return {
+                available: Boolean(redeemItem),
+                has_text: dialog.innerText.includes('Redeem invite code')
+            };
+        })()"""
+        res = cdp_evaluate(self.ws, js_check)
+        self.close_settings_dialog()
+        return res or {"available": False, "reason": "evaluation_failed"}
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Settings menu RPA for NetVM agents")
+    parser.add_argument("node", help="Node name (e.g. 646, pip, muse, opm)")
+    parser.add_argument("--usage", action="store_true", help="Read token and weekly quota usage")
+    parser.add_argument("--json", action="store_true", help="Emit JSON output")
+    parser.add_argument("--check-redeem", action="store_true", help="Check if Redeem Invite Code is available")
+    args = parser.parse_args()
+
+    rpa = SettingsRPA(args.node)
+    try:
+        rpa.connect()
+        if args.usage:
+            usage = rpa.read_usage()
+            if args.json:
+                print(json.dumps(usage.to_dict(), indent=2))
+            else:
+                if not usage.stats_loaded:
+                    status_str = "UNLOADED (STATS DID NOT RENDER)"
+                elif usage.is_blocked:
+                    status_str = "BLOCKED (LIMIT REACHED)"
+                else:
+                    status_str = "ACTIVE"
+                print(f"=== Node {usage.node} Usage ===")
+                print(f"  Plan:           {usage.plan}")
+                print(f"  Weekly Reset:   {usage.weekly_reset_text} ({usage.weekly_percent_used}% used)")
+                print(f"  Extra Tokens:   {usage.extra_tokens_remaining} ({usage.extra_percent_used}% used)")
+                print(f"  Status:         {status_str}")
+        elif args.check_redeem:
+            info = rpa.check_redeem_entrypoint()
+            print(json.dumps(info, indent=2))
+        else:
+            usage = rpa.read_usage()
+            print(json.dumps(usage.to_dict(), indent=2))
+    finally:
+        rpa.close()
+
+
+if __name__ == "__main__":
+    main()

bin/siphon-bl.py

@@ -23,7 +23,7 @@ import time
 # Add bin dir to path for siphon imports
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
-from monitor import monitor_once
+from monitor import monitor_once, flush_digest
 from siphon import RateLimiter
 
 NETVM_BIN = "/home/super/Projects/NetVM/bin"
@@ -135,7 +135,8 @@ def get_messages(thread_id, since_msg_id):
         messages.append({
             "id": mid,
             "text": chunk[:2000],  # truncate long messages
-            "author": agent,
+            "author": "",  # INTEGRATOR 2026-10-06: was `agent`
+            # (thread owner) -- fabricated authorship; empty = unverified
             "ts": str(time.time()),
         })
 
@@ -249,6 +250,15 @@ def main():
     )
 
     save_watermarks(new_marks)
+
+    # INTEGRATOR 2026-10-06: emit batched COMPLETED digest (one message
+    # instead of N per-message relays). Urgency categories already relayed
+    # individually inside monitor_once.
+    digest_text = flush_digest()
+    if digest_text:
+        post_fn(digest_text)
+        log(f"Digest posted ({len(digest_text)} chars).")
+
     log(f"Cycle complete. Watermarks: {len(new_marks)} threads tracked.")
 
 

bin/siphon.py

@@ -1,66 +1,30 @@
 #!/usr/bin/env python3
 """
-Side-chat to main-chat work siphon — siphon action.
+Side-chat to main-chat work siphon — siphon action (INTEGRATED).
 
-When detection fires, post a summary to main chat with:
+Changes vs original (integrator; agent 3 of 5 never delivered, so the
-  - Category badge
+minimal reversible versions below stand in for its authorship/dedup work):
-  - One-line summary (never full message text)
+  - format_siphon imported from detect (single definition; honest labeling
-  - Link back to the source side chat thread
+    + honest authorship live there).
-  - Confidence score (for transparency)
+  - Deduplication is PERSISTENT: siphoned message IDs are stored as JSON
+    on disk (SIPHON_STATE_DIR or ~/.siphon-state/siphoned_ids.json) so a
+    restart can never re-relay. In-memory set kept as a fast path.
+  - mark_siphoned() writes through to disk on every call.
 
-Safety:
+Safety (unchanged):
   - Rate limited (max N siphons per hour per thread)
   - Never posts full message content
   - Respects opt-out registry
-  - Deduplicates (same message_id never siphoned twice)
+  - Deduplicates (same message_id never siphoned twice, even across restarts)
 """
 
+import json
+import os
 import time
 from dataclasses import dataclass, field
 from typing import Callable, Optional
 
-from detect import SiphonHit, is_opted_out
+from detect import SiphonHit, is_opted_out, format_siphon  # noqa: F401 (re-export)
-
-
-# --- Follow-up modulation ---
-#
-# Wire the follow-up modulation table into the siphon so each hit gets
-# the right follow-up policy:
-#   ALERT / BLOCKER / DECISION -> tracked, fast fuse for ALERT/BLOCKER
-#   COMPLETED / MILESTONE      -> untracked (no nudge budget burned)
-#
-# modulate.py must be landed on bl before this runs (rollout step 1).
-# If the import fails we degrade to the old behavior: post the summary
-# with no follow-up tags (fail-closed toward visibility, not tracking).
-try:
-    from modulate import for_siphon_hit, render_tags
-    _MODULATION_AVAILABLE = True
-except ImportError:  # pragma: no cover - deploy keeps modulate.py present
-    _MODULATION_AVAILABLE = False
-    for_siphon_hit = None
-    render_tags = None
-
-
-def policy_for_hit(hit: SiphonHit):
-    """Follow-up policy for a siphon hit, or None when untracked.
-
-    COMPLETED / MILESTONE hits return None (post the summary, create no
-    follow-up record). ALERT / BLOCKER / DECISION return a Policy whose
-    tags render into the canonical bracket vocabulary.
-    """
-    if not _MODULATION_AVAILABLE:
-        return None
-    return for_siphon_hit(hit.category)
-
-
-def is_tracked(hit: SiphonHit) -> bool:
-    """True when this hit should create a follow-up record.
-
-    Callers that route tracked posts through dm.py --expect-reply (so a
-    dm_followup record is actually created) can use this to choose the
-    post path. Untracked hits post as plain summaries.
-    """
-    return policy_for_hit(hit) is not None
 
 
 # --- Rate limiting ---
@@ -82,9 +46,37 @@ class RateLimiter:
         return True
 
 
-# --- Deduplication ---
+# --- Deduplication (persistent) ---
 
-_siphoned_ids: set = set()
+_STATE_DIR = os.environ.get(
+    "SIPHON_STATE_DIR", os.path.expanduser("~/.siphon-state"))
+DEDUP_FILE = os.path.join(_STATE_DIR, "siphoned_ids.json")
+_DEDUP_MAX_IDS = 5000  # bound disk growth; oldest evicted first
+
+
+def _load_siphoned() -> set:
+    try:
+        with open(DEDUP_FILE) as f:
+            data = json.load(f)
+        ids = data.get("ids", []) if isinstance(data, dict) else []
+        return set(ids)
+    except (OSError, ValueError):
+        return set()
+
+
+def _save_siphoned(ids: set) -> None:
+    try:
+        os.makedirs(_STATE_DIR, exist_ok=True)
+        trimmed = sorted(ids)[-_DEDUP_MAX_IDS:]
+        tmp = DEDUP_FILE + ".tmp"
+        with open(tmp, "w") as f:
+            json.dump({"ids": trimmed, "updated": time.time()}, f)
+        os.replace(tmp, DEDUP_FILE)
+    except OSError:
+        pass  # dedup degrades to in-memory; never crash the relay on IO
+
+
+_siphoned_ids: set = _load_siphoned()
 
 
 def already_siphoned(message_id: str) -> bool:
@@ -93,6 +85,11 @@ def already_siphoned(message_id: str) -> bool:
 
 def mark_siphoned(message_id: str):
     _siphoned_ids.add(message_id)
+    _save_siphoned(_siphoned_ids)
+
+
+def siphoned_count() -> int:
+    return len(_siphoned_ids)
 
 
 # --- Siphon action ---
@@ -106,21 +103,6 @@ CATEGORY_EMOJI = {
 }
 
 
-def format_siphon(hit: SiphonHit, agent_name: str = "sidechat") -> str:
-    """
-    Format a siphon message for main chat.
-    Never includes full message text — summary + link only.
-    """
-    emoji = CATEGORY_EMOJI.get(hit.category, "📋")
-    thread_url = f"https://muse.ai/thread/{hit.thread_id}"
-    return (
-        f"{emoji} [{hit.category}] from {agent_name} side chat\n"
-        f"{hit.summary}\n"
-        f"→ {thread_url}\n"
-        f"(confidence {hit.confidence:.0%})"
-    )
-
-
 def siphon(hit: SiphonHit,
            agent_name: str,
            post_to_main: Callable[[str], bool],
@@ -142,16 +124,6 @@ def siphon(hit: SiphonHit,
         return False
 
     text = format_siphon(hit, agent_name)
-
-    # Follow-up modulation: tracked hits (ALERT/BLOCKER/DECISION) get
-    # the canonical follow-up tags appended — [reply:expected],
-    # [reply:timeout=N], [reply:nudges=N], [reply:escalate=X], and
-    # [input:siphon] for the audit trail. Untracked hits
-    # (COMPLETED/MILESTONE) post as plain summaries.
-    policy = policy_for_hit(hit)
-    if policy is not None:
-        text = text + "\n" + render_tags(policy)
-
     ok = post_to_main(text)
     if ok:
         mark_siphoned(hit.message_id)

bin/subagent_tracker.py

@@ -59,8 +59,40 @@ def register_session(parent, session_id, title=None, prompt=None):
     return entry
 
 
-def get_active_sessions(parent=None):
+DEFAULT_TTL_SECONDS = 3600  # 1 hour idle TTL
+
+
+def prune_stale_sessions(ttl_seconds=DEFAULT_TTL_SECONDS):
+    """Archive active sessions whose last activity exceeds ttl_seconds."""
+    data = load_sessions()
+    now = datetime.now(timezone.utc)
+    changed = False
+    for sid, s in data.items():
+        if s.get("status") == "active":
+            last_act = s.get("last_activity_at") or s.get("spawned_at")
+            if last_act:
+                try:
+                    dt = datetime.fromisoformat(last_act.replace("Z", "+00:00"))
+                    if dt.tzinfo is None:
+                        dt = dt.replace(tzinfo=timezone.utc)
+                    if (now - dt).total_seconds() >= ttl_seconds:
+                        s["status"] = "archived"
+                        s["archived_at"] = utcnow()
+                        s["archive_reason"] = f"idle_ttl_exceeded_{ttl_seconds}s"
+                        changed = True
+                except Exception:
+                    pass
+    if changed:
+        save_sessions(data)
+
+
+def get_active_sessions(parent=None, auto_prune=True, ttl_seconds=DEFAULT_TTL_SECONDS):
     """Retrieve all active subagent sessions, optionally filtered by parent."""
+    if auto_prune:
+        try:
+            prune_stale_sessions(ttl_seconds=ttl_seconds)
+        except Exception:
+            pass
     data = load_sessions()
     results = []
     for s in data.values():
@@ -88,6 +120,14 @@ def complete_session(session_id, note=None):
     return update_session(session_id, **kwargs)
 
 
+def archive_session(session_id, reason=None):
+    """Mark a subagent session archived."""
+    kwargs = {"status": "archived", "archived_at": utcnow()}
+    if reason:
+        kwargs["archive_reason"] = reason
+    return update_session(session_id, **kwargs)
+
+
 if __name__ == "__main__":
     if len(sys.argv) > 1 and sys.argv[1] == "list":
         print(json.dumps(load_sessions(), indent=2))

bin/swarm-worker-supervise.sh

@@ -13,6 +13,7 @@
 set -euo pipefail
 
 SESSION="swarm-worker"
+SOCKET_PATH="/tmp/tmux-muse.sock"
 LOG_DIR="/home/super/Projects/NetVM/logs"
 LOG_FILE="${LOG_DIR}/swarm-worker.log"
 
@@ -24,7 +25,7 @@ WORKER_CMD="python3 /home/super/Projects/NetVM/bin/swarm_worker/daemon.py"
 WORKER_MATCH='swarm_worker/daemon.[p]y'
 
 session_exists() {
-    tmux has-session -t "$SESSION" 2>/dev/null
+    tmux -S "$SOCKET_PATH" has-session -t "$SESSION" 2>/dev/null
 }
 
 worker_alive() {
@@ -34,21 +35,30 @@ worker_alive() {
 do_start() {
     mkdir -p "$LOG_DIR"
     if session_exists; then
-        echo "already running (tmux session $SESSION exists)"
+        echo "already running (tmux session $SESSION exists on $SOCKET_PATH)"
         return 0
     fi
-    tmux new-session -d -s "$SESSION" "$WORKER_CMD >>\"$LOG_FILE\" 2>&1"
+    tmux -S "$SOCKET_PATH" new-session -d -s "$SESSION" "$WORKER_CMD >>\"$LOG_FILE\" 2>&1"
     sleep 1
     if worker_alive; then
-        echo "started tmux session $SESSION (logging to $LOG_FILE)"
+        echo "started tmux session $SESSION on $SOCKET_PATH (logging to $LOG_FILE)"
     else
-        echo "WARNING: session $SESSION created but worker process not detected yet"
+        echo "WARNING: session $SESSION created on $SOCKET_PATH but worker process not detected yet"
     fi
 }
 
 do_stop() {
+    local stopped=0
     if session_exists; then
-        tmux kill-session -t "$SESSION"
+        tmux -S "$SOCKET_PATH" kill-session -t "$SESSION" 2>/dev/null || true
+        stopped=1
+    fi
+    # Also clean up accidental session on default socket if present
+    if tmux has-session -t "$SESSION" 2>/dev/null; then
+        tmux kill-session -t "$SESSION" 2>/dev/null || true
+        stopped=1
+    fi
+    if [ "$stopped" -eq 1 ]; then
         echo "stopped tmux session $SESSION"
     else
         echo "not running (no tmux session $SESSION)"

bin/swarm_worker/daemon.py

@@ -23,15 +23,34 @@ import sys
 import time
 import traceback
 
-# Sibling modules live in the same directory.
+# Sibling modules live in swarm_worker, common utilities live in bin/.
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+_SWARM_DIR = os.path.dirname(os.path.abspath(__file__))
+_BIN_DIR = os.path.dirname(_SWARM_DIR)
+sys.path.insert(0, _SWARM_DIR)
+sys.path.insert(0, _BIN_DIR)
 
 from poller import find_pending_slots
-from executor import execute_task
+from executor import execute_task, _looks_like_shell, extract_shell_command, execute_task_in_tmux
-from reporter import post_result
+from reporter import post_result, attach_slot
+from mainloop_notify import notify_via_mainloop
+
+# Fast gateway integration
+try:
+    import muse_hybrid
+    HAS_MUSE_HYBRID = True
+except ImportError:
+    HAS_MUSE_HYBRID = False
+
+# Prompt envelope formatting
+try:
+    import prompt_envelope
+    HAS_PROMPT_ENVELOPE = True
+except ImportError:
+    HAS_PROMPT_ENVELOPE = False
 
