Daemon: /felt-edit + /lifecycle set-outcome for cross-host kanban writes

The owner daemon gains the two endpoints Category-B kanban mutations need so a
viewer routes every cross-host write through the tunnel→owner spine instead of
a WebSocket-connected agent — single-writer at the document holds (only the
owner writes a fiber it owns).

- /lifecycle set-outcome delegates to `shuttle-ctl set-outcome` (block-required
  + ensure_owned_here, so a misroute is a loud owner-mismatch). The outcome
  rides as one argv element, so multi-line block scalars survive without stdin.
- /felt-edit shells `felt edit --untag/--tag` against the owned store — the same
  felt-native tag writer the local path uses. Empty diff is a 200 no-op.

install already had a /lifecycle verb; no new daemon code for it. felt-horizon's
only writer is TS-resident (rewriteHorizonFrontmatter), so it stays on the WS
path until a generic `felt edit --set/--unset` lets one writer serve both planes.

Deploy-gated: these 404 against the currently-deployed remote daemons until the
W5 git-pull + make-all on candide/cineca/local.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: cailmdaley

lib/shuttle_web/controllers/felt_edit_controller.ex

@@ -0,0 +1,79 @@
+defmodule ShuttleWeb.FeltEditController do
+  @moduledoc """
+  Daemon-local felt-document surface edits for host-routed kanban cards.
+
+  The owner-only kanban feed serves a fiber only when its `shuttle.host`
+  resolves to this daemon, so a viewer's tag edit on a remote-owned card routes
+  here over the SSH tunnel instead of editing the viewer's own loom mirror.
+  Single-writer at the document holds: the owner daemon is the lone writer of a
+  fiber it owns, and `felt edit` is the single felt-native tag writer (the same
+  CLI Portolan shells for local cards).
+
+  `POST /api/v1/felt-edit` body: `{ "fiber_id": "...", "add": [...],
+  "remove": [...] }`. An empty diff is a 200 no-op.
+  """
+
+  use Phoenix.Controller, formats: [:json]
+
+  alias Shuttle.FeltStores
+
+  def create(conn, %{"fiber_id" => fiber_id} = params) when is_binary(fiber_id) do
+    add = string_list(params["add"])
+    remove = string_list(params["remove"])
+
+    with {:ok, host, address} <- host_for_fiber(fiber_id),
+         {:ok, output} <- run(host, address, add, remove) do
+      conn
+      |> put_resp_content_type("text/plain")
+      |> send_resp(200, output)
+    else
+      {:error, reason} when is_binary(reason) ->
+        conn
+        |> put_resp_content_type("text/plain")
+        |> send_resp(400, reason)
+
+      {:command_error, status, output} ->
+        conn
+        |> put_resp_content_type("text/plain")
+        |> send_resp(422, "felt exited #{status}: #{output}")
+    end
+  end
+
+  def create(conn, _params) do
+    conn
+    |> put_resp_content_type("text/plain")
+    |> send_resp(400, "fiber_id is required")
+  end
+
+  defp host_for_fiber(fiber_id) do
+    case FeltStores.resolve_fiber(fiber_id) do
+      {:ok, %{host: host, fiber_id: address}} -> {:ok, host, address}
+      {:error, :not_found} -> {:error, "fiber not found: #{fiber_id}"}
+    end
+  end
+
+  # An empty diff is a no-op, mirroring Portolan's local `runFeltTagEdit`.
+  defp run(_host, _fiber_id, [], []), do: {:ok, ""}
+
+  defp run(host, fiber_id, add, remove) do
+    args = ["-C", host, "edit", fiber_id]
+    args = Enum.reduce(remove, args, fn tag, acc -> acc ++ ["--untag", tag] end)
+    args = Enum.reduce(add, args, fn tag, acc -> acc ++ ["--tag", tag] end)
+
+    case System.cmd("felt", args, stderr_to_stdout: true) do
+      {output, 0} -> {:ok, output}
+      {output, status} -> {:command_error, status, output}
+    end
+  rescue
+    e in ErlangError -> {:error, Exception.message(e)}
+  end
+
+  defp string_list(values) when is_list(values) do
+    values
+    |> Enum.filter(&is_binary/1)
+    |> Enum.map(&String.trim/1)
+    |> Enum.reject(&(&1 == ""))
+  end
+
+  defp string_list(_), do: []
+end

lib/shuttle_web/controllers/lifecycle_controller.ex

@@ -5,14 +5,14 @@ defmodule ShuttleWeb.LifecycleController do
   Cross-host lifecycle requests from Portolan land here on the selected
   daemon. The endpoint delegates to the existing shuttle-ctl Go CLI, so the
   validated offline frontmatter writer remains the single implementation of
-  install/pause/resume/repeat/accept/set-model/set-interactive/uninstall.
+  install/pause/resume/repeat/accept/set-model/set-interactive/set-outcome/uninstall.
   """
 
