@haaaiawd/second-nature 0.1.25 → 0.1.27

package/runtime/cli/read-models/index.js

@@ -12,6 +12,8 @@ import { mapOperatorExplainToReadModel } from "./operator-explain-map.js";
 import { loadOperatorFallbackRow, toOperatorFallbackView, } from "../../storage/fallback/load-operator-fallback.js";
 import { loadRhythmPolicySnapshot, } from "../../storage/rhythm/rhythm-policy-snapshot.js";
 import { createNarrativeStateStore } from "../../storage/narrative/narrative-state-store.js";
+import { createRelationshipMemoryStore } from "../../storage/relationship/relationship-memory-store.js";
+import { probeCredentialHealth } from "../../storage/services/credential-vault.js";
 const INTERNAL_RUNTIME_PLATFORM_ID = "second-nature-runtime";
 const INTERNAL_RUNTIME_TRACE_PREFIX = "sn-runtime-";
 function toExplainQuery(subject) {
@@ -31,6 +33,8 @@ function toExplainQuery(subject) {
             return { kind: "delivery", auditId: subject.id };
         case "source_ref":
             return { kind: "source_ref", sourceRefId: subject.id };
+        case "relationship":
+            return { kind: "relationship", relationshipId: subject.id };
         default:
             return undefined;
     }
@@ -47,6 +51,8 @@ function buildCredentialNextStep(status) {
         return "submit_verification_answer";
     if (status === "expired" || status === "revoked" || status === "failed")
         return "refresh_credential_context";
+    if (status === "decrypt_failed")
+        return "verify_or_re_create_credential_then_re_import";
     return undefined;
 }
 /**
@@ -207,12 +213,28 @@ async function buildBaseStatus(deps) {
                 : undefined,
         },
         connectors: connectorSummary,
-        credentials: credentials.map((item) => ({
-            platformId: item.platformId ??
-                item.platform_id,
-            status: item.status,
-            nextStep: buildCredentialNextStep(item.status),
-        })),
+        credentials: credentials.map((item) => {
+            const platformId = item.platformId ??
+                item.platform_id;
+            const encryptedValue = item.encryptedValue ??
+                item.encrypted_value;
+            const baseUrl = item.baseUrl ??
+                item.base_url;
+            const health = probeCredentialHealth(platformId, encryptedValue, baseUrl);
+            const effectiveStatus = health.state === "decrypt_failed"
+                ? "decrypt_failed"
+                : item.status;
+            return {
+                platformId,
+                status: effectiveStatus,
+                nextStep: health.diagnosticCode === "missing_runtime_secret"
+                    ? "set_SECOND_NATURE_ENCRYPTION_KEY_then_re_probe"
+                    : health.diagnosticCode === "credential_recovery_required"
+                        ? "verify_or_re_create_credential_then_re_import"
+                        : buildCredentialNextStep(effectiveStatus),
+                keyHealth: health.keyHealth,
+            };
+        }),
         risk: {
             level: riskFlags.length > 0 ? "medium" : "low",
             flags: riskFlags,
@@ -325,19 +347,40 @@ export function createCliReadModels(deps) {
                 record = undefined;
             }
             if (!record) {
+                // T1.4.1: even when no row exists, probe key health so status can surface
+                // missing_runtime_secret rather than a generic "missing".
+                const health = probeCredentialHealth(platformId, null, null);
                 return {
                     platformId,
-                    status: "missing",
-                    nextStep: "provide_credential_context",
+                    status: health.state,
+                    nextStep: health.diagnosticCode === "missing_runtime_secret"
+                        ? "set_SECOND_NATURE_ENCRYPTION_KEY_then_re_probe"
+                        : "provide_credential_context",
+                    keyHealth: health.keyHealth,
                 };
             }
+            // T1.4.1: attempt decryption to detect decrypt_failed / wrong_key.
+            const encryptedValue = record.encryptedValue ??
+                record.encrypted_value;
+            const baseUrl = record.baseUrl ??
+                record.base_url;
+            const health = probeCredentialHealth(platformId, encryptedValue, baseUrl);
+            // If decryption failed, surface the honest diagnostic; otherwise surface DB status.
+            const effectiveStatus = health.state === "decrypt_failed"
+                ? "decrypt_failed"
+                : record.status;
             return {
                 platformId: record.platformId ??
                     record.platform_id,
-                status: record.status,
+                status: effectiveStatus,
                 verificationDeadline: record.expiresAt ?? undefined,
                 attemptsRemaining: record.attemptsRemaining ?? undefined,
-                nextStep: buildCredentialNextStep(record.status),
+                nextStep: health.diagnosticCode === "missing_runtime_secret"
+                    ? "set_SECOND_NATURE_ENCRYPTION_KEY_then_re_probe"
+                    : health.diagnosticCode === "credential_recovery_required"
+                        ? "verify_or_re_create_credential_then_re_import"
+                        : buildCredentialNextStep(effectiveStatus),
+                keyHealth: health.keyHealth,
             };
         },
         async loadFallbackView(ref) {
@@ -390,6 +433,34 @@ export function createCliReadModels(deps) {
                     evidenceRefs: [],
                 };
             }
+            // T1.4.2: relationship explain reads RelationshipMemory store directly.
+            if (subject.kind === "relationship") {
+                const relationshipStore = createRelationshipMemoryStore(deps.stateDb);
+                const memory = await relationshipStore.loadRelationshipMemory(subject.id);
+                if (!memory) {
+                    return {
+                        subjectType: "relationship",
+                        conclusion: "nothing_yet",
+                        keyFactors: ["no_relationship_memory_recorded"],
+                        evidenceRefs: [],
+                        nextStep: "interact_with_agent_then_re_check",
+                    };
+                }
+                return {
+                    subjectType: "relationship",
+                    conclusion: `tone:${memory.tonePreference} replies:${memory.noReplyCount === 0 ? "responsive" : "cooldown"}`,
+                    keyFactors: [
+                        `tone_preference:${memory.tonePreference}`,
+                        ...(memory.averageReplyDelayMinutes
+                            ? [`avg_reply_delay_minutes:${memory.averageReplyDelayMinutes}`]
+                            : []),
+                        ...(memory.topicAffinities.length > 0
+                            ? [`topics:${memory.topicAffinities.map((t) => t.topic).join(",")}`]
+                            : ["insufficient_history"]),
+                    ],
+                    evidenceRefs: memory.sourceRefs.map((s) => s.sourceId),
+                };
+            }
             const query = subject.kind === "decision" ||
                 subject.kind === "platform-selection" ||
                 subject.kind === "outreach"

