@cat-factory/orchestration 0.124.1 → 0.125.0

package/dist/container.js

@@ -1,5 +1,6 @@
 import { createAppCaches } from '@cat-factory/caching';
-import { getFragment } from '@cat-factory/prompt-fragments';
+import { ModuleRegistry } from './container/module-registry.js';
+import { createServicesModule, createGitHubModule, createDocumentsModule, createTasksModule, createEnvironmentsModule, createRunnersModule, createBootstrapModule, createTesterQualityReviewer, createDocInterviewService, createForkChatService, resolveBlockRunContext, createRequirementsModule, createBrainstormModule, createKaizenModule, createClarityModule, createNotificationsModule, createSlackModule, createRiskPoliciesModule, createSharedStacksModule, createPreflightModule, createSandboxModule, createWorkspaceSettingsModule, createReleaseHealthModule, createPackageRegistriesModule, createPreviewModule, createIncidentEnrichmentModule, createModelPresetsModule, createServiceFragmentDefaultsModule, createTrackerModule, createRecurringModule, } from './container/modules.js';
 import { ServiceMountService } from './modules/services/ServiceMountService.js';
 import { NoopWorkRunner } from '@cat-factory/kernel';
 import { NoopEventPublisher } from '@cat-factory/kernel';
@@ -18,15 +19,13 @@ import { LlmObservabilityService } from './modules/observability/LlmObservabilit
 import { AgentContextObservabilityService } from './modules/observability/AgentContextObservabilityService.js';
 import { SearchQueryObservabilityService } from './modules/observability/SearchQueryObservabilityService.js';
 import { PlatformObservabilityService } from './modules/observability/PlatformObservabilityService.js';
-import { GitHubInstallationService, RepoProvisioningService, GitHubService, GitHubSyncService, WebhookService, DocumentConnectionService, DocumentContentResolverService, DocumentImportService, DocumentPlannerService, DocumentLinkService, MapDocumentSourceRegistry, TaskConnectionService, TaskImportService, TaskLinkService, BugIntakeService, MapTaskSourceRegistry, EnvironmentConnectionService, EnvironmentProvisioningService, EnvironmentTeardownService, EnvironmentUserHandlerService, RunnerPoolConnectionService, PreflightService, ProvisioningLogRecorder, ProvisioningLogService, SharedStackService, SlackConnectionService, SlackSettingsService, SlackMemberMappingService, defaultEnvironmentBackendRegistry, defaultRunnerBackendRegistry, } from '@cat-factory/integrations';
+import { GitHubInstallationService, RepoProvisioningService, GitHubService, GitHubSyncService, WebhookService, DocumentConnectionService, DocumentImportService, DocumentPlannerService, DocumentLinkService, TaskConnectionService, TaskImportService, TaskLinkService, BugIntakeService, EnvironmentConnectionService, EnvironmentProvisioningService, EnvironmentTeardownService, EnvironmentUserHandlerService, RunnerPoolConnectionService, PreflightService, ProvisioningLogRecorder, ProvisioningLogService, SharedStackService, SlackConnectionService, SlackSettingsService, SlackMemberMappingService, } from '@cat-factory/integrations';
 import { BootstrapService } from './modules/bootstrap/BootstrapService.js';
 import { EnvConfigRepairService } from './modules/envConfigRepair/EnvConfigRepairService.js';
 import { EnvironmentTestService } from './modules/environments/EnvironmentTestService.js';
 import { BoardScanService } from './modules/boardScan/BoardScanService.js';
 import { RequirementReviewService } from './modules/requirements/RequirementReviewService.js';
-import { DocInterviewService } from './modules/docInterview/DocInterviewService.js';
-import { ForkChatService } from './modules/execution/ForkChatService.js';
-import { TesterQualityReviewService, } from './modules/execution/TesterQualityReviewService.js';
+import {} from './modules/execution/TesterQualityReviewService.js';
 import { KaizenService } from './modules/kaizen/KaizenService.js';
 import { ClarityReviewService } from './modules/clarity/ClarityReviewService.js';
 import { BrainstormService } from './modules/brainstorm/BrainstormService.js';
@@ -50,1025 +49,8 @@ import { InitiativeInterviewService } from './modules/initiative/InitiativeInter
 import { BLUEPRINT_PIPELINE_ID } from '@cat-factory/kernel';
 import { defaultAgentKindRegistry, defaultInitiativePresetRegistry, FragmentLibraryService, FragmentSourceService, SkillCatalogService, SkillSourceService, SkillRunResolver, } from '@cat-factory/agents';
 import { createFragmentLibraryModule, createSkillLibraryModule, } from './container-content-libraries.js';
-import { defaultGateRegistry, defaultStepResolverRegistry } from '@cat-factory/kernel';
+import { defaultGateRegistry, defaultPipelineRegistry, defaultProviderRegistry, defaultStepResolverRegistry, } from '@cat-factory/kernel';
 /** Assemble the in-org service-sharing module when its repositories are wired. */
-function createServicesModule(deps) {
-    const { serviceRepository, workspaceMountRepository } = deps;
-    if (!serviceRepository || !workspaceMountRepository)
-        return undefined;
-    const service = new ServiceMountService({
-        serviceRepository,
-        workspaceMountRepository,
-        workspaceRepository: deps.workspaceRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-    });
-    return { service };
-}
-/**
- * Assemble the GitHub module when every dependency it needs is present;
- * otherwise return undefined so the feature stays cleanly opt-in.
- */
-function createGitHubModule(deps, caches) {
-    const { githubClient, githubInstallationRepository, repoProjectionRepository, branchProjectionRepository, pullRequestProjectionRepository, issueProjectionRepository, commitProjectionRepository, checkRunProjectionRepository, webhookVerifier, } = deps;
-    if (!githubClient ||
-        !githubInstallationRepository ||
-        !repoProjectionRepository ||
-        !branchProjectionRepository ||
-        !pullRequestProjectionRepository ||
-        !issueProjectionRepository ||
-        !commitProjectionRepository ||
-        !checkRunProjectionRepository ||
-        !webhookVerifier) {
-        return undefined;
-    }
-    const installationService = new GitHubInstallationService({
-        githubClient,
-        githubInstallationRepository,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-        canCreateRepos: deps.canCreateRepos,
-        workflowsGranted: deps.workflowsGranted,
-    });
-    const syncService = new GitHubSyncService({
-        githubClient,
-        githubInstallationRepository,
-        repoProjectionRepository,
-        branchProjectionRepository,
-        pullRequestProjectionRepository,
-        issueProjectionRepository,
-        commitProjectionRepository,
-        checkRunProjectionRepository,
-        userRepoAccessRepository: deps.userRepoAccessRepository,
-        clock: deps.clock,
-        commitBackfillHorizonMs: deps.commitBackfillHorizonMs,
-        // Drop a workspace's cached repo projection (slice 3) after any link/sync write.
-        repoProjectionCache: caches.repoProjection,
-        // Serve the add-service picker's PAT typeahead from a per-user cache (filter in memory)
-        // instead of re-walking `/user/repos` on every keystroke.
-        viewerReposCache: caches.viewerRepos,
-    });
-    const webhookService = new WebhookService({
-        githubInstallationRepository,
-        repoProjectionRepository,
-        branchProjectionRepository,
-        pullRequestProjectionRepository,
-        issueProjectionRepository,
-        commitProjectionRepository,
-        checkRunProjectionRepository,
-        clock: deps.clock,
-        repoProjectionCache: caches.repoProjection,
-        // Drop a pushed branch's cached RepoFiles reads (slice 4) when a branch moves out-of-band.
-        repoFilesCache: caches.repoFiles,
-        // Repo-sourced skill freshness fan-out (slice 4): on a push, resync every skill source
-        // linked to the repo. Both are facade-provided (the queue-backed enqueue only exists where
-        // a runtime has a sync queue); unwired ⇒ the dispatch-time probe is the freshness backstop.
-        skillSourceRepository: deps.skillSourceRepository,
-        enqueueSkillResync: deps.enqueueSkillResync,
-    });
-    const service = new GitHubService({
-        githubClient,
-        repoProjectionRepository,
-        branchProjectionRepository,
-        pullRequestProjectionRepository,
-        issueProjectionRepository,
-        clock: deps.clock,
-    });
-    const provisioningService = deps.repoProvisioningClient
-        ? new RepoProvisioningService({ client: deps.repoProvisioningClient })
-        : undefined;
-    return {
-        installationService,
-        syncService,
-        webhookService,
-        service,
-        webhookVerifier,
-        provisioningService,
-    };
-}
-/**
- * Assemble the document-source module when at least one provider + both
- * repositories are present. The model provider is optional: with it the planner
- * uses an LLM, and without it the deterministic heading parser — so the module
- * stays usable for import/link/spawn even when no LLM is configured.
