feat(issue-50): create --onboard waits for the onboarding job to end (A)

The handshake only said the agent saw the prompt (#23). create_session.sh
now waits, after `started`, for the onboarding job to reach a terminal
status and makes that its own result, so the orchestrator learns it from
create's exit (MULTI_AGENT_RULES §6) instead of guessing from herdr's
agent_status:

- lib_py/delegation/wrapper.py: `wait-terminal` (completed|error|cancelled,
  `timeout` after --timeout, `missing` when the record is gone; stops with
  its caller via --watch-pid) and `onboard-exit` (completed 0, error or
  cancelled 44, timeout or missing 45). bash branches on the printed answer.
- lib.sh: delegate_wait_terminal / delegate_onboard_exit, thin calls.
- create_session.sh: `onboarding completed: job <id> (<n>s)` on stdout, or
  `last_visible_status: onboarding-<status>` on the row, the reason on stderr
  and `exit 44` / `exit 45` after `trap - EXIT` - the session is kept, as for
  a missing handshake. The "no started" path (error, exit 0 before) now ends
  with 44. MAM_ONBOARD_WAIT_S (default 600, floor 1) bounds the wait.
- worktree_prepare.sh: 44/45 pass through with "session and worktree kept".
- create SKILL.md exit table (44, 45) and the knob; the #42 inventory follows.
- tests/conftest.py: --onboard is the default, so ~60 sandbox create tests
  reach the new wait. The mock herdr now acts as the agent for create's
  onboarding prompt - it runs the publish commands the prompt names through
  the real publish_event.py - and MAM_ONBOARD_WAIT_S=3 caps a test that turns
  that off (MAM_MOCK_ONBOARD_HANDSHAKE=0 -> 44, `started` -> 45). The
  delegate-job wrapper's prompt has another shape and is never answered.
- tests/test_issue50_onboard.py: the decision tables, create in the sandbox
  (0 / 44 / 45, session kept, row note, trap window), the knob's integer
  rule, worktree_prepare's pass-through.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.agents/skills/lib.sh

@@ -2381,6 +2381,23 @@ delegate_wait_started() {
   done
 }
 
+# delegate_wait_terminal <job_id> <timeout_s>
+# Issue #50: prints how the job ended - completed|error|cancelled - or
+# `timeout` when it has not ended after <timeout_s>, or `missing` when its
+# record is gone. The decision is lib_py.delegation.wrapper wait-terminal.
+delegate_wait_terminal() {
+  local job_id="$1" timeout_s="$2"
+  local reg_dir="${MAM_JOBS_DIR:-${WORKSPACE_ROOT:-$PWD}/.mam/jobs}"
+  PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -m lib_py.delegation.wrapper wait-terminal \
+      --job "$job_id" --registry-dir "$reg_dir" --timeout "$timeout_s" --watch-pid "$$"
+}
+
+# delegate_onboard_exit <status>
+# Issue #50: create's exit code for an onboarding status (0, 44 or 45).
+delegate_onboard_exit() {
+  PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -m lib_py.delegation.wrapper onboard-exit "$1"
+}
+
 # ensure_subscriber_daemon <job_id> [workdir]
 # Start the monitor subscriber for this workspace unless one is already running.
 # Prints the PID(s) on stdout, exactly as start_watchdog always did.

.agents/skills/lib_py/delegation/wrapper.py

@@ -18,6 +18,12 @@ no answer) cannot pass for "no". The wrapper uses --print.
   finalize-begin / finalize-end ...          finalize_unfinished, split around the one
                                              herdr diagnostic probe bash still runs
 
+Issue #50 (create --onboard waits for the onboarding to end):
+  wait-terminal --job J --registry-dir R --timeout T [--watch-pid P]
+                                             prints the job's terminal status, or
+                                             `timeout` / `missing`
+  onboard-exit <status>                      create's exit code for it: 0, 44, 45
+
 finalize-end answers on fd 3 (stdout when fd 3 is closed): its stdout carries
 registry.py's close output to the wrapper's stdout, as before. It runs as a
 child of the wrapper and must not outlive it (review R1): with --watch-pid it
@@ -48,6 +54,10 @@ SUB_RC_COMPLETED, SUB_RC_ERROR, SUB_RC_NO_EVENT, SUB_RC_BROKER_UNAVAILABLE, SUB_
 