 POLL_INTERVAL = 60          # seconds between poll cycles
 STALE_MINUTES = 5           # slots older than this with no attach are workable
+WORKER_POOL = ["muse"]      # only dispatch to fully authenticated agent nodes
 
 # === SAFETY SWITCH ===
 # True  -> observe only: log what WOULD be done, execute/post nothing.
@@ -46,19 +65,122 @@ logging.basicConfig(
 log = logging.getLogger("swarm-worker")
 
 
+def _select_worker(preferred=None):
+    if preferred and preferred in WORKER_POOL and HAS_MUSE_HYBRID and muse_hybrid.is_node_configured(preferred):
+        return preferred
+    for candidate in WORKER_POOL:
+        if HAS_MUSE_HYBRID and muse_hybrid.is_node_configured(candidate):
+            return candidate
+    return "muse"
+
+
 def process_slot(slot):
     """Execute one slot and report the result. Returns True on full success."""
     swarm_id = slot.get("swarm_id")
     slot_index = slot.get("slot_index")
     task_text = slot.get("task_text") or ""
+    agent_label = slot.get("agent_label")
+    sidechat_id = slot.get("sidechat_id")
     tag = "%s/%s" % (swarm_id, slot_index)
+    short_id = swarm_id[3:19] if str(swarm_id).startswith("sw-") else str(swarm_id)[:16]
+    session_name = f"sw-{short_id}-s{slot_index}"
 
     if DRY_RUN:
         log.info("[dry-run] would execute slot %s (agent=%s, task %.80r)",
-                 tag, slot.get("agent_label"), task_text)
+                 tag, agent_label, task_text)
         return True
 
-    log.info("executing slot %s (agent=%s)", tag, slot.get("agent_label"))
+    # 1. Check if the task is or contains an executable shell command
+    cmd = extract_shell_command(task_text)
+    if cmd:
+        log.info("executing slot %s in host tmux session %s on bl", tag, session_name)
+        # Attach/claim slot in box state
+        attach_slot(swarm_id, slot_index, "swarm-worker", session_id=session_name)
+        try:
+            result = execute_task_in_tmux(session_name, cmd)
+        except Exception:
+            log.error("tmux executor crashed on slot %s:\n%s", tag, traceback.format_exc())
+            result = {"success": False, "output": "",
+                      "error": "tmux executor crashed: see worker log"}
+
+        payload = {
+            "ok": bool(result.get("success")),
+            "output": result.get("output") or "",
+            "error": result.get("error"),
+        }
+        try:
+            posted = post_result(swarm_id, slot_index, payload)
+        except Exception:
+            log.error("reporter crashed on slot %s:\n%s", tag, traceback.format_exc())
+            posted = False
+
+        # Post completion note to the slot sidechat for main loop visibility
+        summary_msg = payload.get("output") or payload.get("error") or "completed"
+        try:
+            notified = notify_via_mainloop(swarm_id, slot_index, summary_msg, worker_id="swarm-worker")
+            log.info("slot %s sidechat notification: %s", tag, notified)
+        except Exception as ne:
+            log.warning("failed to post sidechat notification for %s: %s", tag, ne)
+
+        log.info("slot %s done: ok=%s posted=%s (%.1fs)",
+                 tag, payload["ok"], posted,
+                 float(result.get("duration_s") or 0.0))
+        return bool(payload["ok"]) and posted
+
+    # 2. If the task is purely prose/instructions, dispatch to a verified agent subagent
+    if HAS_MUSE_HYBRID:
+        worker_agent = _select_worker(agent_label)
+        log.info("dispatching prose subagent slot %s to %s", tag, worker_agent)
+        try:
+            title = f"sw-{swarm_id[:16]}-s{slot_index}"
+            sess, err = muse_hybrid.start_session(worker_agent, title=title)
+            if err or not sess or not sess.get("session_id"):
+                log.error("failed to start subagent session for %s on %s: %s", tag, worker_agent, err)
+                return False
+
+            sub_sid = sess["session_id"]
+            log.info("subagent session %s created for slot %s on %s", sub_sid, tag, worker_agent)
+
+            # Attach/claim slot in box state
+            attached = attach_slot(swarm_id, slot_index, worker_agent, session_id=sub_sid)
+            if not attached:
+                log.warning("failed to attach slot %s to %s; proceeding with dispatch", tag, worker_agent)
+
+            # Register in subagent_tracker
+            try:
+                import subagent_tracker
+                subagent_tracker.register_session(worker_agent, sub_sid, title=title, prompt=task_text[:200])
+            except Exception:
+                pass
+
+            # Format prompt with authentic Operator Directive and RESULT expectation
+            if HAS_PROMPT_ENVELOPE and hasattr(prompt_envelope, "wrap_subagent_task"):
+                prompt_body = prompt_envelope.wrap_subagent_task(tag, task_text)
+            else:
+                prompt_body = (
+                    f"Operator assignment for swarm slot {tag}:\n\n"
+                    f"Task:\n{task_text.strip()}\n\n"
+                    f"Instructions:\n"
+                    f"1. Carry out this task directly using your available tools.\n"
+                    f"2. When finished, conclude your final response with your verdict line:\n"
+                    f"[RESULT {tag}] OK: <one-line summary of actions and outcome>\n"
+                    f"(or [RESULT {tag}] FAIL: <reason> if the task could not be completed)\n"
+                )
+
+            # Asynchronously send message to subagent session
+            res, send_err = muse_hybrid.send_message(worker_agent, prompt_body, thread_id=sub_sid, wait=0)
+            if send_err:
+                log.error("failed to send task to subagent %s on %s: %s", sub_sid, worker_agent, send_err)
+                return False
+
+            log.info("slot %s successfully dispatched to subagent %s (harvester will harvest)", tag, sub_sid)
+            return True
+        except Exception:
+            log.error("subagent dispatch crashed on slot %s:\n%s", tag, traceback.format_exc())
+            return False
+
+    # 3. Fallback to sandboxed host execution
+    log.info("executing slot %s in fallback sandbox (agent=%s)", tag, agent_label)
     try:
         result = execute_task(task_text)
     except Exception:
@@ -77,6 +199,11 @@ def process_slot(slot):
         log.error("reporter crashed on slot %s:\n%s", tag, traceback.format_exc())
         posted = False
 
+    try:
+        notify_via_mainloop(swarm_id, slot_index, payload.get("output") or "done", worker_id="swarm-worker")
+    except Exception:
+        pass
+
     log.info("slot %s done: ok=%s posted=%s (%.1fs)",
              tag, payload["ok"], posted,
              float(result.get("duration_s") or 0.0))

bin/swarm_worker/executor.py

@@ -77,11 +77,158 @@ def _looks_like_shell(task_text):
         return False
     if _PROSE_RE.search(t):
         return False
-    # Must start with a word-ish token (not a quote or sentence).
+    # Must start with a plausible executable command or path
     first = t.split()[0] if t.split() else ""
     if not re.match(r"^[a-zA-Z0-9_.\-/]+$", first):
         return False
-    return True
+    # If it's a relative/absolute path, verify it exists and is executable
+    if "/" in first:
+        return os.path.isfile(first) and os.access(first, os.X_OK)
+    # If it's a bare command name, it must exist in standard system bin paths
+    for p in ("/bin", "/usr/bin", "/usr/local/bin", "/home/super/Projects/NetVM/bin", "/home/super/.local/bin"):
+        candidate = os.path.join(p, first)
+        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
+            return True
+    return False
+
+
+def extract_shell_command(task_text):
+    """Extract an executable shell command from task text if present."""
+    t = (task_text or "").strip()
+    if not t:
+        return None
+    if _looks_like_shell(t):
+        return t
+    # Check for "Run: <cmd>" or "Execute this shell command...: <cmd>"
+    m = re.search(r"(?:Run|Execute)(?:\s+this\s+shell\s+command(?:\s+and\s+report\s+its\s+full\s+output)?)?:\s*[`'\"]?([^`'\n]+)[`'\"]?", t, re.IGNORECASE)
+    if m:
+        candidate = m.group(1).strip()
+        if candidate:
+            return candidate
+    # Check for markdown code blocks ```bash ... ``` or ```sh ... ```
+    m = re.search(r"```(?:bash|sh)?\n(.*?)\n```", t, re.DOTALL)
+    if m:
+        candidate = m.group(1).strip()
+        if candidate:
+            return candidate
+    # Check for single backticked command
+    m = re.search(r"`([^`\n]+)`", t)
+    if m:
+        candidate = m.group(1).strip()
+        if _looks_like_shell(candidate):
+            return candidate
+    return None
+
+
+TMUX_SOCKET = "/tmp/tmux-muse.sock"
+TMUX_LOG_DIR = "/home/super/Projects/NetVM/logs/tmux"
+
+
+def execute_task_in_tmux(session_name, cmd_str, timeout=300):
+    """Execute a task inside a dedicated tmux session on /tmp/tmux-muse.sock.
+    
+    Captures output to logs/tmux/{session_name}.log, tracks return code via
+    status file, and returns:
+    dict(success=bool, output=str, duration_s=float, error=str|None)
+    """
+    os.makedirs(TMUX_LOG_DIR, exist_ok=True)
+    started = time.monotonic()
+    log_file = os.path.join(TMUX_LOG_DIR, f"{session_name}.log")
+    exit_file = f"/tmp/{session_name}.exit"
+    script_file = f"/tmp/{session_name}.sh"
+
+    # Clean up prior artifacts
+    for f in (exit_file, script_file):
+        try:
+            if os.path.exists(f):
+                os.remove(f)
+        except Exception:
+            pass
+
+    # Write wrapper script
+    with open(script_file, "w", encoding="utf-8") as sf:
+        sf.write("#!/usr/bin/env bash\n")
+        sf.write("export PATH=\"/home/super/Projects/NetVM/bin:/home/super/.local/bin:/usr/local/bin:/usr/bin:/bin:$PATH\"\n")
+        sf.write("cd /home/super/Projects/NetVM\n")
+        sf.write(f"{cmd_str}\n")
+        sf.write(f"echo $? > \"{exit_file}\"\n")
+    os.chmod(script_file, 0o755)
+
+    # Kill any existing session with this name
+    subprocess.run(["tmux", "-S", TMUX_SOCKET, "kill-session", "-t", session_name],
+                   capture_output=True)
+
+    # Start tmux session
+    tmux_cmd = f"bash \"{script_file}\" > \"{log_file}\" 2>&1"
+    res = subprocess.run(
+        ["tmux", "-S", TMUX_SOCKET, "new-session", "-d", "-s", session_name, tmux_cmd],
+        capture_output=True, text=True
+    )
+    if res.returncode != 0:
+        dur = round(time.monotonic() - started, 3)
+        return {
+            "success": False,
+            "output": "",
+            "duration_s": dur,
+            "error": f"Failed to create tmux session: {res.stderr.strip()}",
+        }
+
+    # Poll for completion or timeout
+    deadline = started + timeout
+    rc = None
+    while time.monotonic() < deadline:
+        if os.path.exists(exit_file):
+            try:
+                with open(exit_file, "r") as ef:
+                    rc = int(ef.read().strip())
+                break
+            except Exception:
+                pass
+        check = subprocess.run(
+            ["tmux", "-S", TMUX_SOCKET, "has-session", "-t", session_name],
+            capture_output=True
+        )
+        if check.returncode != 0 and os.path.exists(exit_file):
+            break
+        time.sleep(0.5)
+
+    dur = round(time.monotonic() - started, 3)
+
+    # Clean up tmux session if still running
+    subprocess.run(["tmux", "-S", TMUX_SOCKET, "kill-session", "-t", session_name],
+                   capture_output=True)
+
+    # Read output log
+    output = ""
+    if os.path.exists(log_file):
+        try:
+            with open(log_file, "r", encoding="utf-8", errors="replace") as lf:
+                output = lf.read()[:OUTPUT_TRUNCATE]
+        except Exception as e:
+            output = f"Error reading log: {e}"
+
+    # Cleanup temporary script and exit file
+    for f in (exit_file, script_file):
+        try:
+            if os.path.exists(f):
+                os.remove(f)
+        except Exception:
+            pass
+
+    if rc is None:
+        return {
+            "success": False,
+            "output": output,
+            "duration_s": dur,
+            "error": f"timeout: exceeded {timeout}s in tmux session",
+        }
+
+    return {
+        "success": (rc == 0),
+        "output": output,
+        "duration_s": dur,
+        "error": None if (rc == 0) else f"exit code {rc}",
+    }
 
 
 def _refused(task_text):

bin/swarm_worker/mainloop_notify.py

@@ -37,14 +37,24 @@ def notify_via_mainloop(swarm_id, slot_index, message, worker_id="swarm-worker",
     Returns:
         True on success (or dry-run), False on failure (logged, not raised).
     """
-    target_name = "sw-%s-s%s" % (swarm_id, slot_index)
+    target_name = f"{swarm_id}-s{slot_index}" if str(swarm_id).startswith("sw-") else f"sw-{swarm_id}-s{slot_index}"
     summary = (message or "").strip().replace("\n", " ")[:NOTE_CHARS]
-    note = "[SWARM-DONE %s/%s] %s" % (swarm_id, slot_index, summary)
+    tag = "%s/%s" % (swarm_id, slot_index)
+    note = "[SWARM-DONE %s] %s" % (tag, summary)
+
+    sender = worker_id if worker_id in ("muse", "pip", "646", "opm", "dev", "def", "super") else "super"
+    to_agent = "opm"
 
