@dotdrelle/wiki-manager 0.15.73 → 0.15.76

package/README.md

@@ -23,11 +23,10 @@ deterministic dispatcher executes bounded tasks with idempotency, bounded
 approvals, per-run budgets and automatic recovery after restart. The chat
 stays available while runs execute; additional requests are queued.
 
-Scope note: this is a single-user deployment baseline. The multi-user model is
-specified in `llm-wiki/docs/industrialisation.md` and planned next. Until
-then, do not expose the runtime as a shared write surface; it binds to
-`127.0.0.1` by default, and `--host 0.0.0.0` must be an explicit deployment
-choice with bearer-token and network protection.
+Scope note: this is a single-user deployment baseline. Do not expose the
+runtime as a shared write surface; it binds to `127.0.0.1` by default, and
+`--host 0.0.0.0` must be an explicit deployment choice with bearer-token and
+network protection.
 
 ---
 
@@ -170,7 +169,7 @@ Projects compared: [OpenWiki](https://github.com/langchain-ai/openwiki),
   territory.
 - Serve a true multi-user instance with per-user identity and an attributed
   audit trail. This is a single-user deployment baseline (see the scope note
-  above); multi-user is specified and planned next.
+  above).
 - Expose a graph-query API over the corpus the way GraphRAG does; retrieval is
   BM25 plus a vector index feeding generation.
 - Ship or host the multi-provider AI gateway — routing to several providers is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotdrelle/wiki-manager",
-  "version": "0.15.73",
+  "version": "0.15.76",
   "description": "Agentic shell and orchestration cockpit for llm-wiki workspaces.",
   "repository": {
     "type": "git",

package/src/cli/wiki-manager.js

@@ -702,8 +702,8 @@ async function runHeadless(argv, agent) {
     session._onStep = step;
 
     let input = prompt;
-    // Plan §24: headless must resolve executable skills through the same
-    // runtime resolver as the Shell and serve. Injecting the skill body into a
+    // Headless must resolve executable skills through the same runtime resolver
+    // as the Shell and serve. Injecting the skill body into a
     // local prompt bypasses the compiler, so a multi-capability skill such as
     // wiki-sync would collapse into a single run here while producing two
     // everywhere else — and the rewritten bodies are business intentions, not

package/src/cli/wiki-manager.test.js

@@ -396,8 +396,8 @@ test('argument extraction keeps a value the vocabulary allows', async () => {
 });
 
 test('headless waits for every run of a skill chain, not just the first', async () => {
-  // wiki-sync compiles into two sequential runs: returning as soon as the
-  // export finishes would report success before the ingest had started.
+  // A multi-step user skill compiles into sequential runs: returning as soon as
+  // the first finishes would report success before the rest had started.
   const client = chainClient([
     { controlQueue: [chainItem(0, 'running', { runId: 'run-a' }), chainItem(1, 'queued')] },
     { controlQueue: [chainItem(0, 'done'), chainItem(1, 'running', { runId: 'run-b' })] },

package/src/commands/slash.js

@@ -682,6 +682,14 @@ function runtimeProvidersSection(session) {
     // never truncates and stays scannable.
     lines.push('capabilities:');
     for (const capability of capabilities) lines.push(`    ${capability}`);
+    // Configured in agent-runtimes.json but not served by the gateway (the
+    // list above is the intersection): say so, one per line, or the operator
+    // reads a shorter list without knowing the gateway lost its /config.
+    const drift = (session.runtimeProviderDrift ?? []).find((item) => item.runtimeId === runtimeId);
+    if (drift && drift.missing.length > 0) {
+      lines.push('not served by the gateway:');
+      for (const capability of drift.missing) lines.push(`    ${capability}`);
+    }
   }
   return sectionBlock('Agentic runtime', lines);
 }
@@ -886,7 +894,7 @@ function componentInstallAction(missingImages) {
   return missingImages.length > 0 ? 'downloaded-and-installed-missing-components' : null;
 }
 
-export function localizedOperationResult({ operation, target, status = 'succeeded', componentAction = null, images = [], detail = null }) {
+export function localizedOperationResult({ operation, target, status = 'succeeded', componentAction = null, images = [], detail = null, style = 'compact' }) {
   const facts = JSON.stringify({
     operation,
     target,
@@ -894,15 +902,21 @@ export function localizedOperationResult({ operation, target, status = 'succeede
     ...(componentAction ? { componentAction, images } : {}),
     ...(detail ? { detail } : {}),
   });
+  const instructions = style === 'report'
+    ? [
+        'Formule le résultat structuré suivant dans la langue et le ton demandés par le profil du workspace.',
+        "Décris ce qui a été fait : ce qui a été démarré, et l'état actuel de chaque service (en marche, en échec ou inconnu).",
+        'Réponds en deux ou trois phrases. Ne cite aucune commande, syntaxe shell, chemin de fichier, sortie docker ou identifiant.',
+      ]
+    : [
+        'Formule le résultat structuré suivant dans la langue et le ton demandés par le profil du workspace.',
+        'Réponds par une seule phrase humaine et naturelle.',
+        'Ne mentionne aucune commande, syntaxe shell, étape suivante ou détail technique.',
+      ];
   return {
     output: facts,
     rawOutput: true,
-    agentTrigger: [
-      'Formule le résultat structuré suivant dans la langue et le ton demandés par le profil du workspace.',
-      'Réponds par une seule phrase humaine et naturelle.',
-      'Ne mentionne aucune commande, syntaxe shell, étape suivante ou détail technique.',
-      `Résultat: ${facts}`,
-    ].join('\n'),
+    agentTrigger: [...instructions, `Résultat: ${facts}`].join('\n'),
   };
 }
 
