@animalabs/connectome-host 0.7.2 → 0.7.4

package/test/framework-strategy-defaults.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Standard-recipe memory defaults (buildFrameworkStrategy).
+ *
+ * A recipe that omits strategy tuning must get the fleet-standard shape:
+ * autobiographical + adaptiveResolution + kv-stable folding + same-model
+ * compression + summaries voiced as the agent itself. Explicit recipe values
+ * always win. DEFAULT_RECIPE must not enable the opt-in modules
+ * (subagents/lessons/retrieval).
+ */
+import { describe, expect, test } from 'bun:test';
+import { buildFrameworkStrategy } from '../src/framework-strategy.js';
+import { DEFAULT_RECIPE, validateRecipe } from '../src/recipe.js';
+
+function recipe(agent: Record<string, unknown> = {}) {
+  return validateRecipe({
+    name: 'framework-strategy-defaults',
+    agent: {
+      systemPrompt: 'sys',
+      ...agent,
+    },
+  });
+}
+
+function configView(strategy: object): Record<string, unknown> {
+  return (strategy as { config?: Record<string, unknown> }).config ?? {};
+}
+
+describe('standard-recipe memory defaults', () => {
+  test('omitted strategy gets kv-stable folding, same-model compression, and agent-voiced summaries', () => {
+    const strategy = buildFrameworkStrategy(
+      recipe({ name: 'Mira' }),
+      'some-model',
+      'America/Los_Angeles',
+    );
+    const config = configView(strategy);
+    expect(config.adaptiveResolution).toBe(true);
+    expect(config.foldingStrategy).toBe('kv-stable');
+    expect(config.compressionModel).toBe('some-model');
+    expect(config.summaryParticipant).toBe('Mira');
+  });
+
+  test('frontdesk gets adaptive + kv-stable too (2026-08-03 clerk outage: hierarchical saturates)', () => {
+    const strategy = buildFrameworkStrategy(
+      recipe({ name: 'Desk', strategy: { type: 'frontdesk' } }),
+      'some-model',
+      'Europe/Kyiv',
+    );
+    const config = configView(strategy);
+    expect(config.adaptiveResolution).toBe(true);
+    expect(config.foldingStrategy).toBe('kv-stable');
+  });
+
+  test('frontdesk adaptiveResolution: false is the hierarchical rollback lever', () => {
+    const strategy = buildFrameworkStrategy(
+      recipe({ name: 'Desk', strategy: { type: 'frontdesk', adaptiveResolution: false } }),
+      'some-model',
+      'Europe/Kyiv',
+    );
+    const config = configView(strategy);
+    expect(config.adaptiveResolution).toBe(false);
+    expect(config.foldingStrategy).toBeUndefined();
+  });
+
+  test('explicit recipe values override the defaults', () => {
+    const strategy = buildFrameworkStrategy(
+      recipe({
+        name: 'Mira',
+        strategy: {
+          type: 'autobiographical',
+          foldingStrategy: 'flat-profile',
+          compressionModel: 'pinned-model',
+          summaryParticipant: 'Someone Else',
+        },
+      }),
+      'some-model',
+      'America/Los_Angeles',
+    );
+    const config = configView(strategy);
+    expect(config.foldingStrategy).toBe('flat-profile');
+    expect(config.compressionModel).toBe('pinned-model');
+    expect(config.summaryParticipant).toBe('Someone Else');
+  });
+
+  test('adaptiveResolution opt-out leaves foldingStrategy unset', () => {
+    const strategy = buildFrameworkStrategy(
+      recipe({ strategy: { type: 'autobiographical', adaptiveResolution: false } }),
+      'some-model',
+      'America/Los_Angeles',
+    );
+    const config = configView(strategy);
+    expect(config.adaptiveResolution).toBe(false);
+    expect(config.foldingStrategy).toBeUndefined();
+  });
+
+  test("without an agent name the summary voice falls back to the library's 'Claude' default", () => {
+    const strategy = buildFrameworkStrategy(
+      recipe(),
+      'some-model',
+      'America/Los_Angeles',
+    );
+    expect(configView(strategy).summaryParticipant).toBe('Claude');
+  });
+
+  test('DEFAULT_RECIPE does not enable the opt-in modules', () => {
+    const modules = DEFAULT_RECIPE.modules ?? {};
+    expect(modules).not.toHaveProperty('subagents');
+    expect(modules).not.toHaveProperty('lessons');
+    expect(modules).not.toHaveProperty('retrieval');
+  });
+});