- */
-function createDocumentsModule(deps, boardService) {
-    const { documentSourceProviders, documentConnectionRepository, documentRepository } = deps;
-    if (!documentSourceProviders ||
-        documentSourceProviders.length === 0 ||
-        !documentConnectionRepository ||
-        !documentRepository) {
-        return undefined;
-    }
-    const registry = new MapDocumentSourceRegistry(documentSourceProviders);
-    const connectionService = new DocumentConnectionService({
-        documentConnectionRepository,
-        registry,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-    });
-    const importService = new DocumentImportService({
-        registry,
-        documentRepository,
-        connectionService,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-    });
-    const plannerService = new DocumentPlannerService({
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        modelRef: deps.documentPlannerModel,
-    });
-    const linkService = new DocumentLinkService({
-        boardService,
-        blockRepository: deps.blockRepository,
-        documentRepository,
-    });
-    const contentResolver = new DocumentContentResolverService({ registry, connectionService });
-    return { connectionService, importService, plannerService, linkService, contentResolver };
-}
-/**
- * Assemble the task-source module when at least one provider + both repositories
- * are present; otherwise return undefined so the feature stays cleanly opt-in.
- * Unlike the documents module there is no planner — issues are linked for
- * context, not expanded into board structure.
- */
-function createTasksModule(deps, boardService) {
-    const { taskSourceProviders, taskConnectionRepository, taskSourceSettingsRepository, taskRepository, } = deps;
-    if (!taskSourceProviders ||
-        taskSourceProviders.length === 0 ||
-        !taskConnectionRepository ||
-        !taskSourceSettingsRepository ||
-        !taskRepository) {
-        return undefined;
-    }
-    const registry = new MapTaskSourceRegistry(taskSourceProviders);
-    const connectionService = new TaskConnectionService({
-        taskConnectionRepository,
-        taskSourceSettingsRepository,
-        registry,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-        // GitHub Issues' availability is the installed GitHub App's presence; absent when
-        // the GitHub integration isn't wired (the provider then isn't registered anyway).
-        ...(deps.githubInstallationRepository
-            ? { installations: deps.githubInstallationRepository }
-            : {}),
-        // Linear OAuth app credentials live in per-account deployment settings (sealed),
-        // resolved dynamically — mirroring the Slack OAuth model. Absent ⇒ the "Connect with
-        // Linear" flow isn't offered (manual API-key paste still works).
-        ...(deps.accountSettings
-            ? {
-                resolveLinearOAuth: (accountKey) => deps.accountSettings.resolve(accountKey).then((s) => s.linearOAuth),
-            }
-            : {}),
-    });
-    const importService = new TaskImportService({
-        registry,
-        taskRepository,
-        connectionService,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-    });
-    const linkService = new TaskLinkService({
-        boardService,
-        blockRepository: deps.blockRepository,
-        taskRepository,
-        importService,
-    });
-    // The recurring bug-intake step's read-and-claim helper — wired only when a schedule
-    // repository is present (an intake fire resolves the schedule's `issueIntake` config by
-    // block). Composes the just-built import/link services + the source registry, so it stays
-    // provider-neutral and runtime-symmetric.
-    const bugIntakeService = deps.pipelineScheduleRepository
-        ? new BugIntakeService({
-            pipelineScheduleRepository: deps.pipelineScheduleRepository,
-            taskSourceRegistry: registry,
-            taskConnectionRepository,
-            importService,
-            linkService,
-            taskRepository,
-        })
-        : undefined;
-    return {
-        connectionService,
-        importService,
-        linkService,
-        ...(bugIntakeService ? { bugIntakeService } : {}),
-    };
-}
-/**
- * Assemble the environment integration when its provider, both repositories and
- * the secret cipher are present; otherwise return undefined so the feature stays
- * cleanly opt-in (the deterministic deployer and env discovery in the engine are
- * gated on the provisioning service being wired).
- */
-function createEnvironmentsModule(deps, provisioningLog, eventPublisher, sharedStackService, preflightService) {
-    const { environmentConnectionRepository, environmentRegistryRepository, secretCipher } = deps;
-    if (!environmentConnectionRepository || !environmentRegistryRepository || !secretCipher) {
-        return undefined;
-    }
-    // Durable async config repair is wired when both the dispatcher (the side-effecting
-    // container plumbing) and the kind-scoped job repository are present. The repair service
-    // and the connection service are mutually dependent: the connection service's
-    // `dispatchConfigRepair` seam STARTS a repair run (→ repairService), and the repair run's
-    // success path RE-VALIDATES via the connection service. We break the cycle by capturing
-    // `repairService` in a closure that is only invoked at request time (after assignment).
-    const canRepair = !!(deps.envConfigRepairer && deps.envConfigRepairJobRepository);
-    let repairService;
-    const connectionService = new EnvironmentConnectionService({
-        environmentConnectionRepository,
-        workspaceRepository: deps.workspaceRepository,
-        secretCipher,
-        clock: deps.clock,
-        environmentBackendRegistry: deps.environmentBackendRegistry ?? defaultEnvironmentBackendRegistry(),
-        ...(deps.customManifestTypeRepository
-            ? { customManifestTypeRepository: deps.customManifestTypeRepository }
-            : {}),
-        ...(deps.customManifestTypeRegistry
-            ? { customManifestTypeRegistry: deps.customManifestTypeRegistry }
-            : {}),
-        ...(deps.environmentCustomTlsSupported !== undefined
-            ? { customTlsSupported: deps.environmentCustomTlsSupported }
-            : {}),
-        ...(deps.environmentProvider ? { environmentProvider: deps.environmentProvider } : {}),
-        ...(deps.environmentUrlSafetyPolicy ? { urlPolicy: deps.environmentUrlSafetyPolicy } : {}),
-        ...(deps.resolveRepoFilesForCoords
-            ? { resolveRepoFilesForWorkspace: deps.resolveRepoFilesForCoords }
-            : {}),
-        ...(deps.detectionConventions ? { detectionConventions: deps.detectionConventions } : {}),
-        ...(canRepair
-            ? {
-                dispatchConfigRepair: (input) => repairService
-                    .start(input.workspaceId, {
-                    owner: input.owner,
-                    repo: input.repo,
-                    gitRef: input.gitRef,
-                    issues: input.issues,
-                    ...(input.inputs ? { inputs: input.inputs } : {}),
-                    ...(input.promptOverride ? { promptOverride: input.promptOverride } : {}),
-                    ...(input.manifestPath ? { manifestPath: input.manifestPath } : {}),
-                })
-                    .then((job) => ({ jobId: job.id })),
-            }
-            : {}),
-        ...(provisioningLog ? { provisioningLog } : {}),
-    });
-    if (canRepair) {
-        repairService = new EnvConfigRepairService({
-            envConfigRepairJobRepository: deps.envConfigRepairJobRepository,
-            workspaceRepository: deps.workspaceRepository,
-            idGenerator: deps.idGenerator,
-            clock: deps.clock,
-            repairer: deps.envConfigRepairer,
-            ...(deps.envConfigRepairRunner ? { runner: deps.envConfigRepairRunner } : {}),
-            ...(eventPublisher ? { eventPublisher } : {}),
-            revalidate: (input) => connectionService.revalidate(input),
-        });
-    }
-    // The per-USER override store is wired ONLY when its repository is present — which, by
-    // design, ONLY the local facade does (so per-user overrides + the per-user controller are
-    // local-mode-only, with no runtime branch in shared code). Its `resolveOverrides` is the
-    // `resolveUserHandlerOverrides` seam the provisioning service layers over the workspace
-    // handlers for the run initiator.
-    const userHandlerService = deps.environmentUserHandlerRepository
-        ? new EnvironmentUserHandlerService({
-            userHandlerRepository: deps.environmentUserHandlerRepository,
-            environmentBackendRegistry: deps.environmentBackendRegistry ?? defaultEnvironmentBackendRegistry(),
-            secretCipher,
-            clock: deps.clock,
-            ...(deps.environmentCustomTlsSupported !== undefined
-                ? { customTlsSupported: deps.environmentCustomTlsSupported }
-                : {}),
-            ...(deps.environmentUrlSafetyPolicy ? { urlPolicy: deps.environmentUrlSafetyPolicy } : {}),
-            ...(deps.logger ? { logger: deps.logger } : {}),
-        })
-        : undefined;
-    // Built BEFORE the provisioning service so it can be injected as `environmentTeardown` there:
-    // a deployer re-run that supersedes a prior env with a DIFFERENT provider identity tears the old
-    // infra down through this service (best-effort; the TTL reaper is the backstop).
