--- class: reference purpose: Public release notes for the harness package v1.1.40. maturity: shipped --- # ArgonDB Claude Code Harness v1.1.40 **`argon-harness-v1.1.40-linux.tar.gz`** — supersedes v1.1.39. Rendered from template commit `4a3cf9cb4a00` (the port commit `569897fcf334` on template main `008c4675cc87`, the v1.1.39 tag, followed by twelve commits from the cut's own gate and render findings), tagged `harness-2026-10-24-4a3cf9cb`, also `harness-v1.1.40`. Same installers, same layout, same four topologies, `overlay_impact: compatible` — measured, not assumed: `template.toml` and `genesis-config.py` are unchanged between the two tags, so nothing in your overlay has to change. 13 template commits since v1.1.39, 55 files changed, 5,938 insertions, 2,373 deletions — measured with `git diff --shortstat` on the template, not recalled. The source project landed 374 commits on its cut source since the v1.1.39 cut source (`80cea9456e`), the task-named landings among them listed in the lane report. This release is R4 of the one fleet job registry (`docs/2026-10-18-one-fleet-job-registry-design.md`, Steve's block of 2026-10-18 [D-2026-10-18-00377b]): every job on every fleet box is a row in ONE job table on the coordinator box, and from this release every coordinator instance writes its own rows into it, over ssh, through the client below [D-2026-10-18-5027bd] [D-2026-10-18-800bb2]. R2 rides inside it: the Mac and splink-server are registry nodes as they are. The executable-set leg read `171 path(s): 142 mirrored, 0 added from main, 24 watchdog script(s) the template does not carry, 5 excluded by the template's map, 0 refused` at the port commit (15 of the 142 were added from main by the leg's first pass). **The one thing v1.1.38 and v1.1.39 said they did NOT carry, this release carries.** The source project's job-table step (its Rust ledger and reconciler, source 5b11b74e4d) ships in this package as main's executable set — `reconcile.sh` and `account-pool.py` read and write the job table — and what makes that viable on an instance that has no Rust binary and no table of its own is the client: the table they reach is the coordinator box's, over ssh. Nothing in this package runs a job table locally. ## What changed **THE REGISTRY CLIENT.** Three faces, one seam, one transport — the ssh reach `scripts/argon_claim.py` already uses for every claim (payload in a file on stdin, `timeout $ARGON_COORD_SSH_TIMEOUT ssh -o ConnectTimeout=15 -o BatchMode=yes bash -s`): - `argon-coord job --registry local|ssh:` — the `--registry` argument on every `job` subcommand. Under `ssh:` the verb runs on the coordinator box; the applied transition's ledger_event seq comes back on the `APPLIED … seq=` line (every `APPLIED`, `NOTED` and `EVENT` line now carries `seq=`), and a `--render ` companion line is written on the instance from it. A refusal by the one place comes back verbatim with its exit code (3): `REFUSED landed->running by coordinator@: a landed job is final…`. An unreachable registry is `REFUSED by : registry ssh: unreachable -- ssh itself failed (exit 255) …` (exit 3), and nothing is written anywhere — never a silent local write. `tail`, `watch`, `sweep` and `compare` refuse an ssh reach by name: they are the coordinator box's own timers. The package carries no binary, so this face is for a box that has one; the two below are what a rendered instance runs. - `python3 scripts/argon_claim.py job -- ` — the script face. `job` is a registry verb like `claim`, so it routes the same way: local on the coordinator box, over ssh everywhere else, where the far side execs the coordinator's binary and passes stdout, stderr and the exit code through. - **`scripts/task-ledger.py` has ONE writer seam.