Diagram — Gate 0 doctor Probe Flow (BUILT)

Status: BUILT. This is the only flow in the repo with running code and green tests behind it (BUILD-REPORT.md: 0 warnings / 0 errors, 18/18 tests). Source: src/FleetRoutine.Cli/.

One-time setup, then repeatable trigger-and-read

sequenceDiagram
    actor Andrew
    participant CLI as fleet-routine.exe (outer process)
    participant WTS as Windows Task Scheduler
    participant Task as fleet-routine-doctor (S4U task)
    participant Payload as doctor --probe-payload (inner process, runs AS the task)
    participant Probes as 6x IHarnessProbe

    rect rgb(235, 245, 235)
    note over Andrew,WTS: One-time interactive registration
    Andrew->>CLI: fleet-routine doctor --register-probe
    CLI->>WTS: RegisterTaskDefinition(fleet-routine-doctor,<br/>Principal=Andrew's user, LogonType=S4U,<br/>RunLevel=Highest, ExecutionTimeLimit=35min)
    WTS-->>Andrew: OS credential prompt (password custodied by LSA/DPAPI)
    WTS-->>CLI: task registered
    end

    rect rgb(230, 240, 250)
    note over Andrew,Probes: Repeatable non-interactive run (the Gate 0 acceptance step)
    Andrew->>CLI: fleet-routine doctor --noninteractive --json
    CLI->>WTS: GetTask(fleet-routine-doctor)
    CLI->>CLI: Validate(task): not SYSTEM, right user,<br/>S4U, RunLevel Highest, action matches<br/>expected payload, no stale-logon (0x8007052E)
    CLI->>CLI: nonce = Canary.CreateToken() e.g. FLEET_OK_7f3a91c0
    CLI->>Task: write request.json {nonce, harnesses, allowMissing}<br/>under %LOCALAPPDATA%\fleet-routine\doctor
    CLI->>Task: delete stale result.json, task.Run()
    activate Task
    Task->>Payload: launches doctor --probe-payload<br/>(runs AS Andrew's user, S4U context)
    activate Payload
    Payload->>Payload: read request.json
    Payload->>Payload: write canary prompt to temp file (UTF-8, no BOM):<br/>"Respond with exactly `FLEET_OK_7f3a91c0` and nothing else."
    loop for each requested harness (sequential, 5-min budget each)
        Payload->>Probes: RunAsync(token, promptFile, timeout)
        Probes-->>Payload: HarnessResult{PASS/FAIL, elapsedMs, failureClass?, detail}
    end
    Payload->>Payload: Gate.Aggregate(results, allowMissing, logonType)
    Payload->>Task: write result.json (tmp then atomic move)
    Payload-->>Task: exit 0 (PASS) or 1 (FAIL)
    deactivate Payload
    deactivate Task
    CLI->>CLI: poll task.State every 500ms (35-min deadline)
    Task-->>CLI: task finished
    CLI->>CLI: read result.json, verify nonce matches (anti-staleness),<br/>verify task exit code matches result.Overall
    CLI->>CLI: stamp Principal/LogonType from the VALIDATED<br/>task definition, not the payload's self-report
    CLI-->>Andrew: JSON DoctorResult (exit 0 PASS / 1 FAIL)
    end

Per-harness probe (inside the loop above)

flowchart TD
    A[RunAsync per harness] --> B{class?}
    B -->|subprocess: claude/codex/gemini/grok| C[start process,<br/>UTF-8 stdio, no window]
    C --> D{SendPromptOnStdin?}
    D -->|yes: claude/codex/gemini| E[pipe prompt file to stdin,<br/>close stdin]
    D -->|no: grok — 32KB argv cap trap| F[pass --prompt-file path,<br/>never argv]
    E --> G[wait for exit, 5-min linked-CTS timeout]
    F --> G
    G -->|timeout| H[FAIL: STDIN_HANG_TIMEOUT or TIMEOUT]
    G -->|exit != 0| I[FAIL: FailureClassifier maps stderr text<br/>-> AUTH_TOKEN_MISSING / AUTH_PROMPT_REQUIRED /<br/>DPAPI_DECRYPT_FAILED / NONZERO_EXIT]
    G -->|exit == 0| J{Canary.Matches output, token?}
    J -->|no| K[FAIL: CANARY_MISMATCH]
    J -->|yes| L[PASS]

    B -->|http: odysseus/ollama, localhost only| M[GET health/tags]
    M -->|unreachable| N[FAIL: NETWORK_UNREACHABLE]
    M --> O{model list empty?}
    O -->|yes| P[FAIL: MODEL_UNAVAILABLE]
    O -->|no| Q[POST generate/chat with prompt file content]
    Q --> R{Canary.Matches response, token?}
    R -->|no| K
    R -->|yes| L

Canary matching (why a stale result or a help banner can't fake a PASS)

flowchart LR
    O[raw captured output] --> S[strip ANSI escape codes]
    S --> N[normalize CRLF/CR -> LF]
    N --> C{contains<br/>FLEET_OK_&lt;this-run's-nonce&gt;<br/>case-sensitive?}
    C -->|yes| PASS
    C -->|no| FAIL[FAIL: CANARY_MISMATCH]

Nonce is fresh 8-hex, generated once per doctor --noninteractive invocation (Canary.CreateToken, RandomNumberGenerator, 4 bytes). A leftover result.json from a prior run, or a CLI --help banner, cannot contain a nonce minted after it existed — so a match proves a model actually executed this run, not just that some process exited 0.