-    const teardownService = new EnvironmentTeardownService({
-        connectionService,
-        environmentRegistryRepository,
-        secretCipher,
-        clock: deps.clock,
-        ...(provisioningLog ? { provisioningLog } : {}),
-    });
-    const provisioningService = new EnvironmentProvisioningService({
-        connectionService,
-        environmentRegistryRepository,
-        secretCipher,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        environmentTeardown: teardownService,
-        ...(deps.environmentUrlSafetyPolicy ? { urlPolicy: deps.environmentUrlSafetyPolicy } : {}),
-        ...(deps.resolveRunRepoContext ? { resolveRunRepoContext: deps.resolveRunRepoContext } : {}),
-        ...(deps.resolveRepoFilesForCoords
-            ? { resolveRepoFilesForWorkspace: deps.resolveRepoFilesForCoords }
-            : {}),
-        ...(userHandlerService
-            ? {
-                resolveUserHandlerOverrides: (userId, ws) => userHandlerService.resolveOverrides(userId, ws),
-            }
-            : {}),
-        // The async, container-backed deploy lifecycle (kustomize/helm) is wired when the facade
-        // supplies the runner transport + the clone-target resolver; absent ⇒ only the synchronous
-        // raw-manifest REST path runs (a render-needing config fails loudly).
-        ...(deps.deployJobClient ? { deployJobClient: deps.deployJobClient } : {}),
-        ...(deps.resolveDeployCloneTarget
-            ? { resolveDeployCloneTarget: deps.resolveDeployCloneTarget }
-            : {}),
-        // A compose stack recipe's `sharedStackRefs` are brought up (provider-before-consumer) through
-        // the shared-stack service, whose managed networks the compose provider attaches the per-PR
-        // project to. Wired only when the shared-stacks module exists (its repository is present on
-        // every facade); the lifecycle itself refuses without a host daemon.
-        ...(sharedStackService
-            ? { ensureSharedStacks: (ws, refs) => sharedStackService.ensureRefsUp(ws, refs) }
-            : {}),
-        // A compose stack recipe's `prerequisites` are re-run at provision start through the preflight
-        // service, whose host probes exist only on the local facade; absent ⇒ a recipe that declares
-        // them fails loudly instead of silently skipping a machine-prerequisite gate.
-        ...(preflightService ? { runPreflights: (_ws, refs) => preflightService.run(refs) } : {}),
-        ...(provisioningLog ? { provisioningLog } : {}),
-    });
-    // The ephemeral-environment self-test: needs its own run store + a git provider (to
-    // create/delete the throwaway branch). Absent either ⇒ no self-test (the controller 503s).
-    const environmentTest = deps.environmentTestRunRepository && deps.resolveRunRepoContext
-        ? new EnvironmentTestService({
-            environmentTestRunRepository: deps.environmentTestRunRepository,
-            workspaceRepository: deps.workspaceRepository,
-            blockRepository: deps.blockRepository,
-            provisioning: provisioningService,
-            teardown: teardownService,
-            environmentRegistry: environmentRegistryRepository,
-            resolveRunRepoContext: deps.resolveRunRepoContext,
-            idGenerator: deps.idGenerator,
-            clock: deps.clock,
-            ...(deps.environmentTestRunner ? { runner: deps.environmentTestRunner } : {}),
-            ...(eventPublisher ? { eventPublisher } : {}),
-        })
-        : undefined;
-    return {
-        connectionService,
-        provisioningService,
-        teardownService,
-        ...(userHandlerService ? { userHandlerService } : {}),
-        ...(repairService ? { envConfigRepair: { service: repairService } } : {}),
-        ...(environmentTest ? { environmentTest } : {}),
-    };
-}
-/**
- * Assemble the self-hosted runner-pool module when its connection repository and
- * the secret cipher are present; otherwise return undefined so the feature stays
- * cleanly opt-in. Per-tenant scheduler-API secrets are encrypted via the cipher.
- */
-function createRunnersModule(deps) {
-    const { runnerPoolConnectionRepository, runnerSecretCipher } = deps;
-    if (!runnerPoolConnectionRepository || !runnerSecretCipher)
-        return undefined;
-    const connectionService = new RunnerPoolConnectionService({
-        runnerPoolConnectionRepository,
-        workspaceRepository: deps.workspaceRepository,
-        secretCipher: runnerSecretCipher,
-        clock: deps.clock,
-        runnerBackendRegistry: deps.runnerBackendRegistry ?? defaultRunnerBackendRegistry(),
-        ...(deps.runnerPoolProvider ? { runnerPoolProvider: deps.runnerPoolProvider } : {}),
-        ...(deps.runnerUrlSafetyPolicy ? { urlPolicy: deps.runnerUrlSafetyPolicy } : {}),
-        ...(deps.runnerCustomTlsSupported !== undefined
-            ? { customTlsSupported: deps.runnerCustomTlsSupported }
-            : {}),
-    });
-    return { connectionService };
-}
-/**
- * Assemble the repo-bootstrap module when both its repositories are present (the
- * worker wires them unconditionally). The `repoBootstrapper` is passed through
- * but optional: the service exposes CRUD regardless and only gates the run path
- * on its presence.
- */
-function createBootstrapModule(deps, eventPublisher, onBootstrapSucceeded) {
-    const { referenceArchitectureRepository, bootstrapJobRepository } = deps;
-    if (!referenceArchitectureRepository || !bootstrapJobRepository)
-        return undefined;
-    const service = new BootstrapService({
-        referenceArchitectureRepository,
-        bootstrapJobRepository,
-        workspaceRepository: deps.workspaceRepository,
-        blockRepository: deps.blockRepository,
-        serviceRepository: deps.serviceRepository,
-        workspaceMountRepository: deps.workspaceMountRepository,
-        serviceFragmentDefaultsRepository: deps.serviceFragmentDefaultsRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        repoBootstrapper: deps.repoBootstrapper,
-        bootstrapRunner: deps.bootstrapRunner,
-        eventPublisher,
-        ...(onBootstrapSucceeded ? { onBootstrapSucceeded } : {}),
-    });
-    return { service };
-}
-/**
- * Assemble the requirements-review module when its repository is present (the
- * worker wires it unconditionally). The model provider/ref are optional within
- * the module — reads work without them and the run paths surface a clear error —
- * and the document/task repositories are reused, when wired, to fold linked PRDs
- * and tracker issues into the reviewed requirements.
- */
-/**
- * Build the inline reviewer for the test quality-control companion. It resolves its model
- * exactly like the requirements reviewer (block pin → workspace per-kind default → routing
- * default). Returns `undefined` when no model provider is configured, so the Tester gate's QC
- * step is a pass-through in unconfigured facades / tests.
- */
-function createTesterQualityReviewer(deps) {
-    if (!deps.modelProviderResolver && !deps.modelProvider)
-        return undefined;
-    return new TesterQualityReviewService({
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        resolveWorkspaceModelDefault: deps.modelPresetRepository
-            ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-            : undefined,
-        resolveRunContext: resolveBlockRunContext(deps),
-    });
-}
-/**
- * Build the interactive document-interview service (WS5). Self-contained (owns its session
- * store + the inline LLM); resolves its model exactly like the requirements reviewer (block
- * pin → workspace per-kind default → routing default). Returns `undefined` when no session
- * store is wired, so the `doc-interviewer` step passes through in unconfigured facades / tests.
- * The LLM is optional within the service (the `enabled` getter is false without a model), so a
- * store-but-no-model deployment still short-circuits the interviewer.
- */
-function createDocInterviewService(deps) {
-    const { docInterviewRepository } = deps;
-    if (!docInterviewRepository)
-        return undefined;
-    return new DocInterviewService({
-        docInterviewRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        resolveWorkspaceModelDefault: deps.modelPresetRepository
-            ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-            : undefined,
-        resolveRunContext: resolveBlockRunContext(deps),
-    });
-}
-/**
- * Build the inline grounded-chat responder for the implementation-fork decision phase. Resolves
- * its model exactly like the requirements reviewer / doc interviewer (block pin → workspace
- * per-kind default → routing default). Returns `undefined` when no model provider is configured,
- * so the fork chat degrades to a canned "chat unavailable" reply in unconfigured facades / tests
- * while pick / custom keep working. Stateless — the chat rides the coder step, no session store.