** Every verb that appends to the JSONL (`append`, `exited`, `park`, `consume`, `respawn`, `amend`, `lineage`, and through them the launcher, the reconciler, the hand door, the lane itself, the node referee, the landings, the checks and watchers, the cut and compaction scripts) lands in `_append_event`, which calls the seam first. When `ARGON_COORD_TRANSPORT` resolves to `ssh:` the shell verb's job verb runs on the coordinator box and the instance's own line carries `data.one_place_seq` (the companion mark v1.1.39's notes called "the ledger companion key"; a tailer folds a marked line as nothing), so the instance's own board, launcher and reconciler keep reading their JSONL. A shell verb the table has no verb for (`held`, `lineage`, a `corrected` whose observed word moves no state) is written locally and COUNTED in `.unrouted` — `task-ledger.py unrouted-count` is the board figure — never dropped. A refusal, or an unreachable registry, refuses the local write too, by name. When the transport resolves to `local` (the coordinator box; unset) nothing changes. - `scripts/argon-coord-client.sh` (rendered `-coord-client.sh`) is what `scripts/lib/coord-cmd-resolve.sh` hands every shell caller of `argon-coord job` on a box with no executable binary under the ssh transport — `reconcile.sh`, `task-ledger.sh`, `fleet-monitor.sh`, `lane-harvest.sh`, `park-resolve.sh` keep calling ` job …` unchanged; it forwards through the script face and renders `--render` here. Any other subcommand is refused by name (exit 2). `scripts/account-pool.py` reads the table through the same face, so the pool's reaper on an instance reads the one table's rows. The shell-verb → job-verb table, one copy (`ONE_PLACE_VERB_TABLE`, kept in step with the tailer's own `verb_of`): `queued` → `transition requeue`; `spawned` → `spawn`; `spawned` (amend), `parked`, `completed`, `needs-fix`, `records-unlanded` → `event --kind note`; `exited` → `exit`; `consumed` with verdict pass and a merge_commit → `land --sha` (proven by `git ls-remote` on the coordinator box); `consumed` (other), `errored`, `corrected` (died, errored) → `fail`; `retired` → `retire`; `held`, `lineage`, `corrected` (other observed) → no job verb, written locally and counted. The job actor is `@` (`ARGON_COORD_INSTANCE`, else fleet.toml's `[coord].name`, else the hostname). `ledger_event.actor` is a CHECKed closed set, so the word stays there and the instance rides in the row's `data.instance`; `job_event.actor` carries it whole. No schema migration. **R2: THE TWO CUTS-ONLY NODES.** `argon-coord job list --node steve-macbook` and `--node splink-server` answer (a `--node` filter on `list`: the row's node, or a `node:` claim the job holds — the macOS cut's exclusive claim names its row before any spawn). `account-pool.py status` ends its node coverage with `node coverage: steve-macbook CUTS-ONLY (macos-build; 0 agent lanes) — no pool dir is the correct reading: …`, derived from the inventory and never probed: nothing is placed there, no pool dir is created, and its jobs are rows. **Beside the client.** The job-events runtime and the job-tail unit now rest on a box with no binary (`JOB-EVENTS: UNARMED …`, exit 0; `job-tail: no argon-coord at …`, exit 0) instead of crash-looping under their timers: on an instance the event log and the tailer are the coordinator box's. Six source rewords the v1.1.39 cut made on its cut branch (fixtures and comments beside the executable-set rows, and the removal of a 9,484-line stray `task-ledger.py.orig`) are now on the source's main. The template's map gained rules for the product's cloud-program name and for the steward spool watcher's mailbox sites (an instance names its mailbox in `_STEWARD_MAILBOX` or has none). ## Adopting it on an instance One setting, written where the instance's units and hooks read their environment (the refresh's user-state leg; for a hand adoption, `~/.config//env` or the unit's `Environment=`): ``` ARGON_COORD_TRANSPORT=ssh: ``` (the rendered spelling is `_COORD_TRANSPORT`), with the alias resolving from the instance's `~/.ssh/config` under the harness key the instance already uses for claims. Nothing else changes; with it unset the instance behaves as v1.1.39 did. The line that proves the first row arrived, read on the coordinator box: ``` argon-coord job list --all --json | python3 -c 'import json,sys; print([r["name"] for r in json.load(sys.stdin) if r.get("owner")])' ``` and