@dotdrelle/wiki-manager 0.15.66 → 0.15.70

package/src/orchestrator/dispatcher.js

@@ -1,7 +1,10 @@
 import { normalizeActivity, parseJsonText } from '../core/activity.js';
 import { createAgentEvent, dispatchAgentEvent } from '../core/agentEvents.js';
 import { callMcpTool, formatMcpToolResult } from '../core/mcp.js';
+import { loadWorkspaceProfile } from '../core/profile.js';
+import { mapRuntimeEvent } from '../core/runtimeEventAdapter.js';
 import { emitRuntimeLog, pollActivitiesOnce } from '../runtime/supervisor.js';
+import { APPROVAL_DEFAULT_CLASS, approvalCovered } from './approvalPolicy.js';
 import { isSuccessful, isTerminal } from './taskStatuses.js';
 
 
@@ -32,6 +35,16 @@ export async function execute(task, assignment, {
   pollBusy = new Set(),
   pollIntervalMs = 2500,
 } = {}) {
+  if (isExternalRuntimeAssignment(assignment)) {
+    return executeExternalRuntime(task, assignment, {
+      session,
+      signal,
+      runId,
+      attempt,
+      timeoutMs,
+      pollIntervalMs,
+    });
+  }
   if (!session) throw new Error('dispatcher.execute requires session.');
   if (!assignment?.serverName) throw new Error(`No MCP server found for agent ${assignment?.agentInstanceId ?? '(unknown)'}.`);
   const serverName = assignment.serverName;
@@ -157,6 +170,243 @@ export async function execute(task, assignment, {
   }
 }
 
