fix(knowledge): 1.2.2 — production-validated corrections from the system audit

[lua-stefan-kruger]

Summary

Knowledge-only release 1.2.2 of lua-agent-builder. Every correction below was validated against production by the 2026-09-13 system audit and re-verified in lua-core-services/packages/* and lua-iac source before editing. No hook, permission or MCP behaviour changed; dist/server.js is rebuilt only for the version strings.

Do not merge before review — merging to main auto-releases.

Checklist

• SA-129 — job retries and user.send() email (primitives.md §6, §12, §14, §16; decision-trees.md; agents/lua-skill-builder.md). Production and staging pin LUA_JOBS_INTAKE_MODE = "enqueue" (lua-iac services/lua-core/prod/k8s/config-map.tf:53, staging/k8s/config-map.tf:91), so deployed code jobs retry after a fixed backoffSeconds (default 60), min(maxAttempts, 10), none without a finite maxAttempts, with job.execution on every run (lua-core job.service.ts run→enqueueJob ~302-323, backoff: { type: 'fixed' } ~409, getHeavyRetryEligibility ~512-531, scheduleHeavyRetry ~572-607; lua-sandbox-runner executor-entry.ts ~231-239). The exponential path is reached only by agent-kind jobs (enqueueJob ~349 routes them to processJob). Email removed from the last-interaction reach list: only lua-whatsapp upsertChannelWindow (utils/channel-window.util.ts) writes channel windows, from its WhatsApp/Facebook/Instagram/MessageBird/SMS/Teams services; lua-email never does, so channel.service.ts:407 is unreachable.
• SA-042 — workflow verbs (primitives.md §12, §14; workflows.md §6). resume / signal / signalByKey / startBatch / setGoal / goals.* work deployed; resume_unavailable / signal_unavailable / not_implemented are unbound-provider guards (lua-core workflow-sandbox-bridge.ts ~251-263, ~266-271, ~278-281, ~188-193, ~320-324, ~348-352); only raiseBudget is 501 everywhere (:319 notImplemented; lua-cli workflow.api.service.ts unavailable('raiseBudget', 'R45')). Also recorded from the same result: deployed list ignores the typed workflow filter (:223-230).
• SA-037 — Voice.createSession (primitives.md §12, §14): re-validated absent in every runtime, lua test included (sandbox-runtime context.ts ~355-369; lua-cli utils/sandbox.ts ~332-341).
• SA-035 — Data indexes (primitives.md §12, §14, §16; decision-trees.md; agents/lua-architect.md, agents/lua-skill-builder.md): deployed create/update never forward index (sandbox-runtime custom.data.api.service.ts ~38-48, ~160-175 post { data, searchText } only); indexes can be declared only from a lua test run (lua-cli custom.data.api.service.ts) — seed-tool recipe added.
• SA-033 — lua chat -e sandbox uploads the whole process.env (primitives.md §12 env(key), §14; cli-reference.md §4; commands/lua-chat.md, commands/lua-test.md, commands/lua-env.md; agents/lua-qa.md; SECURITY.md; docs/USER_GUIDE.md): lua-cli utils/sandbox.ts ~149-172 and services/sandbox.service.ts ~232-238 upload it; the runtime never reads it — a sandbox turn's env() resolves from subAgent.env (lua-core skill-eligibility.resolver.ts ~317-318, ~418). Corrected 1.2.1's claim that sandbox turns read the upload. Guidance: never run sandbox chat from a shell holding secrets you do not want uploaded; prefer env -i / a clean shell; lua test uploads nothing; a platform ticket is open.