package/runtime/cli/read-models/types.d.ts

@@ -25,8 +25,10 @@ export interface ConnectorSummary {
 }
 export interface CredentialSummary {
     platformId: string;
-    status: "missing" | "pending_verification" | "active" | "expired" | "revoked" | "failed";
+    status: "missing" | "pending_verification" | "active" | "expired" | "revoked" | "failed" | "decrypt_failed";
     nextStep?: string;
+    /** T1.4.1 — diagnostic key health without leaking raw secret. */
+    keyHealth?: "missing_key" | "wrong_key" | "ok";
 }
 export interface RiskSummary {
     level: "low" | "medium" | "high";
@@ -129,12 +131,17 @@ export interface SessionDetailReadModel {
 }
 export interface CredentialReadModel {
     platformId: string;
-    status: "missing" | "pending_verification" | "active" | "expired" | "revoked" | "failed";
+    status: "missing" | "pending_verification" | "active" | "expired" | "revoked" | "failed" | "decrypt_failed";
     verificationDeadline?: string;
     attemptsRemaining?: number;
     nextStep?: string;
+    /**
+     * T1.4.1 — redacted diagnostic: when true, the raw encrypted value could not be
+     * decrypted because SECOND_NATURE_ENCRYPTION_KEY is missing or wrong.
+     */
+    keyHealth?: "missing_key" | "wrong_key" | "ok";
 }
-export type ExplainSubjectKind = "decision" | "platform-selection" | "outreach" | "soul-change" | "fallback" | "probe" | "delivery" | "report" | "source_ref";
+export type ExplainSubjectKind = "decision" | "platform-selection" | "outreach" | "soul-change" | "fallback" | "probe" | "delivery" | "report" | "source_ref" | "relationship";
 export interface ExplainReadModel {
     subjectType: ExplainSubjectKind;
     conclusion: string;