     try:
         sys.path.insert(0, BIN)
         import dm
         uuid = dm.resolve_sidechat_target(target_name)
+        if not uuid:
+            sc = dm.load_sidechat_map() if hasattr(dm, "load_sidechat_map") else {}
+            entry = sc.get(target_name, {})
+            uuid = entry.get("thread_uuid")
+            if entry.get("agent"):
+                to_agent = entry.get("agent")
     except Exception as e:
         print("notify_via_mainloop: target resolve failed for %s: %s"
               % (target_name, e), file=sys.stderr)
@@ -55,8 +65,8 @@ def notify_via_mainloop(swarm_id, slot_index, message, worker_id="swarm-worker",
         return False
 
     cmd = [sys.executable, DM_PY, "send",
-           "--agent", worker_id,
+           "--agent", sender,
-           "--to", worker_id,
+           "--to", to_agent,
            "--target", uuid,
            note]
     if dry_run:

bin/swarm_worker/poller.py

@@ -97,7 +97,8 @@ def find_pending_slots(stale_minutes=STALE_MINUTES):
         return found
     swarms = data.get("swarms", []) if isinstance(data, dict) else []
     for summary in swarms:
-        if (summary.get("status") or "").lower() != "running":
+        summary_status = (summary.get("status") or "").lower()
+        if summary_status not in ("running", "pending"):
             continue
         swarm_id = summary.get("swarm_id")
         if not swarm_id:
@@ -110,6 +111,8 @@ def find_pending_slots(stale_minutes=STALE_MINUTES):
         created_ts = swarm.get("created_ts") or summary.get("created_ts")
         for slot in swarm.get("slots", []):
             status = (slot.get("status") or "").lower()
+            if status in ("done", "failed", "killed"):
+                continue
             result = slot.get("result")
             agent = slot.get("agent_id")
             pending = (status == "pending") or (not agent)

bin/swarm_worker/reporter.py

@@ -96,6 +96,62 @@ def post_result(swarm_id, slot_index, result_dict, dry_run=False):
         log.error("post_result %s/%s: box-ctl ok=false: %s",
                   swarm_id, slot_index, str(resp)[:500])
         return False
+    return True
+
+
+def attach_slot(swarm_id, slot_index, agent_id, session_id=None, dry_run=False):
+    """Claim/attach a swarm slot to an agent in box state.
+
+    Args:
+        swarm_id: e.g. "sw-20261005-151307-a222"
+        slot_index: int slot number
+        agent_id: agent string, e.g. "dev"
+        session_id: optional subagent session ID string
+        dry_run: if True, simulate attach without changing state.
+
+    Returns:
+        True on success, False on failure.
+    """
+    if dry_run:
+        print("DRY-RUN would run: %s swarm-attach %s %s %s %s"
+              % (BOX_CTL, swarm_id, slot_index, agent_id, session_id or ""))
+        return True
+
+    cmd = [
+        sys.executable, BOX_CTL, "swarm-attach",
+        str(swarm_id), str(slot_index), str(agent_id),
+    ]
+    if session_id:
+        cmd.append(str(session_id))
+
+    try:
+        proc = subprocess.run(
+            cmd,
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+            timeout=30,
+        )
+    except Exception as e:
+        log.error("attach_slot %s/%s failed to invoke box-ctl: %s",
+                  swarm_id, slot_index, e)
+        return False
+
+    if proc.returncode != 0:
+        err = proc.stderr.decode("utf-8", "replace")[:500]
+        log.error("attach_slot %s/%s box-ctl rc=%d: %s",
+                  swarm_id, slot_index, proc.returncode, err)
+        return False
+
+    try:
+        resp = json.loads(proc.stdout.decode("utf-8", "replace"))
+    except ValueError:
+        log.error("attach_slot %s/%s: box-ctl returned non-JSON output",
+                  swarm_id, slot_index)
+        return False
+
+    if not resp.get("ok"):
+        log.error("attach_slot %s/%s: box-ctl ok=false: %s",
+                  swarm_id, slot_index, str(resp)[:500])
+        return False
 
     return True
 

bin/tests/test_followup_fixes.py

@@ -748,9 +748,26 @@ def main():
             for line in detail.splitlines():
                 print(f"    {line}")
     print("-" * 80)
-    print(f"{len(results)} tests: {npass} pass, {nfail} fail/error, {nskip} skip")
     return 1 if nfail else 0
 
 
+import unittest
+
+
+class TestFollowupFixes(unittest.TestCase):
+    """unittest discovery adapter for contract and wired test functions."""
+    pass
+
+
+for _name, _fn in list(globals().items()):
+    if _name.startswith("test_") and callable(_fn):
+        def _bind(f):
+            def _runner(self):
+                f()
+            return _runner
+        setattr(TestFollowupFixes, _name, _bind(_fn))
+
+
 if __name__ == "__main__":
     sys.exit(main())
+