on the instance, the first routed line in its own ledger: `grep -m1 one_place_seq var/fleet-board/task-ledger.jsonl`. **The ERP-side block is the gate for the ERP instance's first row** (the wording of the design page's §0, selected by Steve on that side). This release does not perform that refresh. ## Candor: what is and is not routed Every writer class of the ERP coordinator's census writes through the one seam as rendered — the launcher's spawned, the reconciler's corrections (and its direct `argon-coord job fail|exit|event` calls through the shell face), the hand door's queued, the lane's exited and park, the node referee's spawned, the landings' consumed, the checks' and the cut scripts' appends — and the fixture proof below drove one write per class. Not routed by VERB, by design and counted: `held` (the brain's after-merge hold), `lineage`, and a `corrected` whose observed word is an advisory (`overdue`, `idle`); those lines stay on the instance's JSONL and `unrouted-count` says how many. Not an instance writer at all: `job-events-runtime.sh` (it rests UNARMED). A refusal by the table refuses the instance's local write too, so the instance's own readers see no line for that event until the write is retried; the refusal is printed with the table's exit code in it. **An instance that has not recorded its coordinator token** (product.toml `coordinator = ""`, set by the instance's coordinator at onboarding; the template renders it empty) sees `MEMORY-MIRROR-LEG: FAIL token` on this release's refresh -- the memory backup unit is named by that token -- and the refresh arms nothing else after it. Record the token first; the acceptance below renders that onboarded state. The installer in this release no longer refuses a render that records NO token (it installs under the render's own slug and says so); a recorded token that DIFFERS from the slug is still refused, as before. **Found on the render, fixed in this release, said plainly.** The first render proof of this client was refused on every routed write: the ssh payload named the coordinator's claim module by its ArgonDB name, and a rendered copy names it by the instance's own identifier; the payload now execs whichever `*_claim.py` the coordinator box holds (template `c2942528d97e`). A rendered copy of the claim module reads its reach-active marker under the instance's prefix (`_CLAIM_COORD_REACH_ACTIVE`), so a coordinator box whose far-side checkout is itself a render re-routes once more unless its fleet.toml says `mode = "local"`; the proof's far side is configured so, and a fleet whose coordinator box is a render should check that line before adopting. Not carried into this release: the v1.1.39 cut branch's rewording of `scripts/lib/memory-mirror-unit.sh` (`5c8d7edf2b`), which never landed on main; the shipped file is main's. Two same-day tags precede the shipped one on the template (`harness-2026-10-23-f9567d3b`, `harness-2026-10-23-92e661d6`); their builds never published and they stay as the record. Four kept acceptance render directories from earlier failed attempts remained on the acceptance login when this was written; they are named in the lane report. ## Proven on a render ``` PROVEN ON A RENDER -- rendered-instance-acceptance: PASS - (iv-a)..(v) on a fresh render of argon-harness-v1.1.39-linux.tar.gz refreshed to argon-harness-v1.1.40-linux.tar.gz on argon-accept@ms-01 RIA (iv-a) OK the refresh log has no NA and no FAIL leg; RECONCILER-OK and WATCHDOG-OK each print once RIA (iv-b) OK list-timers lists riaprod-reconciler.timer and riaprod-watchdog.timer; riaprod-reconciler.service and riaprod-watchdog.service name /home/argon-accept/ria.WTn3hsXr/srv/myproject and never $HOME/projects/ RIA (iv-c) OK `systemctl --user start riaprod-reconciler.service` exited 0; its journal: == reconciler done: 0 task(s) probed, 0 correction(s), 0 overdue flag(s), 0 expired-park flag(s), 0 lane-proof flag(s), 0 zero-idle flag(s), 0 exited-backlog flag(s), 0 contradicted terminal event(s), 0 landing(s) bound, 0 NOT LANDED, 0 respawn dispatch(es), 0 pr-harvest