Module jobs_control 

Controlled-tier scheduled jobs (Domain 11, concept 6) — the FIRST controlled-tier noun, and the shape the rest of wave 2 copies.

Charter (docs/plans/orchestration-domain-11-2026-09-02.md §0.4): supercode never runs a cron engine. Every mutation here is the harness’s OWN verb, executed as a subprocess, with supercode acting as the uniform client:

• Hermes — hermes cron create | edit | pause | resume | run | remove with HERMES_HOME in the environment (a profile IS a HERMES_HOME: upstream hermes_cli/profiles.py spawns profile work with HERMES_HOME=<home>/profiles/<name>).
• OpenClaw — openclaw cron add | edit | disable | enable | run | rm. Every one of these goes through the Gateway websocket, so the endpoint and credential are resolved from OPENCLAW’s OWN config (<state dir>/openclaw.json, pointers /gateway/remote/url, /gateway/port, /gateway/auth/token) through the very same crate::RuntimeConnectLaunch the connect descriptor uses — never from supercode’s own config, and never from an inherited environment variable.
• The orchestrator — its own package (ORC-13). The write door is the daemon’s local socket while it is up and node bin/orchestrator.mjs <op> … when it is down, both landing in the SAME applyOperator → reducer → save() path inside sdk/orchestrator, which owns the folder’s byte-stability and its residue rules (docs/ORCHESTRATOR-IR.md §4.6, §6). supercode writes no file of that folder itself; crate::orchestrator_door is the uniform client.
• Claude Code — refused. Its jobs are session-scoped runtime state created by the model inside a session (CronCreate); the harness publishes no verb a client can call.

Three rules the whole tier inherits:

1. The harness’s answer is the answer. After the verb exits 0 the row is re-read through the ORCH-7 loader (crate::jobs) and returned. A non-zero exit surfaces the harness’s own stderr as the error — never a silent success, never a supercode-invented row.
2. The command is narrated. Every outcome carries ran: the exact argv that was executed, with any credential rendered as <redacted>. Tokens are never printed, logged, or stored.
3. A field the harness has no verb for is refused (JobControlError::Unsupported → UnsupportedAction), never dropped.

Structs

JobDeliverSpec

Uniform delivery for a create/update.

JobMutation

One mutating request, in the uniform Domain 11 vocabulary.

JobMutationOutcome

What one mutation did, with the harness’s own row read back afterwards.

JobPayloadSpec

Uniform payload for a create/update.

JobScheduleSpec

Uniform firing rule for a create/update.

Enums

JobControlError

Why a mutation could not be performed.

JobVerb

One uniform mutating verb.

Constants

CLAUDE_CODE_REFUSAL

Why Claude Code refuses every mutating job verb.

CONTROLLED_JOB_HARNESSES

Harnesses whose scheduled jobs supercode can MUTATE through their own CLI verb. Strictly narrower than crate::jobs::JOB_HARNESSES: Claude Code is readable but not controllable.

HERMES_BIN_ENV

Environment variable overriding the hermes executable (tests).

OPENCLAW_BIN_ENV

Environment variable overriding the openclaw executable (tests).

Functions

harness_program

mutate

Perform one mutation: translate to the harness’s own verb, run it, then re-read the row through the ORCH-7 loader.

supports_job_control

Whether harness can have its scheduled jobs mutated at all.