bin/tmux_auto_approver.py

@@ -0,0 +1,888 @@
+#!/usr/bin/env python3
+"""tmux_auto_approver.py — Tmux worker management, worker tallies, and regex auto-approvals.
+
+Supports:
+1. Multi-socket and multi-agent discovery:
+   - Shared host socket: /tmp/tmux-muse.sock
+   - User sockets: /tmp/tmux-1000/default, /tmp/tmux-1000/lte
+   - Agent netns sockets: /tmp/tmux-<node>.sock (muse, pip, 646, opm, dev, def)
+2. Worker Tally:
+   - Aggregates active sessions, windows, panes, current commands, PIDs, and runtimes.
+3. Regex Auto-Approvals for on-board muse-code runs and autonomous agent workers:
+   - Muse Code execution prompts ("Would you like to run the following... -> 1")
+   - A/B/C choice prompts -> "A"
+   - Numbered menus -> "1"
+   - y/n confirmation prompts -> "y"
+   - Press Enter prompts -> "Enter"
+   - Safety guardrails (passwords, passkeys, destructive commands are never auto-approved)
+4. State persistence & audit logging:
+   - Desired state in .state/tmux-auto-approvals.json
+   - Audit log stream in logs/tmux/auto-approvals.jsonl
+5. Surface linking with https://box.muse-dev.online/
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import signal
+import subprocess
+import sys
+import time
+from dataclasses import asdict, dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+STATE_DIR = REPO_ROOT / ".state"
+LOG_DIR = REPO_ROOT / "logs" / "tmux"
+STATE_FILE = STATE_DIR / "tmux-auto-approvals.json"
+AUDIT_LOG_FILE = LOG_DIR / "auto-approvals.jsonl"
+TMUX_BIN = "/home/super/.local/bin/tmux"
+if not os.path.exists(TMUX_BIN):
+    TMUX_BIN = "tmux"
+
+KNOWN_SOCKETS = [
+    "/tmp/tmux-1000/default",
+    "/tmp/tmux-1000/lte",
+    "/tmp/tmux-muse.sock",
+    "/tmp/tmux-pip.sock",
+    "/tmp/tmux-646.sock",
+    "/tmp/tmux-opm.sock",
+    "/tmp/tmux-dev.sock",
+    "/tmp/tmux-def.sock",
+]
+
+FLEET_AGENTS = ["muse", "pip", "646", "opm", "dev", "def"]
+
+
+# =====================================================================
+# Regex Match Rules for Terminal Prompts
+# =====================================================================
+
+@dataclass
+class MatchRule:
+    id: str
+    name: str
+    pattern: str
+    response_key: str
+    category: str  # "muse_code", "choice", "menu", "confirm", "enter"
+    enabled: bool = True
+    description: str = ""
+    press_enter: bool = False  # whether response requires trailing Enter
+
+# Default built-in rules
+DEFAULT_RULES: List[MatchRule] = [
+    MatchRule(
+        id="muse_code_run_numbered",
+        name="Muse Code Run (Numbered)",
+        pattern=r"Would you like to run the following[\s\S]*?›\s*1\.\s*Yes,?\s*proceed",
+        response_key="1",
+        category="muse_code",
+        enabled=True,
+        description="Auto-approves 'Would you like to run the following ... › 1. Yes, proceed (y)'",
+        press_enter=False,
+    ),
+    MatchRule(
+        id="muse_code_run_yn",
+        name="Muse Code Run (y/n)",
+        pattern=r"›\s*1\.\s*Yes,?\s*proceed\s*\(y\)",
+        response_key="1",
+        category="muse_code",
+        enabled=True,
+        description="Matches active selection indicator on '1. Yes, proceed (y)'",
+        press_enter=False,
+    ),
+    MatchRule(
+        id="muse_code_allow_execution",
+        name="Muse Code Allow Execution",
+        pattern=r"Allow\s+execution\s+of\b[\s\S]*?\[y/N\]",
+        response_key="y",
+        category="muse_code",
+        enabled=True,
+        description="Approves 'Allow execution of ... [y/N]'",
+        press_enter=True,
+    ),
+    MatchRule(
+        id="choice_abc",
+        name="Lettered Choice (A/B/C)",
+        pattern=r"(?i)(?:choose|choice|select|pick\s+one|enter\s+[A-Z]\b)[\s\S]*?^\s*[A-Z]\s*[.\)\-:]\s+\S",
+        response_key="A",
+        category="choice",
+        enabled=True,
+        description="Selects choice 'A' on lettered decision prompts",
+        press_enter=True,
+    ),
+    MatchRule(
+        id="menu_numbered",
+        name="Numbered Menu ((1)/(2))",
+        pattern=r"(?i)(?:Option:|Selection:|choose|select\s+an?|pick\s+a\s+number)[\s\S]*?^\s*\(?1\)?\s+[A-Za-z]",
+        response_key="1",
+        category="menu",
+        enabled=True,
+        description="Selects option 1 on numbered choice menus",
+        press_enter=True,
+    ),
+    MatchRule(
+        id="confirm_yn",
+        name="Line-end y/n Confirmation",
+        pattern=r"([yY]/[nN]|\[[yY]/[nN]\])\s*[\]:)>]?\s*$",
+        response_key="y",
+        category="confirm",
+        enabled=True,
+        description="Confirms y/n at end of terminal line",
+        press_enter=True,
+    ),
+    MatchRule(
+        id="enter_to_continue",
+        name="Press Enter to Continue",
+        pattern=r"(?i)(?:Press\s+\[?Enter\]?\s+to\s+continue|hit\s+enter\s+to\s+proceed)",
+        response_key="Enter",
+        category="enter",
+        enabled=True,
+        description="Sends Enter key on 'Press Enter to continue' prompts",
+        press_enter=False,
+    ),
+]
+
+# Guardrails: NEVER auto-approve these patterns (alert human operator)
+GUARDRAIL_PATTERNS = [
+    re.compile(r"\[sudo\]\s+password\s+for", re.IGNORECASE),
+    re.compile(r"password\s*:\s*$", re.IGNORECASE),
+    re.compile(r"(passkey|private\s+key\s+passphrase|Enter\s+PIN)", re.IGNORECASE),
+    re.compile(r"rm\s+-rf\s+/(?:\s|$)", re.IGNORECASE),
+    re.compile(r"mkfs\.", re.IGNORECASE),
+]
+
+
+# =====================================================================
+# State & Configuration
+# =====================================================================
+
+@dataclass
+class AutoApproverState:
+    global_enabled: bool = True
+    agents_enabled: Dict[str, bool] = field(default_factory=lambda: {a: True for a in FLEET_AGENTS})
+    sessions_enabled: Dict[str, bool] = field(default_factory=dict)
+    rules: List[Dict[str, Any]] = field(default_factory=lambda: [asdict(r) for r in DEFAULT_RULES])
+    max_approvals_per_hour: int = 40
+    poll_interval: float = 1.0
+    updated_at: float = field(default_factory=time.time)
+
+    def save(self) -> None:
+        STATE_DIR.mkdir(parents=True, exist_ok=True)
+        self.updated_at = time.time()
+        with open(STATE_FILE, "w") as f:
+            json.dump(asdict(self), f, indent=2)
+
+    @classmethod
+    def load(cls) -> "AutoApproverState":
+        if not STATE_FILE.exists():
+            st = cls()
+            st.save()
+            return st
+        try:
+            with open(STATE_FILE) as f:
+                data = json.load(f)
+            return cls(**data)
+        except Exception:
+            return cls()
+
+
+# =====================================================================
+# Tmux Worker Tally & Inspection
+# =====================================================================
+
+@dataclass
+class TmuxPaneInfo:
+    socket: str
+    session: str
+    window_idx: int
+    pane_id: str
+    pane_pid: int
+    current_command: str
+    active: bool
+    attached: bool
+    title: str
+    agent_node: str
+    auto_approve: bool = True
+    pending_prompt: Optional[str] = None
+    matched_rule: Optional[str] = None
+
+
+@dataclass
+class TmuxWorkerTally:
+    total_sockets: int
+    total_sessions: int
+    total_panes: int
+    active_workers: int
+    by_agent: Dict[str, Dict[str, Any]]
+    panes: List[TmuxPaneInfo]
+    timestamp: str = field(default_factory=lambda: datetime.now(timezone.utc).isoformat())
+
+
+def get_existing_sockets() -> List[str]:
+    """Find all existing and accessible tmux socket files."""
+    found = []
+    # Check explicitly known paths
+    for s in KNOWN_SOCKETS:
+        if os.path.exists(s):
+            found.append(s)
+
+    # Check /tmp for other tmux-*.sock files
+    try:
+        for f in os.listdir("/tmp"):
+            p = os.path.join("/tmp", f)
+            if f.startswith("tmux-") and f.endswith(".sock") and p not in found:
+                found.append(p)
+    except Exception:
+        pass
+
+    # Check /tmp/tmux-1000/
+    t1000 = "/tmp/tmux-1000"
+    if os.path.isdir(t1000):
+        try:
+            for f in os.listdir(t1000):
+                p = os.path.join(t1000, f)
+                if p not in found:
+                    found.append(p)
+        except Exception:
+            pass
+
+    return sorted(list(set(found)))
+
+
+def infer_agent_for_session(socket_path: str, session_name: str) -> str:
+    """Determine the owning agent (muse, pip, 646, opm, dev, def, host)."""
+    s_lower = session_name.lower()
+    sock_lower = socket_path.lower()
+
+    for agent in FLEET_AGENTS:
+        if f"-{agent}." in sock_lower or f"/{agent}" in sock_lower:
+            return agent
+        if s_lower == agent or s_lower.startswith(f"{agent}-") or f"_{agent}_" in s_lower:
+            return agent
+
+    if "muse" in sock_lower or "muse" in s_lower:
+        return "muse"
+    return "host"
+
+
+def run_tmux_cmd(socket_path: str, *args: str, timeout: float = 3.0) -> Tuple[int, str, str]:
+    """Execute tmux on a specific socket."""
+    cmd = [TMUX_BIN, "-S", socket_path] + list(args)
+    try:
+        res = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return res.returncode, res.stdout, res.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "", "timeout"
+    except Exception as e:
+        return -1, "", str(e)
+
+
+def capture_pane_text(socket_path: str, pane_id: str, lines: int = 30) -> str:
+    """Capture recent lines from a pane, joining wrapped rows.
+
+    -J joins physical wrapped lines into logical lines so matching is
+    width-independent: narrow panes wrap the same dialog onto more
+    rows, which otherwise breaks cue/option regexes.
+    """
+    rc, out, _ = run_tmux_cmd(socket_path, "capture-pane", "-p", "-J",
+                              "-t", pane_id, "-S", f"-{lines}")
+    if rc == 0:
+        return out
+    return ""
+
+
+MUSE_COMMAND_HINTS = ("muse-bin", "muse-code")
+
+
+def should_defer_to_muse_watcher(socket_path: str, pane_id: str,
+                                 current_command: str) -> bool:
+    """True when a per-pane muse watcher owns this pane.
+
+    Single-owner rule: muse_choice_watcher is authoritative for muse
+    panes (stability + re-verify + once-per-prompt + decided-block
+    guard). When its daemon is alive for this socket:pane, tmux must
+    skip the pane entirely, or both daemons answer the same prompt
+    within the same second ('11' + stray keys, observed live). Never
+    raises: import or liveness failures mean no owner, handle here.
+    """
+    try:
+        cmd = current_command or ""
+        if not any(h in cmd for h in MUSE_COMMAND_HINTS):
+            return False
+        import muse_choice_watcher as mcw
+        alive = getattr(mcw, "watcher_alive", mcw.is_running)
+        return alive(socket_path, pane_id) is not None
+    except Exception:
+        return False
+
+
+def gather_tmux_tally(state: Optional[AutoApproverState] = None) -> TmuxWorkerTally:
+    """Scan all sockets and build a comprehensive tally of tmux workers."""
+    if state is None:
+        state = AutoApproverState.load()
+
+    sockets = get_existing_sockets()
+    all_panes: List[TmuxPaneInfo] = []
+    agent_stats: Dict[str, Dict[str, Any]] = {
+        a: {"sessions": 0, "panes": 0, "active_commands": [], "auto_approve": state.agents_enabled.get(a, True)}
+        for a in FLEET_AGENTS
+    }
+    agent_stats["host"] = {"sessions": 0, "panes": 0, "active_commands": [], "auto_approve": state.global_enabled}
+
+    total_sessions_set = set()
+
+    fmt = "#{session_name}___#{window_index}___#{pane_id}___#{pane_pid}___#{pane_current_command}___#{pane_active}___#{session_attached}___#{pane_title}"
+
+    for sock in sockets:
+        rc, out, err = run_tmux_cmd(sock, "list-panes", "-a", "-F", fmt)
+        if rc != 0 or not out.strip():
+            continue
+
+        for line in out.strip().splitlines():
+            parts = line.split("___")
+            if len(parts) < 8:
+                continue
+            sess_name = parts[0]
+            try:
+                win_idx = int(parts[1])
+                p_id = parts[2]
+                p_pid = int(parts[3])
+                cmd_name = parts[4]
+                p_active = (parts[5] == "1")
+                s_attached = (parts[6] == "1")
+                p_title = parts[7]
+            except Exception:
+                continue
+
+            sess_key = f"{sock}:{sess_name}"
+            total_sessions_set.add(sess_key)
+            agent = infer_agent_for_session(sock, sess_name)
+
+            # Determine auto-approve state
+            is_auto = (
+                state.global_enabled
+                and state.agents_enabled.get(agent, True)
+                and state.sessions_enabled.get(sess_name, True)
+            )
+
+            pane_info = TmuxPaneInfo(
+                socket=sock,
+                session=sess_name,
+                window_idx=win_idx,
+                pane_id=p_id,
+                pane_pid=p_pid,
+                current_command=cmd_name,
+                active=p_active,
+                attached=s_attached,
+                title=p_title,
+                agent_node=agent,
+                auto_approve=is_auto,
+            )
+            all_panes.append(pane_info)
+
+            # Update stats
+            if agent in agent_stats:
+                agent_stats[agent]["panes"] += 1
+                if cmd_name not in agent_stats[agent]["active_commands"]:
+                    agent_stats[agent]["active_commands"].append(cmd_name)
+
+    # Count distinct sessions per agent
+    for p in all_panes:
+        agent = p.agent_node
+        if agent in agent_stats:
+            agent_stats[agent]["sessions"] = len({x.session for x in all_panes if x.agent_node == agent})
+
+    return TmuxWorkerTally(
+        total_sockets=len(sockets),
+        total_sessions=len(total_sessions_set),
+        total_panes=len(all_panes),
+        active_workers=len([p for p in all_panes if p.current_command not in ("bash", "sh", "zsh", "")]),
+        by_agent=agent_stats,
+        panes=all_panes,
+    )
+
+
+# =====================================================================
+# Regex Matcher Engine
+# =====================================================================
+
+@dataclass
+class MatchVerdict:
+    matched: bool
+    rule_id: Optional[str] = None
+    rule_name: Optional[str] = None
+    category: Optional[str] = None
+    key: Optional[str] = None
+    press_enter: bool = False
+    excerpt: Optional[str] = None
+    reason: Optional[str] = None
+    is_blocked: bool = False
+    blocked_reason: Optional[str] = None
+
+
+class RegexApproverEngine:
+    """Evaluates scrollback text against active match rules and guardrails."""
+
+    def __init__(self, rules: Optional[List[MatchRule]] = None):
+        if rules is None:
+            self.rules = list(DEFAULT_RULES)
+        else:
+            self.rules = rules
+        self._compiled_rules = [(r, re.compile(r.pattern, re.MULTILINE)) for r in self.rules if r.enabled]
+
+    def reload(self, rules: List[MatchRule]) -> None:
+        self.rules = rules
+        self._compiled_rules = [(r, re.compile(r.pattern, re.MULTILINE)) for r in self.rules if r.enabled]
+
+    def evaluate(self, text: str, tail_lines: int = 35) -> MatchVerdict:
+        """Evaluate terminal text and return match verdict."""
+        if not text:
+            return MatchVerdict(matched=False, reason="Empty text")
+
+        lines = text.strip().splitlines()
+        tail_text = "\n".join(lines[-tail_lines:])
+
+        # 1. Guardrail safety check (NEVER auto-approve sudo/passwords)
+        for guard in GUARDRAIL_PATTERNS:
+            m = guard.search(tail_text)
+            if m:
+                return MatchVerdict(
+                    matched=False,
+                    is_blocked=True,
+                    blocked_reason=f"Security guardrail triggered: '{m.group(0)}'",
+                    excerpt=m.group(0),
+                )
+
+        # 2. Test active rules in priority order
+        for rule, compiled in self._compiled_rules:
+            m = compiled.search(tail_text)
+            if m:
+                excerpt = m.group(0)
+                if len(excerpt) > 100:
+                    excerpt = excerpt[:100] + "..."
+                return MatchVerdict(
+                    matched=True,
+                    rule_id=rule.id,
+                    rule_name=rule.name,
+                    category=rule.category,
+                    key=rule.response_key,
+                    press_enter=rule.press_enter,
+                    excerpt=excerpt,
+                    reason=f"Matched rule '{rule.name}'",
+                )
+
+        return MatchVerdict(matched=False, reason="No matching prompt found in tail window")
+
+
+# =====================================================================
+# Auto-Approval Executor & Daemon Loop
+# =====================================================================
+
+class AutoApproverRunner:
+    """Monitors tmux panes, applies regex matching, and dispatches keys."""
+
+    def __init__(self, dry_run: bool = False):
+        self.dry_run = dry_run
+        self.state = AutoApproverState.load()
+        rule_objs = [MatchRule(**r) for r in self.state.rules]
+        self.engine = RegexApproverEngine(rule_objs)
+        self.recent_signatures: Dict[str, Tuple[float, str]] = {}
+        self.approval_counts: List[float] = []
+
+    def record_audit(self, event: Dict[str, Any]) -> None:
+        """Write structured audit log event."""
+        try:
+            LOG_DIR.mkdir(parents=True, exist_ok=True)
+            event["timestamp"] = datetime.now(timezone.utc).isoformat()
+            event["ts"] = time.time()
+            with open(AUDIT_LOG_FILE, "a") as f:
+                f.write(json.dumps(event) + "\n")
+        except Exception:
+            pass
+
+    def check_rate_limit(self) -> bool:
+        """Enforce hourly approval backstop."""
+        now = time.time()
+        self.approval_counts = [t for t in self.approval_counts if now - t < 3600]
+        return len(self.approval_counts) < self.state.max_approvals_per_hour
+
+    def run_once(self) -> List[Dict[str, Any]]:
+        """Scan all panes once and dispatch auto-approvals for any matched prompts."""
+        self.state = AutoApproverState.load()
+        if not self.state.global_enabled:
+            return [{"status": "disabled", "message": "Global auto-approvals are DISABLED"}]
+
+        rule_objs = [MatchRule(**r) for r in self.state.rules]
+        self.engine.reload(rule_objs)
+
+        tally = gather_tmux_tally(self.state)
+        actions_taken = []
+
+        for p in tally.panes:
+            if not p.auto_approve:
+                continue
+            if should_defer_to_muse_watcher(p.socket, p.pane_id,
+                                            p.current_command):
+                continue
+
+            text = capture_pane_text(p.socket, p.pane_id, lines=30)
+            if not text:
+                continue
+
+            verdict = self.engine.evaluate(text)
+            if verdict.is_blocked:
+                self.record_audit({
+                    "action": "BLOCKED",
+                    "socket": p.socket,
+                    "pane": p.pane_id,
+                    "session": p.session,
+                    "agent": p.agent_node,
+                    "reason": verdict.blocked_reason,
+                    "excerpt": verdict.excerpt,
+                })
+                continue
+
+            if verdict.matched and verdict.key:
+                # Deduplicate identical prompt to avoid infinite loop.
+                # Keyed by socket:pane: bare pane ids repeat on every
+                # tmux socket, so %1 on pip must not suppress %1 on opm.
+                sig = hashlib.sha1(f"{verdict.rule_id}:{verdict.excerpt}".encode()).hexdigest()
+                dedup_key = "%s:%s" % (p.socket, p.pane_id)
+                last_time, last_sig = self.recent_signatures.get(dedup_key, (0, ""))
+                if last_sig == sig and (time.time() - last_time) < 15.0:
+                    continue  # already handled recently
+
+                if not self.check_rate_limit():
+                    actions_taken.append({
+                        "pane": p.pane_id,
+                        "session": p.session,
+                        "status": "rate_limited",
+                        "rule": verdict.rule_name,
+                    })
+                    continue
+
+                # Execute key dispatch
+                success = False
+                if not self.dry_run:
+                    args = ["send-keys", "-t", p.pane_id, verdict.key]
+                    if verdict.press_enter or verdict.key == "Enter":
+                        if verdict.key != "Enter":
+                            args.append("Enter")
+                    rc, _, _ = run_tmux_cmd(p.socket, *args)
+                    success = (rc == 0)
+                else:
+                    success = True  # dry-run simulated
+
+                now = time.time()
+                self.recent_signatures[dedup_key] = (now, sig)
+                self.approval_counts.append(now)
+
+                event = {
+                    "action": "AUTO_APPROVED" if not self.dry_run else "DRY_RUN_MATCH",
+                    "socket": p.socket,
+                    "pane": p.pane_id,
+                    "session": p.session,
+                    "agent": p.agent_node,
+                    "rule_id": verdict.rule_id,
+                    "rule_name": verdict.rule_name,
+                    "key_sent": verdict.key,
+                    "press_enter": verdict.press_enter,
+                    "excerpt": verdict.excerpt,
+                    "dry_run": self.dry_run,
+                    "success": success,
+                }
+                self.record_audit(event)
+                actions_taken.append(event)
+
+        return actions_taken
+
+    def watch_loop(self, interval: Optional[float] = None) -> None:
+        """Run continuous monitoring loop."""
+        if interval is None:
+            interval = self.state.poll_interval
+
+        print(f"[*] Tmux Auto-Approver watching across sockets (interval: {interval}s, dry_run: {self.dry_run})...")
+        print(f"[*] Audit log: {AUDIT_LOG_FILE}")
+        sys.stdout.flush()
+
+        while True:
+            try:
+                res = self.run_once()
+                for act in res:
+                    if act.get("action") in ("AUTO_APPROVED", "DRY_RUN_MATCH"):
+                        print(f"[{datetime.now().strftime('%H:%M:%S')}] ✔ {act['action']} on {act['agent'].upper()}:{act['session']} ({act['pane']}) -> sent '{act['key_sent']}' for '{act['rule_name']}'")
+                        sys.stdout.flush()
+                time.sleep(interval)
+            except KeyboardInterrupt:
+                print("\n[*] Exiting watch loop.")
+                break
+            except Exception as e:
+                time.sleep(interval)
+
+
+# =====================================================================
+# CLI Command Implementations
+# =====================================================================
+
+def cmd_tally(args: argparse.Namespace) -> int:
+    tally = gather_tmux_tally()
+    if getattr(args, "json", False):
+        print(json.dumps(asdict(tally), indent=2))
+        return 0
+
+    print("══════════════════════════════════════════════════════════════════════════════")
+    print(f"  TMUX WORKER TALLY — {tally.total_sessions} Sessions · {tally.total_panes} Panes · {tally.active_workers} Active Workers across {tally.total_sockets} Sockets")
+    print("══════════════════════════════════════════════════════════════════════════════")
+
+    # Agent breakdown table
+    print("\nAGENT WORKERS SUMMARY:")
+    print(f"  {'Agent':<8} {'Sessions':<10} {'Panes':<8} {'Auto-Approve':<14} {'Active Commands'}")
+    print("  " + "─" * 70)
+    for agent, info in tally.by_agent.items():
+        auto_str = "ENABLED [●]" if info.get("auto_approve") else "DISABLED [○]"
+        cmds_str = ", ".join(info.get("active_commands", [])) or "(idle bash)"
+        print(f"  {agent:<8} {info.get('sessions', 0):<10} {info.get('panes', 0):<8} {auto_str:<14} {cmds_str}")
+
+    # Detailed Pane Table
+    print("\nACTIVE PANES & WORKERS:")
+    print(f"  {'Socket':<22} {'Session':<14} {'Pane':<6} {'PID':<8} {'Agent':<6} {'Cmd':<16} {'Auto':<6}")
+    print("  " + "─" * 82)
+    for p in tally.panes:
+        sock_short = os.path.basename(p.socket)
+        auto_tag = "YES" if p.auto_approve else "NO"
+        print(f"  {sock_short:<22} {p.session[:13]:<14} {p.pane_id:<6} {p.pane_pid:<8} {p.agent_node:<6} {p.current_command[:15]:<16} {auto_tag:<6}")
+
+    print("")
+    return 0
+
+
+def cmd_status(args: argparse.Namespace) -> int:
+    st = AutoApproverState.load()
+    if getattr(args, "json", False):
+        print(json.dumps(asdict(st), indent=2))
+        return 0
+
+    print("══════════════════════════════════════════════════════════════════")
+    print("  TMUX AUTO-APPROVAL RUNTIME STATUS")
+    print("══════════════════════════════════════════════════════════════════")
+    status_badge = "ENABLED [●]" if st.global_enabled else "DISABLED [○]"
+    print(f"  Master State:             {status_badge}")
+    print(f"  Max Approvals / Hour:     {st.max_approvals_per_hour}")
+    print(f"  Poll Interval:            {st.poll_interval}s")
+    print(f"  Audit Log:                {AUDIT_LOG_FILE}")
+    print(f"  Surface Link:             https://box.muse-dev.online/")
+
+    print("\nPER-AGENT AUTO-APPROVE POLICIES:")
+    for a in FLEET_AGENTS:
+        en = st.agents_enabled.get(a, True)
+        badge = "ON  [✔]" if en else "OFF [✖]"
+        print(f"  • {a:<6}: {badge}")
+
+    print(f"\nACTIVE REGEX RULES ({len(st.rules)}):")
+    for r in st.rules:
+        en_str = "ON" if r.get("enabled") else "OFF"
+        print(f"  [{en_str}] {r.get('id'):<25} -> sends '{r.get('response_key')}' ({r.get('category')})")
+    print("")
+    return 0
+
+
+def cmd_toggle_on(args: argparse.Namespace) -> int:
+    st = AutoApproverState.load()
+    target_node = getattr(args, "node", None)
+    target_session = getattr(args, "session", None)
+
+    if target_node:
+        st.agents_enabled[target_node] = True
+        print(f"✔ Enabled auto-approvals for agent: {target_node.upper()}")
+    elif target_session:
+        st.sessions_enabled[target_session] = True
+        print(f"✔ Enabled auto-approvals for session: '{target_session}'")
+    else:
+        st.global_enabled = True
+        for a in FLEET_AGENTS:
+            st.agents_enabled[a] = True
+        print("✔ Enabled master auto-approvals across all fleet agents & sessions.")
+
+    st.save()
+    return 0
+
+
+def cmd_toggle_off(args: argparse.Namespace) -> int:
+    st = AutoApproverState.load()
+    target_node = getattr(args, "node", None)
+    target_session = getattr(args, "session", None)
+
+    if target_node:
+        st.agents_enabled[target_node] = False
+        print(f"✖ Disabled auto-approvals for agent: {target_node.upper()}")
+    elif target_session:
+        st.sessions_enabled[target_session] = False
+        print(f"✖ Disabled auto-approvals for session: '{target_session}'")
+    else:
+        st.global_enabled = False
+        print("✖ Disabled master auto-approvals globally.")
+
+    st.save()
+    return 0
+
+
+def cmd_match_test(args: argparse.Namespace) -> int:
+    text = args.text
+    if text == "-" or not text:
+        text = sys.stdin.read()
+
+    engine = RegexApproverEngine()
+    verdict = engine.evaluate(text)
+
+    out = {
+        "matched": verdict.matched,
+        "rule_id": verdict.rule_id,
+        "rule_name": verdict.rule_name,
+        "category": verdict.category,
+        "key_to_send": verdict.key,
+        "press_enter": verdict.press_enter,
+        "excerpt": verdict.excerpt,
+        "reason": verdict.reason,
+        "is_blocked": verdict.is_blocked,
+        "blocked_reason": verdict.blocked_reason,
+    }
+    print(json.dumps(out, indent=2))
+    return 0 if verdict.matched else 1
+
+
+def cmd_run_once(args: argparse.Namespace) -> int:
+    runner = AutoApproverRunner(dry_run=getattr(args, "dry_run", False))
+    res = runner.run_once()
+    print(json.dumps(res, indent=2))
+    return 0
+
+
+def cmd_watch(args: argparse.Namespace) -> int:
+    runner = AutoApproverRunner(dry_run=getattr(args, "dry_run", False))
+    interval = getattr(args, "interval", 1.0)
+    runner.watch_loop(interval=interval)
+    return 0
+
+
+def cmd_logs(args: argparse.Namespace) -> int:
+    lines = getattr(args, "lines", 20) or 20
+    if not AUDIT_LOG_FILE.exists():
+        print("No auto-approval logs yet.")
+        return 0
+
+    with open(AUDIT_LOG_FILE) as f:
+        all_lines = f.readlines()
+
+    tail = all_lines[-lines:]
+    for l in tail:
+        try:
+            d = json.loads(l)
+            ts = d.get("timestamp", "")[:19].replace("T", " ")
+            act = d.get("action", "")
+            ag = d.get("agent", "")
+            sess = d.get("session", "")
+            pane = d.get("pane", "")
+            key = d.get("key_sent", "")
+            rule = d.get("rule_name", "")
+            print(f"[{ts}] {act:<14} {ag.upper():<6} {sess:<12} ({pane}) -> sent '{key}' [{rule}]")
+        except Exception:
+            print(l.strip())
+    return 0
+
+
+def cmd_spawn_worker(args: argparse.Namespace) -> int:
+    session = args.session
+    cmd = getattr(args, "command", "bash")
+    node = getattr(args, "node", "muse")
+    sock = f"/tmp/tmux-{node}.sock" if node != "muse" else "/tmp/tmux-muse.sock"
+
+    # Spawn session
+    t_cmd = [TMUX_BIN, "-S", sock, "new-session", "-d", "-s", session, cmd]
+    res = subprocess.run(t_cmd, capture_output=True, text=True)
+    if res.returncode == 0:
+        print(f"✔ Successfully spawned worker '{session}' on {sock} running '{cmd}'")
+        return 0
+    else:
+        print(f"Failed to spawn worker: {res.stderr.strip() or res.stdout.strip()}", file=sys.stderr)
+        return res.returncode
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="Tmux Worker Tally & Regex Auto-Approval Runtime")
+    subparsers = parser.add_subparsers(dest="subcommand")
+
+    # tally
+    p_tally = subparsers.add_parser("tally", help="Tally all tmux sessions, workers, and panes")
+    p_tally.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+    p_tally.set_defaults(func=cmd_tally)
+
+    # status
+    p_status = subparsers.add_parser("status", help="Show auto-approval configuration & policies")
+    p_status.add_argument("--json", action="store_true", help="Output machine-readable JSON")
+    p_status.set_defaults(func=cmd_status)
+
+    # on / off
+    p_on = subparsers.add_parser("on", help="Enable auto-approvals (global, per-agent, or per-session)")
+    p_on.add_argument("--node", choices=FLEET_AGENTS, help="Enable for specific agent")
+    p_on.add_argument("--session", help="Enable for specific session name")
+    p_on.set_defaults(func=cmd_toggle_on)
+
+    p_off = subparsers.add_parser("off", help="Disable auto-approvals")
+    p_off.add_argument("--node", choices=FLEET_AGENTS, help="Disable for specific agent")
+    p_off.add_argument("--session", help="Disable for specific session name")
+    p_off.set_defaults(func=cmd_toggle_off)
+
+    # match
+    p_match = subparsers.add_parser("match", help="Test regex match against scrollback text")
+    p_match.add_argument("text", nargs="?", default="-", help="Input text or '-' for stdin")
+    p_match.set_defaults(func=cmd_match_test)
+
+    # once
+    p_once = subparsers.add_parser("once", help="Evaluate and auto-approve all active prompts right now")
+    p_once.add_argument("--dry-run", action="store_true", help="Log matches without sending keys")
+    p_once.set_defaults(func=cmd_run_once)
+
+    # watch
+    p_watch = subparsers.add_parser("watch", help="Run background monitor daemon for auto-approvals")
+    p_watch.add_argument("--interval", type=float, default=1.0, help="Poll interval in seconds (default: 1.0)")
+    p_watch.add_argument("--dry-run", action="store_true", help="Log matches without sending keys")
+    p_watch.set_defaults(func=cmd_watch)
+
+    # logs
+    p_logs = subparsers.add_parser("logs", help="Tail auto-approval audit log stream")
+    p_logs.add_argument("-n", "--lines", type=int, default=20, help="Number of lines to show")
+    p_logs.set_defaults(func=cmd_logs)
+
+    # spawn
+    p_spawn = subparsers.add_parser("spawn", help="Spawn a new tmux worker runner")
+    p_spawn.add_argument("session", help="Session name")
+    p_spawn.add_argument("--command", "-c", default="bash", help="Command to run")
+    p_spawn.add_argument("--node", choices=FLEET_AGENTS, default="muse", help="Target agent socket")
+    p_spawn.set_defaults(func=cmd_spawn_worker)
+
+    return parser
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    parser = build_parser()
+    if argv is None:
+        argv = sys.argv[1:]
+    if not argv:
+        parser.print_help()
+        return 0
+    args = parser.parse_args(argv)
+    if not hasattr(args, "func"):
+        parser.print_help()
+        return 1
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/tmux_server_watchdog.py

