feat(orchestrator): modèle de désignation d'orchestrateur + sink de diagnostic

Introduit le modèle AgentManifest { version, entries, orchestrator } et la
garde d'écriture directe may_write_directly(..., &OrchestratorDesignation) :
seul l'orchestrateur désigné peut écrire directement, les autres passent par
le rendez-vous médié. Câble la désignation à travers domain → application →
infrastructure → app-tauri (context_guard, service, lifecycle, ports).

Ajoute crates/application/src/diag.rs : sink de diagnostic best-effort, sans
dépendance, qui miroite les traces du rendez-vous inter-agents de
l'orchestrateur vers un fichier de log persistant (utile au lancement via
AppImage où stderr est jeté), avec la même discipline « zéro dépendance,
ne casse jamais le rendez-vous ».

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/domain/src/agent.rs

@@ -277,24 +277,59 @@ impl ManifestEntry {
 
 /// In-memory image of `.ideai/agents.json`.
 ///
-/// Invariant enforced here: `md_path` values are unique across entries.
+/// Invariants enforced here:
+/// - `md_path` values are unique across entries;
+/// - `orchestrator == Some(id)` ⇒ `id` is present in `entries` (referential).
+///
+/// **Ordering invariant**: `entries` are kept in **creation order**, so
+/// `entries.first()` is the **oldest** agent. There is no per-entry timestamp; the
+/// vector position *is* the chronology, which is why the default orchestrator (when
+/// none is designated) is `entries.first()`.
 #[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AgentManifest {
     /// Schema version of the manifest file.
     pub version: u32,
-    /// Entries (one per project agent).
+    /// Entries (one per project agent), in **creation order** (oldest first).
     #[serde(rename = "agents")]
     pub entries: Vec<ManifestEntry>,
+    /// Explicitly designated orchestrator agent, if any.
+    ///
+    /// We persist only the **deviation** from the default: `None` (the common case)
+    /// means « the oldest agent orchestrates » (see [`effective_orchestrator`]);
+    /// `Some(id)` is an explicit designation. Skipped on serialisation when `None`,
+    /// so pre-feature manifests round-trip unchanged (free backward compatibility).
+    ///
+    /// [`effective_orchestrator`]: AgentManifest::effective_orchestrator
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub orchestrator: Option<AgentId>,
 }
 