package/test/frontdesk-strategy.test.ts

@@ -2,7 +2,6 @@ import { describe, test, expect } from 'bun:test';
 import type {
   MessageStoreView,
   StoredMessage,
-  SummaryEntry,
   ContextEntry,
 } from '@animalabs/context-manager';
 import { FrontdeskStrategy } from '../src/strategies/frontdesk-strategy.js';
@@ -54,12 +53,12 @@ class TestFrontdesk extends FrontdeskStrategy {
   public pub_updateSalience(store: MessageStoreView) {
     this.updateSalience(store);
   }
-  public pub_selectL1(l1: SummaryEntry[], budget: number, maxTokens: number) {
-    return this.selectL1Summaries(l1, budget, maxTokens);
-  }
   public pub_isTopicBoundary(a: StoredMessage, b: StoredMessage) {
     return this.isTopicBoundary(a, b);
   }
+  public pub_chunkBoundaryHint(a: StoredMessage, b: StoredMessage) {
+    return this.chunkBoundaryHint(a, b);
+  }
   public pub_compressionInstruction(chunkMessages: StoredMessage[], target: number) {
     // Build a minimal Chunk shape sufficient for getCompressionInstruction
     const chunk = {
@@ -293,44 +292,33 @@ describe('compression instruction', () => {
   });
 });
 
-describe('salience-biased L1 selection', () => {
-  function summary(id: string, tokens: number, sourceIds: string[]): SummaryEntry {
-    return {
-      id,
-      level: 1,
-      content: '',
-      tokens,
-      sourceLevel: 0,
-      sourceIds,
-      sourceRange: { first: sourceIds[0] ?? '', last: sourceIds[sourceIds.length - 1] ?? '' },
-      created: Date.now(),
-    };
-  }
+describe('chunk boundary hint (topic-aware chunking via the base seam)', () => {
+  // The chunking mechanics — record persistence, minimum-size, tool-pairing
+  // guard — are context-manager's contract, gated by its
+  // chunk-boundary-hook tests. What is conhost's to pin is the hint policy:
+  // frontdesk hints exactly at topic boundaries.
 
-  test('prefers L1 summaries whose sources contain salient messages', () => {
+  test('hints a close when adjacent messages change topic on one channel', () => {
     const s = makeStrategy();
-    const q = msg('User', 'what is x?', {}); // salient: unanswered
-    s.pub_updateSalience(makeStore([q]));
-
-    // Two L1 summaries, each 100 tokens; budget fits only one
-    const routineFirst = summary('L1-0', 100, ['unrelated-1']);
-    const salientSecond = summary('L1-1', 100, [q.id]);
-
-    const { selected } = s.pub_selectL1([routineFirst, salientSecond], 100, 100);
-    expect(selected).toHaveLength(1);
-    expect(selected[0].id).toBe('L1-1');
+    const a = msg('User', 'x', { serverId: 'zulip', channelId: 'zulip:eng', topic: 'retries' });
+    const b = msg('User', 'y', { serverId: 'zulip', channelId: 'zulip:eng', topic: 'deploys' });
+    expect(s.pub_chunkBoundaryHint(a, b)).toBe(true);
   });
 
-  test('falls back to routine summaries once salient are exhausted', () => {
+  test('does not hint within a topic or when topic metadata is absent', () => {
     const s = makeStrategy();
-    const q = msg('User', 'what is x?', {});
-    s.pub_updateSalience(makeStore([q]));
+    const a = msg('User', 'x', { serverId: 'zulip', channelId: 'zulip:eng', topic: 'retries' });
+    const b = msg('User', 'y', { serverId: 'zulip', channelId: 'zulip:eng', topic: 'retries' });
+    const bare = msg('User', 'z', {});
+    expect(s.pub_chunkBoundaryHint(a, b)).toBe(false);
+    expect(s.pub_chunkBoundaryHint(a, bare)).toBe(false);
+    expect(s.pub_chunkBoundaryHint(bare, a)).toBe(false);
+  });
 
