Add dashboard session stop endpoint

.github/workflows/ci.yml

@@ -3,24 +3,27 @@
 #   e2e pass (scripts/e2e/run.sh) since the e2e suites exercise real
 #   spawn/worker flows against a local mock OpenRouter server.
 #
-# Runs on GitHub-hosted runners (public repo — no self-hosted worker).
 # No API key and no network access are needed — the mock server serves the
-# entire session, so this is safe to run on any push/PR, including from forks.
+# entire session. Only branches in the private maintenance repository run here.
 name: ci
 
 on:
   push:
-    branches: ["**", "!headlesscode-claims/**"]
+    branches: ["wip/audit-20261027"]
   pull_request:
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: private-campaign-ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   typecheck-test-e2e:
-    if: github.event.repository.private == false
-    runs-on: ubuntu-latest
+    if: github.repository == 'Capsize-Games/headlesscode-internal' && github.event.repository.private == true && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: [self-hosted, Linux, X64, workstation-ci, headlesscode-internal-ci]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
@@ -32,14 +35,23 @@ jobs:
           node-version: 22
           cache: npm
 
+      - name: Test private Fleet source staging
+        run: node --test scripts/stage-fleet-test-source.test.mjs
+
+      - name: Stage pinned private Fleet source for integration tests
+        env:
+          FLEET_SECURITY_WATCH_PRIVATE_ROOT: ${{ vars.FLEET_SECURITY_WATCH_PRIVATE_ROOT }}
+          FLEET_SECURITY_WATCH_TEST_REF: ${{ vars.FLEET_SECURITY_WATCH_TEST_REF }}
+        run: node scripts/stage-fleet-test-source.mjs
+
       - name: Install dependencies
         run: npm ci
 
       # The full test suite includes src/tools/__tests__/browser-action.test.ts,
       # which launches a REAL headless Chromium via Playwright — the browser
       # binary is a separate download, not part of npm ci.
       - name: Install Playwright browser
-        run: npx playwright install --with-deps chromium
+        run: npx playwright install chromium
 
       - name: Typecheck
         run: npx tsc --noEmit
@@ -55,3 +67,12 @@ jobs:
 
       - name: End-to-end (mock OpenRouter, no key)
         run: bash scripts/e2e/run.sh
+
+      - name: Remove staged Fleet source
+        if: always()
+        run: >-
+          node -e 'const fs=require("node:fs");const path=require("node:path");
+          const root=process.env.FLEET_SECURITY_WATCH_TEST_ROOT;
+          const temp=process.env.RUNNER_TEMP;
+          if(root&&temp&&path.dirname(root).startsWith(path.join(temp,"fleet-test-source-")))
+          fs.rmSync(path.dirname(root),{recursive:true,force:true})'

.github/workflows/container.yml

@@ -1,3 +1,4 @@
+# Public publishing is disabled in this private maintenance branch.
 name: Publish verified container
 on:
   workflow_run:
@@ -12,8 +13,8 @@ concurrency:
   cancel-in-progress: false
 jobs:
   publish:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'master'
-    runs-on: ubuntu-latest
+    if: ${{ false }}
+    runs-on: [self-hosted, Linux, X64, workstation-ci, headlesscode-internal-ci]
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/publish.yml

@@ -1,3 +1,4 @@
+# Public publishing is disabled in this private maintenance branch.
 # Build a release package on version tags and attach it to the GitHub Release.
 # This workflow does not publish packages to npm.
 #
@@ -15,8 +16,8 @@ permissions:
 jobs:
   npm-publish:
     name: Verify and attach release artifact
-    if: github.event.repository.private == false
-    runs-on: ubuntu-latest
+    if: ${{ false }}
+    runs-on: [self-hosted, Linux, X64, workstation-ci, headlesscode-internal-ci]
     timeout-minutes: 30
     steps:
       - name: Checkout tag