   use Phoenix.Controller, formats: [:json]
 
   alias Shuttle.{FeltStores, LifecycleService}
 
-  @allowed ~w(install pause resume repeat accept set-model set-interactive uninstall)
+  @allowed ~w(install pause resume repeat accept set-model set-interactive set-outcome uninstall)
 
   def create(conn, params) do
     with {:ok, action} <- action(params),
@@ -53,7 +53,7 @@ defmodule ShuttleWeb.LifecycleController do
   end
 
   defp execute(action, %{"fiber" => fiber} = params)
-       when action in ~w(pause set-model set-interactive uninstall) do
+       when action in ~w(pause set-model set-interactive set-outcome uninstall) do
     with {:ok, fiber_id} <- fiber_address(fiber) do
       action
       |> args_for(%{params | "fiber" => fiber_id})
@@ -106,6 +106,14 @@ defmodule ShuttleWeb.LifecycleController do
   defp args_for("set-model", %{"fiber" => fiber, "agent" => agent}),
     do: {:ok, ["set-model", fiber, agent]}
 
+  # The outcome string round-trips as a single argv element, so multi-line
+  # values (block scalars) survive without stdin piping. set-outcome refuses a
+  # block-less fiber and runs `ensure_owned_here`, so a misrouted edit surfaces
+  # a loud owner-mismatch rather than writing the wrong host's document.
+  defp args_for("set-outcome", %{"fiber" => fiber, "outcome" => outcome})
+       when is_binary(outcome),
+       do: {:ok, ["set-outcome", fiber, "--outcome", outcome]}
+
   defp args_for("set-interactive", %{"fiber" => fiber, "interactive" => interactive})
        when is_boolean(interactive) do
     with {:ok, host} <- host_for_fiber(fiber) do

lib/shuttle_web/router.ex

@@ -28,6 +28,7 @@ defmodule ShuttleWeb.Router do
     get("/origins", OriginsController, :show)
     post("/lifecycle", LifecycleController, :create)
     post("/felt-history", FeltHistoryController, :create)
+    post("/felt-edit", FeltEditController, :create)
     get("/agents", AgentsController, :show)
     get("/version", VersionController, :show)
     post("/fiber/create", FiberController, :create)