@@ -1189,6 +1203,7 @@ export async function handleSlashCommand(line, context) {
       const startsAgents = service === 'all';
       const target = service === 'services' ? undefined : service;
       try {
+        let agentsResult = null;
         if (startsAgents) {
           // Validate the workspace half before mutating the global agents
           // stack. Otherwise `/start all` with no active workspace starts the
@@ -1196,18 +1211,48 @@ export async function handleSlashCommand(line, context) {
           if (!context.session.workspace || !context.session.workspacePath || !context.session.workspaceEnv?.WORKSPACE_NAME) {
             throw new Error('No workspace loaded. Use /use <workspace>.');
           }
-          const agentsResult = await runAgentCommand(startAgents, 'start');
+          agentsResult = await runAgentCommand(startAgents, 'start');
           if (agentsResult?.failed) return agentsResult;
         }
         step(`Services: starting ${target ?? 'workspace services'}…`);
-        const missingImages = await collectMissingImages(step, (opts) => startService(context.session, target, opts));
+        const started = [];
+        const missingImages = await collectMissingImages(step, async (opts) => {
+          const result = await startService(context.session, target, opts);
+          if (Array.isArray(result?.targets)) started.push(...result.targets);
+        });
         step('Services: refreshing MCP runtime…');
         await refreshMcpRuntimeStatus(context.session);
+        // The report is about what was done, so it names what started and how
+        // each service ended up. A failed state check says so instead of
+        // leaving every state "unknown" without a word.
+        let states = null;
+        try {
+          states = await serviceStates(context.session);
+        } catch (err) {
+          step(`Services: state check after start unavailable — ${rawFailureText(err)}`);
+        }
+        const agentsFacts = agentsResult ? parseJsonText(agentsResult.output) : null;
+        const detail = {
+          ...(agentsFacts && typeof agentsFacts === 'object' && !Array.isArray(agentsFacts) ? { agents: agentsFacts } : {}),
+          ...(started.length > 0
+            ? {
+                services: {
+                  started,
+                  states: started.map((name) => ({
+                    service: name,
+                    running: states?.[name] ? states[name].running : null,
+                  })),
+                },
+              }
+            : {}),
+        };
         return localizedOperationResult({
           operation: 'start',
           target: startsAgents ? 'all-services-and-agents' : (target || 'workspace-services'),
           componentAction: componentInstallAction(missingImages),
           images: missingImages,
+          detail: Object.keys(detail).length > 0 ? detail : null,
+          style: 'report',
         });
       } catch (err) {
         step(formatActivityError('services', 'start', err));

package/src/commands/slash.test.js

@@ -128,6 +128,34 @@ test('a started agent stack reloads the env and the MCP endpoints the script rew
   assert.match(runAgent, /await refreshMcpRuntimeStatus\(context\.session\)/);
 });
 
+test('start report style asks Donna to describe what was done, not a bare sentence', () => {
+  const result = localizedOperationResult({
+    operation: 'start',
+    target: 'wiki',
+    style: 'report',
+    detail: { services: { started: ['wiki'], states: [{ service: 'wiki', running: true }] } },
+  });
+  assert.deepEqual(JSON.parse(result.output).detail, {
+    services: { started: ['wiki'], states: [{ service: 'wiki', running: true }] },
+  });
+  assert.match(result.agentTrigger, /Décris ce qui a été fait/);
+  assert.match(result.agentTrigger, /en marche, en échec ou inconnu/);
+  assert.doesNotMatch(result.agentTrigger, /une seule phrase/);
+  assert.doesNotMatch(result.agentTrigger, /\/start|Docker|compose/);
+});
+
+test('/start captures what actually started and their resulting states', async () => {
+  const { readFile } = await import('node:fs/promises');
+  const source = await readFile(new URL('./slash.js', import.meta.url), 'utf8');
+  const start = source.slice(source.indexOf("case 'start': {"), source.indexOf("case 'stop': {"));
+
+  assert.match(start, /const started = \[\];/);
+  assert.match(start, /result\?\.targets/);
+  assert.match(start, /states = await serviceStates\(context\.session\)/);
+  assert.match(start, /running: states\?\.\[name\] \? states\[name\]\.running : null/);
+  assert.match(start, /style: 'report'/);
+});
+
 test('/start completes to the three documented targets', async () => {
   const { completionDescription } = await import('../shell/repl.js');
   const { matches } = completionContext('/start ', {});