@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""tmux_server_watchdog.py — Death-capture for tmux servers.
+
+Runs on a 1-minute systemd timer. Remembers each known socket's server
+pid; when a server dies or its pid changes without a witnessed death,
+appends a forensics bundle (dmesg OOM/kill lines, memory, uptime,
+journal tail) to logs/tmux-server-deaths.jsonl so the next "tmux
+crashed" leaves evidence instead of a mystery.
+
+Read-only against tmux itself: one `display-message -p` probe per
+socket. Never raises; a watchdog must not need its own watchdog.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from datetime import datetime, timezone
+
+BIN_DIR = os.path.dirname(os.path.abspath(__file__))
+REPO_ROOT = os.path.dirname(BIN_DIR)
+sys.path.insert(0, BIN_DIR)
+
+try:
+    from muse_choice_watcher import KNOWN_SOCKETS
+except Exception:
+    KNOWN_SOCKETS = ["/tmp/tmux-1000/default"]
+
+STATE_FILE = os.path.join(REPO_ROOT, ".state", "tmux-servers.json")
+DEATH_LOG = os.path.join(REPO_ROOT, "logs", "tmux-server-deaths.jsonl")
+
+
+def _now():
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _run(cmd, timeout=10):
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True,
+                           timeout=timeout)
+        return r.returncode, (r.stdout or "").strip()
+    except Exception as e:
+        return -1, "exec failed: %r" % (e,)
+
+
+def probe(socket_path):
+    """Server pid for a socket, or None when unreachable."""
+    rc, out = _run(["tmux", "-S", socket_path, "display-message",
+                    "-p", "#{pid}"], timeout=10)
+    if rc != 0:
+        return None
+    try:
+        return int(out.strip().split()[0])
+    except (ValueError, IndexError):
+        return None
+
+
+def collect_forensics(socket_path, last_pid):
+    """Best-effort death evidence. Dict of strings, never raises."""
+    ev = {"ts": _now(), "socket": socket_path, "last_pid": last_pid}
+    rc, dmesg = _run(["dmesg"], timeout=10)
+    if rc != 0:
+        ev["dmesg"] = "unavailable: %s" % dmesg[:200]
+    else:
+        hits = [ln for ln in dmesg.split("\n")
+                if any(k in ln.lower() for k in
+                       ("oom", "killed process", "segfault", "tmux"))]
+        ev["dmesg_hits"] = hits[-15:]
+    _, ev["memory"] = _run(["free", "-m"], timeout=10)
+    _, ev["uptime"] = _run(["uptime"], timeout=10)
+    rc, journal = _run(["journalctl", "--user", "-n", "50"], timeout=10)
+    if rc == 0:
+        ev["journal_tmux"] = [ln for ln in journal.split("\n")
+                              if "tmux" in ln.lower()][-10:]
+    else:
+        ev["journal_tmux"] = []
+    return ev
+
+
+def read_state(path=None):
+    try:
+        with open(path or STATE_FILE) as f:
+            data = json.load(f)
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def write_state(state, path=None):
+    path = path or STATE_FILE
+    try:
+        parent = os.path.dirname(path)
+        if parent:
+            os.makedirs(parent, exist_ok=True)
+        tmp = "%s.tmp.%d" % (path, os.getpid())
+        with open(tmp, "w") as f:
+            json.dump(state, f, indent=1)
+        os.replace(tmp, path)
+    except Exception:
+        pass
+
+
+def append_death(ev, path=None):
+    path = path or DEATH_LOG
+    try:
+        parent = os.path.dirname(path)
+        if parent:
+            os.makedirs(parent, exist_ok=True)
+        with open(path, "a") as f:
+            f.write(json.dumps(ev) + "\n")
+    except Exception:
+        pass
+
+
+def evaluate(previous, probed):
+    """Pure transition logic: (prev_state, {sock: pid|None}) ->
+    (new_state, events). Events: death | restart | started."""
+    new_state, events = {}, []
+    for sock, pid in sorted(probed.items()):
+        prev = (previous.get(sock) or {})
+        prev_pid = prev.get("pid")
+        if pid is None:
+            new_state[sock] = {"pid": None, "died": _now(),
+                               "last_pid": prev_pid}
+            if prev_pid:
+                events.append({"type": "death", "socket": sock,
+                               "last_pid": prev_pid})
+        else:
+            new_state[sock] = {"pid": pid, "since": _now()}
+            if prev_pid and prev_pid != pid:
+                # Changed with no witnessed death: restart inside one
+                # tick gap (or pid recycled under us). Treat as a
+                # restart, still worth a forensics note.
+                events.append({"type": "restart", "socket": sock,
+                               "old_pid": prev_pid, "pid": pid})
+            elif not prev_pid and prev.get("died"):
+                events.append({"type": "started", "socket": sock,
+                               "pid": pid})
+            elif not prev_pid and not prev:
+                events.append({"type": "started", "socket": sock,
+                               "pid": pid})
+    return new_state, events
+
+
+def check(sockets=None, dry_run=False):
+    """Probe, transition state, log deaths. Returns summary dict."""
+    probed = {s: probe(s) for s in (sockets or KNOWN_SOCKETS)}
+    previous = read_state()
+    new_state, events = evaluate(previous, probed)
+    for ev in events:
+        if ev["type"] == "death":
+            bundle = collect_forensics(ev["socket"], ev["last_pid"])
+            bundle["event"] = "death"
+            if not dry_run:
+                append_death(bundle)
+            ev["forensics"] = bundle
+        elif ev["type"] == "restart":
+            bundle = collect_forensics(ev["socket"], ev["old_pid"])
+            bundle["event"] = "restart-gap-missed"
+            if not dry_run:
+                append_death(bundle)
+            ev["forensics"] = bundle
+    if not dry_run:
+        write_state(new_state)
+    return {"probed": probed, "events": events, "dry_run": dry_run}
+
+
+def main(argv=None):
+    import argparse
+    ap = argparse.ArgumentParser(description="tmux server death-capture")
+    ap.add_argument("--sockets", nargs="*", default=None)
+    ap.add_argument("--dry-run", action="store_true")
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args(argv)
+    try:
+        res = check(sockets=args.sockets, dry_run=args.dry_run)
+    except Exception as e:
+        print("watchdog failed: %r" % (e,), file=sys.stderr)
+        return 1
+    if args.json or args.dry_run:
+        print(json.dumps(res, indent=1, default=str))
+    else:
+        for ev in res["events"]:
+            print("%s: %s" % (ev["type"], ev["socket"]))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