docker/OpenShell.Dockerfile

@@ -33,6 +33,24 @@ RUN mkdir -p /opt/headlesscode-session /opt/headlesscode-data/projects /opt/head
 ENV HEADLESSCODE_ROOT=/opt/headlesscode
 WORKDIR /sandbox
 USER sandbox
+RUN --network=none set -eu; \
+    test "$(id -u)" = "1000"; \
+    test -r /opt/headlesscode/src/cli.ts; \
+    test -r /opt/headlesscode/package.json; \
+    test -r /opt/headlesscode/package-lock.json; \
+    test -r /opt/headlesscode/tsconfig.json; \
+    test -r /opt/headlesscode/shared/stacks; \
+    test -x /opt/headlesscode/shared/stacks; \
+    test -x /opt/headlesscode/node_modules/.bin/tsx; \
+    test -r /opt/headlesscode/scripts/run-worker.sh; \
+    test -x /opt/headlesscode/scripts/run-worker.sh; \
+    test ! -w /opt/headlesscode/src/cli.ts; \
+    test ! -w /opt/headlesscode/src; \
+    test ! -w /opt/headlesscode/shared; \
+    test ! -w /opt/headlesscode/package.json; \
+    test ! -w /opt/headlesscode/package-lock.json; \
+    test ! -w /opt/headlesscode/tsconfig.json; \
+    /opt/headlesscode/node_modules/.bin/tsx /opt/headlesscode/src/cli.ts --help >/dev/null
 RUN test -r /opt/headlesscode/src/cli.ts \
     && test -r /opt/headlesscode/package.json \
     && test -r /opt/headlesscode/package-lock.json \

docs/RSI_SESSION_BRIEF.md

@@ -0,0 +1,76 @@
+# HeadlessCode RSI Self-Improvement — Session Brief
+
+New session. Read this file first, then work. Parent session stays on the
+upstream-fix campaign and Hetzner pipeline; do not touch those.
+
+## Goal
+
+Review the headlesscode codebase, fix what needs fixing, and run the RSI
+loop on headlesscode itself (dogfood the bounded RSI harness against its
+own repo). Workers are authorized for this job — use several in parallel
+on genuinely independent subtasks (review areas, test gaps, docs drift),
+serial where they share files.
+
+## Starting facts (verified 2026-10-27)
+
+- Repo: `~/Projects/headlesscode`, branch `master`, tree CLEAN
+  (HEAD `a1887b3c`, previous `33ac57f7`). Keep it clean: commit completed
+  work per the repo's own contribution rules, never rewrite history.
+- It is a coding-agent harness (CLI + HTTP) with bounded RSI that can
+  already target itself. Entry docs: `docs/recursive-self-improvement.md`,
+  `docs/rsi-progress.md`, `docs/rsi-control-and-monitoring-direction.md`,
+  `docs/evidence-journal.md`, `docs/security-verification.md`.
+- CI runs typecheck + full suite + mock workflows; RSI gates include
+  regression, frozen-proof, and hidden-verification checks.
+
+## Operating rules for this job
+
+1. Read `AGENTS.md`/`CONTRIBUTING.md` first and obey the repo's own gates.
+2. Review before changing: correctness, security controls (the seven
+   insider-risk principles in the README), test coverage, docs drift.
+3. Every code change needs a regression test and must keep CI green.
+   Evidence-required: quote test output, not impressions.
+4. RSI-on-itself runs bounded: fixed task list, inference budgets,
+   contained profile, evidence journal on. Any RSI candidate that fails
+   gates is dropped with the reason recorded.
+5. Never weaken a security gate to make a candidate pass. If a gate
+   blocks legitimate work, flag it for the owner instead.
+6. No history rewrites, no force pushes. Signing deferred (existing key
+   issue) — do not block on it.
+
+## Standing owner constraints (apply here too)
+
+- Approved on everything technical, but: never touch `/opt/wxrq`,
+  homeserver, keyrings, sudoers, systemd daemons, package DBs, kernel
+  builds, or the live Hetzner pipeline (`/home/secwatch`, daemon,
+  drainer, fix-worker). No public exposure of anything.
+- Preserve data, configs, API compatibility, licenses (Apache-2.0 here).
+- `5194`/`5195` stay localhost-only.
+- Report per worker: what was reviewed, what changed, test evidence,
+  what remains unverified. No success claims without observed runs.
+
+## Box workers are IN scope (added 2026-10-27)
+
+The live Hetzner pipeline — `github-mail-daemon.py`, `queue-drain.py`,
+`fix-worker.py` (repo copies in `fleet-security-watch/operations/`) — is
+part of the RSI target. It is the highest-value loop to improve: triage
+accuracy, the fix-worker model loop (v1 ack loop live since 2026-10-27;
+code-fix acting still unimplemented), evidence quality.
+
+Live-safety rules (no exceptions):
+- Review and rewrite code only in repo checkouts and sandboxes. Never
+  hot-edit `/home/secwatch` live files, state, queue, or cron.
+- Deployment to the box stays with the owner session (this window's
+  parent). RSI session proposes; it does not deploy.
+- The fix-worker model loop must keep: STOP kill-switch, post budget,
+  unknown-tasks-stay-queued, mandatory regression test + evidence bundle
+  per fix. Any proposal weakening these is rejected, not refined.
+- No live posting in tests. Dry-runs only outside production paths.
+
+## Suggested split
+
+- Worker 1: code review of `src/rsi/` + roles/gates (correctness + bypasses).
+- Worker 2: code review of permissions/containment/emergency controls.
+- Worker 3: test-gap analysis (what the suite does not cover) + add tests.
+- Worker 4 (after 1–3 land): run bounded RSI-on-itself cycle on one
+  well-scoped target from the reviews, with evidence.