-    const salient = summary('L1-1', 50, [q.id]);
-    const routine = summary('L1-2', 50, ['unrelated-1']);
-    const { selected } = s.pub_selectL1([routine, salient], 200, 200);
-    expect(selected).toHaveLength(2);
-    expect(selected[0].id).toBe('L1-1'); // salient first
-    expect(selected[1].id).toBe('L1-2');
+  test('hint agrees with isTopicBoundary across channels (same topic name, different channel)', () => {
+    const s = makeStrategy();
+    const a = msg('User', 'x', { serverId: 'zulip', channelId: 'zulip:eng', topic: 'retries' });
+    const b = msg('User', 'y', { serverId: 'zulip', channelId: 'zulip:ops', topic: 'retries' });
+    expect(s.pub_chunkBoundaryHint(a, b)).toBe(s.pub_isTopicBoundary(a, b));
   });
 });

package/test/headless-panel-request.test.ts

@@ -0,0 +1,201 @@
+/**
+ * Integration test for the 'panel-request' IPC verb against a REAL headless
+ * child (full framework, no inference): the same runPanelOp dispatcher the
+ * WebUI host uses locally must answer over the socket, so every operator
+ * panel (mcpl / settings / pins / health / context debug) works for fleet
+ * children exactly as it does for the host.
+ *
+ * Also verifies panel-response bypasses subscription filtering — a narrowed
+ * event stream must never eat a request/response pair.
+ */
+import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
+import { spawn, type ChildProcess } from 'node:child_process';
+import { mkdtempSync, writeFileSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { connect as netConnect, type Socket } from 'node:net';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const TEST_DIR = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(TEST_DIR, '..');
+const INDEX_PATH = join(REPO_ROOT, 'src', 'index.ts');
+
+const MINIMAL_RECIPE = {
+  name: 'Panel Test',
+  agent: {
+    name: 'commander',
+    systemPrompt: 'never asked to infer in this test',
+  },
+  modules: {
+    subagents: false,
+    lessons: false,
+    retrieval: false,
+    wake: false,
+    workspace: false,
+  },
+};
+
+function lineReader(socket: Socket): { events: Array<Record<string, unknown>>; stop: () => void } {
+  const events: Array<Record<string, unknown>> = [];
+  let buf = '';
+  const handler = (chunk: Buffer): void => {
+    buf += chunk.toString('utf-8');
+    let i: number;
+    while ((i = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, i).trim();
+      buf = buf.slice(i + 1);
+      if (!line) continue;
+      try { events.push(JSON.parse(line) as Record<string, unknown>); } catch { /* ignore malformed */ }
+    }
+  };
+  socket.on('data', handler);
+  return { events, stop: (): void => { socket.off('data', handler); } };
+}
+
+async function waitFor(check: () => boolean, timeoutMs: number, label: string): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    if (check()) return;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  throw new Error(`waitFor timed out after ${timeoutMs}ms: ${label}`);
+}
+
+async function connectSocket(path: string, timeoutMs = 3_000): Promise<Socket> {
+  return new Promise((resolveConn, rejectConn) => {
+    const s = netConnect(path);
+    const timer = setTimeout(() => {
+      s.destroy();
+      rejectConn(new Error(`socket connect timeout: ${path}`));
+    }, timeoutMs);
+    s.once('connect', () => { clearTimeout(timer); resolveConn(s); });
+    s.once('error', (err) => { clearTimeout(timer); rejectConn(err); });
+  });
+}
+
+describe('headless daemon — panel-request / panel-response', () => {
+  let tmpDir: string;
+  let socketPath: string;
+  let child: ChildProcess;
+  let sock: Socket;
+  let reader: { events: Array<Record<string, unknown>>; stop: () => void };
+  let corrSeq = 0;
+
+  /** Send one panel-request and await its panel-response. */
+  async function panel(op: string, params?: Record<string, unknown>): Promise<Record<string, unknown>> {
+    const corrId = `panel-test-${++corrSeq}`;
+    sock.write(JSON.stringify({ type: 'panel-request', op, ...(params ? { params } : {}), corrId }) + '\n');
+    await waitFor(
+      () => reader.events.some((e) => e.type === 'panel-response' && e.corrId === corrId),
+      10_000,
+      `panel-response for op=${op}`,
+    );
+    return reader.events.find((e) => e.type === 'panel-response' && e.corrId === corrId)!;
+  }
+