package/src/core/buildInfo.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.15.73",
-  "commit": "b7de9bb"
+  "version": "0.15.76",
+  "commit": "2504dc9"
 }

package/src/core/env.js

@@ -11,6 +11,13 @@ const TEMPLATE_AUTHORING_CHAT_TOOLS = [
   'wiki_outline', 'template_read', 'template_write', 'build_context_write',
   'wiki_read_deliverable',
 ];
+// Same additive rule for the packaged cme allow-list: an install scaffolded
+// before the live search tools existed keeps the three legacy reads forever,
+// and /chat can never call cme_confluence_search — the LLM is offered a
+// server with no search and loops. A hand-edited list (not a superset of the
+// legacy default) is the operator's and stays untouched.
+const LEGACY_DEFAULT_CME_CHAT_TOOLS = ['cme_status', 'cme_sources_list', 'cme_export_status'];
+const CME_SEARCH_CHAT_TOOLS = ['cme_confluence_search', 'cme_wiki_search'];
 
 export function userManagerDir() {
   return process.cwd();
@@ -148,17 +155,25 @@ export function ensureManagerScaffold({ log = () => {} } = {}) {
           const missingWikiChatTools = migrateWikiChatTools
             ? TEMPLATE_AUTHORING_CHAT_TOOLS.filter((tool) => !wikiAllow.includes(tool))
             : [];
+          const cmeAllow = current.chatAccess?.servers?.cme?.allow;
+          const migrateCmeChatTools = Array.isArray(cmeAllow)
+            && LEGACY_DEFAULT_CME_CHAT_TOOLS.every((tool) => cmeAllow.includes(tool));
+          const missingCmeChatTools = migrateCmeChatTools
+            ? CME_SEARCH_CHAT_TOOLS.filter((tool) => !cmeAllow.includes(tool))
+            : [];
           if (missing.length > 0) {
             for (const key of missing) current[key] = example[key];
           }
           for (const key of missingServers) currentServers[key] = exampleServers[key];
           wikiAllow?.push(...missingWikiChatTools);
-          if (missing.length > 0 || missingServers.length > 0 || missingWikiChatTools.length > 0) {
+          cmeAllow?.push(...missingCmeChatTools);
+          const missingChatTools = [...missingWikiChatTools, ...missingCmeChatTools];
+          if (missing.length > 0 || missingServers.length > 0 || missingChatTools.length > 0) {
             writeFileSync(endpointsFile, `${JSON.stringify(current, null, 2)}\n`);
             const changes = [
               missing.length > 0 ? `keys: ${missing.join(', ')}` : '',
               missingServers.length > 0 ? `servers: ${missingServers.join(', ')}` : '',
-              missingWikiChatTools.length > 0 ? `chat tools: ${missingWikiChatTools.join(', ')}` : '',
+              missingChatTools.length > 0 ? `chat tools: ${missingChatTools.join(', ')}` : '',
             ].filter(Boolean).join('; ');
             created.push(`mcp.endpoints.json ${changes}`);
           }

package/src/core/env.test.js

@@ -141,6 +141,37 @@ test('scaffold upgrades the packaged wiki chat allow-list with template authorin
   });
 });
 
+test('scaffold upgrades the packaged cme chat allow-list with the live search tools', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    const example = JSON.parse(readFileSync('mcp.endpoints.example.json', 'utf8'));
+    example.chatAccess.servers.cme.allow = ['cme_status', 'cme_sources_list', 'cme_export_status'];
+    writeFileSync(endpointsFile, JSON.stringify(example, null, 2));
+
+    const changes = ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+
+    assert.ok(changes.some((item) => item.includes('cme_confluence_search')));
+    assert.deepEqual(after.chatAccess.servers.cme.allow, [
+      'cme_status', 'cme_sources_list', 'cme_export_status', 'cme_confluence_search', 'cme_wiki_search',
+    ]);
+  });
+});
+
+test('scaffold leaves a custom cme chat allow-list untouched', () => {
+  withTempManagerDir((dir) => {
+    const endpointsFile = join(dir, 'mcp.endpoints.json');
+    writeFileSync(endpointsFile, JSON.stringify({
+      mcpServers: {},
+      chatAccess: { servers: { cme: { allow: ['cme_status'] } } },
+    }, null, 2));
+
+    ensureManagerScaffold();
+    const after = JSON.parse(readFileSync(endpointsFile, 'utf8'));
+    assert.deepEqual(after.chatAccess.servers.cme.allow, ['cme_status']);
+  });
+});
+
 test('scaffold leaves a custom wiki chat allow-list untouched', () => {
   withTempManagerDir((dir) => {
     const endpointsFile = join(dir, 'mcp.endpoints.json');

package/src/core/mcp.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { managerEnvFile, managerMcpEndpointsFile, readEnvFile } from './env.js';
 
