fix(issue-10,11,13,15): complete agy purge, orchestrator purge, workspace-anchored registry

Issue #10 - agy purge_artifacts left resumable pieces behind: it now also
removes the SQLite sidecars (-wal/-shm/-journal), the title annotation and
the presence lock (the lock only once no live process references the
conversation), and residual_artifacts() reports anything under
~/.gemini/antigravity-cli still carrying the uuid.

Issue #13 - the orchestrator has no herdr_sessions row, so its conversation
could not be purged by any skill. `lib_py.agents purge <agent|auto> <uuid>`
resolves the adapter from what is on disk (orchestrator_uuids stores bare
uuids), refuses while a live process names the uuid (conversation_in_use:
process list minus the caller's own lineage, plus lsof), and prints what it
purged. `orc_onboard.sh --remove <uuid> --purge-conversation --yes [--agent]`
runs it before the registry update so a refusal changes nothing (exit 4
without --yes, 5 while in use).

Issue #11 - "Successfully removeed": conjugate add/remove explicitly.

Issue #15 - the job registry and audit log followed the caller's cwd, so the
pytest suite (create_session.sh with its default onboarding job, run from the
repo root) had left 593 test records in the real .mam/jobs. Defaults now
resolve MAM_JOBS_DIR / DELEGATE_JOB_LOGS_DIR, then $WORKSPACE_ROOT/.mam/...,
then the cwd (mqtt_common.default_registry_dir / get_logs_dir; registry.py,
publish_event.py, service.py, create_session.sh, stop_session.sh); the
sandbox fixture pins both. The tier suites that used to leak now leave the
real registry untouched (881 records before and after).

Tests: test_issue10_13_purge.py (13), test_issue15_registry_isolation.py (7);
T-O13 pins the corrected message; the R1 helper test and B-9 logs-dir test
now assert the workspace-anchored contract; publish_event snapshot updated.