test/shuttle_web/controllers/felt_edit_controller_test.exs

@@ -0,0 +1,138 @@
+defmodule ShuttleWeb.FeltEditControllerTest do
+  use ExUnit.Case
+  import Plug.Conn
+  import Phoenix.ConnTest
+
+  @endpoint ShuttleWeb.Endpoint
+
+  test "applies a tag diff against the configured felt store that owns the fiber" do
+    root =
+      System.tmp_dir!()
+      |> Path.join("shuttle-felt-edit-controller-#{System.unique_integer([:positive])}")
+
+    store = Path.join(root, "loom")
+    fiber_dir = Path.join([store, ".felt", "tests", "remote-tags"])
+    File.mkdir_p!(fiber_dir)
+
+    File.write!(
+      Path.join(fiber_dir, "remote-tags.md"),
+      "---\nname: Remote tags\nstatus: active\n---\n\nbody\n"
+    )
+
+    args_file = install_fake_felt!(root)
+    old_loom_homes = System.get_env("LOOM_HOMES")
+    System.put_env("LOOM_HOMES", store)
+
+    on_exit(fn ->
+      restore_env("LOOM_HOMES", old_loom_homes)
+      File.rm_rf(root)
+    end)
+
+    conn =
+      post(
+        api_conn(),
+        "/api/v1/felt-edit",
+        Jason.encode!(%{
+          "fiber_id" => "tests/remote-tags",
+          "remove" => ["old"],
+          "add" => ["constitution", "new"]
+        })
+      )
+
+    assert conn.status == 200
+
+    # Removes first, then adds — the same order Portolan's local `runFeltTagEdit`
+    # shells, so `felt edit` sees one coherent diff.
+    assert File.read!(args_file) ==
+             "-C\n#{store}\nedit\ntests/remote-tags\n--untag\nold\n--tag\nconstitution\n--tag\nnew\n"
+  end
+
+  test "an empty diff is a 200 no-op that never shells felt edit" do
+    root =
+      System.tmp_dir!()
+      |> Path.join("shuttle-felt-edit-noop-#{System.unique_integer([:positive])}")
+
+    store = Path.join(root, "loom")
+    fiber_dir = Path.join([store, ".felt", "tests", "remote-tags"])
+    File.mkdir_p!(fiber_dir)
+
+    File.write!(
+      Path.join(fiber_dir, "remote-tags.md"),
+      "---\nname: Remote tags\nstatus: active\n---\n\nbody\n"
+    )
+
+    args_file = install_fake_felt!(root)
+    old_loom_homes = System.get_env("LOOM_HOMES")
+    System.put_env("LOOM_HOMES", store)
+
+    on_exit(fn ->
+      restore_env("LOOM_HOMES", old_loom_homes)
+      File.rm_rf(root)
+    end)
+
+    conn =
+      post(
+        api_conn(),
+        "/api/v1/felt-edit",
+        Jason.encode!(%{"fiber_id" => "tests/remote-tags", "add" => [], "remove" => []})
+      )
+
+    assert conn.status == 200
+    refute File.exists?(args_file)
+  end
+
+  defp api_conn do
+    build_conn()
+    |> put_req_header("content-type", "application/json")
+    |> put_req_header("accept", "application/json")
+  end
+
+  defp install_fake_felt!(root) do
+    bin_dir = Path.join(root, "bin")
+    File.mkdir_p!(bin_dir)
+
+    bin = Path.join(bin_dir, "felt")
+    args_file = Path.join(root, "felt-args")
+
+    # `FeltStores.resolve_fiber` asks felt for the fiber's carried path
+    # (`felt show -j`), so the fake answers that with felt-shaped JSON (id +
+    # absolute path). The `edit` invocation under test records its args and
+    # prints `ok`.
+    File.write!(bin, """
+    #!/bin/sh
+    case " $* " in
+      *" show "*" -j "*|*" show "*" -j")
+        store=""
+        next=0
+        for a in "$@"; do
+          if [ "$next" = 1 ]; then store="$a"; next=0; fi
+          if [ "$a" = "-C" ]; then next=1; fi
+        done
+        printf '{"id":"tests/remote-tags","path":"%s/.felt/tests/remote-tags/remote-tags.md"}\\n' "$store"
+        ;;
+      *)
+        printf '%s\\n' "$@" > "$FELT_ARGS_FILE"
+        printf 'ok\\n'
+        ;;
+    esac
+    """)
+
+    File.chmod!(bin, 0o755)
+
+    old_path = System.get_env("PATH")
+    old_args_file = System.get_env("FELT_ARGS_FILE")
+
+    System.put_env("PATH", bin_dir <> ":" <> (old_path || ""))
+    System.put_env("FELT_ARGS_FILE", args_file)
+
+    on_exit(fn ->
+      restore_env("PATH", old_path)
+      restore_env("FELT_ARGS_FILE", old_args_file)
+    end)
+
+    args_file
+  end
+
+  defp restore_env(key, nil), do: System.delete_env(key)
+  defp restore_env(key, value), do: System.put_env(key, value)
+end

test/shuttle_web/controllers/lifecycle_controller_test.exs

@@ -103,6 +103,44 @@ defmodule ShuttleWeb.LifecycleControllerTest do
              "--felt-store\n#{store}\nset-interactive\ntests/interactive-uid\nfalse\n"
   end
 
+  test "set-outcome delegates to shuttle-ctl, preserving a multi-line value as one arg" do
+    root =
+      System.tmp_dir!()
+      |> Path.join("shuttle-lifecycle-outcome-#{System.unique_integer([:positive])}")
+
+    store = Path.join(root, "loom")
+    fiber_dir = Path.join([store, ".felt", "tests", "outcome-edit"])
+    File.mkdir_p!(fiber_dir)
+    File.write!(Path.join(fiber_dir, "outcome-edit.md"), "---\nname: Outcome edit\n---\n\n")
+
+    args_file = install_fake_shuttle_ctl!()
+    old_loom_homes = System.get_env("LOOM_HOMES")
+    System.put_env("LOOM_HOMES", store)
+
+    on_exit(fn ->
+      restore_env("LOOM_HOMES", old_loom_homes)
+      File.rm_rf(root)
+    end)
+
+    conn =
+      post(
+        api_conn(),
+        "/api/v1/lifecycle",
+        Jason.encode!(%{
+          "action" => "set-outcome",
+          "fiber" => "tests/outcome-edit",
+          "outcome" => "Blocked: waiting on ADS token\nsecond line"
+        })
+      )
+
+    assert conn.status == 200
+
+    # The multi-line outcome rides as a single argv element (one `--outcome`
+    # value), so the block scalar survives without stdin piping.
+    assert File.read!(args_file) ==
+             "set-outcome\ntests/outcome-edit\n--outcome\nBlocked: waiting on ADS token\nsecond line\n"
+  end
+
   test "accept for standing roles re-arms from the doc and evicts runtime frontmatter" do
     root =
       System.tmp_dir!()