-const WIKI_MANAGER_VERSION = '0.15.73';
+const WIKI_MANAGER_VERSION = '0.15.76';
 
 function envValue(key) {
   const filePath = managerEnvFile();
@@ -756,8 +756,7 @@ export function parseToolCallName(name) {
 // tool name, route to it and report `normalized: true`; otherwise return
 // `server: null` with the list of candidate servers so the caller can raise
 // an explicit error. This is name normalization, never fuzzy matching — do
-// not extend it to description/similarity-based selection (plan directeur
-// §20 forbids that).
+// not extend it to description/similarity-based selection.
 export function resolveToolCallName(mcpStatus, name, extraServers = {}) {
   const parsed = parseToolCallName(name);
   if (parsed.server) return { ...parsed, normalized: false, candidates: [] };

package/src/core/skillCompiler.test.js

@@ -30,8 +30,8 @@ test('validation rejects technical routing details', () => {
   assert.throws(() => validateCompiledObjectives([{ text: 'agent: cme' }]), { code: 'skill_compile_failed' });
 });
 
-test('scaffold skills preserve existing capabilities and split only wiki-sync', async () => {
-  const expected = { pipeline: 1, 'wiki-ingest': 1, 'wiki-build': 1, deliver: 1, diagnose: 1, status: 1, 'new-template': 1, 'wiki-sync': 2 };
+test('every shipped scaffold skill compiles to a single intention', async () => {
+  const expected = { pipeline: 1, 'wiki-sync': 1, 'wiki-ingest': 1, 'wiki-build': 1, deliver: 1, diagnose: 1, status: 1, 'new-template': 1 };
   for (const [name, count] of Object.entries(expected)) {
     const raw = readFileSync(resolve('../llm-wiki/scaffold/workspace/.wiki/skills', `${name}.md`), 'utf8');
     const { meta, body } = parseFrontmatter(raw);
@@ -53,7 +53,7 @@ test('every objective of a chain carries the user parameters, not just the last'
   // Appending the parameters before splitting attached `source` to the ingest
   // step and left the export step — the one that consumes it — without it.
   const skill = {
-    name: 'wiki-sync',
+    name: 'collect-then-ingest',
     params: ['source'],
     body: 'Export the requested source.\n\nThen ingest what was exported.',
   };

package/src/core/startupCheck.js

@@ -357,13 +357,22 @@ export async function checkAgenticRuntimes({
   for (const { id, provider } of providers) {
     try {
       const description = await provider.describe();
+      const down = description.health === 'unavailable';
+      // Ask the runtime what it serves — describe() alone reflects /health,
+      // not the capability set, and a gateway that lost its config answers
+      // healthy with one default capability.
+      const capabilities = down ? [] : await provider.discoverCapabilities();
+      const missing = provider?.lastDiscovery?.missing ?? [];
       runtimes.push({
         name: id,
-        status: description.health === 'unavailable' ? 'failed' : 'connected',
-        capabilities: (description.capabilities ?? [])
+        status: down ? 'failed' : 'connected',
+        capabilities: (capabilities ?? [])
           .map((capability) => capability?.name ?? capability?.id ?? '')
           .filter(Boolean),
-        reason: description.health === 'unavailable' ? (description.error ?? 'unavailable') : null,
+        ...(missing.length > 0 ? { missingCapabilities: [...missing] } : {}),
+        reason: down
+          ? (description.error ?? 'unavailable')
+          : (missing.length > 0 ? `does not serve configured: ${missing.join(', ')}` : null),
       });
     } catch (err) {
       runtimes.push({ name: id, status: 'failed', reason: commandError(err) });

package/src/core/startupCheck.test.js

@@ -327,3 +327,31 @@ test('checkAgenticRuntimes reports a down runtime as failed', async () => {
   assert.equal(result.context.runtimes[0].status, 'failed');
   assert.match(result.detail, /pending/);
 });
+
+test('checkAgenticRuntimes asks the runtime what it serves and reports configured capabilities it does not', async () => {
+  const provider = {
+    runtime: 'deepagents',
+    lastDiscovery: null,
+    async describe() { return { runtime: 'deepagents', health: 'available', version: 't', protocolVersion: '1' }; },
+    async discoverCapabilities() {
+      this.lastDiscovery = { served: ['agent.review'], configured: ['agent.review', 'agent.notify'], missing: ['agent.notify'], extra: [] };
+      return [{ name: 'agent.review', operations: ['run'] }];
+    },
+    async execute() { throw new Error('unused'); },
+    async status() { throw new Error('unused'); },
+    async cancel() {},
+    async approve() {},
+    subscribe() { return () => {}; },
+  };
+  const result = await checkAgenticRuntimes({
+    loadConfig: () => [{ id: 'deepagents', type: 'deepagents', enabled: true }],
+    resolve: () => ({ providers: [{ id: 'deepagents', type: 'deepagents', provider }], skipped: [] }),
+    env: {},
+  });
+  assert.equal(result.ok, true);
+  const runtime = result.context.runtimes[0];
+  assert.equal(runtime.status, 'connected');
+  assert.deepEqual(runtime.capabilities, ['agent.review'], 'the served set, not the configured one');
+  assert.deepEqual(runtime.missingCapabilities, ['agent.notify']);
+  assert.match(runtime.reason, /does not serve configured: agent\.notify/);
+});

package/src/core/workflow.js

@@ -14,13 +14,11 @@ import { isTerminal } from '../orchestrator/taskStatuses.js';
 
 const RUNNING_STATUSES = new Set(['running', 'starting', 'queued', 'waiting', 'pending_approval']);
 