Refs #10 #11 #13 #15

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VCgu9Fa9iT7TbJUSzdq4Ff

tests/test_issue15_registry_isolation.py

@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+"""Issue #15 — the job registry and its audit log follow the workspace, not
+the caller's cwd.
+
+`DEFAULT_REGISTRY_DIR` (".mam/jobs") and the audit-log root were resolved
+relative to the current directory, so `create_session.sh`'s default onboarding
+job — registered through `lib_py.delegation.cli submit` without a
+`--registry-dir` — landed in whatever `.mam/jobs` sat under the cwd. Run from
+the repo root, the pytest suite left hundreds of `running` test records in the
+real registry. The defaults now honour `MAM_JOBS_DIR` / `DELEGATE_JOB_LOGS_DIR`,
+then `$WORKSPACE_ROOT/.mam/...`, and only then the cwd.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+SKILLS = REPO_ROOT / ".agents" / "skills"
+REAL_JOBS = REPO_ROOT / ".mam" / "jobs"
+REAL_LOGS = REPO_ROOT / ".mam" / "delegate_job_logs"
+
+sys.path.insert(0, str(SKILLS))
+from lib_py.delegation import mqtt_common  # noqa: E402
+
+
+def _listing(d: Path) -> set:
+    return set(os.listdir(d)) if d.is_dir() else set()
+
+
+# ---------------------------------------------------------------------------
+# resolution order
+# ---------------------------------------------------------------------------
+def test_registry_dir_env_wins(monkeypatch, tmp_path):
+    monkeypatch.setenv("MAM_JOBS_DIR", str(tmp_path / "explicit"))
+    monkeypatch.setenv("WORKSPACE_ROOT", str(tmp_path))
+    assert mqtt_common.default_registry_dir() == str(tmp_path / "explicit")
+
+
+def test_registry_dir_follows_workspace_root(monkeypatch, tmp_path):
+    monkeypatch.delenv("MAM_JOBS_DIR", raising=False)
+    monkeypatch.setenv("WORKSPACE_ROOT", str(tmp_path))
+    assert mqtt_common.default_registry_dir() == str(tmp_path / ".mam" / "jobs")
+
+
+def test_registry_dir_falls_back_to_cwd_relative(monkeypatch, tmp_path):
+    monkeypatch.delenv("MAM_JOBS_DIR", raising=False)
+    monkeypatch.delenv("WORKSPACE_ROOT", raising=False)
+    assert mqtt_common.default_registry_dir() == ".mam/jobs"
+    # A WORKSPACE_ROOT that is not a directory is ignored, not trusted.
+    monkeypatch.setenv("WORKSPACE_ROOT", str(tmp_path / "does-not-exist"))
+    assert mqtt_common.default_registry_dir() == ".mam/jobs"
+
+
+def test_logs_dir_follows_the_same_order(monkeypatch, tmp_path):
+    monkeypatch.setenv("DELEGATE_JOB_LOGS_DIR", str(tmp_path / "logs"))
+    monkeypatch.setenv("WORKSPACE_ROOT", str(tmp_path))
+    assert mqtt_common.get_logs_dir() == str(tmp_path / "logs")
+    monkeypatch.delenv("DELEGATE_JOB_LOGS_DIR")
+    assert mqtt_common.get_logs_dir() == str(tmp_path / ".mam" / "delegate_job_logs")
+    monkeypatch.delenv("WORKSPACE_ROOT")
+    assert mqtt_common.get_logs_dir() == os.path.join(os.getcwd(), ".mam", "delegate_job_logs")
+
+
+def test_cli_defaults_are_resolved_per_process(monkeypatch, tmp_path):
+    """registry.py / publish_event.py build their argparse defaults at call
+    time, so a process started with WORKSPACE_ROOT set registers there."""
+    monkeypatch.delenv("MAM_JOBS_DIR", raising=False)
+    env = dict(os.environ, WORKSPACE_ROOT=str(tmp_path), PYTHONPATH=f"{SKILLS}:{os.environ.get('PYTHONPATH', '')}")
+    env.pop("MAM_JOBS_DIR", None)
+    res = subprocess.run(
+        [sys.executable, "-m", "lib_py.delegation.cli", "submit", "--prompt", "issue 15", "--agent", "claude-code",
+         "--agent-session", "herdr:issue15-probe"],
+        capture_output=True, text=True, env=env, cwd=str(REPO_ROOT), timeout=60,
+    )
+    assert res.returncode == 0, res.stderr
+    records = list((tmp_path / ".mam" / "jobs").glob("*.json"))
+    assert len(records) == 1, records
+    assert json.loads(records[0].read_text())["agent_session"] == "herdr:issue15-probe"
+
+
+# ---------------------------------------------------------------------------
+# the leak itself: create_session.sh's onboarding job from the repo root cwd
+# ---------------------------------------------------------------------------
+def _create_session_from_repo_root(sandbox: Path, session: str) -> subprocess.CompletedProcess:
+    script = sandbox / ".agents" / "skills" / "multi-agent-mux-create" / "scripts" / "create_session.sh"
+    # cwd deliberately the repo root — the exact shape of the leaking tests.
+    return subprocess.run(
+        ["bash", str(script), "--workspace", str(sandbox), "--agent", "claude", "--role", "Creator",
+         "--session", session],
+        capture_output=True, text=True, cwd=str(REPO_ROOT), timeout=180,
+    )
+
+
+def _assert_registered_in_sandbox_only(sandbox: Path, session: str, before_jobs: set, before_logs: set, res):
+    assert res.returncode == 0, res.stderr + res.stdout
+    assert _listing(REAL_JOBS) == before_jobs, "onboarding job leaked into the repo's .mam/jobs"
+    assert _listing(REAL_LOGS) == before_logs, "audit log leaked into the repo's .mam/delegate_job_logs"
+    records = [json.loads(p.read_text()) for p in (sandbox / ".mam" / "jobs").glob("*.json")]
+    assert any(r.get("agent_session") == f"herdr:{session}" for r in records), records
+
+
+def test_onboarding_job_stays_in_sandbox_with_explicit_env(mam_sandbox, mock_herdr, mock_agents):
+    before_jobs, before_logs = _listing(REAL_JOBS), _listing(REAL_LOGS)
+    res = _create_session_from_repo_root(mam_sandbox, "issue15-explicit-creator-claude")
+    _assert_registered_in_sandbox_only(mam_sandbox, "issue15-explicit-creator-claude", before_jobs, before_logs, res)
+
+
+def test_onboarding_job_follows_workspace_root_alone(mam_sandbox, mock_herdr, mock_agents, monkeypatch):
+    """Without the explicit MAM_JOBS_DIR / DELEGATE_JOB_LOGS_DIR overrides the
+    WORKSPACE_ROOT that lib.sh exports must be enough to keep the record out
+    of the repo's registry."""
+    monkeypatch.delenv("MAM_JOBS_DIR", raising=False)
+    monkeypatch.delenv("DELEGATE_JOB_LOGS_DIR", raising=False)
+    before_jobs, before_logs = _listing(REAL_JOBS), _listing(REAL_LOGS)
+    res = _create_session_from_repo_root(mam_sandbox, "issue15-wsroot-creator-claude")
+    _assert_registered_in_sandbox_only(mam_sandbox, "issue15-wsroot-creator-claude", before_jobs, before_logs, res)