 TERMINAL = ("completed", "error", "cancelled")
 EXIT_CODES = {"completed": 0, "error": 1, "timeout": 2, "broker_unavailable": 3, "cancelled": 5}
+# Issue #50: create --onboard's exit code for how the onboarding job ended.
+# 44 = the agent ended it with error (or it was cancelled), 45 = it did not end
+# within MAM_ONBOARD_WAIT_S (or its record is gone). The session is kept either way.
+ONBOARD_EXIT_CODES = {"completed": 0, "error": 44, "cancelled": 44, "timeout": 45, "missing": 45}
 
 
 def _now() -> int:
@@ -169,6 +179,30 @@ def _tail(path: str, n: int) -> List[str]:
         return fh.read().splitlines()[-n:]
 
 
+# ---------------------------------------------------------------------------
+# Issue #50 A: create --onboard waits for the onboarding job to end
+# ---------------------------------------------------------------------------
+
+def onboard_exit(status: str) -> int:
+    return ONBOARD_EXIT_CODES.get(status, 45)
+
+
+def wait_terminal(a: argparse.Namespace) -> str:
+    """The job's terminal status once it has one; `timeout` after --timeout s,
+    `missing` when the record is gone. Reads the disk every second."""
+    deadline = _now() + a.timeout
+    record = os.path.join(a.registry_dir, f"{a.job}.json")
+    while True:
+        disk = disk_status(a.registry_dir, a.job)
+        if disk in TERMINAL:
+            return disk
+        if not os.path.isfile(record):
+            return "missing"
+        if _now() >= deadline:
+            return "timeout"
+        _sleep(a, 1)
+
+
 def finalize_begin(a: argparse.Namespace) -> str:
     """`keep` (FINAL_JOB_STATUS untouched), `done <final>`, or
     `go|probe <final> <evidence_until> <deadline>`."""
@@ -307,6 +341,12 @@ def _parser() -> argparse.ArgumentParser:
     s.add_argument("session")
     s.add_argument("agent")
     s.add_argument("--print", action="store_true", help="print yes/no and exit 0")
+    s = sub.add_parser("wait-terminal")
+    s.add_argument("--job", required=True)
+    s.add_argument("--registry-dir", required=True)
+    s.add_argument("--timeout", type=int, required=True)
+    s.add_argument("--watch-pid", type=int, default=None, help="the caller's pid; gone -> stop waiting")
+    sub.add_parser("onboard-exit").add_argument("status")
     for name in ("finalize-begin", "finalize-end"):
         s = sub.add_parser(name)
         s.add_argument("--job", required=True)
@@ -353,6 +393,13 @@ def main(argv: Optional[List[str]] = None) -> int:
         return _yes_no(stall_watch(a.session, a.agent), a.print)
     elif a.cmd == "finalize-begin":
         print(finalize_begin(a))
+    elif a.cmd == "wait-terminal":
+        try:
+            print(wait_terminal(a))
+        except OwnerGone:
+            print(f"wait-terminal: caller pid {a.watch_pid} is gone; stopped waiting on job {a.job}", file=sys.stderr)
+    elif a.cmd == "onboard-exit":
+        print(onboard_exit(a.status))
     else:
         try:
             _answer(finalize_end(a))

.agents/skills/multi-agent-mux-create/SKILL.md

@@ -91,7 +91,12 @@ The bootstrapped server receives a **sanitized copy of the caller's environment*
    this script applies to a TUI that never signalled ready). Re-send with
    `multi-agent-mux-delegate-job submit` once the agent is up; the prompt is
    never re-injected automatically. `MAM_ONBOARD_ACK_S` overrides how long that
-   wait is — distinct from the wrapper's `MAM_INJECT_ACK_GRACE_S`.
+   wait is — distinct from the wrapper's `MAM_INJECT_ACK_GRACE_S`. After the
+   handshake the script waits for the onboarding job to **end** (Issue #50,
+   `MAM_ONBOARD_WAIT_S`, default 600 s) and prints `onboarding completed: job <id>
+   (<n>s)`; an onboarding that ends with `error` exits 44 and one that does not
+   end in time exits 45, both keeping the session, with
+   `last_visible_status: onboarding-<status>` on the row.
 