- */
-function createForkChatService(deps) {
-    if (!deps.modelProviderResolver && !deps.modelProvider)
-        return undefined;
-    return new ForkChatService({
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        resolveWorkspaceModelDefault: deps.modelPresetRepository
-            ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-            : undefined,
-        resolveRunContext: resolveBlockRunContext(deps),
-    });
-}
-/**
- * Resolve a block's active run (execution id + initiator) for the iterative reviewers, so an
- * inline subscription reviewer served through a leased per-run activation can lease it. Reads
- * the block's `executionId` and the run's `initiatedBy`; `{}` when the block has no active run
- * (an off-path inspector review with no pipeline) — the reviewer then resolves on a
- * workspace-only scope (pooled lease), unchanged.
- */
-function resolveBlockRunContext(deps) {
-    return async (workspaceId, block) => {
-        if (!block.executionId)
-            return {};
-        const instance = await deps.executionRepository.get(workspaceId, block.executionId);
-        return {
-            executionId: block.executionId,
-            ...(instance?.initiatedBy ? { userId: instance.initiatedBy } : {}),
-        };
-    };
-}
-function createRequirementsModule(deps, notificationService, fragmentLibrary) {
-    const { requirementReviewRepository } = deps;
-    if (!requirementReviewRepository)
-        return undefined;
-    const service = new RequirementReviewService({
-        requirementReviewRepository,
-        blockRepository: deps.blockRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        // Tell product people + the task creator to react to a review's findings (when
-        // the notifications subsystem is wired). Best-effort; absent → no notification.
-        notificationService,
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        // The dedicated reviewer ref, else the document planner's (both the agents' default).
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        // Honour a block's pinned model with the direct/Cloudflare fallback, like the executor.
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        // In local mode, run the reviewer inline through the ambient Claude Code / Codex CLI on a
-        // subscription model instead of degrading to the routing default.
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        // Honour the workspace's model presets for the `requirements` kind too, so the
-        // reviewer resolves its model exactly like a pipeline step. Reuses the already
-        // wired model-preset repository (the workspace default preset); absent → only
-        // block-pin + routing default.
-        resolveWorkspaceModelDefault: deps.modelPresetRepository
-            ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-            : undefined,
-        // The reviewer runs during a parked run, so its execution + initiator come from the
-        // block's active run — threaded into the model scope so an inline subscription ref served
-        // through a leased per-run activation (local container inline backend) can lease it.
-        resolveRunContext: resolveBlockRunContext(deps),
-        documentRepository: deps.documentRepository,
-        taskRepository: deps.taskRepository,
-        // The Requirement Writer (second companion) grounds recommendations on the run's repo
-        // (`spec/` + `tech-spec/` via the checkout-free RepoFiles) — wired in all three facades.
-        resolveRunRepoContext: deps.resolveRunRepoContext,
-        // …and on the block's best-practice fragments (team/org standards), checked FIRST. Walk
-        // the owning frame's service standards then union the block's own pins (same precedence
-        // as the agent context builder), resolved against the merged tenant catalog when the
-        // fragment library is wired (so managed + document-backed fragments ground the review
-        // exactly like they reach a code-aware run), else the static universal pool.
-        resolveBlockFragments: async (workspaceId, blockId) => {
-            const block = await deps.blockRepository.get(workspaceId, blockId);
-            if (!block)
-                return [];
-            const ids = [];
-            const seen = new Set();
-            const add = (id) => {
-                if (!seen.has(id)) {
-                    seen.add(id);
-                    ids.push(id);
-                }
-            };
-            let current = block;
-            for (let i = 0; current && i < 8; i++) {
-                if (current.level === 'frame' || !current.parentId) {
-                    for (const id of current.serviceFragmentIds ?? [])
-                        add(id);
-                    break;
-                }
-                current = await deps.blockRepository.get(workspaceId, current.parentId);
-            }
-            for (const id of block.fragmentIds ?? [])
-                add(id);
-            if (fragmentLibrary) {
-                // Resolve the merged tenant catalog ONCE and reuse it for both the titles map and
-                // the body resolution (which would otherwise re-resolve the same catalog).
-                const catalog = await fragmentLibrary.libraryService.resolveCatalog(workspaceId);
-                const titles = new Map(catalog.map((e) => [e.id, e.title]));
-                const bodies = await fragmentLibrary.libraryService.resolveBodiesForRun(workspaceId, ids, catalog);
-                return bodies.map(({ id, body }) => ({ id, title: titles.get(id) ?? id, body }));
-            }
-            const out = [];
-            for (const id of ids) {
-                const fragment = getFragment(id);
-                if (fragment)
-                    out.push({ id, title: fragment.title, body: fragment.body });
-            }
-            return out;
-        },
-        // `webSearch` (gateway-RAG) is wired by the web-search-connection workstream; until then
-        // the Writer still gets provider-hosted web search on Anthropic/OpenAI models.
-        // When an upstream `requirements-brainstorm` dialogue settled a converged direction, the
-        // reviewer critiques THAT (the refined requirements) instead of the raw description.
-        resolveBrainstormDirection: deps.brainstormSessionRepository
-            ? async (workspaceId, blockId) => {
-                const session = await deps.brainstormSessionRepository.getByBlockStage(workspaceId, blockId, 'requirements');
-                return session?.status === 'incorporated' && session.convergedDirection
-                    ? session.convergedDirection
-                    : undefined;
-            }
-            : undefined,
-    });
-    return { service };
-}
-/**
- * Assemble the brainstorm (structured-dialogue) module when its repository is present (both
- * runtime facades wire it unconditionally). Mirrors {@link createClarityModule}: it builds ONE
- * {@link BrainstormService} per stage (sharing the repository) and reuses the requirements
- * reviewer's model config since all the inline reviewers resolve their model identically. The
- * architecture stage seeds from the refined requirements (a requirements review's incorporated
- * doc, else the requirements-brainstorm's converged direction).
- */
-function createBrainstormModule(deps, notificationService) {
-    const { brainstormSessionRepository } = deps;
-    if (!brainstormSessionRepository)
-        return undefined;
-    const resolveWorkspaceModelDefault = deps.modelPresetRepository
-        ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-        : undefined;
-    // The architecture stage's seed: the most refined requirements available — a settled
-    // requirements review's incorporated doc, else the requirements-brainstorm's direction.
-    const resolveRefinedRequirements = async (workspaceId, blockId) => {
-        const review = await deps.requirementReviewRepository?.getByBlock(workspaceId, blockId);
-        if (review?.status === 'incorporated' && review.incorporatedRequirements) {
-            return review.incorporatedRequirements;
-        }
-        const session = await brainstormSessionRepository.getByBlockStage(workspaceId, blockId, 'requirements');
-        return session?.status === 'incorporated' && session.convergedDirection
-            ? session.convergedDirection
-            : undefined;
-    };
-    const common = {
-        brainstormSessionRepository,
-        blockRepository: deps.blockRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        notificationService,
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        // Brainstorm stages are pipeline gate steps that run during a parked run, so their
-        // execution + initiator come from the block's active run — threaded into the model scope
-        // so an inline subscription ref served through a leased per-run activation (local container
-        // inline backend) can lease it, exactly like the requirements/clarity reviewers.
-        resolveRunContext: resolveBlockRunContext(deps),
-        resolveWorkspaceModelDefault,
-    };
-    return {
-        services: {
-            requirements: new BrainstormService({ ...common, stage: 'requirements' }),
-            architecture: new BrainstormService({
-                ...common,
-                stage: 'architecture',
-                resolveRefinedRequirements,
-            }),
-        },
-    };
-}
-/**
- * Assemble the Kaizen module when its repositories are wired (both runtime facades wire them
- * unconditionally). The grader resolves its model for the `kaizen` kind the same way the
- * requirements reviewer does — block pin > workspace per-kind default > routing default —
- * so operators configure it in Model Configuration alongside every other agent. Needs the
- * telemetry repos (LLM-call metrics + agent-context snapshots) to read what each step was
- * given; absent → the module isn't built and no grading is scheduled.