+function isExternalRuntimeAssignment(assignment) {
+  return assignment?.providerKind === 'external-runtime'
+    && typeof assignment?.runtimeProvider?.execute === 'function';
+}
+
+// A proposal without mutations still waits for a human grant: the request is
+// treated as the default approval class, covered by a run-scope grant like
+// any other. Every announced class must be covered — the "global" approval is
+// bounded by the proposal.
+function pendingApprovalCovered(classes, approvals, context) {
+  const list = Array.isArray(classes) && classes.length > 0
+    ? classes
+    : [APPROVAL_DEFAULT_CLASS];
+  return list.every((approvalClass) => approvalCovered(
+    {
+      // Without an id, grantCoversTask's task/tool-scope match (which keys
+      // off task.id/localId/taskId) can never succeed, so a per-task
+      // `/approve item <id>` grant silently fails to cover this task and only
+      // a run-scope "approve all" can ever unblock it.
+      id: context?.taskId ?? null,
+      taskId: context?.taskId ?? null,
+      groupId: context?.groupId ?? null,
+      requiresApproval: true,
+      approvalClass: String(approvalClass),
+    },
+    approvals,
+    context,
+  ));
+}
+
+async function executeExternalRuntime(task, assignment, {
+  session,
+  signal = null,
+  runId = null,
+  attempt = null,
+  timeoutMs = null,
+  pollIntervalMs = 2500,
+} = {}) {
+  if (!session) throw new Error('dispatcher.execute requires session.');
+  const runtimeProvider = assignment.runtimeProvider;
+  const taskId = String(task.id ?? task.step);
+  const taskTimeoutMs = resolvedTimeoutMs(assignment, timeoutMs);
+  let deadline = Date.now() + taskTimeoutMs;
+  let runtimeRunId = null;
+  let unsubscribe = null;
+  let pendingApproval = null;
+  try {
+    emitRuntimeLog(session, taskLogPayload('runtime.execute', task, assignment, {
+      runId,
+      attempt,
+      detail: 'external-runtime',
+    }));
+    const mcpPool = activeProfileMcp(session);
+    if (!mcpPool) {
+      // A degradation must announce itself. The runtime's whole value is its
+      // eyes: dispatched without the workspace wiki MCP, the Deep Agent
+      // improvises with its built-in backend (it ran `ls /` on the gateway
+      // container and answered "the workspace is empty" — a plausible,
+      // confident, entirely wrong answer). Say it in the journal, keep the
+      // run (the objective may still be answerable from the model alone),
+      // but never let blindness pass silently.
+      emitRuntimeLog(session, taskLogPayload('runtime.blind', task, assignment, {
+        runId,
+        attempt,
+        detail: 'no workspace wiki MCP pool — the endpoint is down or declares no read tools; the runtime will run without its eyes',
+      }));
+    }
+    const accepted = await runtimeProvider.execute({
+      objective: task.label ?? task.description ?? taskId,
+      operation: task.operation ?? null,
+      capability: task.requiredCapability ?? null,
+      arguments: task.arguments && typeof task.arguments === 'object' ? task.arguments : {},
+      workspace: workspaceRequest(session),
+      model: activeProfileModel(session),
+      language: session?.language ?? session?.wikircConfig?.language ?? null,
+      mcp: mcpPool,
+      systemPrompt: activeRuntimeSystemPrompt(session, task, assignment),
+    });
+    runtimeRunId = String(accepted?.runId ?? '');
+    if (!runtimeRunId) throw new Error('runtime.execute did not return runId.');
+    emitRuntimeLog(session, taskLogPayload('runtime.accepted', task, assignment, {
+      runId,
+      attempt,
+      jobId: runtimeRunId,
+      detail: String(accepted?.status ?? 'running'),
+    }));
+    dispatchAgentEvent(session, createAgentEvent('task.started', {
+      origin: 'dispatcher',
+      runId,
+      taskId,
+      payload: {
+        runId,
+        taskId,
+        attemptId: attempt?.attemptId ?? null,
+        agentInstanceId: assignment.agentInstanceId,
+        jobId: runtimeRunId,
+        startedAt: new Date().toISOString(),
+      },
+    }));
+    dispatchExternalRuntimeActivity(session, task, assignment, runtimeRunId, 'running', runId);
+    if (typeof runtimeProvider.subscribe === 'function') {
+      unsubscribe = runtimeProvider.subscribe(runtimeRunId, (event) => {
+        for (const mapped of mapRuntimeEvent(event)) {
+          dispatchAgentEvent(session, createAgentEvent(mapped.type, {
+            origin: 'runtime_provider',
+            runId,
+            taskId,
+            payload: mapped.payload,
+          }));
+          if (mapped.type === 'approval.requested') {
+            pendingApproval = {
+              approvalId: mapped.payload?.approvalId ?? null,
+              approvalClasses: Array.isArray(mapped.payload?.approvalClasses)
+                ? mapped.payload.approvalClasses
+                : [],
+            };
+            const summary = String(mapped.payload?.proposal?.summary ?? mapped.payload?.reason ?? '').trim();
+            dispatchAgentEvent(session, createAgentEvent('assistant_message', {
+              origin: 'runtime_provider',
+              runId,
+              payload: {
+                content: [
+                  '⏸ Approval required before execution:',
+                  ...(summary ? [`  ${summary}`] : []),
+                  'Type /approve (or click "Approve") to proceed, "cancel" to abandon.',
+                ].filter(Boolean).join('\n'),
+              },
+            }));
+          }
+        }
+      });
+    }
+    let approvalWaitStartedAt = null;
+    while (true) {
+      throwIfAborted(signal);
+      // While a proposal waits for a human decision, the task timeout does
+      // not tick — the human decides, not the clock (the scheduler applies