bin/watchdog-alert-check.sh

@@ -12,11 +12,24 @@
 #   - New failures: print each new "relaunch FAILED" line, update the
 #     watermark to the newest line, exit 1.
 #
-# Self-contained: no arguments, no nested quoting. Safe to call from cron
+#   --no-advance: peek-only read. New failures are printed (same output and
-# or from the box CLI.
+#     exit codes as above) but the watermark is NOT advanced. The web
+#     surface (via `box-ctl watchdog-alerts --no-advance`) should always
+#     pass this flag so UI polling never churns the watermark out from
+#     under the CLI. CLI runs without the flag keep advance-on-read.
+#
+# Self-contained: safe to call from cron or from the box CLI.
 
 set -u
 
+NO_ADVANCE=0
+for arg in "$@"; do
+  case "$arg" in
+    --no-advance) NO_ADVANCE=1 ;;
+    *) echo "watchdog-alert-check.sh: unknown argument: $arg" >&2; exit 2 ;;
+  esac
+done
+
 LOG="/home/super/Projects/NetVM/chromebox-watchdog.log"
 WATERMARK="/home/super/Projects/NetVM/watchdog-alert-watermark.txt"
 
@@ -48,7 +61,10 @@ fi
 
 [ "${#new_lines[@]}" -gt 0 ] || exit 0
 
-# Report new failures and advance the watermark to the newest line.
+# Report new failures and advance the watermark to the newest line
+# (skipped in --no-advance peek mode).
 printf '%s\n' "${new_lines[@]}"
-printf '%s\n' "${failed[-1]}" > "$WATERMARK"
+if [ "$NO_ADVANCE" -eq 0 ]; then
+  printf '%s\n' "${failed[-1]}" > "$WATERMARK"
+fi
 exit 1

docs/AGENT-TOOLING.md

@@ -51,7 +51,15 @@ box dm send --agent 646 --to pip --target 646-pip "Hey Pip, start-page onboardin
 You can directly interact with the headless Muse gateway inside your isolated network namespace using either `muse` or `box muse`:
 
 ```bash
-# Using native muse wrapper (interactive prompt & account enforcement)
+# Global lookups & fleet status (no account required)
+muse status                          # Complete fleet overview & node vitality
+muse threads                         # List registered threads and sidechats across fleet
+muse unread                          # View unread counts across all agents
+muse lookup                          # Unified lookup (summary of fleet, approvals, unread)
+muse passkey (or muse key)           # Passkey reference (VM .txt location) & agent approval flow
+muse tmux list                       # List shared tmux sessions across fleet
+
+# Using native muse wrapper for per-account actions:
 muse -a <account> chat               # Interactive conversational REPL with thread selection
 muse -a <account> chat --thread <id> # Direct conversational REPL in specified thread
 muse -a <account> status
@@ -59,19 +67,67 @@ muse -a <account> threads
 muse -a <account> history --thread <thread_uuid> --limit 10
 muse -a <account> send --thread <thread_uuid> "<message>"
 
-# If invoked without -a/--account, it displays valid accounts and usage instructions:
+# If invoked without arguments, it displays available accounts and commands:
 muse
 
 # Alternatively via box CLI:
-box muse <self> threads
+box muse status                      # Cross-fleet status
+box muse <self> status               # Agent-specific status
+box muse <self> threads              # Active sessions for agent
 box muse <self> history --thread <thread_uuid> --limit 10
 box muse <self> unread
+box muse <self> chat                 # Launch interactive chat REPL
 box muse <self> session-start --title "<title>"
 box muse <self> send --thread <thread_uuid> "<message>"
+box muse tmux list                   # Direct bridge to muse-tmux manager
 ```
 
 ---
 
+## 3.1. Unified & Seamless Lookups (`box lookup` & `box thread`)
+
+For fast inspection of fleet state without hunting across multiple tools:
+
+```bash
+# Unified lookup summary (fleet health, pending approvals, key reference)
+box lookup
+box lookup fleet                     # Node health, CDP status, active pages
+box lookup threads                   # List all registered fleet sidechats and mapped UUIDs
+box lookup threads <agent>           # List active threads for a specific agent
+box lookup unread                    # Unread indicators and active tabs across fleet
+box lookup approvals                 # Check if any agent is held on browser approvals
+box lookup key (or box passkey)      # Operator passkey & approval protocol
+
+# Seamless thread inspection:
+box thread list                      # List all registered fleet sidechats across agents
+box thread list <agent>              # List active sessions for an agent
+box thread view <agent> <uuid>       # View recent thread messages (supports short UUID prefix)
+box thread view <agent> "<alias>"    # View thread by registered alias (e.g. "646 tasks", "heartbeat")
+```
+
+---
+
+## 3.2. Operator Passkey & Key Material Architecture
+
+> **Crucial Reality**: Key material and administrative passkeys live in a **single file (`.txt`) on the Google Cloud VM (`34.139.37.135`)**. **NO passkeys or secret stores exist on the dedicated BL (`100.123.153.75`)**.
+
+### Why This Matters:
+- Front-door console access (`https://box.muse-dev.online/`) is secured by operator PIN `3128` (or the passkey in the VM text file).
+- Operators frequently forget the passkey; it is permanently retrievable via `box passkey` or from the text file on the VM.
+- **Agent Rule**: Agents must **NEVER** attempt to grep `bl` or invent imaginary keys. Secrets never reside on the compute node.
+
+### How Agents Get Key Access / Operator Approval:
+When an agent or automated task requires elevated privileges, key material, or operator confirmation:
+1. **Signal the Request**:
+   - In automated scripts: exit with code `2` (the standard `APPROVAL_NEEDED` convention per `INFRA.md`).
+   - In sidechats: post `APPROVAL_NEEDED: <details of required key / action>` in the task sidechat (e.g. `646 tasks`, `pip tasks`, `#jobs`, `heartbeat`).
+2. **Operator Verification**:
+   - The human operator reviews the request in the sidechat or via `box approvals check`.
+   - If approved, the operator retrieves the key from the single `.txt` file on the VM (or submits transient OTP via `box cred submit-otp`).
+3. **Execution**:
+   - The operator authorizes the flow or enters the credential transiently. No raw credentials are saved to `bl` or git.
+
+
 ## 4. Shared & Hybrid Tmux Tooling (`muse tmux`, `box tmux`, & `[TOOL tmux.*]`)
 
 Agents and operators can spawn background sessions and send keystrokes to long-running tasks across three execution tiers:
@@ -147,3 +203,26 @@ When jobs are dispatched to agents via `bin/job-dispatch.py`, they are wrapped i
 2. **Sub-Agent Prioritization**: Break down complex diagnostic or verification jobs by delegating sub-tasks to dedicated subagent threads.
 3. **Execution Reality**: Work is only real if tool calls ran. Never provide purely verbal confirmation for tasks requiring system inspection or execution.
 4. **Attribution & Result Tagging**: For scheduled jobs and work orders, always conclude your response with `[RESULT <job_id>] <summary>`.
+
+---
+
+## 7. Internal Documentation & Agent Lookups (`box docs` & `docs_internal/`)
+
+Agents have access to a structured internal `.md` and `.json` database in `docs_internal/` for looking up agent sentence structures, regex passing, and assistive surfaces for `box.muse-dev.online`:
+
+```bash
+# Query surfaces, DOM selectors, and REST endpoints for box.muse-dev.online
+box docs surfaces jobs
+box docs surfaces dms
+
+# Inspect agent sentence structures and conversational contracts
+box docs sentence work_order
+box docs sentence result
+
+# Test strings or evaluate against canonical regex patterns
+box docs regex result --test "[RESULT 7fce46e0] OK 14 endpoints verified"
+box docs parse "[WO:7fce46e0] [from super] Audit exec — Check stats"
+
+# Full-text search across documentation database
+box docs search "work order"
+```

