feat: clean up R2 event-system CLI cluster

.gitignore

@@ -3,6 +3,8 @@
 /mnemon-harness
 /mnemon-hub
 /mnemond
+/mnemon-multica-runtime
+/mnemon-acceptance
 /bin/
 
 # Local dogfood / capability test sandboxes (per-test subdirs)

Makefile

@@ -22,10 +22,11 @@ deps: ## Download Go dependencies
 build: ## Build the mnemon binary
 	go build -ldflags "$(LDFLAGS)" -o $(BINARY) .
 
-harness-build: ## Build the harness binaries (mnemon-harness local plane + mnemon-hub remote hub + mnemond local governance daemon + test-only acceptance runner)
+harness-build: ## Build the harness binaries (mnemon-harness, mnemond, mnemonhub, Multica runtime adapter, and test-only acceptance runner)
 	go build -ldflags "$(LDFLAGS)" -o mnemon-harness ./harness/cmd/mnemon-harness
 	go build -ldflags "$(LDFLAGS)" -o mnemon-hub ./harness/cmd/mnemon-hub
 	go build -ldflags "$(LDFLAGS)" -o mnemond ./harness/cmd/mnemond
+	go build -ldflags "$(LDFLAGS)" -o mnemon-multica-runtime ./harness/cmd/mnemon-multica-runtime
 	go build -ldflags "$(LDFLAGS)" -o mnemon-acceptance ./harness/cmd/mnemon-acceptance
 
 # ── Install / Uninstall ─────────────────────────────────────────────

harness/cmd/mnemon-acceptance/acceptance_github_mesh.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"net/http"
 	"os"
 	"path/filepath"
 	"sort"
@@ -30,6 +31,12 @@ var (
 	acceptanceGitHubSyncInterval time.Duration
 )
 
+var (
+	r1GitHubMeshRateLimitAPIURL = "https://api.github.com/rate_limit"
+	r1GitHubMeshAPIBaseURL      = "https://api.github.com"
+	r1GitHubMeshHTTPClient      = &http.Client{Timeout: 10 * time.Second}
+)
+
 var acceptanceR1GitHubMeshCmd = &cobra.Command{
 	Use:   "r1-github-mesh-task-suite",
 	Short: "Run GitHub-backed Remote Workspace task-suite acceptance",
@@ -155,6 +162,11 @@ func runR1GitHubMeshAcceptance(ctx context.Context, opts r1GitHubMeshAcceptanceO
 		report.Status = "blocked"
 		return report, err
 	}
+	if err := validateR1GitHubMeshSyncInterval(opts); err != nil {
+		addR1Error(&report, err)
+		report.Status = "blocked"
+		return report, err
+	}
 	if opts.TokenFile == "" {
 		err := fmt.Errorf("--github-token-file is required")
 		addR1Error(&report, err)
@@ -173,6 +185,24 @@ func runR1GitHubMeshAcceptance(ctx context.Context, opts r1GitHubMeshAcceptanceO
 		report.Status = "blocked"
 		return report, err
 	}
+	report.Artifacts["github_repo"] = opts.Repo
+	report.Artifacts["github_token_file"] = tokenFile
+	rateLimit, err := preflightR1GitHubMeshRateLimit(ctx, tokenFile, r1GitHubMeshMinimumRateLimitRemaining(opts))
+	if rateLimit.Limit > 0 || !rateLimit.ResetAt.IsZero() {
+		report.Artifacts["github_rate_limit_remaining"] = fmt.Sprintf("%d", rateLimit.Remaining)
+		report.Artifacts["github_rate_limit_limit"] = fmt.Sprintf("%d", rateLimit.Limit)
+		report.Artifacts["github_rate_limit_reset"] = rateLimit.ResetAt.UTC().Format(time.RFC3339)
+	}
+	if err != nil {
+		addR1Error(&report, err)
+		report.Status = "blocked"
+		return report, err
+	}
+	if err := preflightR1GitHubMeshRepositoryAccess(ctx, opts.Repo, tokenFile); err != nil {
+		addR1Error(&report, err)
+		report.Status = "blocked"
+		return report, err
+	}
 	branches := r1GitHubMeshBranches(branchPrefix, opts.Agents)
 	if err := ensureR1GitHubMeshBranches(ctx, opts.Repo, tokenFile, branches); err != nil {
 		addR1Error(&report, err)
@@ -187,8 +217,6 @@ func runR1GitHubMeshAcceptance(ctx context.Context, opts r1GitHubMeshAcceptanceO
 	}
 	sourceCodexHome := resolveSourceCodexHome(opts.CodexHome)
 	report.Artifacts["codex_home_source"] = sourceCodexHome
-	report.Artifacts["github_repo"] = opts.Repo
-	report.Artifacts["github_token_file"] = tokenFile
 	report.Artifacts["github_branch_prefix"] = branchPrefix
 	report.Artifacts["github_sync_interval"] = opts.SyncInterval.String()
 	initialOnline := opts.Agents
@@ -1383,6 +1411,16 @@ func r1GitHubMeshBranchPrefix(prefix string, started time.Time) string {
 	return "mnemon/mnemond-" + started.UTC().Format("20060102T150405Z") + "-"
 }
 