+      // the same rule to its approval waits). The elapsed wait is credited
+      // back onto the deadline once the gate clears (below), rather than
+      // merely skipped from this check, so a late approval does not
+      // immediately expire the task on the very next iteration.
+      if (!pendingApproval && Date.now() > deadline) {
+        await runtimeProvider.cancel(runtimeRunId).catch(() => null);
+        throw new Error(`Task timed out after ${taskTimeoutMs}ms.`);
+      }
+      if (pendingApproval) {
+        approvalWaitStartedAt ??= Date.now();
+        const approvalBeingChecked = pendingApproval;
+        const approvals = session.agentProjection?.approvals ?? session.approvals ?? [];
+        const covered = pendingApprovalCovered(approvalBeingChecked.approvalClasses, approvals, {
+          runId,
+          taskId,
+          groupId: task.groupId ?? null,
+          workspaceId: session.workspace ?? null,
+          planRevision: session.planRevision ?? session.agentProjection?.planRevision ?? null,
+        });
+        if (covered && typeof runtimeProvider.approve === 'function') {
+          emitRuntimeLog(session, taskLogPayload('runtime.approval_granted', task, assignment, {
+            runId,
+            attempt,
+            jobId: runtimeRunId,
+            detail: 'unblocking runtime HITL',
+          }));
+          await runtimeProvider.approve(runtimeRunId, { approved: true, scope: approvalBeingChecked.approvalClasses });
+          // Only clear the approval just resolved: the runtime's event stream
+          // may have raised a second, unrelated one while the approve() round
+          // trip above was in flight.
+          if (pendingApproval === approvalBeingChecked) {
+            pendingApproval = null;
+            deadline += Date.now() - approvalWaitStartedAt;
+            approvalWaitStartedAt = null;
+          }
+        } else {
+          await delay(pollIntervalMs, signal);
+          continue;
+        }
+      }
+      const lastStatus = await runtimeProvider.status(runtimeRunId);
+      if (isTerminal(lastStatus?.status)) {
+        const refusedParams = Array.isArray(lastStatus?.result?.refusedParams)
+          ? lastStatus.result.refusedParams
+          : [];
+        if (refusedParams.length > 0) {
+          emitRuntimeLog(session, taskLogPayload('runtime.params_refused', task, assignment, {
+            runId,
+            attempt,
+            jobId: runtimeRunId,
+            detail: `model refused sampling parameters (${refusedParams.join(', ')}) — remove them from the workspace .wikirc (llm.<key>) so they are no longer sent`,
+          }));
+        }
+        emitRuntimeLog(session, taskLogPayload('runtime.result_returned', task, assignment, {
+          runId,
+          attempt,
+          jobId: runtimeRunId,
+          status: lastStatus.status,
+          detail: 'terminal status',
+        }));
+        dispatchExternalRuntimeActivity(session, task, assignment, runtimeRunId, lastStatus.status, runId);
+        return taskResultFromStatus(task, assignment, runtimeRunId, lastStatus, attempt);
+      }
+      await delay(pollIntervalMs, signal);
+    }
+  } catch (error) {
+    if (isAbortError(error) && runtimeRunId) {
+      await runtimeProvider.cancel(runtimeRunId).catch(() => null);
+    }
+    throw error;
+  } finally {
+    unsubscribe?.();
+    emitRuntimeLog(session, taskLogPayload('lock.released', task, assignment, {
+      runId,
+      attempt,
+      jobId: runtimeRunId,
+      detail: attempt?.locks?.join(',') || 'no locks',
+    }));
+    attempt?.release?.();
+  }
+}
+
+function dispatchExternalRuntimeActivity(session, task, assignment, runtimeRunId, status, runId) {
+  const activity = normalizeActivity({
+    id: runtimeRunId,
+    source: assignment.runtimeId ?? 'external-runtime',
+    kind: task.operation ?? task.requiredCapability ?? 'task',
+    label: task.label ?? task.description ?? String(task.id ?? task.step),
+    status,
+    progress: { percent: isTerminal(status) ? 100 : 0, stepId: String(task.id ?? task.step) },
+    outputRefs: [],
+  });
+  dispatchAgentEvent(session, createAgentEvent('activity_upserted', {
+    origin: 'dispatcher',
+    runId,
+    taskId: String(task.id ?? task.step),
+    payload: { activity },
+  }));
+}
+
 function executeRequest(task, session, runId) {
   return {
     taskId: String(task.id ?? task.step),
@@ -165,7 +415,20 @@ function executeRequest(task, session, runId) {
     idempotencyKey: task.idempotencyKey ?? undefined,
     operation: task.operation,
     workspace: workspaceRequest(session),
-    arguments: task.arguments && typeof task.arguments === 'object' ? task.arguments : {},
+    arguments: {
+      ...(task.arguments && typeof task.arguments === 'object' ? task.arguments : {}),
+      // The production agent's confirmation guard
+      // (PRODUCTION_REQUIRE_CONFIRMATION=true) has one contract: "only an
+      // approved task may run a mutating operation — Donna passes
+      // confirm=true after the run-scope approval". The scheduler never
+      // dispatches a requiresApproval task before coverage
+      // (dependencyResolver.readyTasks), so reaching dispatch IS the
+      // approval. Without this, an operator who enables the guard sees every
+      // mutating production job fail with "requires confirm=true" — the
+      // first E2E ingest plan dispatched by the deep agent's
+      // planExpansionRequest failed exactly that way, 19 tasks in one batch.
+      ...(task.requiresApproval === true ? { confirm: true } : {}),
+    },
     constraints: {
       requireApprovalForMutations: task.requiresApproval === true,
     },
@@ -178,6 +441,93 @@ function workspaceRequest(session) {
   return { name: String(workspace ?? 'workspace') };
 }
 
