Merge M10: run-record retention

Closes #32

docs/plans/CURRENT.md

@@ -7,14 +7,14 @@ update this file to the next action). No ambiguity, no re-planning.
 
 ## Next action
 
-Owner decision on M9: mission-level capability policy (design sketch: missions may declare default tool sets; tasks inherit unless overridden; conductor validates the merge). Say "next" to proceed or name a different target.
+Owner review of M9 (mission capability policy) — then name the next target.
 
 ## Queue (ordered, not started)
 
-1. M9: mission-level capability policy
-2. Run-record retention/pruning policy
-3. Second real adapter (parked — owner focused on Pi)
-4. Auto-apply policy for worker patches (deferred until capability policy exists)
+1. Run-record retention/pruning policy
+2. Second real adapter (parked — owner focused on Pi)
+3. Auto-apply policy for worker patches (capability policy now exists as its substrate)
+4. Session forking from a common ancestor (pi JSONL trees make this native)
 
 ## Rules
 
@@ -33,4 +33,7 @@ Owner decision on M9: mission-level capability policy (design sketch: missions m
 - 2026-09-03 — M7 run inspection + release 0.0.6 (#24) — merged, activated
 - 2026-09-03 — M8 conductor loop + worker-built retry (#25, #26, #27) — merged; worker authored retry in 2 refinement rounds, conductor fixed a 3-line interpolation rename; live retry verified
 - 2026-09-03 — retry lineage + relative mission resolution (#28) — merged, 36/24/14 suites + verify green
+- 2026-09-03 — M9 mission capability policy (#30) — merged, least-privilege intersection, 41/36/14 + verify green
+- 2026-09-03 — M8 conductor loop + worker-built retry (#25, #26, #27) — merged; worker authored retry in 2 refinement rounds, conductor fixed a 3-line interpolation rename; live retry verified
+- 2026-09-03 — retry lineage + relative mission resolution (#28) — merged, 36/24/14 suites + verify green
 - 2026-09-03 — M8 conductor loop + worker-built retry (#25, #26, #27) — merged; worker authored retry in 2 refinement rounds, conductor fixed a 3-line interpolation rename; live retry verified

scripts/mosaic-task.mjs

@@ -529,6 +529,52 @@ function retryRun(runId) {
   runTask(tempTaskFile, { retriedFrom: runId });
 }
 
+function pruneRuns(args) {
+  const resolved = loadConfig();
+  const root = runsRoot(resolved);
+  let keep = 50;
+  let apply = false;
+  for (const arg of args) {
+    if (arg === "--yes") apply = true;
+    else if (arg === "--keep") fail(4, "prune: --keep requires a value");
+    else if (arg.startsWith("--keep=")) {
+      keep = Number(arg.slice("--keep=".length));
+      if (!Number.isInteger(keep) || keep < 1) fail(4, `--keep must be a positive integer (got ${arg.slice(7)})`);
+    } else fail(4, `unknown prune option: ${arg}`);
+  }
+
+  let entries = [];
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true })
+      .filter((e) => e.name.startsWith("r-") && e.isDirectory() && !e.isSymbolicLink())
+      .map((e) => e.name)
+      .sort();
+  } catch {
+    // No runs yet.
+  }
+
+  if (entries.length <= keep) {
+    process.stdout.write(`prune: ${entries.length} run(s) present, keep=${keep} -> nothing to prune\n`);
+    process.exit(0);
+  }
+
+  const doomed = entries.slice(0, entries.length - keep); // oldest first
+  if (!apply) {
+    process.stdout.write(`prune (dry-run): would remove ${doomed.length} oldest run(s), keep ${entries.length - doomed.length}:\n`);
+    for (const id of doomed) process.stdout.write(`  would remove: ${id}\n`);
+    process.stdout.write("prune: re-run with --yes to apply\n");
+    process.exit(0);
+  }
+
+  const receipt = path.join(root, ".pruned.log");
+  for (const id of doomed) {
+    fs.rmSync(path.join(root, id), { recursive: true, force: true });
+    fs.appendFileSync(receipt, `${JSON.stringify({ at: new Date().toISOString(), event: "pruned", runId: id })}\n`);
+  }
+  process.stdout.write(`prune: removed ${doomed.length} run(s), kept ${keep}; receipt: ${receipt}\n`);
+  process.exit(0);
+}
+
 const operation = process.argv[2];
 const target = process.argv[3];
 