-// Canonical workflow projection for 0.9.6.
+// Canonical workflow projection.
 //
-// Decision: projectWorkflow consumes the existing event-sourced agentProjection
-// instead of replacing it in this release. agentProjection remains the
-// compatibility reducer/hydration format; workflow is the canonical read model
-// for Serve and ShellTUI. Future releases can move the reducer internals behind
-// this module without changing UI contracts.
+// projectWorkflow consumes the existing event-sourced agentProjection instead
+// of replacing it: agentProjection remains the compatibility reducer/hydration
+// format; workflow is the canonical read model for Serve and ShellTUI.
 export function projectWorkflow(state = {}, events = []) {
   const run = currentRun(state, events);
   const plan = Array.isArray(state.plan) ? state.plan : [];

package/src/orchestrator/objectiveResolver.test.js

@@ -92,7 +92,7 @@ test('resolveObjective disambiguates "export" of a Confluence source via alias,
   assert.equal(result.provider.agentInstanceId, 'cme-1');
 });
 
-test('resolveObjective resolves the ingest step of wiki-sync deterministically despite notification and guardrails', async () => {
+test('resolveObjective resolves an ingest objective deterministically despite notification and guardrails', async () => {
   const session = sessionWith([
     provider('production-1', knowledge),
     provider('production-2', publish),

package/src/orchestrator/providers/deepAgentsProvider.js

@@ -56,7 +56,10 @@ export function createDeepAgentsProvider({
     }
   }
 
-  return {
+  const provider = {
+    // Filled by discoverCapabilities: what the gateway served vs what the
+    // config declares. `null` until the first discovery.
+    lastDiscovery: null,
     async describe() {
       let health = 'available';
       let runtimeVersion = version ?? null;
@@ -77,10 +80,33 @@ export function createDeepAgentsProvider({
         ...(lastError ? { error: lastError } : {}),
       };
     },
+    // The gateway is ALWAYS asked what it serves. The static config (the
+    // manager's agent-runtimes.json entry) carries the richer metadata the
+    // resolver routes on — mutationClass, aliases, aliasOperations — but it is
+    // a declaration, not an observation: a gateway that lost its /config
+    // mount degrades to its built-in default and the manager, trusting the
+    // config alone, kept listing eight capabilities it could not govern.
+    // Only the capabilities BOTH declare are offered; the difference is
+    // exposed as `lastDiscovery` so /status and the runtime log can say why a
+    // configured capability is missing.
     async discoverCapabilities() {
-      if (Array.isArray(capabilities)) return capabilities;
       const list = await httpJson('/capabilities');
-      return Array.isArray(list) ? list : [];
+      const served = (Array.isArray(list) ? list : [])
+        .filter((item) => item && typeof item === 'object' && typeof item.name === 'string' && item.name.trim());
+      const servedNames = served.map((item) => item.name);
+      if (!Array.isArray(capabilities)) {
+        provider.lastDiscovery = { served: servedNames, configured: null, missing: [], extra: [] };
+        return served;
+      }
+      const configuredNames = capabilities.map((item) => String(item?.name ?? ''));
+      const offered = capabilities.filter((item) => servedNames.includes(String(item?.name ?? '')));
+      provider.lastDiscovery = {
+        served: servedNames,
+        configured: configuredNames,
+        missing: configuredNames.filter((name) => !servedNames.includes(name)),
+        extra: servedNames.filter((name) => !configuredNames.includes(name)),
+      };
+      return offered;
     },
     async execute(request = {}) {
       const accepted = await httpJson('/runs', {
@@ -165,4 +191,5 @@ export function createDeepAgentsProvider({
       return () => controller.abort();
     },
   };
+  return provider;
 }

package/src/orchestrator/providers/deepAgentsProvider.test.js

@@ -74,16 +74,44 @@ test('discoverCapabilities fetches /capabilities', async () => {
   assert.deepEqual(await provider.discoverCapabilities(), [{ name: 'agent.review', operations: ['run'] }]);
 });
 