+func validateR1GitHubMeshSyncInterval(opts r1GitHubMeshAcceptanceOptions) error {
+	if !opts.AgentTurns {
+		return nil
+	}
+	if opts.SyncInterval < 30*time.Second {
+		return fmt.Errorf("github mesh agent-turns require --sync-interval >= 30s to protect GitHub API quota (got %s)", opts.SyncInterval)
+	}
+	return nil
+}
+
 func ensureR1GitHubMeshBranches(ctx context.Context, repo, tokenFile string, branches []string) error {
 	token, err := readR1GitHubMeshToken(tokenFile)
 	if err != nil {
@@ -1402,6 +1440,139 @@ func ensureR1GitHubMeshBranches(ctx context.Context, repo, tokenFile string, bra
 	return nil
 }
 
+type r1GitHubMeshRateLimit struct {
+	Limit     int
+	Remaining int
+	Used      int
+	ResetAt   time.Time
+}
+
+func r1GitHubMeshMinimumRateLimitRemaining(opts r1GitHubMeshAcceptanceOptions) int {
+	scenarios := len(r1GitHubMeshScenarioNames(opts.Scenarios))
+	if scenarios == 0 {
+		scenarios = 1
+	}
+	agents := opts.Agents
+	if agents < 5 {
+		agents = 5
+	}
+	min := 500 + agents*scenarios*150
+	if min < 1500 {
+		return 1500
+	}
+	return min
+}
+
+func preflightR1GitHubMeshRateLimit(ctx context.Context, tokenFile string, minRemaining int) (r1GitHubMeshRateLimit, error) {
+	token, err := readR1GitHubMeshToken(tokenFile)
+	if err != nil {
+		return r1GitHubMeshRateLimit{}, err
+	}
+	limit, err := fetchR1GitHubMeshRateLimit(ctx, token)
+	if err != nil {
+		return r1GitHubMeshRateLimit{}, err
+	}
+	if limit.Remaining < minRemaining {
+		return limit, fmt.Errorf("github core API rate limit remaining %d below required %d; reset=%s", limit.Remaining, minRemaining, limit.ResetAt.UTC().Format(time.RFC3339))
+	}
+	return limit, nil
+}
+
+func preflightR1GitHubMeshRepositoryAccess(ctx context.Context, repo, tokenFile string) error {
+	token, err := readR1GitHubMeshToken(tokenFile)
+	if err != nil {
+		return err
+	}
+	return fetchR1GitHubMeshRepositoryAccess(ctx, repo, token)
+}
+
+func fetchR1GitHubMeshRepositoryAccess(ctx context.Context, repo, token string) error {
+	repo, err := exchange.NormalizeGitHubRepo(repo)
+	if err != nil {
+		return err
+	}
+	baseURL := strings.TrimRight(strings.TrimSpace(r1GitHubMeshAPIBaseURL), "/")
+	if baseURL == "" {
+		baseURL = "https://api.github.com"
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, baseURL+"/repos/"+repo, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+	req.Header.Set("User-Agent", "mnemon-acceptance")
+	if strings.TrimSpace(token) != "" {
+		req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(token))
+	}
+	client := r1GitHubMeshHTTPClient
+	if client == nil {
+		client = http.DefaultClient
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("github repo access status %d for %s: %s", resp.StatusCode, repo, strings.TrimSpace(string(body)))
+	}
+	return nil
+}
+
+func fetchR1GitHubMeshRateLimit(ctx context.Context, token string) (r1GitHubMeshRateLimit, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, r1GitHubMeshRateLimitAPIURL, nil)
+	if err != nil {
+		return r1GitHubMeshRateLimit{}, err
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+	req.Header.Set("User-Agent", "mnemon-acceptance")
+	if strings.TrimSpace(token) != "" {
+		req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(token))
+	}
+	client := r1GitHubMeshHTTPClient
+	if client == nil {
+		client = http.DefaultClient
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return r1GitHubMeshRateLimit{}, err
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return r1GitHubMeshRateLimit{}, err
+	}
+	if resp.StatusCode >= 300 {
+		return r1GitHubMeshRateLimit{}, fmt.Errorf("github rate_limit status %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	var doc struct {
+		Resources struct {
+			Core struct {
+				Limit     int   `json:"limit"`
+				Remaining int   `json:"remaining"`
+				Reset     int64 `json:"reset"`
+				Used      int   `json:"used"`
+			} `json:"core"`
+		} `json:"resources"`
+	}
+	if err := json.Unmarshal(body, &doc); err != nil {
+		return r1GitHubMeshRateLimit{}, fmt.Errorf("parse github rate_limit response: %w", err)
+	}
+	core := doc.Resources.Core
+	return r1GitHubMeshRateLimit{
+		Limit:     core.Limit,
+		Remaining: core.Remaining,
+		Used:      core.Used,
+		ResetAt:   time.Unix(core.Reset, 0).UTC(),
+	}, nil
+}
+
 func readR1GitHubMeshToken(tokenFile string) (string, error) {
 	body, err := os.ReadFile(tokenFile)
 	if err != nil {

