merge: sync upstream Cotal main into rigel-release (RIG-5440)

.changeset/config.json

@@ -14,6 +14,7 @@
       "@cotal-ai/manager",
       "@cotal-ai/delivery",
       "@cotal-ai/web",
+      "@cotal-ai/linear",
       "@cotal-ai/cmux",
       "@cotal-ai/orca",
       "@cotal-ai/tmux",

.claude-plugin/marketplace.json

@@ -7,12 +7,12 @@
     {
       "name": "cotal",
       "description": "Join the Cotal mesh — coordinate with other AI agents as lateral peers (presence, messaging, role requests) over NATS.",
-      "source": "./extensions/connector-claude-code"
+      "source": "./claude-plugin/cotal"
     },
     {
       "name": "cotal-skills",
       "description": "Cotal-authored Claude Code skills for coordinating agent teams on the mesh (team-topology). Installed and removed independently of the cotal connector.",
-      "source": "./extensions/connector-claude-code/skills-plugin"
+      "source": "./claude-plugin/cotal-skills"
     }
   ]
 }

.github/workflows/attribution.yml

@@ -156,3 +156,7 @@ jobs:
           git fetch --no-tags origin "$BASE" "$HEAD"
           echo "range $BASE..$HEAD"
           node scripts/check-attribution.mjs --range "$BASE..$HEAD" --event "$GITHUB_EVENT_PATH"
+      # Last, so a PR still waiting for its approval gets every other grade first. It lives in this
+      # job for the reason the upgrade-section step does: `attribution` is the only required check.
+      - name: Approval names the head
+        run: node scripts/review-verdict-gate.mjs --event "$GITHUB_EVENT_PATH"

.github/workflows/changesets.yml.disabled

@@ -73,7 +73,7 @@ jobs:
   version:
     if: github.event_name == 'push' || inputs.snapshot == ''
     needs: [seat-native-linux-x64, seat-native-linux-arm64]
-    timeout-minutes: 20
+    timeout-minutes: 35
     runs-on: ubuntu-latest
     environment: npm-publish
     permissions:
@@ -166,13 +166,31 @@ jobs:
             exit 1
           fi
 