package/runtime/connectors/base/manifest.d.ts

@@ -1,77 +1,77 @@
-import { z } from "zod";
-import { type CapabilityIntent, type ChannelType } from "./contract.js";
-declare const connectorManifestSchema: z.ZodObject<{
-    platformId: z.ZodString;
-    supportedCapabilities: z.ZodArray<z.ZodEnum<{
-        "feed.read": "feed.read";
-        "post.publish": "post.publish";
-        "comment.reply": "comment.reply";
-        "notification.list": "notification.list";
-        "message.send": "message.send";
-        "agent.register": "agent.register";
-        "agent.heartbeat": "agent.heartbeat";
-        "work.discover": "work.discover";
-        "task.claim": "task.claim";
-    }>>;
-    channelPriority: z.ZodArray<z.ZodEnum<{
-        api_rest: "api_rest";
-        api_rpc: "api_rpc";
-        a2a: "a2a";
-        mcp: "mcp";
-        cli: "cli";
-        skill: "skill";
-        browser: "browser";
-    }>>;
-    credentialTypes: z.ZodArray<z.ZodString>;
-    degradedChannels: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        api_rest: "api_rest";
-        api_rpc: "api_rpc";
-        a2a: "a2a";
-        mcp: "mcp";
-        cli: "cli";
-        skill: "skill";
-        browser: "browser";
-    }>>>;
-    sourceRefPolicy: z.ZodOptional<z.ZodObject<{
-        minSourceRefs: z.ZodDefault<z.ZodNumber>;
-        rejectInlineSensitivePayload: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type ConnectorManifest = z.infer<typeof connectorManifestSchema>;
-export interface ResolvedConnectorCapability {
-    platformId: string;
-    intent: CapabilityIntent;
-    source: "namespace" | "v5_explicit" | "unambiguous_default";
-}
-export declare class CapabilityContractRegistry {
-    private readonly byPlatform;
-    register(manifest: ConnectorManifest): void;
-    loadManifest(platformId: string): ConnectorManifest;
-    listRegisteredPlatformIds(): string[];
-    hasCapability(platformId: string, intent: CapabilityIntent): boolean;
-    listCapabilities(platformId: string): CapabilityIntent[];
-    listChannels(platformId: string): ChannelType[];
-    /**
-     * Resolve a capability string that may be namespaced (`platformId:capability`)
-     * or a bare v5 capability. Returns the platform + intent pair.
-     * If bare capability and no explicit platform is provided, only succeeds when
-     * exactly one registered platform supports it (unambiguous_default).
-     */
-    resolveCapability(intentWithNamespace: string, explicitPlatformId?: string): ResolvedConnectorCapability;
-    findPlatformsForIntent(intent: CapabilityIntent): string[];
-}
-/** T3.1.1 contract name for manifest-first registry. */
-export declare const ConnectorManifestRegistry: typeof CapabilityContractRegistry;
-export type ConnectorManifestRegistry = CapabilityContractRegistry;
-export declare function describeConnector(registry: CapabilityContractRegistry, platformId: string): ConnectorManifest;
-export declare function checkConnector(registry: CapabilityContractRegistry, platformId: string): {
-    ok: boolean;
-    errors: string[];
-};
-export declare function discoverCapabilities(registry: CapabilityContractRegistry): Array<{
-    platformId: string;
-    capabilities: CapabilityIntent[];
-    degradedChannels?: ChannelType[];
-}>;
-export declare function parseConnectorManifest(input: unknown): ConnectorManifest;
-export {};
+import { z } from "zod";
+import { type CapabilityIntent, type ChannelType } from "./contract.js";
+declare const connectorManifestSchema: z.ZodObject<{
+    platformId: z.ZodString;
+    supportedCapabilities: z.ZodArray<z.ZodEnum<{
+        "feed.read": "feed.read";
+        "post.publish": "post.publish";
+        "comment.reply": "comment.reply";
+        "notification.list": "notification.list";
+        "message.send": "message.send";
+        "agent.register": "agent.register";
+        "agent.heartbeat": "agent.heartbeat";
+        "work.discover": "work.discover";
+        "task.claim": "task.claim";
+    }>>;
+    channelPriority: z.ZodArray<z.ZodEnum<{
+        api_rest: "api_rest";
+        api_rpc: "api_rpc";
+        a2a: "a2a";
+        mcp: "mcp";
+        cli: "cli";
+        skill: "skill";
+        browser: "browser";
+    }>>;
+    credentialTypes: z.ZodArray<z.ZodString>;
+    degradedChannels: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        api_rest: "api_rest";
+        api_rpc: "api_rpc";
+        a2a: "a2a";
+        mcp: "mcp";
+        cli: "cli";
+        skill: "skill";
+        browser: "browser";
+    }>>>;
+    sourceRefPolicy: z.ZodOptional<z.ZodObject<{
+        minSourceRefs: z.ZodDefault<z.ZodNumber>;
+        rejectInlineSensitivePayload: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ConnectorManifest = z.infer<typeof connectorManifestSchema>;
+export interface ResolvedConnectorCapability {
+    platformId: string;
+    intent: CapabilityIntent;
+    source: "namespace" | "v5_explicit" | "unambiguous_default";
+}
+export declare class CapabilityContractRegistry {
+    private readonly byPlatform;
+    register(manifest: ConnectorManifest): void;
+    loadManifest(platformId: string): ConnectorManifest;
+    listRegisteredPlatformIds(): string[];
+    hasCapability(platformId: string, intent: CapabilityIntent): boolean;
+    listCapabilities(platformId: string): CapabilityIntent[];
+    listChannels(platformId: string): ChannelType[];
+    /**
+     * Resolve a capability string that may be namespaced (`platformId:capability`)
+     * or a bare v5 capability. Returns the platform + intent pair.
+     * If bare capability and no explicit platform is provided, only succeeds when
+     * exactly one registered platform supports it (unambiguous_default).
+     */
+    resolveCapability(intentWithNamespace: string, explicitPlatformId?: string): ResolvedConnectorCapability;
+    findPlatformsForIntent(intent: CapabilityIntent): string[];
+}
+/** T3.1.1 contract name for manifest-first registry. */
+export declare const ConnectorManifestRegistry: typeof CapabilityContractRegistry;
+export type ConnectorManifestRegistry = CapabilityContractRegistry;
+export declare function describeConnector(registry: CapabilityContractRegistry, platformId: string): ConnectorManifest;
+export declare function checkConnector(registry: CapabilityContractRegistry, platformId: string): {
+    ok: boolean;
+    errors: string[];
+};
+export declare function discoverCapabilities(registry: CapabilityContractRegistry): Array<{
+    platformId: string;
+    capabilities: CapabilityIntent[];
+    degradedChannels?: ChannelType[];
+}>;
+export declare function parseConnectorManifest(input: unknown): ConnectorManifest;
+export {};