harness/cmd/mnemon-acceptance/acceptance_github_mesh_test.go

@@ -3,6 +3,8 @@ package main
 import (
 	"context"
 	"database/sql"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -48,6 +50,143 @@ func TestR1GitHubMeshBranchPrefixDefaultsToRunScopedBranches(t *testing.T) {
 	}
 }
 
+func TestFetchR1GitHubMeshRateLimit(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer secret-token" {
+			t.Fatalf("authorization header = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"resources":{"core":{"limit":5000,"remaining":4321,"reset":1782725122,"used":679}}}`))
+	}))
+	defer server.Close()
+	oldURL := r1GitHubMeshRateLimitAPIURL
+	oldClient := r1GitHubMeshHTTPClient
+	r1GitHubMeshRateLimitAPIURL = server.URL
+	r1GitHubMeshHTTPClient = server.Client()
+	t.Cleanup(func() {
+		r1GitHubMeshRateLimitAPIURL = oldURL
+		r1GitHubMeshHTTPClient = oldClient
+	})
+
+	limit, err := fetchR1GitHubMeshRateLimit(context.Background(), "secret-token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if limit.Limit != 5000 || limit.Remaining != 4321 || limit.Used != 679 || limit.ResetAt.Unix() != 1782725122 {
+		t.Fatalf("rate limit mismatch: %+v", limit)
+	}
+}
+
+func TestPreflightR1GitHubMeshRateLimitBlocksLowRemaining(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"resources":{"core":{"limit":5000,"remaining":42,"reset":1782725122,"used":4958}}}`))
+	}))
+	defer server.Close()
+	oldURL := r1GitHubMeshRateLimitAPIURL
+	oldClient := r1GitHubMeshHTTPClient
+	r1GitHubMeshRateLimitAPIURL = server.URL
+	r1GitHubMeshHTTPClient = server.Client()
+	t.Cleanup(func() {
+		r1GitHubMeshRateLimitAPIURL = oldURL
+		r1GitHubMeshHTTPClient = oldClient
+	})
+	tokenFile := filepath.Join(t.TempDir(), "github.token")
+	if err := os.WriteFile(tokenFile, []byte("secret-token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	limit, err := preflightR1GitHubMeshRateLimit(context.Background(), tokenFile, 1500)
+	if err == nil || !strings.Contains(err.Error(), "below required 1500") {
+		t.Fatalf("expected low-rate-limit error, got limit=%+v err=%v", limit, err)
+	}
+	if limit.Remaining != 42 {
+		t.Fatalf("rate limit should be returned for diagnostics: %+v", limit)
+	}
+}
+
+func TestR1GitHubMeshAcceptanceBlocksInvalidRepositoryTokenBeforeSetup(t *testing.T) {
+	tmp := t.TempDir()
+	var repoChecked bool
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer secret-token" {
+			t.Fatalf("authorization header = %q", got)
+		}
+		switch r.URL.Path {
+		case "/rate_limit":
+			_, _ = w.Write([]byte(`{"resources":{"core":{"limit":5000,"remaining":5000,"reset":1782725122,"used":0}}}`))
+		case "/repos/mnemon-dev/mnemon-teamwork-example":
+			repoChecked = true
+			w.WriteHeader(http.StatusUnauthorized)
+			_, _ = w.Write([]byte(`{"message":"Bad credentials"}`))
+		default:
+			t.Fatalf("unexpected path %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	oldRateLimitURL := r1GitHubMeshRateLimitAPIURL