pass(es), 0 park-resolve pass(es), 0 table/shell disagreement(s) not probed, 0 stale refusal(s), 0 alarm(s) == RIA (iv-d) OK post-compact-health.sh prints reconciler=armed and no RECONCILER: ABSENT line RIA (iv-e) OK lane-launch.sh spawned 'rendered-instance-acceptance-trivial-lane' (STAND-IN PRODUCER: LANE_LAUNCH_DRYRUN=1, no model call): launched=ok, /home/argon-accept/ria.WTn3hsXr/srv/myproject/var/fleet-board/lane-runs/rendered-instance-acceptance-trivial-lane/20261024T013054Z-e8157bd1/run.deadline_at=1792819857, an exited event in /home/argon-accept/ria.WTn3hsXr/srv/myproject/var/fleet-board/task-ledger.jsonl RIA (iv-f) OK context-refresh-sessionstart.sh on a subagent-shaped stdin (rc 0) prints no TEXT ONLY instruction RIA (v) OK every unit this run armed is disarmed and removed: `systemctl --user list-timers --all | grep -c riaprod` = 0, and no riaprod* file is left in /home/argon-accept/.config/systemd/user ``` `(iv-e)` used the launcher's stand-in producer (`LANE_LAUNCH_DRYRUN=1`) and made no model call. The acceptance render records its coordinator token (`var/product-local.toml`) and declares itself a coordinator on its box before the refresh, as every instance's onboarding does; a render that never recorded the token fails the memory-mirror leg as the candor section says. The eighth build attempt is the one that proved it: the first seven refused on the builder-tree rule, the package sanitizer, a file-roles row, the acceptance leg's predecessor resolution and three acceptance-render reds, each named with its fix in the lane report. ## Proven against a copy of the live table `testing/harness/registry-client-selftest.sh --fixture ` on the source's build node, over a REAL ssh to localhost (a per-run sshd): ``` registry-client-selftest: fixture table: a copy of /tmp/registry-fixture.r4-lane/harness.sqlite.pristine (63799296 bytes) ok T0 a real ssh session to localhost:38776 answers (per-run sshd, per-run key) ok T1 [hand-door] -> ledger_event seq=18558 actor=coordinator@fixture-instance; local JSONL line marked one_place_seq=18558 ok T2 [launcher] -> ledger_event seq=18559 actor=coordinator@fixture-instance; local JSONL line marked one_place_seq=18559 ok T3 [lane] -> ledger_event seq=18560 actor=lane@fixture-instance; local JSONL line marked one_place_seq=18560 ok T4 [landings] -> ledger_event seq=18561 actor=coordinator@fixture-instance; local JSONL line marked one_place_seq=18561 ok T5 task A walked queued -> running -> exited -> landed on the fixture (state=landed) ok T6 [reconciler] -> ledger_event seq=18564 actor=reconciler@fixture-instance; local JSONL line marked one_place_seq=18564 ok T7 [cut-scripts] -> ledger_event seq=18565 actor=coordinator@fixture-instance; local JSONL line marked one_place_seq=18565 ok T8 [referee] -> ledger_event seq=18567 actor=coordinator@fixture-instance; local JSONL line marked one_place_seq=18567 ok T9 [checks-watchers] -> ledger_event seq=18568 actor=coordinator@fixture-instance; local JSONL line marked one_place_seq=18568 ok T10 a shell verb with no job verb (held) is written locally, unmarked, and counted (0 -> 1; line(s) in .unrouted) ok T11 the instance's JSONL folds with its marked lines (fold rc=0) ok T12 12 local lines carry one_place_seq (>= 7, one per writer class) ok T13 `argon-coord job list --node steve-macbook` answers over the client (rc=0, 0 row(s)) ok T14 `job list --node splink-server` names task C (the referee's row, node splink-server) ok T15 no table was created on the instance (the registry stays on the far side) ok T16 scripts/argon-coord-client.sh job list reaches the fixture (task A landed) ok T17 the shell face refuses a non-job subcommand by name (exit 2) ok T18 the shell face renders the companion line here from the far seq (one_place_seq=18570) ok T19 coord-cmd-resolve.sh hands the shell face to a box with no binary under ssh: ok T20 under transport local the resolver answers the build-tree default as before ok T21 account-pool.py names steve-macbook CUTS-ONLY with its measured state (no pool dir is the correct reading) ok T22 a spawn