@@ -552,10 +598,13 @@ switch (operation) {
   case "list":
     listRuns();
     process.exit(0);
+  case "prune":
+    pruneRuns(process.argv.slice(3));
+    break;
   case "retry":
     if (!target) fail(4, "usage: mosaic-task.mjs retry <runId>");
     retryRun(target);
     break;
   default:
-    fail(4, `unknown operation: ${JSON.stringify(operation ?? "")} (expected validate | run | show | list | retry)`);
+    fail(4, `unknown operation: ${JSON.stringify(operation ?? "")} (expected validate | run | show | list | retry | prune)`);
 }

scripts/test-config.sh

@@ -10,10 +10,16 @@ SANDBOX="$(mktemp -d)"
 trap 'rm -rf "$SANDBOX"' EXIT
 
 PASS=0
+# Status colors: terminal-only, NO_COLOR-respecting; plain when piped.
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_OK=$'\033[0;32m'; C_FAIL=$'\033[0;31m'; C_RESET=$'\033[0m'
+else
+    C_OK=""; C_FAIL=""; C_RESET=""
+fi
 FAIL=0
 
 check() {
-    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "ok   $1"; else FAIL=$((FAIL+1)); echo "FAIL $1"; fi
+    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $1"; else FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $1"; fi
 }
 
 # expect_exit NAME EXPECTED_RC -- command...
@@ -25,10 +31,10 @@ expect_exit() {
     rc=$?
     if [ "$rc" -eq "$expected" ]; then
         PASS=$((PASS + 1))
-        echo "ok   $name (exit $rc)"
+        echo "${C_OK}OK${C_RESET}    $name (exit $rc)"
     else
         FAIL=$((FAIL + 1))
-        echo "FAIL $name (exit $rc, expected $expected)"
+        echo "${C_FAIL}FAIL${C_RESET} $name (exit $rc, expected $expected)"
     fi
 }
 
@@ -62,8 +68,8 @@ check "env exports adapter" $?
 rm -f "$SANDBOX/config.json"
 expect_exit "bootstrap creates default when absent" 0 -- \
     env MOSAIC_CONFIG="$SANDBOX/config.json" $CONFIG_OP bootstrap
-[ -f "$SANDBOX/config.json" ] && { PASS=$((PASS+1)); echo "ok   bootstrap wrote config file"; } \
-    || { FAIL=$((FAIL+1)); echo "FAIL bootstrap wrote config file"; }
+[ -f "$SANDBOX/config.json" ] && { PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    bootstrap wrote config file"; } \
+    || { FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} bootstrap wrote config file"; }
 
 SUM_BEFORE=$(sha256sum "$SANDBOX/config.json" | cut -d' ' -f1)
 MTIME_BEFORE=$(stat -c %Y "$SANDBOX/config.json")
@@ -73,9 +79,9 @@ expect_exit "bootstrap is idempotent on existing config" 0 -- \
 SUM_AFTER=$(sha256sum "$SANDBOX/config.json" | cut -d' ' -f1)
 MTIME_AFTER=$(stat -c %Y "$SANDBOX/config.json")
 if [ "$SUM_BEFORE" = "$SUM_AFTER" ] && [ "$MTIME_BEFORE" = "$MTIME_AFTER" ]; then
-    PASS=$((PASS+1)); echo "ok   bootstrap did not rewrite existing config"
+    PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    bootstrap did not rewrite existing config"
 else
-    FAIL=$((FAIL+1)); echo "FAIL bootstrap rewrote existing config"
+    FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} bootstrap rewrote existing config"
 fi
 
 # --- validate ---
@@ -140,9 +146,9 @@ cfg valid.json "$(valid_body "$DATA_ROOT")"
 EVAL_OUT="$(MOSAIC_CONFIG="$SANDBOX/valid.json" $CONFIG_OP env)" || true
 if eval "$EVAL_OUT" 2>/dev/null && [ "$MOSAIC_DATA_ROOT" = "$DATA_ROOT" ] \
     && [ "$MOSAIC_PROVIDER" = "zai" ] && [ "$MOSAIC_MODEL" = "glm-5.3-flash" ]; then
-    PASS=$((PASS+1)); echo "ok   env exports resolve correctly"
+    PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    env exports resolve correctly"
 else
-    FAIL=$((FAIL+1)); echo "FAIL env exports resolve correctly"
+    FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} env exports resolve correctly"
 fi
 
 # --- validation must not modify the file ---
@@ -150,9 +156,9 @@ SUM_INVALID_BEFORE=$(sha256sum "$SANDBOX/invalid.json" | cut -d' ' -f1)
 MOSAIC_CONFIG="$SANDBOX/invalid.json" $CONFIG_OP validate >/dev/null 2>&1
 SUM_INVALID_AFTER=$(sha256sum "$SANDBOX/invalid.json" | cut -d' ' -f1)
 if [ "$SUM_INVALID_BEFORE" = "$SUM_INVALID_AFTER" ]; then
-    PASS=$((PASS+1)); echo "ok   failed validation modified nothing"
+    PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    failed validation modified nothing"
 else
-    FAIL=$((FAIL+1)); echo "FAIL failed validation modified the file"
+    FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} failed validation modified the file"
 fi
 
 echo

scripts/test-release.sh

@@ -15,6 +15,12 @@ cp RELEASE "$RELEASE_BACKUP"
 trap 'cp "$RELEASE_BACKUP" RELEASE 2>/dev/null; rm -rf "$SANDBOX" "$RELEASE_BACKUP"' EXIT
 