docs/campaign-control-service.md

@@ -0,0 +1,101 @@
+# Campaign-control API supervisor
+
+`headlesscode campaign serve` runs the loopback campaign-control HTTP API and
+its dashboard files. The API binds to `127.0.0.1:4391`; it does not run campaign
+ticks or start RSI work. On MX, `scripts/campaign_control_supervisor.py`
+checks the listener address, process command line, working directory, and API
+status before adopting the existing process. If that process exits, it starts
+only the installed fixed `headlesscode campaign serve` command, using bounded
+retry delays.
+
+The supervisor uses the existing home-directory registration and control
+files. It does not set a model, budget, adapter, credential, or alternate
+data-directory environment variable. Campaign data remains under
+`~/.local/share/headlesscode/campaign-control/`. API authentication continues
+to follow the existing campaign-control server configuration.
+
+## Prerequisites
+
+- Node.js and the supported `headlesscode` CLI wrapper are installed.
+- The dashboard build exists at
+  `~/Projects/capsize-web/apps/fleet-campaign-control/dist`, the path selected
+  by `campaign serve`.
+- The user cron daemon is running. The installer adds one marked `@reboot`
+  entry and preserves unrelated entries.
+- Port 4391 is free, or the existing campaign-control API is the process being
+  adopted. Do not start a second instance beside the existing listener.
+
+The installer checks the wrapper and dashboard build before changing cron. It
+rejects a changed or duplicate managed entry and preserves cron output that it
+cannot verify as the explicit no-crontab case. It does not inspect or copy
+process environment values.
+
+## Install and check
+
+The reviewed supervisor was activated on the reference MX workstation on
+2026-10-29. Use these commands to install on another authorized target or verify
+the existing installation.
+
+```sh
+python3 scripts/manage_campaign_control_supervisor.py install
+python3 scripts/manage_campaign_control_supervisor.py check
+```
+
+The supervisor checks every ten seconds. Restart delays increase from five
+seconds to a five-minute cap. Production waits are interruptible, so rollback
+can stop the supervisor promptly during backoff. It uses a private lock, PID
+file, and log under
+`~/.local/state/headlesscode/campaign-control-supervisor/`; it does not write
+campaign state. If the port belongs to an unrecognized process, it leaves that
+listener untouched and does not launch another process. For campaign data, use
+`headlesscode campaign status --json`; do not use `campaign tick` as a service
+health check.
+
+## Rollback
+
+```sh
+python3 scripts/manage_campaign_control_supervisor.py rollback
+```
+
+Rollback validates the managed cron line before stopping the supervisor or
+removing its installed artifact. It removes only its exact marked `@reboot`
+line and stops the supervisor only when its PID matches the fixed launcher. It
+does not signal the campaign API or delete registration, control state, job
+history, or evidence. If the cron line or installed source was edited, rollback
+stops and preserves it for review. Other cron entries are kept.
+
+## Current activation status
+
+The managed check last reported the loopback supervisor healthy. An earlier
+check found the supervisor stopped even though its `@reboot` entry remained;
+the supported installer restarted the existing managed singleton, and the next
+managed check passed. Reboot recovery has not been exercised, so the cron entry
+is not evidence of a successful reboot test. The API is a control surface; its
+health does not establish that a repository worker is ready or running.
+
+At the latest recorded campaign check, legacy global admission was ON at epoch
+20. The separate Curl repository campaign remained disabled and blocked on
+prerequisites because `workerQualified` was false and the private worker registry
+was empty. No live CVE worker was runnable or claimed. See
+[Fleet campaign control](fleet-campaign-control.md) for the current distinction
+between global admission and repository readiness.
+
+The service check does not verify model access, qualify a worker, enable a
+repository campaign, run a campaign tick, or test reboot recovery. It does not
+change repository campaign state or publish CVE catalog content.
+
+## Synthetic checks
+
+Run the focused unit suite through the shared build queue and compile-check the
+Python modules:
+
+```sh
+python3 -m py_compile scripts/campaign_control_supervisor.py scripts/manage_campaign_control_supervisor.py scripts/test_campaign_control_supervisor.py
+python3 -m unittest discover -s scripts -p 'test_campaign_control_supervisor.py' -v
+```
+
+The tests use temporary state and mocked listeners/processes. They cover exact
+loopback process identity, unknown-listener refusal, singleton locking,
+interruptible backoff, bounded restart delay, cron preservation, error handling,
+rollback validation, and zombie process handling. They do not connect to the
+campaign API or a provider.