+// The model travels WITH the run: the runtime is workspace-agnostic and must
+// follow the active profile — default or `/config use` — without a config
+// sync. Numeric LLM parameters declared by the profile (temperature, …) ride
+// along too: nothing is hardcoded here, the workspace config is the source.
+function activeProfileModel(session) {
+  const llm = session?.wikircConfig?.llm ?? {};
+  const model = {
+    ...(llm.baseUrl ? { baseUrl: String(llm.baseUrl) } : {}),
+    ...(llm.model ? { model: String(llm.model) } : {}),
+    ...(llm.apiKey ? { apiKey: String(llm.apiKey) } : {}),
+  };
+  for (const key of ['temperature', 'maxTokens', 'topP', 'seed']) {
+    const value = Number(llm[key]);
+    if (Number.isFinite(value)) model[key] = value;
+  }
+  return Object.keys(model).length > 0 ? model : null;
+}
+
+// The read-only wiki MCP tools the runtime is allowed to see. An explicit
+// allow-list, not a denylist: the runtime has eyes (read tools) and a mouth
+// (gated side-effects through the DAG), never hands on the workspace. A denylist
+// keyed on "write_page|add_source|…" already silently let build_context_write
+// and template_write through, and would leak any future wiki_delete_page /
+// wiki_move_page / wiki_rename the moment it is added upstream.
+const READ_ONLY_WIKI_TOOLS = new Set([
+  'help_list', 'help_read', 'help_search',
+  'profile_read', 'template_read',
+  'wiki_collect_context', 'wiki_list_ingested_sources', 'wiki_list_pages',
+  'wiki_outline', 'wiki_read_deliverable', 'wiki_read_ingested_source',
+  'wiki_read_page', 'wiki_read_pages', 'wiki_search_context',
+  'wiki_workspace_status',
+]);
+
+// The runtime's EYES, per run: the active workspace's wiki MCP, read tools
+// only. Workspace-scoped endpoints are per-run by nature — they cannot live
+// in a static gateway file. The allow-list here is the authority: nothing
+// else reaches the runtime.
+export function activeProfileMcp(session) {
+  const wiki = session?.mcp?.wiki;
+  if (!wiki?.url || wiki.status !== 'connected') return null;
+  const tools = (wiki.tools ?? [])
+    .map((tool) => String(tool.name ?? ''))
+    .filter((name) => {
+      if (!name) return false;
+      const base = name.includes('__') ? name.slice(name.lastIndexOf('__') + 2) : name;
+      return READ_ONLY_WIKI_TOOLS.has(base);
+    });
+  if (tools.length === 0) return null;
+  // Same credential contract as the manager's own MCP client (mcp.js
+  // `authorization: Bearer ${endpoint.token}`): the wiki detail carries
+  // `token`, not `headers` — without it the gateway's MCP connection is
+  // rejected by the workspace MCP server ("invalid or missing bearer token")
+  // and the Deep Agent runs blind.
+  const headers = {
+    ...(wiki.headers && typeof wiki.headers === 'object' ? wiki.headers : {}),
+    ...(wiki.token ? { Authorization: `Bearer ${wiki.token}` } : {}),
+  };
+  return [{
+    name: 'wiki',
+    url: String(wiki.url),
+    ...(Object.keys(headers).length > 0 ? { headers } : {}),
+    tools,
+  }];
+}
+
+// The Deep Agent's system prompt, built per run from the same ingredients
+// Donna uses: role, the ONE capability being executed (with its declared
+// description), the eyes/bouche/mains boundary, the workspace profile and the
+// reply language. Without it, the runtime falls back to deepagents' generic
+// assistant prompt — which is exactly the "upload your project" hallucination.
+function activeRuntimeSystemPrompt(session, task, assignment) {
+  const capability = assignment?.capability ?? null;
+  const description = String(capability?.description ?? '').trim();
+  const language = session?.language ?? session?.wikircConfig?.language ?? null;
+  const profile = loadWorkspaceProfile(session?.workspacePath);
+  return [
+    'You are the agentic analysis engine of a knowledge workspace (wikiLLM), executed behind the manager Donna.',
+    `Execute exactly ONE capability: ${task?.requiredCapability ?? 'unknown'}${description ? ` — ${description}` : ''}.`,
+    `Operation: ${task?.operation ?? 'run'}.`,
+    'Boundary: you have READ tools only (the workspace wiki). You never modify the workspace — structural changes are proposals you return in your final answer (a planExpansionRequest), the manager integrates them under human approval. Side-effects on the outside world are gated by approval.',
+    'Ground every claim in what the read tools return. Never invent pages, names, facts, jobs or results.',
+    'Tool discipline: discover real page paths with the list/search tools BEFORE reading. Never guess a path — a read refused for "path not allowed" means the path was invented, so list/search first, then read exactly what exists.',
+    ...(language ? [`Reply in the workspace language: ${language}.`] : []),
+    ...(profile ? [`Workspace preferences — apply them to every reply:\n${profile}`] : []),
+  ].join('\n');
+}
+
 function dispatchTaskActivity(session, task, assignment, jobId, statusTool, runId) {
   const activity = normalizeActivity({
     id: jobId,
@@ -215,7 +565,16 @@ function taskResultFromStatus(task, assignment, jobId, statusPayload, attempt =
     status: result.status ?? statusPayload?.status,
     outputRefs: Array.isArray(result.outputRefs) ? result.outputRefs : [],
     metrics: result.metrics ?? {},
-    error: normalizeTaskError(result.error),
+    // The gateway reports its failure at the TOP level of the status payload
+    // ({ runId, status, error }), not inside `result`. Reading only
+    // `result.error` dropped the only actionable sentence ("no model…") and
+    // left Donna to invent a cause.
+    error: normalizeTaskError(result.error ?? statusPayload.error),
+    // Agent -> DAG (RFC § 30/31/41): a result may request the execution of a
+    // deterministic capability. Propagated here so resultAggregator.maybeExpandPlan
+    // picks it up and routes it through the manager's own resolution + approval
+    // — never a direct scheduler call by the runtime.
+    ...(result.planExpansionRequest ? { planExpansionRequest: result.planExpansionRequest } : {}),
     rawStatus: statusPayload,
   };
 }