- */
-function createKaizenModule(deps) {
-    const { kaizenGradingRepository, kaizenVerifiedComboRepository } = deps;
-    if (!kaizenGradingRepository || !kaizenVerifiedComboRepository)
-        return undefined;
-    if (!deps.llmCallMetricRepository || !deps.agentContextObservability)
-        return undefined;
-    const service = new KaizenService({
-        kaizenGradingRepository,
-        kaizenVerifiedComboRepository,
-        blockRepository: deps.blockRepository,
-        llmCallMetricRepository: deps.llmCallMetricRepository,
-        agentContextObservability: deps.agentContextObservability,
-        workspaceSettingsRepository: deps.workspaceSettingsRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        events: deps.executionEventPublisher,
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        // Reuse the reviewer's routing default ref + block-model resolver (the agents' default).
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        // Resolve the workspace's per-kind default for `kaizen`, like a pipeline step.
-        resolveWorkspaceModelDefault: deps.modelPresetRepository
-            ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-            : undefined,
-    });
-    return { service };
-}
-/**
- * Assemble the clarity-review module when its repository is present (both runtime facades
- * wire it unconditionally). Mirrors {@link createRequirementsModule}: it reuses the
- * requirements reviewer's model config (the same routing default) since both reviewers
- * resolve their model identically.
- */
-function createClarityModule(deps, notificationService) {
-    const { clarityReviewRepository } = deps;
-    if (!clarityReviewRepository)
-        return undefined;
-    const service = new ClarityReviewService({
-        clarityReviewRepository,
-        blockRepository: deps.blockRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        notificationService,
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        modelRef: deps.requirementReviewModel ?? deps.documentPlannerModel,
-        resolveBlockModel: deps.requirementReviewResolveModel,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-        resolveWorkspaceModelDefault: deps.modelPresetRepository
-            ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(deps.modelPresetRepository, workspaceId, agentKind, modelPresetId)
-            : undefined,
-        resolveRunContext: resolveBlockRunContext(deps),
-    });
-    return { service };
-}
-/**
- * Assemble the notifications module when its repository is present (the worker
- * wires it unconditionally). The delivery channel is optional within the module —
- * without it the rows still persist (the inbox + snapshot work) but nothing is
- * pushed; the worker wires the in-app channel, and email/Slack compose in later.
- */
-function createNotificationsModule(deps) {
-    const { notificationRepository } = deps;
-    if (!notificationRepository)
-        return undefined;
-    const service = new NotificationService({
-        notificationRepository,
-        workspaceRepository: deps.workspaceRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        channel: deps.notificationChannel,
-    });
-    return { service };
-}
-/**
- * Assemble the Slack integration module when its three repositories and the
- * secret cipher are present. Powers the management API (connect/settings/member
- * map); the actual Slack delivery is a `notificationChannel` composed in by the
- * facade. OAuth is optional — manual-token onboarding works without it.
- */
-function createSlackModule(deps) {
-    const { slackConnectionRepository, slackSettingsRepository, slackMemberMappingRepository, slackSecretCipher, } = deps;
-    if (!slackConnectionRepository ||
-        !slackSettingsRepository ||
-        !slackMemberMappingRepository ||
-        !slackSecretCipher) {
-        return undefined;
-    }
-    return {
-        connectionService: new SlackConnectionService({
-            slackConnectionRepository,
-            workspaceRepository: deps.workspaceRepository,
-            secretCipher: slackSecretCipher,
-            clock: deps.clock,
-            resolveOAuth: deps.accountSettings
-                ? (accountKey) => deps.accountSettings.resolve(accountKey).then((s) => s.slackOAuth)
-                : undefined,
-        }),
-        settingsService: new SlackSettingsService({
-            slackSettingsRepository,
-            workspaceRepository: deps.workspaceRepository,
-            clock: deps.clock,
-        }),
-        memberMappingService: new SlackMemberMappingService({
-            slackMemberMappingRepository,
-            workspaceRepository: deps.workspaceRepository,
-            clock: deps.clock,
-        }),
-    };
-}
-/** Assemble the merge-preset module when its repository is present. */
-function createRiskPoliciesModule(deps, caches) {
-    const { riskPolicyRepository } = deps;
-    if (!riskPolicyRepository)
-        return undefined;
-    const service = new RiskPolicyService({
-        riskPolicyRepository,
-        workspaceRepository: deps.workspaceRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        // Invalidate the read-through slice the engine's `resolveRiskPolicy` uses on every write.
-        riskPolicyCache: caches.riskPolicy,
-    });
-    return { service };
-}
-/**
- * Assemble the shared-stacks module when its repository is present. The `composeRuntime` is
- * optional — wired only on the local facade, so CRUD works everywhere but the lifecycle
- * (ensureUp/teardown) refuses without a host daemon (the documented compose runtime-binding
- * exception). Persistence is fully runtime-symmetric.
- */
-function createSharedStacksModule(deps, preflightService) {
-    const { sharedStackRepository } = deps;
-    if (!sharedStackRepository)
-        return undefined;
-    const service = new SharedStackService({
-        sharedStackRepository,
-        workspaceRepository: deps.workspaceRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        ...(deps.composeRuntime ? { composeRuntime: deps.composeRuntime } : {}),
-        ...(deps.sharedStackCloneToken ? { cloneToken: deps.sharedStackCloneToken } : {}),
-        // Enables the checkout-free repo autodetection (`detect`); wired from the same coords-bound
-        // RepoFiles resolver the environment detector uses, so both facades get it for free.
-        ...(deps.resolveRepoFilesForCoords
-            ? { resolveRepoFilesForWorkspace: deps.resolveRepoFilesForCoords }
-            : {}),
-        // Same deployment-level detection-convention extensions the environment detector honours, so
-        // shared-stack `detect` recognises the org's house compose layout too.
-        ...(deps.detectionConventions ? { detectionConventions: deps.detectionConventions } : {}),
-        // Re-run a stack's declared machine-prerequisite checks at bring-up start. Present only where
-        // the host-probe seam is wired (the local facade — same runtime binding as `composeRuntime`).
-        ...(preflightService ? { runPreflights: (refs) => preflightService.run(refs) } : {}),
-    });
-    return { service };
-}
-/**
- * Assemble the preflight module when the host-probe seam is present — wired ONLY on the local
- * facade (a host Docker daemon), the documented compose runtime-binding exception. Absent elsewhere
- * ⇒ the preflight API 503s and a stack recipe that declares `prerequisites` fails loudly at
- * provision (rather than silently skipping a declared machine-prerequisite gate).
- */
-function createPreflightModule(deps) {
-    if (!deps.preflightHostProbes)
-        return undefined;
-    return { service: new PreflightService({ hostProbes: deps.preflightHostProbes }) };
-}
-/**
- * Assemble the Sandbox module when its five repositories are present (both runtime
- * facades wire them together). Reuses the requirements reviewer's inline model config —
- * the per-scope provider resolver, the routing default ref, and the block-model resolver
- * — so a Sandbox cell (and the judge) resolves its catalog id exactly like a pipeline step.
- */
-function createSandboxModule(deps, agentKindRegistry) {
-    const { sandboxPromptVersionRepository, sandboxFixtureRepository, sandboxExperimentRepository, sandboxRunRepository, sandboxGradeRepository, } = deps;
-    if (!sandboxPromptVersionRepository ||
-        !sandboxFixtureRepository ||
-        !sandboxExperimentRepository ||
-        !sandboxRunRepository ||
-        !sandboxGradeRepository) {
-        return undefined;
-    }
-    const repositories = {
-        sandboxPromptVersionRepository,
-        sandboxFixtureRepository,
-        sandboxExperimentRepository,
-        sandboxRunRepository,
-        sandboxGradeRepository,
-        workspaceRepository: deps.workspaceRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        agentKindRegistry,
-    };
-    const defaultModelRef = deps.requirementReviewModel ?? deps.documentPlannerModel;
-    const service = new SandboxService({ ...repositories, defaultModelRef });
-    const runService = new SandboxRunService({
-        ...repositories,
-        modelProviderResolver: deps.modelProviderResolver,
-        modelProvider: deps.modelProvider,
-        resolveModelId: deps.requirementReviewResolveModel,
-        defaultModelRef,
-        ...(deps.inlineHarnessRef ? { runsInline: deps.inlineHarnessRef } : {}),
-    });
-    return { service, runService };
-}
-/** Assemble the workspace-settings module when its repository is present. */
-function createWorkspaceSettingsModule(deps, workspaceSettingsCache) {
-    const { workspaceSettingsRepository } = deps;
-    if (!workspaceSettingsRepository)
-        return undefined;
-    const service = new WorkspaceSettingsService({
-        workspaceSettingsRepository,
-        workspaceRepository: deps.workspaceRepository,
-        workspaceSettingsCache,
-    });
-    return { service };
-}
-/** Assemble the release-health (observability) module when its repos + cipher are present. */
-function createReleaseHealthModule(deps) {
-    const { observabilityConnectionRepository, releaseHealthConfigRepository, observabilitySecretCipher, } = deps;
-    if (!observabilityConnectionRepository ||
-        !releaseHealthConfigRepository ||
-        !observabilitySecretCipher) {
-        return undefined;
-    }
-    const service = new ReleaseHealthService({
-        observabilityConnectionRepository,
-        releaseHealthConfigRepository,
-        observabilitySecretCipher,
-        workspaceRepository: deps.workspaceRepository,
-        blockRepository: deps.blockRepository,
-        clock: deps.clock,
-    });
-    return { service };
-}
-/** Assemble the package-registries module when its repo + cipher are present. */
-function createPackageRegistriesModule(deps) {
-    const { packageRegistryConnectionRepository, packageRegistrySecretCipher } = deps;
-    if (!packageRegistryConnectionRepository || !packageRegistrySecretCipher) {
-        return undefined;
-    }
-    const service = new PackageRegistryService({
-        packageRegistryConnectionRepository,
-        packageRegistrySecretCipher,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-        idGenerator: deps.idGenerator,
-    });
-    return { service };
-}
-/**
- * Assemble the browsable-frontend-preview module when its per-runtime transport + the facade's
- * job builder + the env registry are all wired (local/node with a host-port-publish runtime).