    **Start-up dialogs** are answered for every agent, not only claude (#24). The
    blocking-modal signatures and their accept keys live in each agent adapter
@@ -171,6 +176,8 @@ bash .agents/skills/multi-agent-mux-create/scripts/create_session.sh --workspace
 | `--auto-trust` / `--no-auto-trust` | Answer a start-up directory-trust dialog or leave it to a human (`MAM_AUTO_TRUST`; default: answer) |
 | `--isolate` / `--no-isolate` | Legacy, no-op |
 
+`MAM_ONBOARD_WAIT_S` (default 600): how long `--onboard` waits for the onboarding job to end after the `started` handshake.
+
 | Exit | Meaning |
 |---|---|
 | 0 | Created; or `--dry-run` |
@@ -180,6 +187,8 @@ bash .agents/skills/multi-agent-mux-create/scripts/create_session.sh --workspace
 | 4 | The YAML already has a `running` row of that name. The YAML write raises it after spawn, and the herdr session is rolled back |
 | 42 | The TUI never became ready and the process is gone, or it is alive and `MAM_KILL_ON_READY_TIMEOUT=1` (rolled back) |
 | 43 | The rollback could not kill the herdr session; it is still running |
+| 44 | The onboarding job ended with `error` (or was cancelled); the session is kept (Issue #50) |
+| 45 | The onboarding job did not end within `MAM_ONBOARD_WAIT_S`, or its record is gone; the session is kept |
 | other | A later step failed and its code is passed through. The EXIT trap (`cleanup_herdr_on_error`) rolls back the herdr session and closes the onboarding job as `cancelled`; if that kill fails, the exit is 43 instead |
 
 ## Registering the session in agent-sessions.yaml
@@ -201,7 +210,7 @@ bash .agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh \
 - `--creator-agent` creates the creator through this skill with the control root's binding and `MAM_NO_SUBSCRIBER_DAEMON=1`; the row's `pane.cwd` is the worktree.
 - Prints `BASE=<sha>`: record it **before** delegating the implementation, then review with `run_loop.sh --worktree <WT> --base "$BASE" --review-only`.
 - A submodule path that is not initialised yet but already holds files refuses `--submodules` up front (exit 3, nothing changed): the clone would fail on it and a rollback could not tell those files from its own.
-- Exit codes: 0 ok, 1 git / submodule / create failure, 2 usage or path rule, 3 refused to protect existing content (nothing changed).
+- Exit codes: 0 ok, 1 git / submodule / create failure, 2 usage or path rule, 3 refused to protect existing content (nothing changed); 44/45 are create's (onboarding error / timeout with `--onboard`; session and worktree kept).
 - create itself: a control-plane binding that cannot be computed is refused (exit 2) for a `--workspace` other than the control root and warned about for the control root; the immediate reconcile and the watchdog run the control root's code.
 
 ## Pitfalls

.agents/skills/multi-agent-mux-create/scripts/create_session.sh

@@ -19,6 +19,8 @@
 #   4  = agent-sessions.yaml append failure
 #   42 = agent TUI never became ready and the process is gone
 #   43 = rollback could not kill the herdr session; it is still running (#23)
+#   44 = the onboarding job ended with error (or was cancelled); the session is kept (#50)
+#   45 = the onboarding job did not end within MAM_ONBOARD_WAIT_S; the session is kept (#50)
 set -euo pipefail
 
 _script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -316,6 +318,21 @@ for s in d.get('herdr_sessions', []):
 PYEOF
 }
 