package/runtime/core/second-nature/feedback/owner-reply-feedback.d.ts

@@ -0,0 +1,46 @@
+/**
+ * T4.2.1 — Owner reply ingestion and RelationshipMemory feedback loop.
+ *
+ * When an owner replies to an outreach, this function:
+ * 1. Appends a `SessionChronicle` entry with the reply context.
+ * 2. Loads the current `RelationshipMemory`.
+ * 3. Infers tone/timing/topic from the reply text and updates the memory.
+ * 4. Persists the updated `RelationshipMemory` with source refs pointing to the chronicle entry.
+ *
+ * Boundaries:
+ * - Does NOT generate outreach drafts; that is the guidance layer's job.
+ * - Does NOT execute connectors; this is a pure state update path.
+ * - Errors in relationship update must not break chronicle write (chronicle is source of truth).
+ */
+import type { StateDatabase } from "../../../storage/db/index.js";
+import { type OwnerReplySignal } from "../../../storage/chronicle/session-chronicle-store.js";
+import { type RelationshipMemory, type TopicAffinity } from "../../../storage/relationship/relationship-memory-store.js";
+export interface ReplyInferenceConfig {
+    positiveKeywords?: string[];
+    negativeKeywords?: string[];
+    busyKeywords?: string[];
+    topicPatterns?: Record<string, string[]>;
+}
+export declare function inferTone(text: string, config?: ReplyInferenceConfig): "casual" | "direct" | "quiet" | "unknown";
+export declare function inferTiming(text: string, config?: ReplyInferenceConfig): "responsive" | "busy" | undefined;
+export declare function inferTopics(text: string, config?: ReplyInferenceConfig): string[];
+export declare function mergeTopicAffinities(existing: TopicAffinity[], newTopics: string[]): TopicAffinity[];
+export interface ProcessOwnerReplyInput {
+    /** The raw reply text from the owner. */
+    replyText: string;
+    /** The decisionId of the outreach this reply is responding to. */
+    relatedDecisionId: string;
+    /** Optional explicit owner signal (parsed by host or explicit UI). */
+    explicitSignal?: OwnerReplySignal;
+}
+export interface ProcessOwnerReplyResult {
+    chronicleEntryId: string;
+    relationshipUpdated: boolean;
+    priorMemory?: RelationshipMemory;
+    updatedMemory?: RelationshipMemory;
+    relationshipUpdateError?: string;
+}
+/**
+ * Process an owner reply: write chronicle, update RelationshipMemory.
+ */
+export declare function processOwnerReply(input: ProcessOwnerReplyInput, state: StateDatabase): Promise<ProcessOwnerReplyResult>;