-      # Cut the GitHub Release ONLY when this push actually published a new version to npm AND the
-      # full closure gate passed. The gate exits non-zero on a partial publish, an unsettled registry,
-      # or a version nothing serves, so the Release step runs only after every package in the fixed
-      # group is verified present at the requested version on the registry.
+      # Presence is not installability: npm install reads the packument, which can lag the
+      # per-version endpoint the closure gate reads, so a closed closure can still fail
+      # `npm i -g cotal-ai@<version>` with ETARGET on a pinned sibling (#1412). Install the version
+      # from the registry into a scratch prefix and run the binary, polling until a deadline, before
+      # anything is announced. A version that never installs reds the job and cuts no Release.
+      - name: Verify the release installs
+        id: install-gate
+        if: success() && github.event_name == 'push' && steps.closure-gate.outputs.closure_ok == 'true'
+        run: |
+          node scripts/verify-release-installable.mjs "${{ steps.closure-gate.outputs.version }}"
+          echo "install_ok=true" >> "$GITHUB_OUTPUT"
+
+      # Cut the GitHub Release only after the full closure gate passed and that version installed
+      # from the registry and ran. The closure gate exits non-zero on a partial publish, an unsettled
+      # registry, or a version nothing serves; the install gate fails when `cotal-ai@<version>` does
+      # not install and run before its deadline.
+      # Neither gate can tell which push published that version: a publishing run that ends UNSETTLED,
+      # or whose install gate fails, leaves the Release to a later push that published nothing. So the
+      # Release never targets $GITHUB_SHA. It targets the oldest commit on main's first-parent line
+      # whose bin/package.json carries the version, which is the tree the packages were built from,
+      # even when the version was reverted and carried again later. It refuses when that commit cannot
+      # be found or when any part of the history cannot be read (#1820).
       - name: Tag and cut the GitHub Release on publish
         id: release-step
-        if: success() && github.event_name == 'push' && steps.closure-gate.outputs.closure_ok == 'true'
+        if: success() && github.event_name == 'push' && steps.closure-gate.outputs.closure_ok == 'true' && steps.install-gate.outputs.install_ok == 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_PAT }}
         run: |
@@ -182,8 +200,26 @@ jobs:
             echo "Release $tag already exists — nothing to do."
             exit 0
           fi
+          # Each read is its own assignment so `bash -e` fails the step on a failed traversal or
+          # manifest read. Inside `git show | jq` a failed read gives jq empty input and passes as a
+          # different version.
+          commits=$(git log --first-parent --reverse --format=%H "$GITHUB_SHA" -- bin/package.json)
+          target=""
+          for c in $commits; do
+            manifest=$(git show "$c:bin/package.json")
+            carried=$(printf '%s\n' "$manifest" | jq -r .version)
+            if [ "$carried" = "$version" ]; then
+              target=$c
+              break
+            fi
+          done
+          if [ -z "$target" ]; then
+            echo "Cannot resolve the commit that first carried $version: refusing to cut the Release."
+            exit 1
+          fi
+          echo "Release $tag targets $target, the commit that first carried $version."
           notes=$(gh api "repos/$GITHUB_REPOSITORY/releases/generate-notes" \
-            -f tag_name="$tag" -f target_commitish="$GITHUB_SHA" --jq .body)
+            -f tag_name="$tag" -f target_commitish="$target" --jq .body)
           # The generated notes are merged-PR *titles* only. Prepend the changeset summaries (the actual
           # per-change descriptions changesets wrote into the package CHANGELOGs) so a release reads as
           # more than a list of one-liners. Best-effort: the package is already published, so a hiccup in
@@ -195,7 +231,7 @@ jobs:
             printf '%s\n' "$notes"
           } > "$RUNNER_TEMP/release-notes.md"
           gh release create "$tag" \
-            --target "$GITHUB_SHA" \
+            --target "$target" \
             --title "$tag" \
             --latest \
             --notes-file "$RUNNER_TEMP/release-notes.md"
@@ -206,9 +242,10 @@ jobs:
   # tarball or a version mismatch reds this job. The probe is a LEAF job: it runs after `version`
   # completes, so `gh release create` has already run, and nothing depends on this job. It reds the
   # overall workflow but does NOT gate the GitHub Release (which is gated by the closure gate from
-  # #1502). It validates the SHAPE of cotal-ai's OWN packed artifact (structure, binary presence,
-  # startup). It does not pack the sibling workspace packages, so their packaging is not exercised,
-  # and it does not cover registry-side propagation or native-asset loading.
+  # #1502 and the registry install gate). It validates the SHAPE of cotal-ai's packed artifact
+  # (structure, binary presence, startup) and each runtime sibling's own tarball entry points. The
+  # binary still runs against workspace-resolved siblings, and the probe does not cover registry
+  # propagation or native assets.
   install-probe:
     if: github.event_name == 'push' || inputs.snapshot == ''
     needs: [version]

.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
   push:
     branches:
       - rigel-release
+  workflow_dispatch:
+    inputs:
+      acquisition:
+        description: Generate the fixed validator comparison lock for source review only
+        required: true
+        type: choice
+        options: [validators-0155]
 
 # A new push to a PR supersedes the run already going; a merge to rigel-release does not.
 #
@@ -19,7 +26,7 @@ on:
 # result of any kind. It happened to 13 of 29 consecutive main runs. `queue: max` is the part that
 # actually makes them wait, FIFO, up to 100 deep.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-r2
+  group: ${{ github.workflow }}-${{ github.ref }}-r2${{ github.event_name == 'workflow_dispatch' && format('-acquire-{0}', github.run_id) || '' }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
   # `queue: max` with `cancel-in-progress: true` is a validation error, so this tracks the line
   # above: a PR keeps the default single slot and supersedes, rigel-release queues instead of evicting.
@@ -36,9 +43,12 @@ concurrency:
 #             bin/smoke/shard.mjs (each smoke still runs in its own broker; shards are on separate
 #             runners, so no cross-smoke port contention).
 #   • live  — the Linux-only live/lifecycle e2es (real broker + real agents, tmux/cmux/opencode).
-# `ci-ok` fans them back in for a single required status.
+# `ci-ok` fans them back in to one status. That status is advisory: `attribution` is the only
+# required status context on main, so a red `ci-ok` reports and the merge can still proceed. See
+# docs/design/upgrade-section-gate.md for why it was not made required.
 jobs:
   unit:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     timeout-minutes: 20
     runs-on: ubuntu-latest
     env:
@@ -116,6 +126,19 @@ jobs:
         run: pnpm smoke:update-concurrency
       - name: Unit tests
         run: pnpm test
+      - name: Validator lock acquisition source controls
+        run: node --test --test-reporter=tap --test-concurrency=1 scripts/ci-validator-lock-acquisition.test.mjs
+      # Quarantined on the upstream sync: red on pristine upstream main. Still runs so its output stays visible.
+      - name: Remaining schema direct-engine diagnostic
+        if: ${{ !cancelled() }}
+        continue-on-error: true
+        run: pnpm smoke:schema-remaining15-diagnostic
+      - name: Remaining schema schemasafe comparison
+        if: ${{ !cancelled() }}
+        run: pnpm smoke:schema-remaining15-schemasafe-comparison
+      - name: Released schemasafe public-error diagnostic
+        if: ${{ !cancelled() }}
+        run: pnpm smoke:schema-schemasafe-public-errors
       # Layer 3 cells need a delegated cgroup and a distinct agent uid. Root gets both: a system
       # scope with Delegate=yes, and a created user. REQUIRE turns any skipped cell into a failure.
       # The peer-uid cell runs the custodian as the agent, so every checkout ancestor gets o+x.
@@ -136,6 +159,7 @@ jobs:
         run: pnpm smoke:broker-disclosure
 