+  beforeAll(async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'fkm-panelreq-'));
+    const recipePath = join(tmpDir, 'recipe.json');
+    socketPath = join(tmpDir, 'ipc.sock');
+    writeFileSync(recipePath, JSON.stringify(MINIMAL_RECIPE), 'utf-8');
+
+    child = spawn(
+      'bun',
+      [INDEX_PATH, recipePath, '--headless'],
+      {
+        cwd: tmpDir,
+        env: {
+          ...process.env,
+          ANTHROPIC_API_KEY: 'sk-test-panel',
+          DATA_DIR: tmpDir,
+        },
+        stdio: ['ignore', 'ignore', 'ignore'],
+      },
+    );
+
+    await waitFor(() => existsSync(socketPath), 15_000, 'socket file appears');
+    sock = await connectSocket(socketPath);
+    reader = lineReader(sock);
+    await waitFor(
+      () => reader.events.some((e) => e.type === 'lifecycle' && (e as { phase?: string }).phase === 'ready'),
+      5_000,
+      'lifecycle:ready',
+    );
+  });
+
+  afterAll(async () => {
+    try { sock.write(JSON.stringify({ type: 'shutdown' }) + '\n'); } catch { /* noop */ }
+    await new Promise((r) => setTimeout(r, 500));
+    try { reader.stop(); sock.destroy(); } catch { /* noop */ }
+    try { if (child.exitCode === null) child.kill('SIGKILL'); } catch { /* noop */ }
+    try { rmSync(tmpDir, { recursive: true, force: true }); } catch { /* noop */ }
+  });
+
+  test('op=health returns the healthz assembly', async () => {
+    const res = await panel('health');
+    expect(res.ok).toBe(true);
+    expect(res.op).toBe('health');
+    const data = res.data as Record<string, unknown>;
+    // Same shape /healthz serves: framework snapshot + the panel-data extras.
+    expect(data.agents ?? data.runtimeSettings ?? data.contextComposition).toBeDefined();
+  });
+
+  test('op=settings returns the primary agent runtime settings', async () => {
+    const res = await panel('settings');
+    expect(res.ok).toBe(true);
+    const data = res.data as { agent: string; settings: Record<string, unknown>; hotKeys: string[] };
+    expect(data.agent).toBe('commander');
+    expect(typeof data.settings).toBe('object');
+    expect(Array.isArray(data.hotKeys)).toBe(true);
+  });
+
+  test('op=mcpl returns registry + live server view', async () => {
+    const res = await panel('mcpl');
+    expect(res.ok).toBe(true);
+    const data = res.data as { configPath: string; servers: unknown[]; live: unknown[] };
+    expect(typeof data.configPath).toBe('string');
+    expect(Array.isArray(data.servers)).toBe(true);
+    expect(Array.isArray(data.live)).toBe(true);
+    expect(data.live.length).toBe(0); // minimal recipe opts into no MCPLs
+  });
+
+  test('op=pins returns a snapshot with candidates when asked', async () => {
+    const res = await panel('pins', { withCandidates: true });
+    expect(res.ok).toBe(true);
+    const data = res.data as { agent: string; pins: unknown[]; pinsSupported: boolean; candidates?: unknown[] };
+    expect(data.agent).toBe('commander');
+    expect(Array.isArray(data.pins)).toBe(true);
+    expect(typeof data.pinsSupported).toBe('boolean');
+    expect(Array.isArray(data.candidates)).toBe(true);
+  });
+
+  test('op=context-coverage names the agent and its branch', async () => {
+    const res = await panel('context-coverage');
+    expect(res.ok).toBe(true);
+    const data = res.data as { agent: string; branch: string; totals: Record<string, number> };
+    expect(data.agent).toBe('commander');
+    expect(typeof data.branch).toBe('string');
+    expect(typeof data.totals.chunks).toBe('number');
+  });
+
+  test('unknown agent comes back ok:false with 404', async () => {
+    const res = await panel('context-coverage', { agent: 'nonexistent' });
+    expect(res.ok).toBe(false);
+    expect(res.status).toBe(404);
+    expect(res.error).toContain('nonexistent');
+  });
+
+  test('unknown op comes back ok:false with 400', async () => {
+    const res = await panel('no-such-op');
+    expect(res.ok).toBe(false);
+    expect(res.status).toBe(400);
+    expect(res.error).toContain('unknown panel op');
+  });
+
+  test('panel-response bypasses subscription filter', async () => {
+    sock.write(JSON.stringify({ type: 'subscribe', events: ['command-output'] }) + '\n');
+    await new Promise((r) => setTimeout(r, 100));
+    const res = await panel('health');
+    expect(res.ok).toBe(true);
+  });
+});