- * Absent on the Worker (no preview transport) ⇒ the controller 503s there.
- */
-function createPreviewModule(deps) {
-    const { previewTransport, buildPreviewJob, environmentRegistryRepository } = deps;
-    if (!previewTransport || !buildPreviewJob || !environmentRegistryRepository)
-        return undefined;
-    const service = new PreviewService({
-        previewTransport,
-        buildPreviewJob,
-        environmentRegistryRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-    });
-    return { service };
-}
-/** Assemble the incident-enrichment settings module when its repo + cipher are present. */
-function createIncidentEnrichmentModule(deps) {
-    const { incidentEnrichmentConnectionRepository, incidentEnrichmentSecretCipher } = deps;
-    if (!incidentEnrichmentConnectionRepository || !incidentEnrichmentSecretCipher)
-        return undefined;
-    const service = new IncidentEnrichmentService({
-        incidentEnrichmentConnectionRepository,
-        incidentEnrichmentSecretCipher,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-    });
-    return { service };
-}
-/** Assemble the model-presets module when its repository is present. */
-function createModelPresetsModule(deps) {
-    const { modelPresetRepository } = deps;
-    if (!modelPresetRepository)
-        return undefined;
-    const service = new ModelPresetService({
-        modelPresetRepository,
-        workspaceRepository: deps.workspaceRepository,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        ...(deps.defaultModelPresetId ? { defaultPresetId: deps.defaultModelPresetId } : {}),
-    });
-    return { service };
-}
-/** Assemble the service-fragment-defaults module when its repository is present. */
-function createServiceFragmentDefaultsModule(deps) {
-    const { serviceFragmentDefaultsRepository } = deps;
-    if (!serviceFragmentDefaultsRepository)
-        return undefined;
-    const service = new ServiceFragmentDefaultsService({
-        serviceFragmentDefaultsRepository,
-        workspaceRepository: deps.workspaceRepository,
-    });
-    return { service };
-}
-/** Assemble the tracker-settings module when its repository is present. */
-function createTrackerModule(deps) {
-    const { trackerSettingsRepository } = deps;
-    if (!trackerSettingsRepository)
-        return undefined;
-    const service = new TrackerSettingsService({
-        trackerSettingsRepository,
-        workspaceRepository: deps.workspaceRepository,
-        clock: deps.clock,
-    });
-    return { service };
-}
-/**
- * Assemble the recurring-pipeline module when its repository is present. Built
- * after the execution engine since each fire starts a pipeline through it.
- */
-function createRecurringModule(deps, executionService, executionEventPublisher, taskConnectionService) {
-    const { pipelineScheduleRepository } = deps;
-    if (!pipelineScheduleRepository)
-        return undefined;
-    const service = new RecurringPipelineService({
-        pipelineScheduleRepository,
-        workspaceRepository: deps.workspaceRepository,
-        pipelineRepository: deps.pipelineRepository,
-        blockRepository: deps.blockRepository,
-        executionRepository: deps.executionRepository,
-        executionService,
-        idGenerator: deps.idGenerator,
-        clock: deps.clock,
-        serviceRepository: deps.serviceRepository,
-        workspaceMountRepository: deps.workspaceMountRepository,
-        // Validates a `bug-intake` pipeline's schedule carries an `issueIntake` config whose source
-        // is a connected task source. Absent (no task sources wired) → the presence check still runs.
-        taskConnectionService,
-        // Pushes a `block-added` board event when the reused block is created, so it appears live.
-        executionEventPublisher,
-    });
-    return { service };
-}
 export function createCore(dependencies) {
     // Resolve the app-owned agent-kind registry ONCE: the facade's injected instance (so a
     // deployment's custom kinds are visible) else a fresh built-ins-only registry. The SAME
@@ -1079,6 +61,13 @@ export function createCore(dependencies) {
     // visible), else fresh empty registries so gate steps pass through in bare test builds.
     const gateRegistry = dependencies.gateRegistry ?? defaultGateRegistry();
     const stepResolverRegistry = dependencies.stepResolverRegistry ?? defaultStepResolverRegistry();
+    // The app-owned provider registry the gate machine reads through its GateContext. Resolved ONCE
+    // and threaded into the execution service alongside the gate registry (same instance the facade
+    // wired its gate providers on).
+    const providerRegistry = dependencies.providerRegistry ?? defaultProviderRegistry();
+    // The app-owned pipeline registry (deployment-registered extra pipelines). Resolved ONCE and
+    // threaded into the workspace + pipeline services so seeding + reseed see the same extras.
+    const pipelineRegistry = dependencies.pipelineRegistry ?? defaultPipelineRegistry();
     // Resolve the app-owned initiative-preset registry ONCE (same reasoning as the agent-kind one):
     // the facade's injected instance, else a fresh registry preloaded with the built-in presets.
     const initiativePresetRegistry = dependencies.initiativePresetRegistry ?? defaultInitiativePresetRegistry();
@@ -1090,6 +79,15 @@ export function createCore(dependencies) {
     // write-site invalidation — is exercised everywhere. Built here (before the services that
     // invalidate through it) so it can be threaded into all of them.
     const caches = dependencies.caches ?? createAppCaches();
+    // The optional-module registry: every feature that is wired only when its prerequisites are
+    // configured is `build`-declared through this, instead of a scattered `const x = createX(...)`
+    // + a matching `...(x ? { x } : {})` return spread. Registration order below IS dependency
+    // order: `build` returns the value, so a module consumed downstream is kept in a local and
+    // threaded into the later factories that need it (`modules.get(...)` is there for a reader that
+    // holds no local). The whole set is emitted in one place via `...modules.assemble()` at the
+    // return. The core spine (below) stays explicit —
+    // it carries the genuine circular late-bindings (account ⇄ spend, engine ⇄ initiative loop).
+    const modules = new ModuleRegistry();
     // Pass the resolved publisher so board mutations push a coarse `boardChanged` to every
     // user on the workspace (and every board mounting a shared service) — both facades route
     // here, so the wiring is symmetric by construction. The repo-projection cache lets
@@ -1101,13 +99,17 @@ export function createCore(dependencies) {
     });
     const workspaceService = new WorkspaceService({
         ...dependencies,
+        // The resolved (defaulted) pipeline registry, so a new workspace is seeded with the built-in
+        // catalog + any deployment-registered pipelines (the raw `dependencies.pipelineRegistry` may be
+        // undefined; this is the same instance the pipeline service reseeds from).
+        pipelineRegistry,
         // A board delete drops its cached access decisions (workspace-rbac).
         workspaceAccessCache: caches.workspaceAccess,
     });
     // Workspace-RBAC roster + access-mode management (workspace-rbac, slice 5). Present only when
     // the member repository is wired (both facades wire it; tests/no-roster leave it absent, so the
     // members controller 503s). Every roster/access-mode write drops the board's access cache group.