package/runtime/core/second-nature/feedback/owner-reply-feedback.js

@@ -0,0 +1,159 @@
+import { createSessionChronicleStore, } from "../../../storage/chronicle/session-chronicle-store.js";
+import { createRelationshipMemoryStore, } from "../../../storage/relationship/relationship-memory-store.js";
+const DEFAULT_POSITIVE_KEYWORDS = [
+    "agree", "thanks", "appreciate", "helpful", "good", "great", "love", "like", "enjoy",
+    "excited", "happy", "nice", "wonderful", "awesome", "perfect", "cool", "ok", "yes",
+];
+const DEFAULT_NEGATIVE_KEYWORDS = [
+    "disagree", "frustrated", "annoying", "bad", "hate", "dislike", "angry", "upset",
+    "disappointed", "concerned", "no", "not", "never", "wrong", "terrible", "awful",
+    "useless", "stop", "don't",
+];
+const DEFAULT_BUSY_KEYWORDS = [
+    "busy", "swamped", "occupied", "tight schedule", "no time", "later",
+    "overloaded", "overwhelmed", "backlog", "not now", "another time", "schedule tight",
+];
+const DEFAULT_TOPIC_PATTERNS = {
+    work: ["work", "project", "task", "job", "delivery", "deadline"],
+    personal: ["family", "life", "health", "weekend", "trip"],
+    tech: ["code", "system", "bug", "feature", "architecture", "design"],
+    social: ["friend", "community", "meetup", "event", "collaboration"],
+};
+export function inferTone(text, config) {
+    const lower = text.toLowerCase();
+    const positiveKeywords = config?.positiveKeywords ?? DEFAULT_POSITIVE_KEYWORDS;
+    const negativeKeywords = config?.negativeKeywords ?? DEFAULT_NEGATIVE_KEYWORDS;
+    const pos = positiveKeywords.filter((w) => lower.includes(w)).length;
+    const neg = negativeKeywords.filter((w) => lower.includes(w)).length;
+    if (neg >= pos && neg > 0)
+        return "quiet"; // owner is negative → agent should be more reserved
+    if (pos > 0)
+        return "casual"; // positive → casual is fine
+    return "unknown";
+}
+export function inferTiming(text, config) {
+    const lower = text.toLowerCase();
+    const busyKeywords = config?.busyKeywords ?? DEFAULT_BUSY_KEYWORDS;
+    if (busyKeywords.some((w) => lower.includes(w)))
+        return "busy";
+    if (lower.includes("quick") || lower.includes("prompt"))
+        return "responsive";
+    return undefined;
+}
+export function inferTopics(text, config) {
+    const lower = text.toLowerCase();
+    const topicPatterns = config?.topicPatterns ?? DEFAULT_TOPIC_PATTERNS;
+    const topics = [];
+    for (const [topic, patterns] of Object.entries(topicPatterns)) {
+        if (patterns.some((p) => lower.includes(p))) {
+            topics.push(topic);
+        }
+    }
+    return topics;
+}
+export function mergeTopicAffinities(existing, newTopics) {
+    const map = new Map(existing.map((t) => [t.topic, t.affinity]));
+    for (const topic of newTopics) {
+        map.set(topic, Math.min(1, (map.get(topic) ?? 0) + 0.1));
+    }
+    return Array.from(map.entries())
+        .map(([topic, affinity]) => ({ topic, affinity }))
+        .sort((a, b) => b.affinity - a.affinity);
+}
+function redactSensitive(text) {
+    return text
+        .replace(/\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g, "[REDACTED_CARD]")
+        .replace(/password[:\s=]+\S+/gi, "[REDACTED_PASSWORD]")
+        .replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g, "[REDACTED_EMAIL]")
+        .replace(/\b\d{3}[-.\s]?\d{3}[-.\s]?\d{4}\b/g, "[REDACTED_PHONE]")
+        .replace(/\b\d{3}-\d{2}-\d{4}\b/g, "[REDACTED_SSN]")
+        .replace(/\b(?:sk-|pk-|Bearer\s+|api[_-]?key[:\s=]+)[A-Za-z0-9_\-\/+=]{20,}\b/gi, "[REDACTED_TOKEN]");
+}
+/**
+ * Process an owner reply: write chronicle, update RelationshipMemory.
+ */
+export async function processOwnerReply(input, state) {
+    const chronicleStore = createSessionChronicleStore(state);
+    const relStore = createRelationshipMemoryStore(state);
+    const now = new Date().toISOString();