package/test/identity-and-surfaces.test.ts

@@ -0,0 +1,157 @@
+// Identity module (archipelago-home client) + the tools↔utilities surface
+// flags on mcpl-admin and observers. See docs/home-node.md §4 and the af
+// utils meta-tool (Module.getUtilities).
+//
+// Design under test: the AGENT surface is credential-free (status /
+// accept_invite, no tokens in any result); credentials exist only on the
+// HOST-facing API (accessFor/httpAuthFor) that the MCPL dial provider
+// and HTTP helpers consume outside model context.
+import { describe, it, expect } from 'bun:test';
+import { mkdtempSync, existsSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+
+import { IdentityModule } from '../src/modules/identity-module.ts';
+import { McplAdminModule } from '../src/modules/mcpl-admin-module.ts';
+import { ObserversModule } from '../src/modules/observers-module.ts';
+
+const call = (name: string, input: unknown) => ({ id: 't1', name, input });
+
+function fakeHome(routes: Record<string, (body: any) => { status: number; json: unknown }>): typeof fetch {
+  return (async (url: string | URL | Request, init?: RequestInit) => {
+    const path = new URL(String(url)).pathname;
+    const handler = routes[path];
+    if (!handler) return new Response('{}', { status: 404 });
+    const body = JSON.parse(String(init?.body ?? '{}'));
+    const { status, json } = handler(body);
+    return new Response(JSON.stringify(json), { status });
+  }) as typeof fetch;
+}
+
+describe('identity module', () => {
+  it('is utilities-only, and the agent surface never mentions or returns credentials', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    const mod = new IdentityModule({ keyPath: join(dir, 'identity-key.pem'), home: 'id.test' });
+    expect(mod.getTools()).toEqual([]);
+    expect(mod.getUtilities().map((u) => u.name)).toEqual(['status', 'accept_invite']);
+    // Framing check: no crypto/credential vocabulary in agent-visible text.
+    const visible = JSON.stringify(mod.getUtilities()).toLowerCase();
+    for (const scary of ['token', 'key', 'sign', 'proof', 'ed25519', 'mint', 'bearer']) {
+      expect(visible).not.toContain(scary);
+    }
+
+    const res = await mod.handleToolCall(call('status', {}));
+    expect(res.success).toBe(true);
+    const data = res.data as { registeredAs: unknown; note: string };
+    expect(data.registeredAs).toBe(null);
+    expect(data.note).toContain('invitation code');
+    expect(JSON.stringify(res.data)).not.toContain('ed25519'); // key exists on disk, not in results
+    expect(existsSync(join(dir, 'identity-key.pem'))).toBe(true);
+  });
+
+  it('accept_invite registers, echoes NO credential, and is one-time', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    let seen: any = null;
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      fetchImpl: fakeHome({
+        '/enroll': (body) => {
+          seen = body;
+          return { status: 200, json: { sub: 'agent:ferro@guest', token: 'aid1.SECRET.x' } };
+        },
+      }),
+    });
+    const res = await mod.handleToolCall(call('accept_invite', { invite: 'inv_1', name: 'Ferro' }));
+    expect(res.success).toBe(true);
+    expect((res.data as any).id).toBe('agent:ferro@guest');
+    // The home node's response token must NOT reach the agent.
+    expect(JSON.stringify(res.data)).not.toContain('aid1.');
+
+    // Wire-level: the signed statement is the spec's, verifiable by the module's own key.
+    const raw = Buffer.from(seen.id.slice('ed25519:'.length), 'base64url');
+    const key = createPublicKey({
+      key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), raw]),