-    const workspaceMemberService = dependencies.workspaceMemberRepository
+    modules.build('workspaceMemberService', () => dependencies.workspaceMemberRepository
         ? new WorkspaceMemberService({
             workspaceMemberRepository: dependencies.workspaceMemberRepository,
             workspaceRepository: dependencies.workspaceRepository,
@@ -1116,7 +118,7 @@ export function createCore(dependencies) {
             clock: dependencies.clock,
             workspaceAccessCache: caches.workspaceAccess,
         })
-        : undefined;
+        : undefined);
     // Late-bound so the account service can invalidate the spend service's cached
     // account-budget limit on an account-budget edit (spendService is built below).
     let spendServiceRef;
@@ -1140,14 +142,14 @@ export function createCore(dependencies) {
         idGenerator: dependencies.idGenerator,
         clock: dependencies.clock,
     });
-    const email = dependencies.emailConnectionRepository && dependencies.emailSecretCipher
+    const email = modules.build('email', () => dependencies.emailConnectionRepository && dependencies.emailSecretCipher
         ? new EmailConnectionService({
             emailConnectionRepository: dependencies.emailConnectionRepository,
             secretCipher: dependencies.emailSecretCipher,
             clock: dependencies.clock,
         })
-        : undefined;
-    const invitations = dependencies.invitationRepository
+        : undefined);
+    modules.build('invitations', () => dependencies.invitationRepository
         ? new InvitationService({
             invitationRepository: dependencies.invitationRepository,
             accountRepository: dependencies.accountRepository,
@@ -1160,8 +162,8 @@ export function createCore(dependencies) {
             // Accepting an invitation grants membership ⇒ drop the workspace-access cache (workspace-rbac).
             onAccountMembershipChanged: () => caches.workspaceAccess.invalidateAll(),
         })
-        : undefined;
-    const passwordReset = dependencies.passwordResetTokenRepository
+        : undefined);
+    modules.build('passwordReset', () => dependencies.passwordResetTokenRepository
         ? new PasswordResetService({
             passwordResetTokenRepository: dependencies.passwordResetTokenRepository,
             userRepository: dependencies.userRepository,
@@ -1172,8 +174,8 @@ export function createCore(dependencies) {
             appBaseUrl: dependencies.appBaseUrl,
             logger: dependencies.logger,
         })
-        : undefined;
-    const pipelineService = new PipelineService(dependencies);
+        : undefined);
+    const pipelineService = new PipelineService({ ...dependencies, pipelineRegistry });
     const spendService = new SpendService({
         tokenUsageRepository: dependencies.tokenUsageRepository,
         idGenerator: dependencies.idGenerator,
@@ -1191,7 +193,7 @@ export function createCore(dependencies) {
         userBudgetLimitCache: caches.userBudgetLimit,
     });
     spendServiceRef = spendService;
-    const userSettings = dependencies.userSettingsRepository
+    modules.build('userSettings', () => dependencies.userSettingsRepository
         ? {
             service: new UserSettingsService({
                 userSettingsRepository: dependencies.userSettingsRepository,
@@ -1200,8 +202,8 @@ export function createCore(dependencies) {
                 resolveUserBudgetCap: () => spendService.budgetCaps().userMonthlyLimitMax,
             }),
         }
-        : undefined;
-    const llmObservability = dependencies.llmCallMetricRepository
+        : undefined);
+    const llmObservability = modules.build('llmObservability', () => dependencies.llmCallMetricRepository
         ? new LlmObservabilityService({
             llmCallMetricRepository: dependencies.llmCallMetricRepository,
             idGenerator: dependencies.idGenerator,
@@ -1211,13 +213,13 @@ export function createCore(dependencies) {
             workspaceSettingsRepository: dependencies.workspaceSettingsRepository,
             workspaceSettingsCache: caches.workspaceSettings,
         })
-        : undefined;
-    const platformObservability = dependencies.platformMetricsRepository
+        : undefined);
+    modules.build('platformObservability', () => dependencies.platformMetricsRepository
         ? new PlatformObservabilityService({
             platformMetricsRepository: dependencies.platformMetricsRepository,
             clock: dependencies.clock,
         })
-        : undefined;
+        : undefined);
     // The provisioning event log lives in a separate high-churn store. When its
     // repository is wired, build a best-effort recorder (threaded into the env
     // services) + the read service (exposed for the logs controller). The container
@@ -1229,28 +231,30 @@ export function createCore(dependencies) {
             clock: dependencies.clock,
         })
         : undefined;
-    const provisioningLogs = dependencies.provisioningLogRepository
+    modules.build('provisioningLogs', () => dependencies.provisioningLogRepository
         ? {
-            service: new ProvisioningLogService({ repository: dependencies.provisioningLogRepository }),
+            service: new ProvisioningLogService({
+                repository: dependencies.provisioningLogRepository,
+            }),
         }
-        : undefined;
+        : undefined);
     // Built before the shared-stacks + environments modules so a compose stack recipe's
     // `prerequisites` (and a shared stack's own prerequisites) are re-run at provision / bring-up
     // start through this service. The host probes exist only on the local facade; absent ⇒ a recipe /
     // stack that declares prerequisites fails loudly (the preflight API 503s too).
-    const preflight = createPreflightModule(dependencies);
+    const preflight = modules.build('preflight', () => createPreflightModule(dependencies));
     // Built before the environments module so a compose stack recipe's `sharedStackRefs` can be
     // brought up (provider-before-consumer) through this service during provisioning. Persistence is
     // runtime-symmetric (present on every facade); the lifecycle only runs where a host daemon is
     // wired (`composeRuntime` — the local facade), else `ensureRefsUp` returns a clean error. It gets
     // the preflight service so a shared stack re-checks its own machine prerequisites at bring-up.
-    const sharedStacks = createSharedStacksModule(dependencies, preflight?.service);
-    const environments = createEnvironmentsModule(dependencies, provisioningLogRecorder, executionEventPublisher, sharedStacks?.service, preflight?.service);
+    const sharedStacks = modules.build('sharedStacks', () => createSharedStacksModule(dependencies, preflight?.service));
+    const environments = modules.build('environments', () => createEnvironmentsModule(dependencies, provisioningLogRecorder, executionEventPublisher, sharedStacks?.service, preflight?.service));
     // Built before the fragment library so a document-backed fragment can re-resolve
     // its linked Confluence/Notion/GitHub page through the document module's reader.
-    const documents = createDocumentsModule(dependencies, boardService);
-    const fragmentLibrary = createFragmentLibraryModule(dependencies, documents?.contentResolver, caches);
-    const skillLibrary = createSkillLibraryModule(dependencies, caches);
+    const documents = modules.build('documents', () => createDocumentsModule(dependencies, boardService));
+    const fragmentLibrary = modules.build('fragmentLibrary', () => createFragmentLibraryModule(dependencies, documents?.contentResolver, caches));
+    const skillLibrary = modules.build('skillLibrary', () => createSkillLibraryModule(dependencies, caches));
     // Reconciles a `blueprints` step's decomposition onto the board. Needs only the
     // board service + block repository (both always present), so it is wired
     // unconditionally — there is no standalone scan command or persisted blueprint store.
@@ -1260,19 +264,19 @@ export function createCore(dependencies) {
     });
     // Built before the execution engine so it can raise merge-review / CI-failed /
     // pipeline-complete notifications during a run (when the module is configured).
-    const notifications = createNotificationsModule(dependencies);
-    const slack = createSlackModule(dependencies);
-    const riskPolicies = createRiskPoliciesModule(dependencies, caches);
-    const sandbox = createSandboxModule(dependencies, agentKindRegistry);
+    const notifications = modules.build('notifications', () => createNotificationsModule(dependencies));
+    modules.build('slack', () => createSlackModule(dependencies));
+    modules.build('riskPolicies', () => createRiskPoliciesModule(dependencies, caches));
+    modules.build('sandbox', () => createSandboxModule(dependencies, agentKindRegistry));
     // Built before the execution engine so the per-service running-task limit can be
     // enforced at start() (and the escalation sweep can read the waiting threshold).