+    // 1. Write chronicle entry (source of truth)
+    const entryId = `owner_reply:${input.relatedDecisionId}:${Date.now()}`;
+    const replyText = input.replyText?.trim() ?? "";
+    const isEmpty = replyText.length === 0;
+    const tone = isEmpty ? "unknown" : inferTone(replyText);
+    const timing = isEmpty ? undefined : inferTiming(replyText);
+    const topics = isEmpty ? [] : inferTopics(replyText);
+    const chronicleEntry = {
+        entryId,
+        eventKind: "owner_reply",
+        actor: "owner",
+        occurredAt: now,
+        summary: redactSensitive(isEmpty ? "(empty reply)" : replyText.slice(0, 500)),
+        result: "succeeded",
+        sourceRefs: [{ sourceId: entryId, kind: "owner_reply", url: `chronicle://${entryId}` }],
+        relatedDecisionId: input.relatedDecisionId,
+        ownerReply: {
+            tone,
+            delayMinutes: input.explicitSignal?.delayMinutes,
+            topics: topics.length > 0 ? topics : input.explicitSignal?.topics,
+            explicitPreference: input.explicitSignal?.explicitPreference,
+        },
+    };
+    await chronicleStore.appendSessionChronicle(chronicleEntry);
+    // 2. Load and update RelationshipMemory (best-effort)
+    let relationshipUpdated = false;
+    let priorMemory;
+    let updatedMemory;
+    try {
+        priorMemory = (await relStore.loadRelationshipMemory()) ?? undefined;
+        const nextRevision = (priorMemory?.revision ?? 0) + 1;
+        const topicAffinities = mergeTopicAffinities(priorMemory?.topicAffinities ?? [], topics);
+        const update = {
+            relationshipId: priorMemory?.relationshipId ?? "default",
+            revision: nextRevision,
+            tonePreference: tone !== "unknown" ? tone : (priorMemory?.tonePreference ?? "unknown"),
+            averageReplyDelayMinutes: input.explicitSignal?.delayMinutes ?? priorMemory?.averageReplyDelayMinutes,
+            noReplyCount: 0, // owner replied → reset counter
+            topicAffinities: topicAffinities.length > 0 ? topicAffinities : (priorMemory?.topicAffinities ?? []),
+            lastInteractionAt: now,
+            sourceRefs: [
+                ...(priorMemory?.sourceRefs ?? []),
+                { sourceId: entryId, kind: "owner_reply_feedback", url: `chronicle://${entryId}` },
+            ],
+            updatedAt: now,
+        };
+        await relStore.upsertRelationshipMemory(update);
+        updatedMemory = (await relStore.loadRelationshipMemory()) ?? undefined;
+        relationshipUpdated = true;
+    }
+    catch (err) {
+        // Relationship update is best-effort; chronicle is the source of truth.
+        // Missing memory update will be reflected in the next `explain relationship` query.
+        const errorMessage = err instanceof Error ? err.message : String(err);
+        console.warn(`[owner-reply-feedback] RelationshipMemory update failed: ${errorMessage}`);
+        // Write a diagnostic chronicle entry so operators can trace the failure.
+        await chronicleStore.appendSessionChronicle({
+            entryId: `${entryId}:diagnostic`,
+            eventKind: "system_notice",
+            actor: "system",
+            occurredAt: new Date().toISOString(),
+            summary: `RelationshipMemory update failed: ${errorMessage}`,
+            result: "failed",
+            sourceRefs: [{ sourceId: entryId, kind: "owner_reply_feedback", url: `chronicle://${entryId}` }],
+            relatedDecisionId: input.relatedDecisionId,
+        });
+        return {
+            chronicleEntryId: entryId,
+            relationshipUpdated: false,
+            priorMemory,
+            updatedMemory,
+            relationshipUpdateError: errorMessage,
+        };
+    }
+    return {
+        chronicleEntryId: entryId,
+        relationshipUpdated,
+        priorMemory,
+        updatedMemory,
+    };
+}