 PASS=0
+# Status colors: terminal-only, NO_COLOR-respecting; plain when piped.
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_OK=$'\033[0;32m'; C_FAIL=$'\033[0;31m'; C_RESET=$'\033[0m'
+else
+    C_OK=""; C_FAIL=""; C_RESET=""
+fi
 FAIL=0
 
 expect_exit() {
@@ -24,14 +30,14 @@ expect_exit() {
     "$@" >/dev/null 2>&1
     rc=$?
     if [ "$rc" -eq "$expected" ]; then
-        PASS=$((PASS+1)); echo "ok   $name (exit $rc)"
+        PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $name (exit $rc)"
     else
-        FAIL=$((FAIL+1)); echo "FAIL $name (exit $rc, expected $expected)"
+        FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $name (exit $rc, expected $expected)"
     fi
 }
 
 check() {
-    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "ok   $1"; else FAIL=$((FAIL+1)); echo "FAIL $1"; fi
+    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $1"; else FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $1"; fi
 }
 
 # ---------- fast: release identity ----------

scripts/test-task.sh

@@ -11,6 +11,12 @@ SANDBOX="$(mktemp -d)"
 trap 'rm -rf "$SANDBOX"' EXIT
 
 PASS=0
+# Status colors: terminal-only, NO_COLOR-respecting; plain when piped.
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_OK=$'\033[0;32m'; C_FAIL=$'\033[0;31m'; C_RESET=$'\033[0m'
+else
+    C_OK=""; C_FAIL=""; C_RESET=""
+fi
 FAIL=0
 
 expect_exit() {
@@ -20,14 +26,14 @@ expect_exit() {
     "$@" >/dev/null 2>&1
     rc=$?
     if [ "$rc" -eq "$expected" ]; then
-        PASS=$((PASS+1)); echo "ok   $name (exit $rc)"
+        PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $name (exit $rc)"
     else
-        FAIL=$((FAIL+1)); echo "FAIL $name (exit $rc, expected $expected)"
+        FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $name (exit $rc, expected $expected)"
     fi
 }
 
 check() {
-    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "ok   $1"; else FAIL=$((FAIL+1)); echo "FAIL $1"; fi
+    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    $1"; else FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} $1"; fi
 }
 
 latest_reason() {
@@ -36,10 +42,6 @@ latest_reason() {
     [ -n "$latest" ] && node -e 'try{const r=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));console.log(r.reason??"")}catch{console.log("")}' "$latest/result.json" 2>/dev/null
 }
 
-check() {
-    if [ "$2" = "0" ]; then PASS=$((PASS+1)); echo "ok   $1"; else FAIL=$((FAIL+1)); echo "FAIL $1"; fi
-}
-
 CONFIG="$SANDBOX/config.json"
 DATA_ROOT="$SANDBOX/data"
 mkdir -p "$DATA_ROOT"
@@ -102,6 +104,37 @@ $TASK validate "$SANDBOX/ok.json" >/dev/null 2>&1
 M2=$(stat -c %Y "$SANDBOX/ok.json")
 [ "$M1" = "$M2" ] && check "validation does not modify the task file" 0 || check "validation does not modify the task file" 1
 