+      format: 'der', type: 'spki',
+    });
+    const statement = `archipelago-enroll|v1|id.test|inv_1|${seen.timestamp}`;
+    expect(cryptoVerify(null, Buffer.from(statement), key, Buffer.from(seen.proof, 'base64url'))).toBe(true);
+
+    const rec = JSON.parse(readFileSync(join(dir, 'k.json'), 'utf8'));
+    expect(rec.sub).toBe('agent:ferro@guest');
+
+    const again = await mod.handleToolCall(call('accept_invite', { invite: 'inv_2', name: 'Ferro2' }));
+    expect(again.success).toBe(false);
+    expect(again.error).toContain('Already registered');
+  });
+
+  it('host-facing accessFor: requires registration, then exchanges per call', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    let mints = 0;
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      defaultAudience: 'eidoverse',
+      fetchImpl: fakeHome({
+        '/enroll': () => ({ status: 200, json: { sub: 'agent:a@guest', token: 't0' } }),
+        '/token': (body) => body.audience === 'eidoverse'
+          ? { status: 200, json: { token: `aid1.fresh.${++mints}` } }
+          : { status: 400, json: { error: 'unknown audience' } },
+      }),
+    });
+    await expect(mod.accessFor()).rejects.toThrow(/not registered/);
+
+    await mod.handleToolCall(call('accept_invite', { invite: 'i', name: 'A' }));
+    expect(await mod.accessFor()).toBe('aid1.fresh.1');
+    expect(await mod.accessFor('eidoverse')).toBe('aid1.fresh.2'); // fresh per call — dial-time rotation
+    expect((await mod.httpAuthFor()).authorization).toBe('Bearer aid1.fresh.3');
+    await expect(mod.accessFor('nope')).rejects.toThrow(/unknown audience/);
+    expect(mod.isEnrolled()).toBe(true);
+    expect(mod.sub()).toBe('agent:a@guest');
+  });
+});
+
+describe('mcpl-admin access grants', () => {
+  it('deploy with `access` requires identity wiring, and stores the NAME not a credential', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'mcpl-'));
+    const mod = new McplAdminModule({ overlayPath: join(dir, 'overlay.json') });
+    // stub framework so the deploy reaches the access check
+    mod.setFramework({
+      listMcplServers: () => [],
+      connectMcplServer: async () => {},
+      restartMcplServer: async () => {},
+      disconnectMcplServer: async () => {},
+    } as any);
+
+    // no identity wired → clear bounce
+    const refused = await mod.handleToolCall(call('mcpl_deploy', {
+      id: 'worlds', url: 'wss://example.test/mcpl', access: 'eidoverse',
+    }) as any);
+    expect(refused.success).toBe(false);
+    expect(refused.error).toContain('identity');
+  });
+
+  it('surface flags: default keeps four first-class tools; utilities parks them', () => {
+    const asTools = new McplAdminModule({});
+    expect(asTools.getTools().length).toBe(4);
+    expect(asTools.getUtilities().length).toBe(0);
+
+    const asUtils = new McplAdminModule({ surface: 'utilities' });
+    expect(asUtils.getTools().length).toBe(0);
+    expect(asUtils.getUtilities().map((u) => u.name).sort()).toEqual(
+      ['mcpl_deploy', 'mcpl_list', 'mcpl_restart', 'mcpl_unload'],
+    );
+  });
+});
+
+describe('observers surface flag', () => {
+  it('same definitions on either surface', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'obs-'));
+    const asTools = new ObserversModule({ path: join(dir, 'observers.json') });
+    const asUtils = new ObserversModule({ path: join(dir, 'observers.json'), surface: 'utilities' });
+    expect(asTools.getTools().map((t) => t.name)).toEqual(asUtils.getUtilities().map((u) => u.name));
+    expect(asTools.getUtilities().length).toBe(0);
+    expect(asUtils.getTools().length).toBe(0);
+  });
+});