package/src/orchestrator/dispatcher.test.js

@@ -1,6 +1,52 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { createDispatcher, normalizeTaskError } from './dispatcher.js';
+import { activeProfileMcp, createDispatcher, normalizeTaskError } from './dispatcher.js';
+
+test('activeProfileMcp forwards only the read-only wiki tools to the external runtime', () => {
+  const session = {
+    mcp: {
+      wiki: {
+        url: 'http://wiki:3000/mcp',
+        status: 'connected',
+        token: 't',
+        tools: [
+          { name: 'wiki_read_page' },
+          { name: 'wiki_search_context' },
+          { name: 'wiki_workspace_status' },
+          { name: 'help_read' },
+          // every mutation tool must be dropped, including the ones the old
+          // substring denylist ("write_page|add_source|…") let through:
+          { name: 'wiki_write_page' },
+          { name: 'wiki_add_source' },
+          { name: 'profile_update' },
+          { name: 'template_write' },
+          { name: 'build_context_write' },
+          // and a hypothetical future mutation tool the denylist could not know:
+          { name: 'wiki_delete_page' },
+          { name: 'wiki_move_page' },
+        ],
+      },
+    },
+  };
+  const [pool] = activeProfileMcp(session);
+  assert.deepEqual(
+    [...pool.tools].sort(),
+    ['help_read', 'wiki_read_page', 'wiki_search_context', 'wiki_workspace_status'],
+  );
+});
+
+test('activeProfileMcp tolerates namespaced tool names', () => {
+  const session = {
+    mcp: {
+      wiki: {
+        url: 'http://wiki:3000/mcp',
+        status: 'connected',
+        tools: [{ name: 'wiki__wiki_read_page' }, { name: 'wiki__wiki_write_page' }],
+      },
+    },
+  };
+  assert.deepEqual(activeProfileMcp(session)[0].tools, ['wiki__wiki_read_page']);
+});
 