-test('discoverCapabilities uses the static config when provided', async () => {
-  const fetchImpl = mockFetch({});
+test('discoverCapabilities keeps the configured metadata but only for capabilities the gateway serves', async () => {
+  const fetchImpl = mockFetch({
+    'GET /capabilities': () => jsonResponse(200, [
+      { name: 'agent.review', operations: ['run'] },
+      { name: 'agent.notify', operations: ['run'] },
+    ]),
+  });
   const provider = createDeepAgentsProvider({
     endpoint: 'http://agent-runtime:8080',
-    capabilities: [{ name: 'agent.review', operations: ['run'] }],
+    capabilities: [
+      { name: 'agent.review', operations: ['run'], aliases: ['audit'] },
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
     fetchImpl,
   });
 
+  const offered = await provider.discoverCapabilities();
+  assert.equal(fetchImpl.calls.length, 1, 'the gateway is always asked what it serves');
+  assert.deepEqual(offered.map((item) => item.name), ['agent.review', 'agent.notify']);
+  assert.equal(offered[0].aliases[0], 'audit', 'the configured metadata is what the resolver routes on');
+  assert.deepEqual(provider.lastDiscovery, {
+    served: ['agent.review', 'agent.notify'],
+    configured: ['agent.review', 'agent.research', 'agent.notify'],
+    missing: ['agent.research'],
+    extra: [],
+  });
+});
+
+test('discoverCapabilities with no static config serves the gateway list as-is', async () => {
+  const fetchImpl = mockFetch({
+    'GET /capabilities': () => jsonResponse(200, [{ name: 'agent.review', operations: ['run'] }]),
+  });
+  const provider = createDeepAgentsProvider({ endpoint: 'http://agent-runtime:8080', fetchImpl });
+
   assert.deepEqual(await provider.discoverCapabilities(), [{ name: 'agent.review', operations: ['run'] }]);
-  assert.equal(fetchImpl.calls.length, 0, 'no HTTP call when capabilities are static');
+  assert.deepEqual(provider.lastDiscovery.missing, []);
+  assert.equal(provider.lastDiscovery.configured, null);
 });
 
 test('execute POSTs /runs and returns the runId', async () => {

package/src/orchestrator/providers/runtimeProviders.js

@@ -24,6 +24,11 @@ export async function discoverRuntimeProviderAgents(runtimeProviders) {
     : (runtimeProviders?.list?.() ?? []);
   const agents = [];
   const unavailable = [];
+  // Configured-but-not-served capabilities, per runtime (deepagents providers
+  // fill `lastDiscovery`). A drift is not an outage: the runtime stays
+  // available with the capabilities it really serves, and the difference is
+  // reported so an operator can see WHY agent.research is not routable.
+  const drift = [];
 
   for (const entry of providers) {
     const provider = entry?.provider ?? entry;
@@ -53,9 +58,13 @@ export async function discoverRuntimeProviderAgents(runtimeProviders) {
     for (const capability of capabilities ?? []) {
       agents.push(runtimeProviderAgent(runtimeId, provider, description, capability, health));
     }
+    const discovery = provider?.lastDiscovery;
+    if (discovery && Array.isArray(discovery.missing) && discovery.missing.length > 0) {
+      drift.push({ runtimeId, missing: [...discovery.missing], served: [...(discovery.served ?? [])] });
+    }
   }
 
-  return { agents, unavailable };
+  return { agents, unavailable, drift };
 }
 
 /**
@@ -254,7 +263,10 @@ export async function discoverRuntimeProvidersOnce(session, {
     },
   });
   const resolved = resolveRuntimeProviders(entries);
-  const { agents, unavailable } = await discoverRuntimeProviderAgents(resolved.providers);
+  const { agents, unavailable, drift } = await discoverRuntimeProviderAgents(resolved.providers);
+  // Exposed for /status: which configured capabilities the runtime does not
+  // serve right now. Replaced on every scan — a recovered gateway clears it.
+  session.runtimeProviderDrift = drift;
 
   // A failed probe is not a lost agent (same rule as agentRegistry): a runtime
   // that reported unavailable this round but for which we hold a last-known-good
@@ -330,6 +342,20 @@ export async function discoverRuntimeProvidersOnce(session, {
         : `agent-runtimes: ${item.runtimeId} unavailable (${item.error})`);
     }
   }
+  // Same edge-triggered rule for a capability drift: announced when it
+  // appears (or changes), silent while it persists, announced again after a
+  // recovery.
+  session._runtimeProviderDriftAnnounced ??= new Map();
+  const announced = session._runtimeProviderDriftAnnounced;
+  const currentDrift = new Map(drift.map((item) => [item.runtimeId, item.missing.join(',')]));
+  for (const item of drift) {
+    if (announced.get(item.runtimeId) === currentDrift.get(item.runtimeId)) continue;
+    dispatchRuntimeLog(session, `agent-runtimes: ${item.runtimeId} does not serve ${item.missing.length} configured capabilit${item.missing.length === 1 ? 'y' : 'ies'} (${item.missing.join(', ')}) — it serves ${item.served.join(', ') || 'nothing'}; check the gateway's /config mount (agent-runtimes.json)`);
+  }
+  for (const id of [...announced.keys()]) {
+    if (!currentDrift.has(id)) announced.delete(id);
+  }
+  for (const [id, key] of currentDrift) announced.set(id, key);
   session._runtimeProviderDown = currentDown;
   return effectiveAgents;
 }

package/src/orchestrator/providers/runtimeProviders.test.js

@@ -265,6 +265,54 @@ test('discoverRuntimeProvidersOnce announces a down runtime only once across re-
   assert.equal(logs.length, 1, 'the degradation is announced once, not on every re-scan');
 });
 