package/test/mcpl-admin-module.test.ts

@@ -15,8 +15,14 @@ import { readAgentOverlay, saveAgentOverlay } from '../src/mcpl-config.js';
 interface StubServer {
   id: string;
   connected: boolean;
+  retrying: boolean;
   toolPrefix: string;
   toolCount: number;
+  policyEstablished: boolean;
+  effectiveGrant: string[];
+  maskedCapabilities: string[];
+  deniedCapabilities: string[];
+  allowHostCommands: boolean;
   command?: string;
   url?: string;
 }
@@ -32,8 +38,14 @@ function makeStubFramework() {
       servers.set(config.id, {
         id: config.id,
         connected: true,
+        retrying: false,
         toolPrefix: config.toolPrefix ?? `mcpl--${config.id}`,
         toolCount: 1,
+        policyEstablished: true,
+        effectiveGrant: ['channels.incoming'],
+        maskedCapabilities: ['channels.streaming'],
+        deniedCapabilities: ['contextHooks.beforeInference.inject.system'],
+        allowHostCommands: false,
         command: config.command,
         url: config.url,
       });
@@ -49,8 +61,14 @@ function makeStubFramework() {
       servers.set(id, {
         id,
         connected: true,
+        retrying: false,
         toolPrefix: `mcpl--${id}`,
         toolCount: 1,
+        policyEstablished: true,
+        effectiveGrant: ['channels.incoming'],
+        maskedCapabilities: ['channels.streaming'],
+        deniedCapabilities: ['contextHooks.beforeInference.inject.system'],
+        allowHostCommands: false,
         command: config?.command ?? prev?.command,
       });
     },
@@ -207,6 +225,11 @@ describe('mcpl_list', () => {
     const text = String(result.data);
     expect(text).toContain('discord: CONNECTED');
     expect(text).toContain('mytool: CONNECTED');
+    expect(text).toContain('policy=established');
+    expect(text).toContain('grant=[channels.incoming]');
+    expect(text).toContain('masked=[channels.streaming]');
+    expect(text).toContain('denied=[contextHooks.beforeInference.inject.system]');
+    expect(text).toContain('hostCommands=deny');
     expect(text).toContain('source=agent-overlay');
     expect(text).toContain('gone: UNLOADED');
   });

package/test/mock-headless-child.ts

@@ -83,6 +83,20 @@ function simulateFinalInference(text: string, emitIdleAfter: boolean): void {
 function dispatch(msg: Record<string, unknown>): void {
   const t = typeof msg.type === 'string' ? msg.type : '';
   if (t === 'subscribe') return;  // accept silently
+  if (t === 'panel-request') {
+    // Panel-op verbs for FleetModule.requestPanel tests:
+    //   op 'hang' → never answers (timeout path)
+    //   op 'fail' → ok:false with a status (error passthrough path)
+    //   anything else → ok:true echoing the params back
+    const op = typeof msg.op === 'string' ? msg.op : '';
+    if (op === 'hang') return;
+    if (op === 'fail') {
+      emit({ type: 'panel-response', corrId: msg.corrId, op, ok: false, error: 'mock failure', status: 418 });
+      return;
+    }
+    emit({ type: 'panel-response', corrId: msg.corrId, op, ok: true, data: { op, echo: msg.params ?? null } });
+    return;
+  }
   if (t === 'shutdown') {
     emit({ type: 'lifecycle', phase: 'exiting', reason: 'shutdown' });
     setTimeout(() => process.exit(0), 50);