on a landed row is REFUSED (rc=2) and no local line is written: REFUSED by the one place (exit 3): REFUSED rcst-1792764753-2847661-a landed->running by coordinator@fixture-in ok T23 an unreachable registry is REFUSED by name (rc=2) and the local line is not written ok T24 the binary's client refuses an unreachable registry with exit 3, by name ok T25 the fixture's row for task C is untouched by the refused writes (state=running) registry-client-selftest: writer-class proof (class|task|verb|seq|actor): hand-door|rcst-1792764753-2847661-a|append --task rcst-1792764753-2847661-a --actor|seq=18558|actor=coordinator@fixture-instance launcher|rcst-1792764753-2847661-a|append --task rcst-1792764753-2847661-a --actor|seq=18559|actor=coordinator@fixture-instance lane|rcst-1792764753-2847661-a|exited --task rcst-1792764753-2847661-a --exit-code|seq=18560|actor=lane@fixture-instance landings|rcst-1792764753-2847661-a|consume --task rcst-1792764753-2847661-a --verdict|seq=18561|actor=coordinator@fixture-instance reconciler|rcst-1792764753-2847661-b|append --task rcst-1792764753-2847661-b --actor|seq=18564|actor=reconciler@fixture-instance cut-scripts|rcst-1792764753-2847661-b|append --task rcst-1792764753-2847661-b --actor|seq=18565|actor=coordinator@fixture-instance referee|rcst-1792764753-2847661-c|append --task rcst-1792764753-2847661-c --actor|seq=18567|actor=coordinator@fixture-instance checks-watchers|rcst-1792764753-2847661-c|park --task rcst-1792764753-2847661-c --awaiting|seq=18568|actor=coordinator@fixture-instance registry-client-selftest: fixture `argon-coord job list --json` for this run's rows: {"name": "rcst-1792764753-2847661-a", "state": "landed", "node": "ms-01", "owner": "20261023T000000Z-aaaaaaaa", "landed_sha": "6afd81f64322f2377d164ccef25a32eb100e2faf", "exit_code": 0, "updated_seq": null} {"name": "rcst-1792764753-2847661-b", "state": "retired", "node": "ms-01", "owner": "r1", "landed_sha": null, "exit_code": null, "updated_seq": null} {"name": "rcst-1792764753-2847661-c", "state": "running", "node": "splink-server", "owner": "node-job-1", "landed_sha": null, "exit_code": null, "updated_seq": null} {"name": "rcst-1792764753-2847661-d", "state": "queued", "node": null, "owner": null, "landed_sha": null, "exit_code": null, "updated_seq": null} registry-client-selftest: wall 13s registry-client-selftest: PASS (26 checks) ``` ## Required by hand of an instance updated onto this release Run the deployer once — `bash ops/fleet-watchdog/install-coordinator.sh` — and read its last lines; its done-line is a read of the failed units, and a FAIL line there is the instance's to act on before the next heartbeat. Then, to join the registry, write the one setting above and read the proof line. ## Verification ``` curl -fsS https://releases.argondb.ai/harness/LATEST curl -fsSO https://releases.argondb.ai/harness/v1.1.40/argon-harness-v1.1.40-linux.tar.gz curl -fsS https://releases.argondb.ai/harness/v1.1.40/SHA256SUMS sha256sum -c SHA256SUMS ``` sha256 of the tarball: `f76d037de815563f4e64489eb125e87a3a101f22c81c771d92d4cc0a153b144f` (4,945,507 bytes; reproducible: the builder's `--verify-reproducible` leg built it twice into separate staging trees and the two agreed). Built and gated on 2026-10-23 from cut source `6a916eb548` on ms-01 under fleet slot 4 (box load1 2.02 at the build's start), with the rendered-instance acceptance, the update-existing-instance leg against the served v1.1.39 tarball (`9fe7fc11bef8…`) and the refresh-log check all green on the eighth build attempt (`build-harness-tarball: OK -- argon-harness-v1.1.40-linux.tar.gz built and gated`; the executable-set leg `171 path(s): 140 mirrored, 0 added from main, 24 watchdog script(s) the template does not carry, 7 excluded by the template's map, 0 refused`). The template's own roster ran green in full on `c2942528d97e`, the tag's parent; the tagged commit `4a3cf9cb4a00` differs from it by one data file (`ops/fleet-watchdog/carried-paths.txt` at main's bytes) and was tagged with the roster skipped -- said here because the cutter's own line says it.