+test('a gateway serving fewer capabilities than configured is a drift: offered = intersection, announced once, cleared on recovery', async () => {
+  const session = sessionWithEvents();
+  const config = [{
+    id: 'deepagents', type: 'deepagents', endpoint: 'http://127.0.0.1:7789', enabled: true,
+    capabilities: [
+      { name: 'agent.review', operations: ['run'] },
+      { name: 'agent.research', operations: ['run'], mutationClass: 'ingest' },
+      { name: 'agent.notify', operations: ['run'], defaultRequiresApproval: true },
+    ],
+  }];
+  const originalFetch = globalThis.fetch;
+  let served = [{ name: 'agent.review', operations: ['run'] }];
+  globalThis.fetch = async (url) => {
+    if (String(url).includes('/health')) return new Response(JSON.stringify({ ok: true, version: 't' }), { status: 200, headers: { 'content-type': 'application/json' } });
+    if (String(url).includes('/capabilities')) return new Response(JSON.stringify(served), { status: 200, headers: { 'content-type': 'application/json' } });
+    throw new Error('unexpected probe ' + String(url));
+  };
+  try {
+    await discoverRuntimeProvidersOnce(session, { config });
+    await discoverRuntimeProvidersOnce(session, { config });
+    const driftLogs = () => (session.agentEvents ?? []).filter((event) => event.type === 'runtime_log'
+      && String(event.payload?.message ?? '').includes('does not serve'));
+
+    // Only what the gateway serves is routable — a governed capability the
+    // gateway would run ungoverned is not offered at all.
+    assert.deepEqual(session.runtimeProviderAgents.map((agent) => agent.agentInstanceId), ['deepagents::agent.review']);
+    assert.deepEqual(session.runtimeProviderDrift, [{
+      runtimeId: 'deepagents', missing: ['agent.research', 'agent.notify'], served: ['agent.review'],
+    }]);
+    assert.equal(driftLogs().length, 1, 'announced once across re-scans');
+    assert.match(String(driftLogs()[0].payload.message), /does not serve 2 configured capabilities \(agent\.research, agent\.notify\)/);
+    assert.match(String(driftLogs()[0].payload.message), /\/config mount/);
+
+    // The gateway recovers its config: no drift, all three routable.
+    served = config[0].capabilities.map(({ name, operations }) => ({ name, operations }));
+    await discoverRuntimeProvidersOnce(session, { config });
+    assert.equal(session.runtimeProviderAgents.length, 3);
+    assert.deepEqual(session.runtimeProviderDrift, []);
+
+    // …and a later drift is announced again.
+    served = [{ name: 'agent.review', operations: ['run'] }];
+    await discoverRuntimeProvidersOnce(session, { config });
+    assert.equal(driftLogs().length, 2);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 test('an HTTP 401 gateway probe is announced as not-ready with the ⚠ glyph, not as a failure', async () => {
   const session = sessionWithEvents();
   const originalFetch = globalThis.fetch;

package/src/runtime/server.js

@@ -1422,9 +1422,8 @@ function rejectPlanPatch(context, store, patchId, reason) {
   };
 }
 
-// Classifier for control §4.2 of the plan directeur. The plan expects an
-// LLM-backed classification — "the classification LLM se trompera" — and this
-// is that, now: the only deterministic matches left are the runtime's own
+// Classifier for the control lane's free-text messages. The classification is
+// LLM-backed: the only deterministic matches left are the runtime's own
 // control verbs (cancel, an explicit "later/queue", status and plan-change
 // wording). Deciding "is this a NEW task to queue vs plain conversation" is a
 // semantic judgement about the workspace's domain, so it is never a keyword

