Receives every audit record synchronously as the tick emits it, before the record is also
returned from tick(). A throwing sink aborts the tick.
OptionalconfigPer-field overrides merged over defaultSupervisorConfig.
OptionalescalateCalled once per escalation with the same record already sent to audit — the pager hook.
Absent, escalations still reach the audit trail.
OptionalpausePauses the host worker's scheduled loop — the integrity pass's containment lever. Deliberately a one-way switch: the supervisor never resumes; a human does, after the evidence is reviewed.
OptionalproveRuns the integrity prover once when a mismatch episode is detected; its resolved value (or
{ proverFailed } when it throws) rides the escalation record as evidence. Absent, the
escalation carries a null proof.
OptionalreviveFlips up to limit dead inbox rows back to pending, typically store.inbox.reviveDead.
OptionalrunA targeted relay run for the outbox-backlog remediation, typically
worker.sweep({ ...input, only: ['relay'] }). Falls back to runSweep when absent.
The stuck-saga lever: one guarded worker sweep, typically
(now) => worker.sweep({ now, limit }). One sweep serves every actionable saga; the pass
verifies by re-loading each saga afterward. Also the outbox fallback when runRelay is
absent.
The saga store slice the stuck-saga pass polls and re-reads.
The detector's input, normally an OpsRuntime's signals.
What the host injects into createSupervisor. The required ports cover observation (clock, signals, sagas), the one mandatory lever (
runSweep), and the audit sink; the optional ones add levers and hooks the matching passes use when present and quietly skip when absent.