docs/BOX-API-READ-HTTPS.md

@@ -0,0 +1,152 @@
+# Box Read-Only Lookups over HTTPS (Agent Access, No SSH)
+
+> **Box is the main surface.** All operator work goes through Box (box.muse-dev.online). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+**Date:** 2026-10-06
+**Status:** bl side implemented; VM board REST below is specified, not yet implemented
+**Scope:** read-only lookups only (fleet, threads, unread, dm log). Mutations stay on existing paths.
+
+## 1. Problem
+
+Agents in containers reach box over a 2-hop SSH chain (container → VM → bl).
+SSH toggles lapse and every agent needs the full chain configured. Agents need
+the daily read lookups — "latest from each agent" — over HTTPS with no secrets
+on the wire.
+
+## 2. What exists now (bl side, implemented)
+
+Two agent HTTPS paths already serve reads; both use the same signature auth
+(`ssh-keygen -Y sign`, namespace per server, ±300s clock skew, nonce replay
+cache) and per-agent principals from `dm-signers/allowed_signers`:
+
+| Path | Server | Client | Auth namespace |
+|---|---|---|---|
+| Named ops (works today) | `bin/exec-constrained.py` via `https://exec.muse-dev.online/exec` | `bin/exec-sign.sh <op> '<args>'` or `bin/box-relay.sh` (served at `GET /box`) | `exec-constrained` |
+| Typed REST (specified below) | VM board `/srv/board/server.py` | any HTTPS client | `box-api` |
+
+New named ops (this change, all `side_effecting: false`, all in `DEFAULT_PERMS`
+so any valid fleet signer may call them):
+
+- `fleet.unread` `{"agent"?}` → `box-ctl.py unread [--agent X]`
+- `dm.log` `{"limit"?, "agent"?}` (limit 1..100, default 20) → `box-ctl.py dm-log [limit] [--agent X]`
+
+Already present and unchanged: `health.check` (fleet status), `thread.list`,
+`thread.view`, `dm.read`, `chat.messages`.
+
+New `box-relay.sh` client commands (this change):
+
+```bash
+box unread [<agent>]                 # fleet unread/activity counts
+box dm log [<limit=20>] [--agent <agent>]
+```
+
+New `box-ctl.py` backend verbs (this change; also callable over the board's
+existing SSH bridge until the board speaks REST):
+
+```bash
+box-ctl.py unread [--agent <agent>]
+box-ctl.py dm-log [limit] [--agent <agent>]   # back-compat: bare [limit] unchanged
+```
+
+Also fixed: `box lookup unread` / `muse unread` previously always failed with
+"Unknown lookup target 'unread'" (`_lookup_unreads` was never wired into
+`cmd_lookup`); it now works and supports `--json`.
+
+## 3. VM board REST (to implement on the VM)
+
+Base: `https://box.muse-dev.online/api/box`. All endpoints require
+agent-signature auth (§4) or the existing `ops_session` cookie (humans).
+
+```text
+GET /api/box/fleet            exists today; keep behavior
+GET /api/box/threads?agent=X  backend: box-ctl.py thread-list --agent X (pass JSON through)
+GET /api/box/unread?agent=X   backend: box-ctl.py unread [--agent X]
+GET /api/box/dm/log?limit=N&agent=X
+                              backend: box-ctl.py dm-log [N] [--agent X]
+```
+
+### Agent scoping (server-enforced)
+
+- Verified identity `operator-X` or `X` (X in `muse,pip,646,opm,def,dev`)
+  may only read slices for X. The board MUST pass `--agent X` to box-ctl and
+  MUST NOT accept a different `agent=` query value from that identity.
+- `ops_session` (human PIN login) may omit `agent=` and read the full fleet.
+- Unknown/expired signatures → `401`. Authenticated but out-of-scope → `403`.
+
+### Response schemas (bl verbs pass through unchanged)
+
+`GET /api/box/unread`:
+
+```json
+{"ok": true, "nodes": [
+  {"node": "muse", "unread": 2, "approval_pending": false,
+   "title": "muse (2)", "thread": "abc123-uuid-or-null"}
+]}
+```
+
+`GET /api/box/dm/log` (agent filter matches entries from OR to the agent):
+
+```json
+{"ok": true,
+ "entries": [{"type": "sent", "id": "bdf7beb6", "agent": "opm",
+              "to": "pip", "target": "pip tasks",
+              "ts": "2026-10-06T05:56:01.328629+00:00"}],
+ "dms": ["... same array, legacy key ..."]}
+```
+
+`GET /api/box/fleet`: existing `{"ok": true, "fleet": [...]}` shape, unchanged.
+
+Errors follow `docs/BOX-API-DESIGN-DMS.md` §3.1 (`{"ok": false, "code", "error"}`).
+
+## 4. Agent-signature auth for the REST endpoints
+
+Same identity primitive as signed DMs and `exec-constrained.py`; a signature
+is not a secret, so agents can sign without handling credentials.
+
+1. Client builds the canonical string (LF-separated, no trailing newline):
+
+   ```text
+   {METHOD}\n{PATH}\n{SORTED_QUERY}\n{TS}\n{NONCE}
+   ```
+
+   - `METHOD`: `GET`; `PATH`: e.g. `/api/box/dm/log`; `SORTED_QUERY`: raw
+     query string sorted by key (`agent=opm&limit=5`), empty string when none.
+   - `TS`: unix epoch seconds; `NONCE`: 16–128 hex chars, single use.
+2. Client signs it: `ssh-keygen -Y sign -f <key> -n box-api`.
+3. Client sends headers (armor is base64-encoded to stay header-safe):
+
+   ```text
+   X-Box-Identity: operator-646
+   X-Box-Timestamp: 1728...
+   X-Box-Nonce: <hex>
+   X-Box-Signature: <base64 of the -----BEGIN SSH SIGNATURE----- armor>
+   ```
+
+4. Server recomputes the canonical string from the received request, base64-
+   decodes the signature, and runs `ssh-keygen -Y verify -f allowed_signers
+   -I <identity> -n box-api -s <sigfile>` with the canonical string on stdin.
+   Accept only if: verify exit 0, `|now-TS| ≤ 300`, nonce unseen (cache ≥600s).
+   Signers file is synced from bl `dm-signers/allowed_signers`.
+
+Example:
+
+```bash
+TS=$(date +%s); NONCE=$(python3 -c "import secrets; print(secrets.token_hex(16))")
+CANON=$(printf 'GET\n/api/box/dm/log\nagent=opm&limit=5\n%s\n%s' "$TS" "$NONCE")
+SIG=$(printf '%s' "$CANON" | ssh-keygen -Y sign -f ~/.ssh/id_frontdoor -n box-api \
+  | base64 -w0)
+curl -s 'https://box.muse-dev.online/api/box/dm/log?agent=opm&limit=5' \
+  -H "X-Box-Identity: operator-646" -H "X-Box-Timestamp: $TS" \
+  -H "X-Box-Nonce: $NONCE" -H "X-Box-Signature: $SIG"
+```
+
+## 5. Rollout notes
+
+- `exec-constrained.py` reads `OPS` at startup: restart the service after
+  deploying for `fleet.unread` / `dm.log` to appear in `GET /ops`.
+- `box-relay.sh` is served from bl (`GET /box`); agents re-fetch to get
+  `unread` / `dm log`.
+- Until the VM board implements §3, agents use the named-ops path (§2),
+  which needs no SSH today.
+- Non-goals: write endpoints (`dm.send` etc. stay on the ops path for now),
+  PIN/human flows (unchanged), secret handling (no secrets cross the wire).

docs/BOX-APPROVALS-HTTPS.md

@@ -0,0 +1,92 @@
+# Box Approvals over HTTPS (No SSH)
+
+> **Box is the main surface.** All operator work goes through Box (box.muse-dev.online). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+**Date:** 2026-10-06
+**Status:** implemented on bl (`exec-constrained.py` + `box-relay.sh`;
+`box-ctl.py` verbs pre-existed, plus fast node validation and
+`quality-validate` branches; `approvals.py` untouched)
+**Scope:** approval visibility (check) + governed decisions (deny, auto,
+one-shot allow). Persistent/forced allow (`--always`/`--force`) stays
+SSH-only.
+
+## 1. Why
+
+Agents blocked on browser approvals needed SSH to see fleet approval
+state, deny a bad prompt, auto-resolve trusted prompts, or allow a
+known-good one. All of this now rides the agent HTTPS path
+(`https://exec.muse-dev.online/exec`, signature or Bearer [REDACTED], named-op
+allowlist, audit log).
+
+## 2. New ops
+
+| Op | Args | Backend | Access |
+|---|---|---|---|
+| `approval.check` | `{node?}` (default fleet) | `box-ctl.py approval-check` | read-only, in `DEFAULT_PERMS` |
+| `approval.deny` | `{node!, message!, allow_main_chat?}` | `box-ctl.py approval-deny` | known-identities-only |
+| `approval.auto` | `{node?}` (default fleet) | `box-ctl.py approval-auto` | known-identities-only |
+| `approval.allow` | `{node!, message!, allow_main_chat?}` | `box-ctl.py approval-allow` (one-shot) | known-identities-only |
+
+New `box-relay.sh` client commands:
+
+```bash
+box approvals check [node]
+box approvals allow <node> --message <text> [--allow-main-chat]
+box approvals deny <node> --message <text> [--allow-main-chat]
+box approvals auto [node]
+```
+
+Raw op calls (signature auth, no token):
+
+```bash
+exec-sign.sh approval.check '{}'
+exec-sign.sh approval.check '{"node": "646"}'
+exec-sign.sh approval.allow '{"node": "646", "message": "trusted deploy script"}'
+exec-sign.sh approval.auto '{"node": "opm"}'
+```
+
+## 3. What the decisions do
+
+- `approval.allow` clicks Allow **once** on the node's active prompt.
+  There is deliberately no remote `--always` (persistent site allow)
+  or `--force`.
+- `approval.deny` clicks Deny on the node's active prompt.
+- `approval.auto` scans (fleet or one node) and allows only TRUSTED
+  non-key prompts. Key/passkey approvals are never auto-approved;
+  they need an explicit allow/deny, which notifies the waiting agent.
+- All three are audited with identity + op + node.
+
+## 4. Safety notes (same posture as existing ops)
+
+- **Attribution is mandatory.** The allow/deny flows DM the waiting
+  agent, historically with an `[operator]` prefix. A remote caller is
+  an agent, not the operator — so the exec layer **requires** a
+  non-empty `message` (≤2000 chars, no controls) on both allow and
+  deny. (`box-ctl.py` still permits omitting `--message` for SSH
+  callers; the HTTPS layer is the narrower gate.)
+- **One-shot only.** The allow argv never carries `--always` or
+  `--force`; the validators reject those keys. Persistence stays an
+  SSH-side decision.
+- **Sidechat-first.** `allow_main_chat` defaults to false; Main Chat
+  delivery needs the explicit flag, same as `notify`/`dm.ack`.
+- **Fixed argv, validated values.** Nodes must be fleet members (fast
+  `BAD_NODE` before any CDP probe — `approval-check`/`approval-auto`
+  gained the same node check allow/deny already had); unknown arg
+  keys rejected.
+- **Timeouts.** Check 180s (fleet CDP scan), auto 300s (scan plus one
+  click per trusted prompt), allow/deny 120s.
+- **Retry-safe reads.** `approval-check` / `approval-list` joined
+  `IDEMPOTENT_ACTIONS`; all six approval verbs have
+  `quality-validate` dry-run branches.
+
+## 5. Rollout notes
+
+- Restart `exec-constrained.py` after deploy for the 4 new ops to
+  appear in `GET /ops` (repo total becomes 83).
+- `box-relay.sh` is served from bl (`GET /box`); agents re-fetch to
+  get the `approvals` group.
+- While fleet browsers crash-loop, decision ops fail honestly
+  (`APPROVAL_FAILED` / CDP errors) instead of hanging; check still
+  reports per-node state including `UNREACHABLE`.
+- Non-goals: deletes, `main-loop` enable/disable, policy writes,
+  swarm kill/prune — future expansions, same pattern.

docs/BOX-DEV-HTTPS.md

@@ -0,0 +1,80 @@
+# Box Dev + Comms over HTTPS (No SSH)
+
+> **Box is the main surface.** All operator work goes through Box (box.muse-dev.online). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+**Date:** 2026-10-06
+**Status:** implemented on bl (`exec-constrained.py` + `box-ctl.py` + `box-relay.sh`)
+**Scope:** git visibility, test runs, notify, work-order acks. Read-only lookups
+live in `docs/BOX-API-READ-HTTPS.md`.
+
+## 1. Why
+
+Agents developing the box must inspect the tree, run the suite, nudge peers,
+and acknowledge work orders without SSH. All of this now rides the existing
+agent HTTPS path (`https://exec.muse-dev.online/exec`, signature or bearer
+auth, named-op allowlist, audit log) — no new trust model.
+
+## 2. New ops
+
+| Op | Args | Backend | Write? | Who |
+|---|---|---|---|---|
+| `git.status` | `{}` | `box-ctl.py git-status` | no | any valid signer |
+| `git.diff` | `{path?, stat?}` | `box-ctl.py git-diff [--stat] [--path p]` | no | any valid signer |
+| `git.log` | `{limit?, path?}` (1..50, default 10) | `box-ctl.py git-log` | no | any valid signer |
+| `tests.run` | `{test?, filter?}` (`tests.<module>` or full suite; `filter` is unittest `-k`) | `box-ctl.py tests-run [module] [--filter p]` | yes (executes) | known identities only |
+| `notify.send` | `{agent, message≤1000, sidechat?, sender?}` | `box-ctl.py notify ...` | yes (sends DM) | known identities only |
+| `dm.ack` | `{id, to, sender!, sidechat?, allow_main_chat?}` | `box-ctl.py ack ...` | yes (sends DM) | known identities only |
+
+New `box-ctl.py` verbs: `git-status`, `git-diff`, `git-log`, `tests-run`,
+`ack` (all in `USAGE`, `quality-validate`, and — for the git reads —
+`IDEMPOTENT_ACTIONS`).
+
+New `box-relay.sh` client commands:
+
+```bash
+box git status
+box git diff [--stat] [--path <path>]     # path also accepted positionally
+box git log [<limit=10>] [--path <path>]
+box tests run [tests.<module>] [--filter <pattern>]  # full suite (~2-3 min) when omitted; filter is -k
+box notify <agent> [--sidechat <n>] [--sender <a>] <message...>
+box dm ack <id> --to <agent> --sender <agent> [--sidechat <name>]
+```
+
+Raw op call (signature auth, no token):
+
+```bash
+exec-sign.sh git.log '{"limit": 5, "path": "bin/dm.py"}'
+exec-sign.sh tests.run '{"test": "tests.test_box_dev_https"}'
+exec-sign.sh dm.ack '{"id": "bdf7beb6", "to": "pip", "sender": "opm"}'
+```
+
+## 3. Safety notes (same posture as existing ops)
+
+- **Fixed argv, validated values.** Clients influence only whitelisted argument
+  values. Git paths must be repo-relative without `..` (plus symlink-escape
+  check in box-ctl); test modules must match `^tests\.[a-z0-9_]+$` and exist;
+  ack ids must be 6–64 hex; notify messages ≤1000 chars.
+- **Caps.** `git diff` output capped at 64KB, status at 200 entries, test
+  output at 32KB tail; every capped response carries `truncated: true`.
+- **Sidechat-first.** `notify.send` and `dm.ack` default to the recipient's
+  sidechat and never touch Main Chat unless `allow_main_chat` is set —
+  mirroring `box-ctl.py notify` and the WO dispatcher.
+- **Attribution.** `sender` is caller-asserted (validated ∈ fleet agents),
+  same as the existing `dm.send` op; the HTTPS identity is recorded
+  separately in the exec audit log. `dm.ack` requires an explicit sender —
+  no silent default.
+- **tests.run executes repo code** (whatever is in `tests/`), so it is
+  `side_effecting`, excluded from the read-only default permission subset,
+  and capped at a 600s timeout. Test failures report as
+  `{"ok": false, "returncode", "output"}` — the op itself succeeded.
+- New `box-ctl.py` fail codes `GIT_ERROR` / `TESTS_ERROR` are registered in
+  `KNOWN_ERROR_CODES`, so `quality-check` stays at its baseline.
+
+## 4. Rollout notes
+
+- Restart `exec-constrained.py` after deploy for the new ops to appear in
+  `GET /ops`.
+- `box-relay.sh` is served from bl (`GET /box`); agents re-fetch to get
+  `git` / `tests` / `notify` / `dm ack`.
+- Non-goals: git commit/push, service restarts for box itself, live
+  streaming tails — future expansions, same pattern.