package/src/runtime/server.test.js

@@ -1606,7 +1606,7 @@ test('runtime server handle drains a pre-existing hydrated control request', asy
 test('POST /run compiles a workspace skill into a sequential runtime chain', async (t) => {
   const root = mkdtempSync(join(tmpdir(), 'runtime-skill-'));
   mkdirSync(join(root, '.wiki', 'skills'), { recursive: true });
-  writeFileSync(join(root, '.wiki', 'skills', 'wiki-sync.md'), '---\nname: wiki-sync\nparams:\n  - source\n---\nExport the source.\n\nThen ingest the files.');
+  writeFileSync(join(root, '.wiki', 'skills', 'sync-ingest.md'), '---\nname: sync-ingest\nparams:\n  - source\n---\nExport the source.\n\nThen ingest the files.');
   const session = { workspace: 'acme', workspacePath: root, controlQueue: [] };
   const context = { workspace: 'acme', session, running: false, currentAbortController: null };
   let startedBody = null;
@@ -1623,7 +1623,7 @@ test('POST /run compiles a workspace skill into a sequential runtime chain', asy
     throw err;
   }
   try {
-    const response = await fetch(`http://127.0.0.1:${handle.port}/run?workspace=acme`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ input: '/wiki-sync docs' }) });
+    const response = await fetch(`http://127.0.0.1:${handle.port}/run?workspace=acme`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ input: '/sync-ingest docs' }) });
     const body = await response.json();
     assert.equal(response.status, 202);
     assert.equal(body.kind, 'skill_chain');
@@ -1633,15 +1633,15 @@ test('POST /run compiles a workspace skill into a sequential runtime chain', asy
     assert.equal(session.controlQueue[1].status, 'queued');
     assert.equal(session.controlQueue[0].chainId, session.controlQueue[1].chainId);
     assert.equal('capabilityPlan' in session.controlQueue[0], false);
-    assert.equal(session.controlQueue[0].input, '/wiki-sync source="docs"');
+    assert.equal(session.controlQueue[0].input, '/sync-ingest source="docs"');
     assert.equal(session.controlQueue[0].skillExecution, 'orchestrated');
     assert.match(startedBody.input, /Export the source/);
-    assert.equal(startedBody.publicInput, '/wiki-sync source="docs"');
+    assert.equal(startedBody.publicInput, '/sync-ingest source="docs"');
     assert.equal(startedBody.skillChain.execution, 'orchestrated');
     assert.equal(startedBody.requireApproval, true);
     assert.notEqual(startedBody.autoApprove, true);
     assert.deepEqual(session.agentProjection.conversation, [
-      { role: 'user', content: '/wiki-sync docs' },
+      { role: 'user', content: '/sync-ingest docs' },
     ]);
     assert.doesNotMatch(JSON.stringify(session.agentEvents), /Export the source|Then ingest the files/);
   } finally {

package/src/runtime/skillChain.e2e.test.js

@@ -132,26 +132,31 @@ test('E2E-001 pipeline: one objective, one run, internal plan left untouched', a
   assert.equal(env.chain().length, 1);
 });
 
-test('E2E-002 wiki-sync: two objectives, two ordered runs, one chainId', async (t) => {
-  const env = await harness(t, { skills: { 'wiki-sync': null } });
+test('E2E-002 multi-step skill: two objectives, two ordered runs, one chainId', async (t) => {
+  // No shipped skill splits any more (each is one intention); a user-authored
+  // body with a strong connector still must.
+  const env = await harness(t, {
+    skills: {
+      'sync-ingest': '---\nname: sync-ingest\nparams: []\n---\nExport every configured Confluence source.\n\nThen ingest the exported Markdown into the wiki.',
+    },
+  });
   if (!env) return;
 
-  const { body } = await env.post('/run?workspace=acme', { input: '/wiki-sync' });
+  const { body } = await env.post('/run?workspace=acme', { input: '/sync-ingest' });
   await env.settle();
 
   assert.equal(body.objectives, 2);
   assert.equal(env.runs.length, 2, 'the second objective must run after the first');
   assert.match(env.runs[0].input, /^Export every configured Confluence source/);
-  assert.match(env.runs[1].input, /^Run the production pipeline step ingest over the newly exported Markdown/);
-  // CME first, Production second — the skill carries no source parameter, so
-  // no run may receive a source selector (the export step must stay "all").
+  assert.match(env.runs[1].input, /^Ingest the exported Markdown/);
+  // The skill carries no parameter, so no run may receive a selector.
   for (const run of env.runs) assert.doesNotMatch(run.input, /User parameters:/);
   const items = env.chain();
   assert.equal(items.length, 2);
   assert.equal(items[0].chainId, items[1].chainId);
   assert.equal(items[0].chainId, body.chainId);
   assert.deepEqual(items.map((item) => item.status), ['done', 'done']);
-  assert.deepEqual(items.map((item) => item.skillName), ['wiki-sync', 'wiki-sync']);
+  assert.deepEqual(items.map((item) => item.skillName), ['sync-ingest', 'sync-ingest']);
 });
 
 test('E2E-002b parameters reach every objective of a multi-step skill', async (t) => {
@@ -220,13 +225,13 @@ test('E2E-003 cancel: the running step and its chain stop, unrelated queue survi
 // that silently fragments would show up as extra runs, not as extra objectives.
 const PERFORMANCE_TABLE = {
   pipeline: 1,
+  'wiki-sync': 1,
   'wiki-ingest': 1,
   'wiki-build': 1,
   deliver: 1,
   diagnose: 1,
   status: 1,
   'new-template': 1,
-  'wiki-sync': 2,
 };
 
 for (const [name, expected] of Object.entries(PERFORMANCE_TABLE)) {