package/runtime/core/second-nature/heartbeat/heartbeat-loop.d.ts

@@ -20,6 +20,7 @@ import type { GuidanceDraftPort } from "../../../guidance/outreach-draft-schema.
 import type { StateDatabase } from "../../../storage/db/index.js";
 import { type OpenClawDeliveryPort } from "../outreach/dispatch-user-outreach.js";
 import type { ConnectorExecutor } from "../../../connectors/base/contract.js";
+import type { CapabilityContractRegistry } from "../../../connectors/base/manifest.js";
 import type { NarrativeStateStore } from "../../../storage/narrative/narrative-state-store.js";
 import type { NarrativeTracePayload } from "../../../observability/services/lived-experience-audit.js";
 export interface HeartbeatDecisionTracePayload {
@@ -47,7 +48,7 @@ export interface HeartbeatQuietWorkflowDeps {
  * Resolves the heartbeat outcome for a guard-allowed intent (outreach dispatch, quiet orchestration, or default).
  * Exported for unit tests (CR-M1 wiring).
  */
-export declare function resolveAllowedIntentResult(intent: CandidateIntent, runtime: HeartbeatRuntimeSnapshot, inputs: SnapshotInputs, signal: HeartbeatSignal, deps: Pick<HeartbeatDeps, "outreachDispatch" | "quietWorkflow" | "connectorExecutor">): Promise<HeartbeatCycleResult>;
+export declare function resolveAllowedIntentResult(intent: CandidateIntent, runtime: HeartbeatRuntimeSnapshot, inputs: SnapshotInputs, signal: HeartbeatSignal, deps: Pick<HeartbeatDeps, "outreachDispatch" | "quietWorkflow" | "connectorExecutor" | "state" | "workspaceRoot">): Promise<HeartbeatCycleResult>;
 export interface HeartbeatDeps {
     /** Load snapshot inputs from state-system */
     loadSnapshotInputs: () => Promise<SnapshotInputs>;
@@ -64,6 +65,12 @@ export interface HeartbeatDeps {
     narrativeStateStore?: NarrativeStateStore;
     /** T5.1.2: when present, heartbeat records a NarrativeTrace after successful narrative state update. */
     recordNarrativeTrace?: (payload: NarrativeTracePayload) => Promise<void>;
+    /** T3.3.1: when present, successful connector effects write LifeEvidence artifacts. */
+    state?: StateDatabase;
+    /** T3.3.1: workspace root for evidence artifact paths. */
+    workspaceRoot?: string;
+    /** T2.4.1: when present, planner resolves platform-specific intents. */
+    connectorRegistry?: CapabilityContractRegistry;
 }
 /**
  * Ingest a heartbeat rhythm signal and drive one full decision round.