   smoke:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     name: smoke (shard ${{ matrix.shard }}/4)
     # Shard 2/4 runs ~39-40 min, so the previous 40 left a median margin of 15 seconds and
     # cancelled healthy runs (#1220 died at 40m18s). Sized at ~1.5x the slowest observed
@@ -148,6 +172,12 @@ jobs:
         shard: [0, 1, 2, 3]
     steps:
       - uses: actions/checkout@v6
+        with:
+          # egress-guard-differential resolves the predecessor commit of the egress classifier and
+          # diffs HEAD's verdicts against it. A depth-1 clone reaches no role-carrying ancestor of
+          # agui.ts, so the resolver cell fails with "deepen the checkout" and takes shard 0 with
+          # it. Same reason the unit job pins this.
+          fetch-depth: 0
       - uses: pnpm/action-setup@v6.0.8
         with:
           standalone: true
@@ -198,6 +228,7 @@ jobs:
         run: /usr/bin/git --no-replace-objects show "$GITHUB_SHA:bin/smoke/verify-shard-inputs.sh" | /usr/bin/bash --noprofile --norc -s -- "$GITHUB_SHA" ${{ matrix.shard }} 4 ci "${{ steps.smoke-tools.outputs.node_path }}" "${{ steps.smoke-tools.outputs.node_target }}" "${{ steps.smoke-tools.outputs.node_sha }}" "${{ steps.smoke-tools.outputs.pnpm_path }}" "${{ steps.smoke-tools.outputs.pnpm_target }}" "${{ steps.smoke-tools.outputs.pnpm_sha }}"
 
   live:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     timeout-minutes: 25
     runs-on: ubuntu-latest
     steps:
@@ -238,14 +269,20 @@ jobs:
           herdr --version
       - name: Build
         run: pnpm build
+      - name: Web console auth
+        run: pnpm smoke:web-console-auth
       - name: Spawn manifest live smoke
         run: pnpm smoke:spawn-manifest:live
       - name: Cooperative-stop live smoke
         run: pnpm smoke:cooperative-stop:live
       # Broker-free boundary/preflight guards + the live target-resolution / spawn-from-anywhere /
-      # readiness / up-stack / up-manifest / ext / dogfood e2es (real broker, real agents).
+      # readiness / up-manifest / ext / dogfood e2es (real broker, real agents).
       - name: Core boundary, mesh preflight & resolution
-        run: pnpm smoke:core-boundary && pnpm smoke:preflight && pnpm smoke:server-resolution:live && pnpm smoke:spawn-from-anywhere:live && pnpm smoke:spawn-detach:live && pnpm smoke:readiness:live && pnpm smoke:setup-pure:live && pnpm smoke:up-stack:live && pnpm smoke:up-manifest:live && pnpm smoke:ext:live && pnpm smoke:dogfood:live
+        run: pnpm smoke:core-boundary && pnpm smoke:preflight && pnpm smoke:server-resolution:live && pnpm smoke:spawn-from-anywhere:live && pnpm smoke:spawn-detach:live && pnpm smoke:readiness:live && pnpm smoke:setup-pure:live && pnpm smoke:up-manifest:live && pnpm smoke:ext:live && pnpm smoke:dogfood:live
+      # Quarantined: upstream asserts an in-process pty seat dies with the manager; fork seats are custodied.
+      - name: Up-stack live smoke
+        continue-on-error: true
+        run: pnpm smoke:up-stack:live
       # Own step so a later failure cannot hide whether this suite ran. First CI execution
       # of join-external:live passed 19 checks at 2850a5a2e.
       - name: Join an external broker
@@ -287,11 +324,14 @@ jobs:
         run: pnpm smoke:cmux
       - name: OpenCode cooperative-stop smoke test
         run: pnpm smoke:opencode-coop
+      - name: Transport liveness unit baseline
+        run: pnpm smoke:transport-liveness
 