docs/fleet-campaign-control.md

@@ -0,0 +1,52 @@
+# Fleet campaign control
+
+HeadlessCode exposes two separate controls: the legacy global Fleet adapter and
+registered per-repository campaigns. Their switches and readiness are separate.
+Enabling the global adapter does not enable a repository campaign.
+
+## Legacy global adapter
+
+The optional `headlesscode campaign` commands control the locally registered
+Fleet adapter:
+
+- `campaign status` reads the global switch, budget allocation and run history.
+- `campaign on` and `campaign off` change admission for the legacy adapter.
+  OFF blocks new work while accepted work retains its cleanup and evaluation
+  path.
+- `campaign budget --usd <amount>` sets the shared monthly limit. The limit
+  cannot discard committed or ambiguous spend.
+- `campaign tick` runs the fixed adapter under a non-overlap lease. The ordinary
+  owner-managed schedule invokes it; Codex timers do not.
+- `campaign serve` exposes the loopback control API on port 4391. It does not
+  expose the public CVE catalog.
+
+The legacy budget remains part of the existing shared monthly authority; it is
+not a separate allowance for repository campaigns.
+
+## Per-repository campaign status
+
+The additive repository coordinator keeps campaign definitions, claims,
+readiness, job history and worker registrations in separate owner-controlled
+state. Browser requests cannot set trusted source, worker, policy, model,
+access or evaluator qualifications. A campaign is runnable only when the
+owner-provisioned definition and exact worker registration satisfy those
+checks.
+
+The current repository definition is the Curl entry for CVE-2026-92390. Code
+includes the fixed evaluator profile `curl-92390-fixed-v1` and a
+qualification-only preflight for its pinned source proof. That proof does not
+establish worker qualification and the preflight is not a patch worker or a
+general advisory approval. The live private worker registry is empty and the
+campaign definition reports `workerQualified=false`. The Curl campaign is
+disabled and blocked on prerequisites. No live CVE worker is currently
+runnable or claimed.
+
+As of 2026-10-29, the legacy global admission switch is ON at control epoch 22.
+That state does not change the Curl campaign's disabled, blocked-prerequisite
+state. Do not describe qualification-profile code or historical jobs as a live
+worker run, verified repair, upstream submission or catalog publication.
+
+The protected budget and stop controls remain authoritative for any future
+repository worker. A stopped or blocked campaign must not be started until its
+registered source, worker, fixed recipe, evaluator, data access and model
+qualifications are independently present and verified.