 test('dispatcher returns a retryable logical failure when agent_execute reports workspace_busy', async () => {
   const session = {
@@ -215,3 +261,68 @@ test('normalizeTaskError falls back only when the agent reports no reason at all
   assert.equal(error.code, 'execution_rejected');
   assert.equal(error.message, 'agent_execute rejected task');
 });
+
+test('dispatcher passes confirm=true to agent_execute for an approval-gated task', async () => {
+  let executeArgs;
+  const session = {
+    workspace: 'test',
+    mcp: {
+      production: {
+        tools: [{ name: 'agent_execute' }, { name: 'agent_status' }, { name: 'agent_cancel' }],
+      },
+    },
+    activities: {},
+  };
+  const dispatcher = createDispatcher({
+    session,
+    pollIntervalMs: 1,
+    callTool: async (_mcp, _server, tool, args) => {
+      if (tool === 'agent_execute') {
+        executeArgs = args;
+        return { accepted: true, jobId: 'job-ingest', status: 'queued' };
+      }
+      return { jobId: 'job-ingest', status: 'succeeded', terminal: true, result: { status: 'succeeded' } };
+    },
+  });
+
+  await dispatcher.execute(
+    { id: 'ingest-a', requiredCapability: 'knowledge.update', operation: 'ingest_apply', arguments: {}, requiresApproval: true },
+    { serverName: 'production', agentInstanceId: 'production-main' },
+    { runId: 'run-donna-confirm', attempt: { attemptId: 'ingest-a:attempt-1', locks: [], release() {} } },
+  );
+
+  assert.equal(executeArgs.arguments.confirm, true, 'covered mutating task must carry confirm=true');
+  assert.equal(executeArgs.constraints.requireApprovalForMutations, true);
+});
+
+test('dispatcher does not invent confirm=true for a non-gated task', async () => {
+  let executeArgs;
+  const session = {
+    workspace: 'test',
+    mcp: {
+      production: {
+        tools: [{ name: 'agent_execute' }, { name: 'agent_status' }, { name: 'agent_cancel' }],
+      },
+    },
+    activities: {},
+  };
+  const dispatcher = createDispatcher({
+    session,
+    pollIntervalMs: 1,
+    callTool: async (_mcp, _server, tool, args) => {
+      if (tool === 'agent_execute') {
+        executeArgs = args;
+        return { accepted: true, jobId: 'job-doctor', status: 'queued' };
+      }
+      return { jobId: 'job-doctor', status: 'succeeded', terminal: true, result: { status: 'succeeded' } };
+    },
+  });
+
+  await dispatcher.execute(
+    { id: 'doctor-a', requiredCapability: 'workspace.diagnose', operation: 'doctor', arguments: {} },
+    { serverName: 'production', agentInstanceId: 'production-main' },
+    { runId: 'run-donna-doctor', attempt: { attemptId: 'doctor-a:attempt-1', locks: [], release() {} } },
+  );
+
+  assert.equal(executeArgs.arguments.confirm, undefined);
+});

package/src/orchestrator/objectiveResolver.js

@@ -113,11 +113,10 @@ function resolveMentionedRegistryOperation(objective, candidates) {
       // A capability with more than one operation may declare
       // aliasOperations, mapping the specific alias phrase that matched to
       // the operation it actually names. Without it, operations[0]
-      // (alphabetical) is a silent guess: for knowledge.concepts this always
-      // picked the destructive grid-rebuild "concepts" operation, even when
-      // the matched alias ("reclassify concepts", "file unclassified
-      // concepts") named the safe, mechanical "reclassify-concepts" one —
-      // making that operation structurally unreachable from natural language.
+      // (alphabetical) is a silent guess — a multi-operation capability's
+      // other operations become structurally unreachable from natural
+      // language, and the alphabetical first one may well be the destructive
+      // one.
       const operation = candidate.aliasOperations?.[matchedAlias] ?? candidate.operations[0];
       return { capability: candidate.id, operation };
     })
@@ -176,7 +175,10 @@ function registrySnapshot(session) {
   const registry = session?.capabilityRegistry;
   if (registry?.snapshot) return registry.snapshot();
   if (registry && typeof registry === 'object') return registry;
-  const agents = session?.agentRegistry?.snapshot?.() ?? session?.agentRegistrySnapshot ?? [];
+  const agents = [
+    ...(session?.agentRegistry?.snapshot?.() ?? session?.agentRegistrySnapshot ?? []),
+    ...(session?.runtimeProviderAgents ?? []),
+  ];
   const snapshot = {};
   for (const agent of agents) {
     for (const capability of agent?.description?.capabilities ?? []) {
@@ -187,6 +189,8 @@ function registrySnapshot(session) {
         capability,
         description: agent.description,
         health: agent.health,
+        providerKind: agent.providerKind ?? null,
+        runtimeProvider: agent.runtimeProvider ?? null,
       });
     }
   }

package/src/orchestrator/objectiveResolver.test.js

@@ -122,53 +122,52 @@ test('resolveObjective resolves diagnose via alias despite the notification "sen
   assert.equal(result.operation, 'doctor');
 });
 