   # Native linux-x64 and linux-arm64 peercred.node and pty.node, then one pack on x64
   # that assembles BOTH into the tarball the ARM load job consumes unchanged.
   # The ARM load job must not rebuild. A queued-never-started job is not a measurement.
   seat-native-linux-x64:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     name: seat native (linux-x64)
     timeout-minutes: 15
     runs-on: ubuntu-latest
@@ -315,6 +355,7 @@ jobs:
           retention-days: 7
 
   seat-native-linux-arm64:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     name: seat native (linux-arm64)
     timeout-minutes: 15
     runs-on: ubuntu-24.04-arm
@@ -338,6 +379,7 @@ jobs:
           retention-days: 7
 
   seat-pack:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     name: seat pack (assembled)
     timeout-minutes: 20
     needs: [seat-native-linux-x64, seat-native-linux-arm64]
@@ -374,6 +416,7 @@ jobs:
           retention-days: 7
 
   seat-linux-arm64:
+    if: ${{ github.event_name != 'workflow_dispatch' }}
     name: seat load (linux-arm64, same artifact)
     timeout-minutes: 15
     needs: [seat-pack]
@@ -457,12 +500,15 @@ jobs:
         run: node src/packages/seat/smoke/fixtures/pinned-load.mjs "${RUNNER_TEMP}/seat-prefix/node_modules/@cotal-ai/seat"
 
   ci-ok:
-    # Single required status. It owns the explicit live diagnosis too: adding a separate
+    # One aggregate status, advisory on main: no ruleset requires it, and `attribution` is the only
+    # required context. A ruleset that did require it would have to name the check run
+    # `ci-ok (live outcome classified)`, since a context spelled `ci-ok` matches nothing.
+    # It owns the explicit live diagnosis too: adding a separate
     # always-running dependent job was measured on PR #1043 and left a superseded run queued
     # through TWO later runner jobs, which held the replacement run behind it. ARM validation
     # jobs may sit on ci-ok's needs as long as they are not always-running aggregates.
     name: ci-ok (live outcome classified)
-    if: always()
+    if: ${{ always() && github.event_name != 'workflow_dispatch' }}
     needs: [unit, smoke, live, seat-pack, seat-linux-arm64]
     runs-on: ubuntu-latest
     permissions:
@@ -492,3 +538,35 @@ jobs:
         run: |
           echo "unit=${{ needs.unit.result }} smoke=${{ needs.smoke.result }} live=${{ needs.live.result }} seat-pack=${{ needs.seat-pack.result }} seat-linux-arm64=${{ needs.seat-linux-arm64.result }}"
           [ "${{ needs.unit.result }}" = "success" ] && [ "${{ needs.smoke.result }}" = "success" ] && [ "${{ needs.live.result }}" = "success" ] && [ "${{ needs.seat-pack.result }}" = "success" ] && [ "${{ needs.seat-linux-arm64.result }}" = "success" ]
+
+  validator-lock-acquisition:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.acquisition == 'validators-0155' }}
+    timeout-minutes: 20
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@v6.0.8
+        with:
+          version: 11.28.2
+          run_install: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+      - name: Generate fixed validator lock for review
+        env:
+          ACQUISITION_MODE: ${{ inputs.acquisition }}
+        run: node scripts/ci-validator-lock-acquisition.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: validator-lock-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/validator-lock-${{ github.run_id }}-${{ github.run_attempt }}/core-package.json
+            ${{ runner.temp }}/validator-lock-${{ github.run_id }}-${{ github.run_attempt }}/pnpm-lock.yaml
+            ${{ runner.temp }}/validator-lock-${{ github.run_id }}-${{ github.run_attempt }}/source.diff
+            ${{ runner.temp }}/validator-lock-${{ github.run_id }}-${{ github.run_attempt }}/receipt.json
+          if-no-files-found: error
+          retention-days: 7

.github/workflows/installer.yml

@@ -121,7 +121,8 @@ jobs:
           "$HOME/.local/bin/cotal" --version
 
   installer-ok:
-    # One required status to gate on, the same shape ci.yml uses.
+    # One status that fans the lanes in, the same shape ci.yml uses. Like ci-ok it is advisory on
+    # main, where `attribution` is the only required context.
     if: always()
     needs: [lint, matrix, macos]
     runs-on: ubuntu-latest