 impl AgentManifest {
-    /// Builds a validated manifest.
+    /// Builds a validated manifest with **no** explicit orchestrator (the default:
+    /// the oldest agent orchestrates — see [`effective_orchestrator`]).
+    ///
+    /// [`effective_orchestrator`]: AgentManifest::effective_orchestrator
     ///
     /// # Errors
     /// Returns [`DomainError::InconsistentManifest`] if two entries share the
     /// same `md_path`.
     pub fn new(version: u32, entries: Vec<ManifestEntry>) -> Result<Self, DomainError> {
+        Self::with_orchestrator(version, entries, None)
+    }
+
+    /// Builds a validated manifest carrying an explicit `orchestrator` designation.
+    ///
+    /// # Errors
+    /// - [`DomainError::InconsistentManifest`] if two entries share the same
+    ///   `md_path`;
+    /// - [`DomainError::InconsistentManifest`] if `orchestrator == Some(id)` while
+    ///   `id` is **not** present in `entries` (referential integrity).
+    pub fn with_orchestrator(
+        version: u32,
+        entries: Vec<ManifestEntry>,
+        orchestrator: Option<AgentId>,
+    ) -> Result<Self, DomainError> {
         let mut seen = std::collections::HashSet::new();
         for entry in &entries {
             if !seen.insert(entry.md_path.as_str()) {
@@ -303,6 +338,196 @@ impl AgentManifest {
                 });
             }
         }
-        Ok(Self { version, entries })
+        if let Some(id) = orchestrator {
+            if !entries.iter().any(|e| e.agent_id == id) {
+                return Err(DomainError::InconsistentManifest {
+                    reason: format!("designated orchestrator `{id}` is not a known agent"),
+                });
+            }
+        }
+        Ok(Self {
+            version,
+            entries,
+            orchestrator,
+        })
+    }
+
+    /// The **effective** orchestrator agent: the explicit designation if any,
+    /// otherwise the **oldest** agent (`entries.first()`, by the creation-order
+    /// invariant). `None` only when the manifest has no entries at all.
+    #[must_use]
+    pub fn effective_orchestrator(&self) -> Option<AgentId> {
+        self.orchestrator
+            .or_else(|| self.entries.first().map(|e| e.agent_id))
+    }
+
+    /// Folds the [`effective_orchestrator`](Self::effective_orchestrator) into the
+    /// [`OrchestratorDesignation`] value object consumed by the FileGuard policy.
+    #[must_use]
+    pub fn orchestrator_designation(&self) -> crate::fileguard::OrchestratorDesignation {
+        match self.effective_orchestrator() {
+            Some(id) => crate::fileguard::OrchestratorDesignation::of(id),
+            None => crate::fileguard::OrchestratorDesignation::none(),
+        }
+    }
+
+    /// Designates `id` as the project's orchestrator (radio semantics: overwrites any
+    /// previous designation).
+    ///
+    /// # Errors
+    /// [`DomainError::InconsistentManifest`] if `id` is not a known agent of this
+    /// manifest.
+    pub fn designate(&mut self, id: AgentId) -> Result<(), DomainError> {
+        if !self.entries.iter().any(|e| e.agent_id == id) {
+            return Err(DomainError::InconsistentManifest {
+                reason: format!("cannot designate unknown agent `{id}` as orchestrator"),
+            });
+        }
+        self.orchestrator = Some(id);
+        Ok(())
+    }
+
+    /// Reacts to the removal of an agent: if it was the **explicitly designated**
+    /// orchestrator, clears the designation so the manifest falls back to the default
+    /// (lazy succession — the next-oldest agent becomes effective). A no-op when the
+    /// removed agent was not the designated one.
+    ///
+    /// Pure bookkeeping: it does **not** remove the entry itself (the caller owns
+    /// `entries`); it only keeps the `orchestrator` deviation consistent.
+    pub fn on_agent_deleted(&mut self, removed: AgentId) {
+        if self.orchestrator == Some(removed) {
+            self.orchestrator = None;
+        }
+    }
+}
+
+#[cfg(test)]
+mod orchestrator_tests {
+    use super::*;
+    use crate::conversation::ConversationParty;
+    use crate::fileguard::{may_write_directly, GuardedResource, OrchestratorDesignation};
+
+    fn agent_id(n: u128) -> AgentId {
+        AgentId::from_uuid(uuid::Uuid::from_u128(n))
+    }
+
+    /// Builds a manifest entry for `id`, with a `md_path` derived from `n` so entries
+    /// stay unique.
+    fn entry(n: u128) -> ManifestEntry {
+        ManifestEntry::new(
+            agent_id(n),
+            format!("agent-{n}"),
+            format!("agents/agent-{n}.md"),