package/runtime/core/second-nature/heartbeat/heartbeat-loop.js

@@ -8,6 +8,8 @@ import { buildJudgeOutreachInputFromSnapshot } from "../outreach/judge-input-fro
 import { runSourceBackedQuiet } from "../quiet/run-source-backed-quiet.js";
 import { toCapabilityIntent } from "../orchestrator/effect-dispatcher.js";
 import { updateNarrativeAfterEffect } from "../orchestrator/narrative-update.js";
+import { mapLifeEvidence } from "../../../connectors/base/map-life-evidence.js";
+import { appendLifeEvidence } from "../../../storage/life-evidence/append-life-evidence.js";
 /**
  * Resolves the heartbeat outcome for a guard-allowed intent (outreach dispatch, quiet orchestration, or default).
  * Exported for unit tests (CR-M1 wiring).
@@ -52,19 +54,53 @@ export async function resolveAllowedIntentResult(intent, runtime, inputs, signal
         intent.kind === "maintenance";
     const connectorUnwired = intent.effectClass === "connector_action";
     if (connectorUnwired && deps.connectorExecutor) {
+        if (!intent.platformId || intent.platformId === "unknown") {
+            return {
+                scope: "rhythm",
+                status: "intent_selected",
+                selectedIntentId: intent.id,
+                decisionId: `decision:${intent.id}:${Date.now()}`,
+                reasons: ["connector_dispatch_unavailable"],
+            };
+        }
+        const decisionId = `decision:${intent.id}:${Date.now()}`;
         const result = await deps.connectorExecutor.executeEffect({
-            platformId: intent.platformId ?? "unknown",
+            platformId: intent.platformId,
             intent: toCapabilityIntent(intent),
             payload: {},
-            decisionId: `decision:${intent.id}:${Date.now()}`,
+            decisionId,
             intentId: intent.id,
             idempotencyKey: `idem:${intent.id}:${Date.now()}`,
         });
+        // T3.3.1: on success, map connector result to life evidence and append.
+        // On failure or empty result, no evidence is fabricated — attempt audit
+        // is already recorded by the connector policy layer telemetry.
+        if (result.status === "success" &&
+            deps.state &&
+            deps.workspaceRoot) {
+            try {
+                const candidate = mapLifeEvidence({
+                    platformId: intent.platformId,
+                    intent: toCapabilityIntent(intent),
+                    result,
+                    observedAt: new Date().toISOString(),
+                });
+                if (candidate) {
+                    await appendLifeEvidence(deps.state, deps.workspaceRoot, candidate);
+                }
+            }
+            catch (err) {
+                // Evidence append must not break the heartbeat cycle.
+                // Missing evidence will be reflected in the next snapshot load.
+                const errorMessage = err instanceof Error ? err.message : String(err);
+                console.warn(`[heartbeat] evidence append failed for ${intent.platformId ?? "unknown"}: ${errorMessage}`);
+            }
+        }
         const base = {
             scope: "rhythm",
             status: "intent_selected",
             selectedIntentId: intent.id,
-            decisionId: `decision:${intent.id}:${Date.now()}`,
+            decisionId,
             reasons: result.status === "success"
                 ? ["connector_effect_executed"]
                 : result.status === "retryable_failure"
@@ -163,7 +199,12 @@ export async function ingestRhythmSignal(signal, deps) {
     const snapshot = buildContinuitySnapshot(inputs);
     const timestamp = signal.payload.timestamp;
     const runtime = buildHeartbeatRuntimeSnapshot(timestamp, inputs, snapshot);
-    const rawCandidates = planCandidateIntents(runtime);
+    const rawCandidates = planCandidateIntents(runtime, {
+        acceptedGoals: inputs.acceptedGoals,
+        connectorRegistry: deps.connectorRegistry,
+        narrativeState: runtime.narrativeState,
+        relationshipMemory: runtime.relationshipMemory,
+    });
     const { candidates } = applyGoalPriority(rawCandidates, inputs.acceptedGoals);
     const emitTrace = async (result) => {
         if (!deps.recordDecisionTrace)

package/runtime/core/second-nature/heartbeat/runtime-snapshot.d.ts

@@ -21,6 +21,8 @@ export interface HeartbeatRuntimeSnapshot {
     lifeEvidence: PlannerLifeEvidenceSlice;
     rhythmWindow: PlannerRhythmWindowSlice;
     hardGuards: HardGuardDeps;
+    narrativeState?: import("../../../storage/narrative/narrative-state-store.js").NarrativeState;
+    relationshipMemory?: import("../../../storage/relationship/relationship-memory-store.js").RelationshipMemory;
 }
 export declare function buildLifeEvidenceSliceFromInputs(inputs: SnapshotInputs): PlannerLifeEvidenceSlice;
 export declare function buildHardGuardDeps(continuity: ContinuitySnapshot, inputs: SnapshotInputs): HardGuardDeps;