+	oldAPIBaseURL := r1GitHubMeshAPIBaseURL
+	oldClient := r1GitHubMeshHTTPClient
+	r1GitHubMeshRateLimitAPIURL = server.URL + "/rate_limit"
+	r1GitHubMeshAPIBaseURL = server.URL
+	r1GitHubMeshHTTPClient = server.Client()
+	t.Cleanup(func() {
+		r1GitHubMeshRateLimitAPIURL = oldRateLimitURL
+		r1GitHubMeshAPIBaseURL = oldAPIBaseURL
+		r1GitHubMeshHTTPClient = oldClient
+	})
+
+	tokenFile := filepath.Join(tmp, "github.token")
+	if err := os.WriteFile(tokenFile, []byte("secret-token\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	report, err := runR1GitHubMeshAcceptance(context.Background(), r1GitHubMeshAcceptanceOptions{
+		r1CodexAcceptanceOptions: r1CodexAcceptanceOptions{
+			RunRoot:     filepath.Join(tmp, "run"),
+			AgentTurns:  true,
+			TurnTimeout: time.Millisecond,
+		},
+		Repo:         "mnemon-dev/mnemon-teamwork-example",
+		TokenFile:    tokenFile,
+		SyncInterval: 30 * time.Second,
+	})
+	if err == nil || !strings.Contains(err.Error(), "github repo access status 401") || !strings.Contains(err.Error(), "Bad credentials") {
+		t.Fatalf("expected invalid repo token blocker, got report=%+v err=%v", report, err)
+	}
+	if !repoChecked {
+		t.Fatal("repository access preflight was not called")
+	}
+	if report.Status != "blocked" || !strings.Contains(strings.Join(report.Errors, "\n"), "Bad credentials") {
+		t.Fatalf("report should be blocked with repo credential error: %+v", report)
+	}
+	if _, err := os.Stat(filepath.Join(report.RunRoot, "bin")); !os.IsNotExist(err) {
+		t.Fatalf("acceptance should block before installing binaries, stat err=%v", err)
+	}
+	data, err := os.ReadFile(report.ReportPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(data), "github repo access status 401") {
+		t.Fatalf("written report missing repo access blocker:\n%s", data)
+	}
+}
+
+func TestValidateR1GitHubMeshSyncIntervalProtectsAgentTurns(t *testing.T) {
+	err := validateR1GitHubMeshSyncInterval(r1GitHubMeshAcceptanceOptions{
+		r1CodexAcceptanceOptions: r1CodexAcceptanceOptions{AgentTurns: true},
+		SyncInterval:             10 * time.Second,
+	})
+	if err == nil || !strings.Contains(err.Error(), ">= 30s") {
+		t.Fatalf("expected short sync interval guard, got %v", err)
+	}
+	if err := validateR1GitHubMeshSyncInterval(r1GitHubMeshAcceptanceOptions{
+		r1CodexAcceptanceOptions: r1CodexAcceptanceOptions{AgentTurns: true},
+		SyncInterval:             30 * time.Second,
+	}); err != nil {
+		t.Fatalf("30s sync interval should be allowed: %v", err)
+	}
+	if err := validateR1GitHubMeshSyncInterval(r1GitHubMeshAcceptanceOptions{SyncInterval: 10 * time.Second}); err != nil {
+		t.Fatalf("short non-agent-turn sync interval should be allowed: %v", err)
+	}
+}
+
 func TestWriteR1GitHubMeshRemotesCreatesPublishAndSubscribePlan(t *testing.T) {
 	root := t.TempDir()
 	tokenFile := filepath.Join(root, "github.token")