+            ProfileId::from_uuid(uuid::Uuid::from_u128(1000 + n)),
+            None,
+            false,
+            None,
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn default_orchestrator_is_oldest_agent_when_none_designated() {
+        // entries are in creation order: first is the oldest → the effective default.
+        let m = AgentManifest::new(1, vec![entry(1), entry(2), entry(3)]).unwrap();
+        assert_eq!(m.orchestrator, None);
+        assert_eq!(m.effective_orchestrator(), Some(agent_id(1)));
+        assert_eq!(
+            m.orchestrator_designation(),
+            OrchestratorDesignation::of(agent_id(1))
+        );
+    }
+
+    #[test]
+    fn empty_manifest_has_no_effective_orchestrator() {
+        let m = AgentManifest::new(1, vec![]).unwrap();
+        assert_eq!(m.effective_orchestrator(), None);
+        assert_eq!(
+            m.orchestrator_designation(),
+            OrchestratorDesignation::none()
+        );
+    }
+
+    #[test]
+    fn explicit_designation_overrides_oldest() {
+        let mut m = AgentManifest::new(1, vec![entry(1), entry(2)]).unwrap();
+        m.designate(agent_id(2)).unwrap();
+        assert_eq!(m.orchestrator, Some(agent_id(2)));
+        assert_eq!(m.effective_orchestrator(), Some(agent_id(2)));
+    }
+
+    #[test]
+    fn designate_is_radio_and_rejects_unknown_agent() {
+        let mut m = AgentManifest::new(1, vec![entry(1), entry(2)]).unwrap();
+        m.designate(agent_id(1)).unwrap();
+        // Radio: a second designation overwrites the first (never accumulates).
+        m.designate(agent_id(2)).unwrap();
+        assert_eq!(m.orchestrator, Some(agent_id(2)));
+        // Referential: designating an agent absent from `entries` is rejected.
+        let err = m.designate(agent_id(99)).unwrap_err();
+        assert!(matches!(err, DomainError::InconsistentManifest { .. }));
+        // …and the previous valid designation is untouched.
+        assert_eq!(m.orchestrator, Some(agent_id(2)));
+    }
+
+    #[test]
+    fn lazy_succession_falls_back_to_oldest_when_designated_is_deleted() {
+        let mut m = AgentManifest::new(1, vec![entry(1), entry(2), entry(3)]).unwrap();
+        m.designate(agent_id(3)).unwrap();
+        // The designated agent is removed → designation cleared, default takes over.
+        m.entries.retain(|e| e.agent_id != agent_id(3));
+        m.on_agent_deleted(agent_id(3));
+        assert_eq!(m.orchestrator, None);
+        // Falls back to the (now) oldest remaining agent.
+        assert_eq!(m.effective_orchestrator(), Some(agent_id(1)));
+    }
+
+    #[test]
+    fn on_agent_deleted_is_noop_for_non_designated_agent() {
+        let mut m = AgentManifest::new(1, vec![entry(1), entry(2)]).unwrap();
+        m.designate(agent_id(2)).unwrap();
+        m.on_agent_deleted(agent_id(1));
+        // Deleting a non-designated agent leaves the designation intact.
+        assert_eq!(m.orchestrator, Some(agent_id(2)));
+    }
+
+    #[test]
+    fn constructor_enforces_referential_integrity_of_orchestrator() {
+        // Some(id) with id present in entries → ok.
+        assert!(
+            AgentManifest::with_orchestrator(1, vec![entry(1), entry(2)], Some(agent_id(2)),)
+                .is_ok()
+        );
+        // Some(id) with id absent → rejected.
+        let err =
+            AgentManifest::with_orchestrator(1, vec![entry(1)], Some(agent_id(42))).unwrap_err();
+        assert!(matches!(err, DomainError::InconsistentManifest { .. }));
+        // None is always valid (even with an empty manifest).
+        assert!(AgentManifest::with_orchestrator(1, vec![], None).is_ok());
+    }
+
+    #[test]
+    fn designated_agent_may_write_project_context_via_manifest_designation() {
+        let mut m = AgentManifest::new(1, vec![entry(1), entry(2)]).unwrap();
+        m.designate(agent_id(1)).unwrap();
+        let d = m.orchestrator_designation();
+        // The designated agent writes the project context directly…
+        assert!(may_write_directly(
+            ConversationParty::agent(agent_id(1)),
+            &GuardedResource::ProjectContext,
+            &d,
+        ));
+        // …another agent is refused (single-writer preserved)…
+        assert!(!may_write_directly(
+            ConversationParty::agent(agent_id(2)),
+            &GuardedResource::ProjectContext,
+            &d,
+        ));
+        // …and the human is always allowed.
+        assert!(may_write_directly(
+            ConversationParty::User,
+            &GuardedResource::ProjectContext,
+            &d,
+        ));
     }
 }