+# _mark_row_note <note>
+# Issue #50: last_visible_status only. The row stays `running` with its
+# delegate_job_id: the session is alive and the job record is the evidence.
+_mark_row_note() {
+  local note="$1"
+  [ "${ROW_APPENDED:-0}" = "1" ] || return 0
+  atomic_dump_yaml "$AGENT_SESSIONS_YAML" SESSION_NAME="$SESSION_NAME" ROW_NOTE="$note" <<'PYEOF' || true
+name = os.environ['SESSION_NAME']
+for s in d.get('herdr_sessions', []):
+    if s.get('name') == name:
+        s['last_visible_status'] = os.environ['ROW_NOTE']
+        break
+PYEOF
+}
+
 # Trap for rolling back/cleaning up herdr session if script exits due to error
 cleanup_herdr_on_error() {
   local exit_code=$?
@@ -698,12 +715,38 @@ If you delegate any part of it with multi-agent-mux-delegate-job submit, add --p
     esac
     JOB_TERMINALIZED=1
   fi
+  # Issue #50: the handshake only said the agent saw the prompt. Wait for the
+  # onboarding itself to end; its result is this script's exit code, so the
+  # orchestrator learns it from create (MULTI_AGENT_RULES §6) instead of
+  # guessing from herdr's agent_status. A job marked `error` just above is
+  # terminal and returns at once.
+  ONBOARD_WAIT_S=$(mam_int_knob MAM_ONBOARD_WAIT_S 600 1)
+  ONBOARD_T0=$(date +%s)
+  ONBOARD_STATUS="$(delegate_wait_terminal "$DELEGATE_JOB_ID" "$ONBOARD_WAIT_S")"
+  ONBOARD_STATUS="${ONBOARD_STATUS:-missing}"
   # Trigger immediate priority reconcile cycle asynchronously
   # Issue #21 phase 2 (A8): the control root's reconcile/watchdog, never the
   # (unreviewed) copy in a worktree --workspace; identical paths by default.
   (bash "$SKILL_DIR/multi-agent-mux-monitor/scripts/reconcile.sh" --once >/dev/null 2>&1 &) || true
   WD_PID=$(start_watchdog "$DELEGATE_JOB_ID" "$WORKSPACE_ROOT")
   echo "watchdog PID: $WD_PID"
+  case "$ONBOARD_STATUS" in
+    completed)
+      echo "onboarding completed: job $DELEGATE_JOB_ID ($(( $(date +%s) - ONBOARD_T0 ))s)"
+      ;;
+    *)
+      # The session is kept, as for a missing handshake above: the row says
+      # what happened and the exit code tells the caller. The trap is cleared
+      # first - a non-zero exit must not roll a live session back.
+      _mark_row_note "onboarding-$ONBOARD_STATUS"
+      echo "ERROR: onboarding $ONBOARD_STATUS for '$SESSION_NAME': job $DELEGATE_JOB_ID; the session is kept" >&2
+      trap - EXIT
+      case "$(delegate_onboard_exit "$ONBOARD_STATUS")" in
+        44) exit 44 ;;
+        *) exit 45 ;;
+      esac
+      ;;
+  esac
 fi
 # Clear cleanup trap as registration was fully successful
 trap - EXIT

.agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh

@@ -15,7 +15,8 @@
 # creator session registered in the control root's .mam -> summary with BASE=.
 #
 # Exit codes: 0 ok, 1 git / submodule / create failure, 2 usage or path rule,
-# 3 refused to protect existing content (nothing changed).
+# 3 refused to protect existing content (nothing changed); 44/45 are create's
+# (onboarding error / timeout; session and worktree kept, Issue #50).
 set -euo pipefail
 
 _script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -239,7 +240,11 @@ if [ -n "$CREATOR_AGENT" ]; then
   rc=0
   env "${env_add[@]}" bash "$SKILL_DIR/multi-agent-mux-create/scripts/create_session.sh" "${args[@]}" || rc=$?
   if [ "$rc" -ne 0 ]; then
-    echo "ERROR: create_session.sh failed (rc=$rc); the worktree is kept - remove it with worktree_remove.sh --path '$WT'" >&2
+    case "$rc" in
+      44) echo "ERROR: onboarding error for '$SESSION' (create_session.sh rc=44); session and worktree kept" >&2 ;;
+      45) echo "ERROR: onboarding timeout for '$SESSION' (create_session.sh rc=45); session and worktree kept" >&2 ;;
+      *) echo "ERROR: create_session.sh failed (rc=$rc); the worktree is kept - remove it with worktree_remove.sh --path '$WT'" >&2 ;;
+    esac
     exit "$rc"
   fi
 fi