• SA-132 — deployed webhooks have no wall timeout (primitives.md §4, §14; decision-trees.md; agents/lua-architect.md, agents/lua-skill-builder.md): lua-core webhook.service.ts ~327-340 → execute.webhook.service.ts ~40-56 run the handler in-process with only the VM's synchronous-prefix timeout (sandbox-runtime runner.ts ~57-68); tools go to the remote runner with a 180 s wall (execute-function.service.ts:15 TOOL_TIMEOUT_MS, :245 wallMs; lua-iac LUA_SANDBOX_ROUTING_DEFAULT = "remote"). Guidance: short, idempotent handlers; never rely on a server-side cut.
• SA-061 — concurrencyPolicy: 'forbid' not enforced on starts (primitives.md §5, §12, §14; workflows.md §1, §6, §9; commands/lua-workflow.md; decision-trees.md; agents/lua-architect.md): WorkflowRunService.createRun has no overlap check (lua-core workflow-run.service.ts:5-12 header; the only guard is the schedule dispatcher, workflow-schedule-dispatch.service.ts ~253-268). No QA/deploy/workflow guidance relies on RUNS_IN_FLIGHT any more; idempotencyKey and in-workflow guards are recommended instead.
• SA-078 — OrderStatus.FULFILLED vs fullfilled (primitives.md §12, §14; agents/lua-architect.md, agents/lua-skill-builder.md): lua-cli interfaces/orders.ts:18 'fulfilled' goes into the path unmapped (order.api.service.ts ~42-44); the platform enum, Swagger and charts use fullfilled (shared-schemas ecommerce-order.schema.ts:6-11; lua-api orders/base.controller.ts:31,:182; chart.service.ts); the status param is never validated; 200 success:false envelopes are rethrown by the SDK as generic errors.
• SA-050 / SA-119 — LuaWebhook schemas and secret (primitives.md §4, §14; decision-trees.md; integrations.md; agents/lua-architect.md, agents/lua-skill-builder.md): the Zod schemas are parsed only by the class helper (lua-cli types/skill.ts ~694-712), which the bundler strips (compiler/bundler.ts ~78-96); lua test (utils/sandbox.ts ~492-533) and lua-core (execute.webhook.service.ts ~171-176) call execute(event) directly → safeParse in execute. secret must be a literal/const (compiler/plugins/webhook.plugin.ts ~144-152) and verifies Lua's own x-lua-signature (lua-core webhook.service.ts ~250-262), so it blocks vendor-signed senders — verify their HMAC in a defineTrigger verify over rawBody.
• SA-005 / SA-015 / SA-016 — --ci exit codes (cli-reference.md §1, §4; commands/lua-test.md, commands/lua-push.md, commands/lua-deploy.md; agents/lua-skill-builder.md, agents/lua-debug.md, agents/lua-deploy-pilot.md; primitives.md §14): SA-005 (raw prompts exit 0 under --ci) was already in 1.2.1 — verified present (prompt-handler.ts:16-20; test.ts:62-81), unchanged. SA-015 and SA-016 were not present and are added: lua test prints the success banner and exits 0 when execute throws (utils/sandbox.ts ~463-467 / ~524-528 / ~599-603 / ~713-717; test.ts ~390-399, ~497-501 — the debug agent previously said "exit 1 with a stack"); lua push all / lua deploy all exit 0 on partial failure (push.ts ~1300-1353; deploy.ts ~537-545, ~604-645).
• Version bump 1.2.1 → 1.2.2: package.json ×2 and both lockfiles, .claude-plugin/plugin.json, .claude-plugin/marketplace.json, mcp/lua-platform/src/server.mjs (×3), mcp/lua-platform/src/api-client.mjs, rebuilt mcp/lua-platform/dist/server.js, docs/USER_GUIDE.md. CHANGELOG.md 1.2.2 entry names the source for every line.

Verification

• npm run lint — all 18 lint scripts pass (LUA_CLI_SRC set, so lint-knowledge-commands really ran: 716 lua … references validated against command-definitions.ts; lint-release-version: 1.2.2 consistent)
• npm test -- --coverage — 18 suites / 428 tests pass; scripts/check-coverage.mjs pass (99.12 % statements)
• MCP: npm run build, npm test (9 suites / 147 tests), npm run lint, npm run typecheck, scripts/check-bundle-size.mjs (0.10 MB) — all pass

🤖 Generated with Claude Code

https://claude.ai/code/session_01AfAcTzKPi9LdoGvRcjJNQo