-const concepts = makeCapability('knowledge.concepts', {
-  operations: ['concepts', 'reclassify-concepts'],
-  aliases: ['concept grid', 'reclassify concepts', 'file unclassified concepts'],
+const snapshot = makeCapability('data.snapshot', {
+  operations: ['snapshot', 'prune'],
+  aliases: ['take a snapshot', 'prune snapshots', 'clean old snapshots'],
   aliasOperations: {
-    'concept grid': 'concepts',
-    'reclassify concepts': 'reclassify-concepts',
-    'file unclassified concepts': 'reclassify-concepts',
+    'take a snapshot': 'snapshot',
+    'prune snapshots': 'prune',
+    'clean old snapshots': 'prune',
   },
-  description: 'Synthesize the concept grid or file unclassified pages into it.',
+  description: 'Take a snapshot of the workspace or prune old snapshots.',
 });
 
 /*
  Regression: with two operations, [...new Set(supportedOperations)].sort()
- alphabetizes to ["concepts", "reclassify-concepts"], so a naive alias hit
- defaulting to operations[0] would ALWAYS resolve to "concepts" — the
- destructive grid rebuild — even for aliases explicitly authored to reach the
- safe "reclassify-concepts" operation. aliasOperations must be consulted
- first.
+ alphabetizes to ["prune", "snapshot"], so a naive alias hit defaulting to
+ operations[0] would ALWAYS resolve to "prune" — the destructive operation —
+ even for aliases explicitly authored to reach the safe "snapshot" one.
+ aliasOperations must be consulted first.
 */
-test('resolveObjective routes "reclassify concepts" to reclassify-concepts, not operations[0]', async () => {
-  const session = sessionWith([provider('production-1', concepts)]);
+test('resolveObjective routes "prune snapshots" to prune, not operations[0]', async () => {
+  const session = sessionWith([provider('production-1', snapshot)]);
   session.llm.completeWithTools = async () => {
     throw new Error('the aliased operation must not depend on LLM selection');
   };
-  const result = await resolveObjective('Please reclassify concepts in the workspace', session);
-  assert.equal(result.capability, 'knowledge.concepts');
-  assert.equal(result.operation, 'reclassify-concepts');
+  const result = await resolveObjective('Please prune the old snapshots', session);
+  assert.equal(result.capability, 'data.snapshot');
+  assert.equal(result.operation, 'prune');
 });
 
-test('resolveObjective routes "file unclassified concepts" to reclassify-concepts', async () => {
-  const session = sessionWith([provider('production-1', concepts)]);
+test('resolveObjective routes "clean old snapshots" to prune', async () => {
+  const session = sessionWith([provider('production-1', snapshot)]);
   session.llm.completeWithTools = async () => {
     throw new Error('the aliased operation must not depend on LLM selection');
   };
-  const result = await resolveObjective('File unclassified concepts into the grid', session);
-  assert.equal(result.capability, 'knowledge.concepts');
-  assert.equal(result.operation, 'reclassify-concepts');
+  const result = await resolveObjective('Clean old snapshots of the workspace', session);
+  assert.equal(result.capability, 'data.snapshot');
+  assert.equal(result.operation, 'prune');
 });
 
-test('resolveObjective routes "concept grid" to the concepts operation', async () => {
-  const session = sessionWith([provider('production-1', concepts)]);
+test('resolveObjective routes "take a snapshot" to the snapshot operation', async () => {
+  const session = sessionWith([provider('production-1', snapshot)]);
   session.llm.completeWithTools = async () => {
     throw new Error('the aliased operation must not depend on LLM selection');
   };
-  const result = await resolveObjective('Rebuild the concept grid', session);
-  assert.equal(result.capability, 'knowledge.concepts');
-  assert.equal(result.operation, 'concepts');
+  const result = await resolveObjective('Take a snapshot of the workspace', session);
+  assert.equal(result.capability, 'data.snapshot');
+  assert.equal(result.operation, 'snapshot');
 });
 
 test('resolveObjective falls back to operations[0] when a matched alias has no aliasOperations entry', async () => {