+# ---------- retention: prune (deterministic, no Docker) ----------
+mkdir -p "$SANDBOX/data"
+cat > "$SANDBOX/prune-config.json" <<EOF
+{"configVersion":1,"environment":"development","dataRoot":"$SANDBOX/data","execution":{"backend":"docker","provider":"zai","model":"m"}}
+EOF
+for i in 1 2 3 4 5; do
+    D="$SANDBOX/data/runs/r-20260903T0100_0${i}Z-suite00$i"
+    mkdir -p "$D"
+    printf '{"runVersion":1,"runId":"r-20260903T0100_0%sZ-suite00%s","taskId":"t","status":"succeeded"}' "$i" "$i" > "$D/result.json"
+done
+mkdir -p "$SANDBOX/data/sessions/sentinel" "$SANDBOX/data/workspaces/sentinel"
+
+expect_exit "prune dry-run exits 0" 0 -- env MOSAIC_CONFIG="$SANDBOX/prune-config.json" node scripts/mosaic-task.mjs prune
+[ "$(ls "$SANDBOX/data/runs" | grep -c '^r-')" -eq 5 ] \
+    && check "dry-run deleted nothing" 0 || check "dry-run deleted nothing" 1
+
+expect_exit "prune --keep=2 --yes removes oldest" 0 -- env MOSAIC_CONFIG="$SANDBOX/prune-config.json" node scripts/mosaic-task.mjs prune --keep=2 --yes
+[ "$(ls "$SANDBOX/data/runs" | grep -c '^r-')" -eq 2 ] \
+    && check "kept exactly 2 newest runs" 0 || check "kept exactly 2 newest runs" 1
+NEWEST="r-20260903T0100_05Z-suite005"
+[ -d "$SANDBOX/data/runs/$NEWEST" ] \
+    && check "newest run kept, oldest pruned" 0 || check "newest run kept, oldest pruned" 1
+[ -f "$SANDBOX/data/runs/.pruned.log" ] \
+    && [ "$(grep -c 'pruned' "$SANDBOX/data/runs/.pruned.log")" -eq 3 ] \
+    && check "append-only receipt written (3 entries)" 0 \
+    || check "append-only receipt written (3 entries)" 1
+[ -d "$SANDBOX/data/sessions/sentinel" ] && [ -d "$SANDBOX/data/workspaces/sentinel" ] \
+    && check "sessions/workspaces untouched by prune" 0 \
+    || check "sessions/workspaces untouched by prune" 1
+expect_exit "prune with invalid keep exits 4" 4 -- env MOSAIC_CONFIG="$SANDBOX/prune-config.json" node scripts/mosaic-task.mjs prune --keep=0 --yes
+
 # ---------- adapter seam: deterministic mock cases (Docker, no provider) ----------
 if docker info >/dev/null 2>&1; then
     good_task "$SANDBOX/ok.json"
@@ -238,18 +271,12 @@ dump_latest_run() {
     fi
 }
 
-latest_reason() {
-    local latest
-    latest="$(ls -dt "$SANDBOX/data/runs"/r-* 2>/dev/null | head -1)"
-    [ -n "$latest" ] && node -e 'try{const r=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));console.log(r.reason??"")}catch{console.log("")}' "$latest/result.json" 2>/dev/null
-}
-
 if docker info >/dev/null 2>&1; then
     RUNS1=$(ls "$DATA_ROOT/runs" 2>/dev/null | wc -l)
     if scripts/run-task.sh run "$SANDBOX/ok.json" >/dev/null 2>&1; then
-        PASS=$((PASS+1)); echo "ok   live hello task succeeds with exact marker"
+        PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    live hello task succeeds with exact marker"
     else
-        FAIL=$((FAIL+1)); echo "FAIL live hello task succeeds with exact marker" >&2
+        FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} live hello task succeeds with exact marker" >&2
         dump_latest_run
     fi
 
@@ -266,9 +293,9 @@ process.exit(r.status === "succeeded" && r.response === "MOSAIC_HELLO_OK" && r.e
     RC=$?
     WRONG_REASON="$(latest_reason)"
     if [ "$RC" -eq 1 ] && [ "$WRONG_REASON" = "expect-mismatch" ]; then
-        PASS=$((PASS+1)); echo "ok   wrong expectExact fails with exit 1 (reason: expect-mismatch)"
+        PASS=$((PASS+1)); echo "${C_OK}OK${C_RESET}    wrong expectExact fails with exit 1 (reason: expect-mismatch)"
     else
-        FAIL=$((FAIL+1)); echo "FAIL wrong expectExact (exit $RC, reason: '${WRONG_REASON:-none}')" >&2
+        FAIL=$((FAIL+1)); echo "${C_FAIL}FAIL${C_RESET} wrong expectExact (exit $RC, reason: '${WRONG_REASON:-none}')" >&2
         dump_latest_run
     fi
 

scripts/verify.sh

@@ -16,6 +16,13 @@ source scripts/common.sh
 
 EXPECTED="${EXPECTED_MARKER:-MOSAIC_HELLO_OK}"
 
+# Status colors: terminal-only, NO_COLOR-respecting; plain when piped.
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_OK=$'\033[0;32m'; C_FAIL=$'\033[0;31m'; C_RESET=$'\033[0m'
+else
+    C_OK=""; C_FAIL=""; C_RESET=""
+fi
+
 load_config
 load_release
 IMAGE="$MOSAIC_IMAGE_TAG"
@@ -51,11 +58,11 @@ TRIMMED="$(printf '%s' "$RESPONSE" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]
 
 # 4-6. Exact comparison gate.
 if [ "$TRIMMED" = "$EXPECTED" ]; then
-    echo "PASS: response matches expected marker"
+    echo "${C_OK}PASS${C_RESET}: response matches expected marker"
     exit 0
 fi
 
-echo "FAIL: response does not match expected marker" >&2
+echo "${C_FAIL}FAIL${C_RESET}: response does not match expected marker" >&2
 printf 'expected: %s\n' "$EXPECTED" >&2
 printf 'actual  : %s\n' "$TRIMMED" >&2
 exit 1