docs/BOX-JOBS-HTTPS.md

@@ -0,0 +1,88 @@
+# Box Job Lifecycle over HTTPS (No SSH)
+
+> **Box is the main surface.** All operator work goes through Box (box.muse-dev.online). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+**Date:** 2026-10-06
+**Status:** implemented on bl (`exec-constrained.py` + `box-relay.sh`;
+`box-ctl.py` verbs pre-existed)
+**Scope:** safe job-lifecycle mutations. Deletes are deliberately NOT
+exposed (`job-delete`, `timer-delete` stay SSH/operator-only).
+
+## 1. Why
+
+Agents own scheduled automation but could only run jobs (`cron.run`) or read
+them (`box.exec`). Creating, updating, triggering, chaining, previewing, and
+pausing jobs needed SSH. All of this now rides the agent HTTPS path
+(`https://exec.muse-dev.online/exec`, signature or bearer auth, named-op
+allowlist, audit log).
+
+## 2. New ops
+
+| Op | Args | Backend | Write? | Who |
+|---|---|---|---|---|
+| `job.put` | `{name, definition}` | `box-ctl.py job-put` (definition on stdin) | yes (writes + commits) | known identities only |
+| `job.trigger` | `{name}` | `box-ctl.py job-trigger` | yes (dispatches now) | known identities only |
+| `job.chain` | `{from, to, on_failure?}` | `box-ctl.py job-chain` | yes (writes + commits) | known identities only |
+| `job.next` | `{job_id, success?}` | `box-ctl.py job-next` | no (dry-run) | any valid signer |
+| `cron.timer_stop` | `{name}` | `box-ctl.py timer-stop` | yes (systemd) | known identities only |
+| `cron.timer_disable` | `{name}` | `box-ctl.py timer-disable` | yes (systemd) | known identities only |
+
+New `box-relay.sh` client commands:
+
+```bash
+box cron put <name> '<json-definition>'   # create or update (see §3)
+box cron trigger <name>                   # dispatch now (audited JSON)
+box cron chain <from> <to> [--on-failure] # wire chain_next
+box cron next <job-id> [--success|--fail] # dry-run: what dispatches next
+box timer stop <name>                     # pause schedule (keeps unit)
+box timer disable <name>                  # pause schedule (disables unit)
+```
+
+Raw op call (signature auth, no token):
+
+```bash
+exec-sign.sh job.next '{"job_id": "heartbeat-20200101-000000-deadbeef"}'
+exec-sign.sh job.chain '{"from": "ops-audit-step2", "to": "ops-audit-step3"}'
+```
+
+Notes:
+
+- `job.trigger` vs existing `job.run`: `job.run` shells straight to
+  `job-dispatch.py` and relays raw output; `job.trigger` goes through
+  `box-ctl.py` (existence check, 300s bound, audit trail, JSON contract).
+  Prefer `job.trigger` for agent-driven dispatches.
+- `job.next` job ids look like `<name>-YYYYMMDD-HHMMSS-<8hex>`; with no
+  `success` flag the box infers it from the last recorded result.
+
+## 3. Job definition shape (`job.put`)
+
+The full schema is enforced by `box-ctl.py validate_job` (single copy);
+required fields: `name` (must match the argv name), `schedule` (`manual`
+or convertible cron), `agent` (fleet member), `prompt_template` (1–4000
+chars, no protocol literals, known `{placeholders}` only). `timeout`
+60–3600s, `on_failure` policy, optional `chain_next` (must exist) and
+`sidechat` / `dm_target` routing. `box-ctl.py` writes `jobs/<name>.json`
+and commits (`Add/Update job <name> via box-ctl`).
+
+## 4. Safety notes (same posture as existing ops)
+
+- **Fixed argv, validated values.** Job names match
+  `^[a-z0-9][a-z0-9-]{0,63}$`; trigger/chain/timer ops require the job
+  file to exist; chain rejects self-links and cycles; timer ops require
+  the unit to exist. All checks run before any side effect.
+- **Stdin plumbing.** `job.put` is the first op to pipe a request body to
+  `box-ctl.py` stdin (the raw definition, not the envelope); the routing
+  lives in one helper (`_stdin_body`) covered by unit tests.
+- **No deletes, no kills.** `job-delete` / `timer-delete` are reachable
+  only over the operator SSH path, by explicit scope decision.
+- **Audited.** Every execution records identity + op + args hash;
+  `box-ctl.py` additionally audits each mutation with its target.
+
+## 5. Rollout notes
+
+- Restart `exec-constrained.py` after deploy for the new ops to appear in
+  `GET /ops`.
+- `box-relay.sh` is served from bl (`GET /box`); agents re-fetch to get
+  the `cron put|trigger|chain|next` and `timer stop|disable` commands.
+- Non-goals: deletes, `job-result` ingestion, `strat`/`loop` writes,
+  approvals — future expansions, same pattern.

docs/BOX-LOOP-HTTPS.md

@@ -0,0 +1,85 @@
+# Box Loop + Strategy Writes over HTTPS (No SSH)
+
+> **Box is the main surface.** All operator work goes through Box (box.muse-dev.online). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+**Date:** 2026-10-06
+**Status:** implemented on bl (`exec-constrained.py` + `box-relay.sh`;
+`box-ctl.py` verbs pre-existed, plus a vars-name validator fix)
+**Scope:** safe loop/strategy/variable mutations. Reads (`loop-status`,
+`loop-health`, `loop-breaks`, `strat-get`, `vars-get`, ...) already ride
+`box.exec` or typed read ops and are unchanged here.
+
+## 1. Why
+
+Agents watching loop health could see breaks but needed SSH to remediate
+them, resolve stale followups, tune strategy overrides, or undo variable
+changes. All of this now rides the agent HTTPS path
+(`https://exec.muse-dev.online/exec`, signature or bearer auth, named-op
+allowlist, audit log).
+
+## 2. New ops (all known-identities-only, none in the read-only subset)
+
+| Op | Args | Backend |
+|---|---|---|
+| `loop.remediate` | `{dry_run?}` (default false) | `box-ctl.py loop-remediate [--dry-run]` |
+| `loop.resolve` | `{dm_id, note?}` | `box-ctl.py loop-resolve` |
+| `strat.set` | `{type!, subtype?, agent?, track?, priority?, timeout_s?, nudges?, escalate?}` | `box-ctl.py strat-set` (payload as argv JSON) |
+| `strat.reset` | `{type!, subtype?, agent?}` | `box-ctl.py strat-reset` |
+| `vars.reset` | `{name}` | `box-ctl.py vars-reset` (restore default) |
+| `vars.rollback` | `{name, revision?}` (int step or timestamp) | `box-ctl.py vars-rollback` |
+
+New `box-relay.sh` client commands:
+
+```bash
+box loop remediate [--dry-run]
+box loop resolve <dm_id> [note...]
+box strat set <type> [--subtype S] [--agent A] [--track true|false] [--priority p] [--timeout N] [--nudges N] [--escalate E]
+box strat reset <type> [subtype] [--agent <agent>]
+box vars reset <name>
+box vars rollback <name> [revision]
+```
+
+Raw op call (signature auth, no token):
+
+```bash
+exec-sign.sh loop.remediate '{"dry_run": true}'
+exec-sign.sh strat.set '{"type": "job", "priority": "important", "nudges": 3}'
+```
+
+## 3. What remediate does (non-dry)
+
+`loop.remediate` delegates to `gravity.remediate_breaks`: resolves
+followups already answered in logs, re-arms expired followups with nudges
+remaining (runs the followup sweeper once), auto-allows TRUSTED (non-key)
+browser approvals, and on hard breaks appends a `hard_break_alert` to
+job-log plus one DM to opm. Use `{"dry_run": true}` first to preview the
+`remediated` / `escalated` lists with zero side effects.
+
+## 4. Safety notes (same posture as existing ops)
+
+- **Fixed argv, validated values.** Strategy types are a strict enum
+  (`wake|job|siphon|manual|health|heartbeat`) — the backend silently maps
+  typos to MANUAL, so the op rejects them instead. Priorities are a
+  strict enum; timeouts/nudges must be integers (backend clamps);
+  dm ids must be 6–64 hex; variable names mirror the engine identifier
+  rule. All checks run before any side effect.
+- **Stdin-free.** Unlike `job.put`, `strat.set` passes its JSON payload
+  as an argv token (`strat-set <type> [JSON]`), so no new stdin plumbing
+  was needed.
+- **Vars-name validator fix.** `quality-validate` for all five vars
+  verbs used the job-name regex (`^[a-z0-9-]{1,64}$`), rejecting every
+  real variable name (`max_nudge_count`, ...). They now share
+  `qv_var_name` (`^[A-Za-z0-9_.-]{1,64}$`), mirroring the
+  `exec-constrained.py` rule.
+- **Audited.** Every execution records identity + op + args hash;
+  `box-ctl.py` additionally audits each mutation with its target.
+
+## 5. Rollout notes
+
+- Restart `exec-constrained.py` after deploy for the new ops to appear in
+  `GET /ops`.
+- `box-relay.sh` is served from bl (`GET /box`); agents re-fetch to get
+  the `loop` / `strat` groups and `vars reset|rollback`.
+- Non-goals: approvals, deletes, `main-loop` enable/disable — future
+  expansions, same pattern. (md drive files shipped separately; see
+  BOX-MD-HTTPS.md.)

docs/BOX-MD-HTTPS.md

@@ -0,0 +1,109 @@
+# Box Md Drive Files over HTTPS (No SSH)
+
+> **Box is the main surface.** All operator work goes through Box (box.muse-dev.online). The web UI, `box` CLI, and agents share the same API endpoints. No UI-only powers.
+
+**Date:** 2026-10-06
+**Status:** implemented on bl (`exec-constrained.py` + `box-relay.sh`;
+`box-ctl.py` verbs pre-existed, plus traversal hardening, output caps,
+`--stdin` content plumbing, and hyphenated amend/append/pull aliases)
+**Scope:** md reads (audit/list/read/diff) + governed writes
+(amend/append/pull/inject-drive/sync-all). Raw container writes
+(`md-write`) stay SSH-only by design.
+
+## 1. Why
+
+Agents shaping fleet behavior could see drive scores but needed SSH to
+read an agent's `SOUL.md`, diff it against the canonical template, or
+push updated operator files. All of this now rides the agent HTTPS path
+(`https://exec.muse-dev.online/exec`, signature or Bearer [REDACTED], named-op
+allowlist, audit log).
+
+## 2. New ops
+
+Reads (all `side_effecting: false`, all in `DEFAULT_PERMS`):
+
+| Op | Args | Backend |
+|---|---|---|
+| `md.audit` | `{accounts?}` (default all) | `box-ctl.py md-audit [accounts...]` |
+| `md.list` | `{account!, path?}` | `box-ctl.py md-list` (capped, see §4) |
+| `md.read` | `{account!, filename!}` | `box-ctl.py md-read` (capped, see §4) |
+| `md.diff` | `{account!, filename!}` (shared template only) | `box-ctl.py md-diff` (capped, see §4) |
+
+Governed writes (all known-identities-only, none in the read-only subset):
+
+| Op | Args | Backend |
+|---|---|---|
+| `md.pull` | `{account!, filename!}` (shared template only) | `box-ctl.py md-pull` |
+| `md.inject_drive` | `{account!}` | `box-ctl.py md-inject-drive` |
+| `md.sync_all` | `{}` | `box-ctl.py md-sync-all` |
+| `md.amend` | `{filename!, content!, author?, reason?}` | `box-ctl.py md-amend --stdin` (content on stdin) |
+| `md.append` | `{filename!, text!, author?, section?}` | `box-ctl.py md-append --stdin` (text on stdin) |
+
+New `box-relay.sh` client commands:
+
+```bash
+box md audit [accounts...]
+box md list <account> [path]
+box md read <account> <filename>
+box md diff <account> <filename>
+box md pull <account> <filename>
+box md inject-drive <account>
+box md sync-all
+box md amend <filename> (--content <text>|--file <path>) [--author <name>] [--reason <why>]
+box md append <filename> (--content <text>|--file <path>) [--author <name>] [--section <header>]
+```
+
+Raw op calls (signature auth, no token):
+
+```bash
+exec-sign.sh md.audit '{"accounts": ["646", "opm"]}'
+exec-sign.sh md.read '{"account": "646", "filename": "SOUL.md"}'
+exec-sign.sh md.diff '{"account": "pip", "filename": "HEARTBEAT.md"}'
+exec-sign.sh md.append '{"filename": "AGENTS.md", "text": "lesson ...", "author": "646"}'
+```
+
+## 3. What the governed writes do
+
+- `md.amend` rewrites a `shared/operators/` template after the
+  drive-safety checks (HEARTBEAT checklist not gutted,
+  PROACTIVE_PREFERENCES not blanked, SOUL not reverted to stock),
+  then git-commits it. Full-file content rides stdin (up to 256KB).
+- `md.append` appends a timestamped, attributed note (optional section)
+  via the same validated + committed path (up to 64KB).
+- `md.pull` / `md.inject_drive` / `md.sync_all` push canonical
+  templates *out* to containers; no agent-supplied content crosses.
+  Injection always overwrites (AGENTS.md preserves remote `## Lessons`).
+
+## 4. Safety notes (same posture as existing ops)
+
+- **Traversal hardening (single-copy in `agent_md.py`).** Account,
+  filename, and list-path validation now lives in `agent_md.py`
+  (`MDValidationError`, raised before any gateway call or write);
+  `box-ctl.py` maps it to `BAD_NAME`, and exec ops + quality-validate
+  mirror the same shapes. Previously `md-read 646 ../x` reached the
+  gateway and `md amend ../../x` could escape `shared/operators/`.
+  Template flows (diff/amend/append/pull) additionally require one of
+  the 8 known template names.
+- **Fixed argv, validated values.** Unknown arg keys rejected; author /
+  reason / section are control-char-free with length caps; amend
+  content must be non-empty.
+- **Caps with `truncated` flags.** Reads cap at 64KB, diffs at 64KB,
+  listings at 200 entries — same convention as git/tests verbs.
+- **No raw `md-write` op.** Arbitrary content-to-container stays
+  SSH-only; remote writes go through the validated template flows.
+- **Timeouts.** Audit 300s, sync-all 600s, single-file ops 120s.
+- **Audited.** Every execution records identity + op; `box-ctl.py`
+  additionally audits each verb with its target.
+- **Retry-safe reads.** `md-audit` / `md-list` / `md-read` / `md-diff`
+  joined `IDEMPOTENT_ACTIONS`; all ten md verbs have
+  `quality-validate` dry-run branches.
+
+## 5. Rollout notes
+
+- Restart `exec-constrained.py` after deploy for the 9 new ops to
+  appear in `GET /ops` (repo total becomes 79).
+- `box-relay.sh` is served from bl (`GET /box`); agents re-fetch to
+  get the `md` group.
+- Non-goals: deletes, `main-loop` enable/disable, policy writes,
+  swarm kill/prune — future expansions, same pattern. (Approvals
+  shipped separately; see BOX-APPROVALS-HTTPS.md.)