-    const settings = createWorkspaceSettingsModule(dependencies, caches.workspaceSettings);
-    const releaseHealth = createReleaseHealthModule(dependencies);
-    const packageRegistries = createPackageRegistriesModule(dependencies);
-    const preview = createPreviewModule(dependencies);
-    const incidentEnrichmentSettings = createIncidentEnrichmentModule(dependencies);
-    const modelPresets = createModelPresetsModule(dependencies);
-    const serviceFragmentDefaults = createServiceFragmentDefaultsModule(dependencies);
+    const settings = modules.build('settings', () => createWorkspaceSettingsModule(dependencies, caches.workspaceSettings));
+    modules.build('releaseHealth', () => createReleaseHealthModule(dependencies));
+    modules.build('packageRegistries', () => createPackageRegistriesModule(dependencies));
+    modules.build('preview', () => createPreviewModule(dependencies));
+    modules.build('incidentEnrichmentSettings', () => createIncidentEnrichmentModule(dependencies));
+    modules.build('modelPresets', () => createModelPresetsModule(dependencies));
+    modules.build('serviceFragmentDefaults', () => createServiceFragmentDefaultsModule(dependencies));
     // Built before the execution engine so the planning pipeline's plan ingest + the
     // committer step's tracker mirror can run through it.
     const initiativeService = dependencies.initiativeRepository
@@ -1308,14 +312,14 @@ export function createCore(dependencies) {
     });
     // Built before the execution engine so the special `requirements-review` gate step can
     // drive the inline reviewer + the iterative answer → incorporate → re-review loop.
-    const requirements = createRequirementsModule(dependencies, notifications?.service, fragmentLibrary);
+    const requirements = modules.build('requirements', () => createRequirementsModule(dependencies, notifications?.service, fragmentLibrary));
     const docInterview = createDocInterviewService(dependencies);
     const forkChat = createForkChatService(dependencies);
-    const clarity = createClarityModule(dependencies, notifications?.service);
-    const brainstorm = createBrainstormModule(dependencies, notifications?.service);
+    const clarity = modules.build('clarity', () => createClarityModule(dependencies, notifications?.service));
+    const brainstorm = modules.build('brainstorm', () => createBrainstormModule(dependencies, notifications?.service));
     // Built before the execution engine so the engine's terminal hook can schedule a
     // post-run Kaizen grading for each completed agent step.
-    const kaizen = createKaizenModule(dependencies);
+    const kaizen = modules.build('kaizen', () => createKaizenModule(dependencies));
     // Late-bound so the engine's terminal hooks can poke the execution loop, which is built AFTER
     // the engine (the loop depends on `executionService.start`). Fire-and-forget; a null ref (the
     // loop unwired, or the settled block not part of an initiative) is a no-op.
@@ -1326,12 +330,13 @@ export function createCore(dependencies) {
     // Built before the execution engine so the engine's `bug-intake` step can drive the
     // read-and-claim intake helper (`tasks.bugIntakeService`). Also feeds the recurring module's
     // schedule intake-config validation below.
-    const tasks = createTasksModule(dependencies, boardService);
+    const tasks = modules.build('tasks', () => createTasksModule(dependencies, boardService));
     const executionService = new ExecutionService({
         ...dependencies,
         agentKindRegistry,
         gateRegistry,
         stepResolverRegistry,
+        providerRegistry,
         initiativePresetRegistry,
         workRunner,
         executionEventPublisher,
@@ -1394,13 +399,21 @@ export function createCore(dependencies) {
             ? (workspaceId, agentKind, modelPresetId) => resolvePresetModelForKind(dependencies.modelPresetRepository, workspaceId, agentKind, modelPresetId)
             : undefined,
     });
-    const github = createGitHubModule(dependencies, caches);
-    const runners = createRunnersModule(dependencies);
+    modules.build('github', () => createGitHubModule(dependencies, caches));
+    modules.build('runners', () => createRunnersModule(dependencies));
     // After a bootstrap succeeds, map the new repo into a blueprint + the board by
     // starting the blueprint-only pipeline against the service frame.
-    const bootstrap = createBootstrapModule(dependencies, executionEventPublisher, (ws, blockId) => executionService.start(ws, blockId, BLUEPRINT_PIPELINE_ID).then(() => undefined));
-    const tracker = createTrackerModule(dependencies);
-    const recurring = createRecurringModule(dependencies, executionService, executionEventPublisher, tasks?.connectionService);
+    modules.build('bootstrap', () => createBootstrapModule(dependencies, executionEventPublisher, (ws, blockId) => executionService.start(ws, blockId, BLUEPRINT_PIPELINE_ID).then(() => undefined)));
+    modules.build('tracker', () => createTrackerModule(dependencies));
+    modules.build('recurring', () => createRecurringModule(dependencies, executionService, executionEventPublisher, tasks?.connectionService));
+    // The env-config-repair module is a sub-module of `environments` — surfaced as its own top-level
+    // `Core.envConfigRepair` key. Registered here (not in the `environments` build above) so it emits
+    // through the same registry rather than a bespoke return spread.
+    modules.build('envConfigRepair', () => environments?.envConfigRepair);
+    // Observability + per-account settings that a facade builds and passes through on the deps bag.
+    modules.build('agentContextObservability', () => dependencies.agentContextObservability);
+    modules.build('searchQueryObservability', () => dependencies.searchQueryObservability);
+    modules.build('accountSettings', () => dependencies.accountSettings ? { service: dependencies.accountSettings } : undefined);
     // The initiative EXECUTION LOOP (slice 3): built after the engine (it drives
     // `executionService.start` to spawn tasks), then late-bound into the terminal poke above so a
     // settling child run advances its owning initiative immediately. Present only when initiatives
@@ -1421,70 +434,27 @@ export function createCore(dependencies) {
         })
         : undefined;
     initiativeLoopRef = initiativeLoop;
-    const initiatives = initiativeService && initiativeLoop
+    modules.build('initiatives', () => initiativeService && initiativeLoop
         ? { service: initiativeService, loop: initiativeLoop }
-        : undefined;
-    const services = createServicesModule(dependencies);
+        : undefined);
+    modules.build('services', () => createServicesModule(dependencies));
+    // The always-present spine, plus every optional module the registry assembled in ONE place
+    // (unwired keys absent) — replacing the ~40 hand-written `...(x ? { x } : {})` return spreads.
     return {
         caches,
         workspaceService,
-        workspaceMemberService,
         accountService,
         userService,
-        ...(invitations ? { invitations } : {}),
-        ...(passwordReset ? { passwordReset } : {}),
-        ...(email ? { email } : {}),
         boardService,
         pipelineService,
         executionService,
         spendService,
         agentKindRegistry,
         gateRegistry,
+        pipelineRegistry,
         initiativePresetRegistry,
         executionEventPublisher,
-        ...(llmObservability ? { llmObservability } : {}),
-        ...(platformObservability ? { platformObservability } : {}),
-        ...(dependencies.agentContextObservability
-            ? { agentContextObservability: dependencies.agentContextObservability }
-            : {}),
-        ...(dependencies.searchQueryObservability
-            ? { searchQueryObservability: dependencies.searchQueryObservability }
-            : {}),
-        ...(github ? { github } : {}),
-        ...(documents ? { documents } : {}),
-        ...(tasks ? { tasks } : {}),
-        ...(environments ? { environments } : {}),
-        ...(environments?.envConfigRepair ? { envConfigRepair: environments.envConfigRepair } : {}),
-        ...(runners ? { runners } : {}),
-        ...(provisioningLogs ? { provisioningLogs } : {}),
-        ...(bootstrap ? { bootstrap } : {}),
-        ...(requirements ? { requirements } : {}),
-        ...(kaizen ? { kaizen } : {}),
-        ...(clarity ? { clarity } : {}),
-        ...(brainstorm ? { brainstorm } : {}),
-        ...(notifications ? { notifications } : {}),
-        ...(slack ? { slack } : {}),
-        ...(riskPolicies ? { riskPolicies } : {}),
-        ...(sharedStacks ? { sharedStacks } : {}),
-        ...(preflight ? { preflight } : {}),
-        ...(sandbox ? { sandbox } : {}),
-        ...(settings ? { settings } : {}),
-        ...(userSettings ? { userSettings } : {}),
-        ...(releaseHealth ? { releaseHealth } : {}),
-        ...(packageRegistries ? { packageRegistries } : {}),
-        ...(preview ? { preview } : {}),
-        ...(incidentEnrichmentSettings ? { incidentEnrichmentSettings } : {}),
-        ...(dependencies.accountSettings
-            ? { accountSettings: { service: dependencies.accountSettings } }
-            : {}),
-        ...(modelPresets ? { modelPresets } : {}),
-        ...(serviceFragmentDefaults ? { serviceFragmentDefaults } : {}),
-        ...(fragmentLibrary ? { fragmentLibrary } : {}),
-        ...(skillLibrary ? { skillLibrary } : {}),
-        ...(initiatives ? { initiatives } : {}),
-        ...(recurring ? { recurring } : {}),
-        ...(tracker ? { tracker } : {}),
-        ...(services ? { services } : {}),
+        ...modules.assemble(),
     };
 }
 //# sourceMappingURL=container.js.map