@haaaiawd/second-nature 0.1.31 → 0.1.33

package/index.js

@@ -71,7 +71,7 @@ process.stderr.write("[second-nature] module evaluated\n");
 const INTERNAL_RUNTIME_TRACE_PREFIX = "sn-runtime-";
 const HOST_SAFE_LIMITATION_MESSAGE = "Host-safe plugin package keeps synchronous register/load semantics, but mutating workspace runtime flows remain unavailable here.";
 const SETUP_MARKER_RELATIVE_PATH = path.join(".second-nature", "setup", "agent-inner-guide-ack.json");
-const SETUP_GUIDE_VERSION = "0.1.31";
+const SETUP_GUIDE_VERSION = "0.1.33";
 const SETUP_COMMANDS = new Set(["setup_hint", "setup_ack"]);
 let activationSpine = null;
 /** T1.1.4 — lazily opened full read bridge; closed when workspace root / resolution changes. */
@@ -111,6 +111,7 @@ const WORKSPACE_BRIDGE_COMMANDS = new Set([
     "self_health",
     "tool_affordance",
     "heartbeat_digest",
+    "snapshot:capture",
     "narrative:diff",
     "timeline",
     "restore",
@@ -1094,6 +1095,12 @@ function parseCommandInput(rawArgs) {
                 command,
                 input: rest[0] ? { date: rest[0] } : undefined,
             };
+        case "snapshot:capture":
+            return {
+                ok: true,
+                command,
+                input: rest[0] ? { snapshotId: rest[0] } : undefined,
+            };
         case "narrative:diff":
             return {
                 ok: true,
@@ -1200,7 +1207,7 @@ export default {
                     };
                 }
                 const resolved = spine.router.resolve(parsed.command);
-                if (!resolved) {
+                if (!resolved && !isWorkspaceBridgeCommand(parsed.command, parsed.input)) {
                     return {
                         text: JSON.stringify({
                             ok: false,
@@ -1219,7 +1226,7 @@ export default {
             const spine = ensureActivationSpine();
             syncWorkspaceRootFromTool(spine, params.workspaceRoot);
             const resolved = spine.router.resolve(params.command);
-            if (!resolved) {
+            if (!resolved && !isWorkspaceBridgeCommand(params.command, params.args)) {
                 return {
                     content: [
                         {

package/openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "second-nature",
   "name": "Second Nature",
-  "version": "0.1.31",
-  "description": "OpenClaw native plugin with synchronous surface registration and bundled runtime spine. Set SECOND_NATURE_WORKSPACE_ROOT or tool workspaceRoot to the same path as the agent workspace. Agent inner guide is packaged as agent-inner-guide.md. v7 ops surface: self_health, tool_affordance, heartbeat_digest, narrative:diff, timeline, restore, runtime_secret_bootstrap.",
+  "version": "0.1.33",
+  "description": "OpenClaw native plugin with synchronous surface registration and bundled runtime spine. Set SECOND_NATURE_WORKSPACE_ROOT or tool workspaceRoot to the same path as the agent workspace. Agent inner guide is packaged as agent-inner-guide.md. v7 ops surface: self_health, tool_affordance, heartbeat_digest, snapshot:capture, narrative:diff, timeline, restore, runtime_secret_bootstrap.",
   "activation": {
     "onStartup": true,
     "onCapabilities": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haaaiawd/second-nature",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "OpenClaw native plugin with synchronous registration, a packaged runtime artifact, and operator-facing status/explain flows.",
   "keywords": [
     "openclaw",

package/runtime/cli/commands/index.js

@@ -280,6 +280,7 @@ export function createCliCommands(deps) {
         opsCommand("self_health", "T-ROS.C.1 — show v7 self-health snapshot and degraded dimensions"),
         opsCommand("tool_affordance", "T-ROS.C.1 — show v7 tool affordance map or explicit unavailable state"),
         opsCommand("heartbeat_digest", "T-ROS.C.1 — assemble v7 heartbeat digest for a day"),
+        opsCommand("snapshot:capture", "T-V7C.C.1 — capture restore snapshot and narrative timeline version"),
         opsCommand("narrative:diff", "T-ROS.C.1 — compare two narrative timeline versions"),
         opsCommand("timeline", "T-ROS.C.1 — query v7 narrative timeline with cursor pagination"),
         opsCommand("restore", "T-ROS.C.1 — apply bounded restore and write restore audit"),

package/runtime/cli/index.js

@@ -9,6 +9,15 @@ import { resolvePackagedRuntime } from "./runtime/runtime-artifact-boundary.js";
 import { createRestoreSnapshotStore, } from "../storage/services/restore-snapshot-store.js";
 import { createRuntimeDecisionRecorder, } from "../observability/services/runtime-decision-recorder.js";
 import { createConnectorExecutorAdapter, } from "../connectors/services/connector-executor-adapter.js";
+import { CapabilityContractRegistry } from "../connectors/base/manifest.js";
+import { CapabilityContractRegistryV7 } from "../connectors/base/manifest-v7.js";
+import { moltbookManifest } from "../connectors/social-community/moltbook/manifest.js";
+import { evomapManifest } from "../connectors/agent-network/evomap/manifest.js";
+import { agentWorldManifest } from "../connectors/agent-network/agent-world/manifest.js";
+import { instreetManifest } from "../connectors/social-community/instreet/manifest.js";
+import { createAffordanceAssembler, } from "../core/second-nature/body/tool-affordance/affordance-assembler.js";
+import { createHistoryDigestStore, } from "../storage/services/history-digest-store.js";
+import { probeCredentialHealth, } from "../storage/services/credential-vault.js";
 import { DynamicConnectorRegistry, createRegistrySnapshotStore, } from "../connectors/registry/index.js";
 /** Built-in connector manifests for DynamicConnectorRegistry. */
 const BUILT_IN_CONNECTOR_MANIFESTS = [
@@ -54,6 +63,154 @@ const BUILT_IN_CONNECTOR_MANIFESTS = [
         sourceRefPolicy: { minSourceRefs: 1 },
     },
 ];
+const BUILT_IN_CAPABILITY_MANIFESTS = [
+    moltbookManifest,
+    evomapManifest,
+    agentWorldManifest,
+    instreetManifest,
+];
+function idempotencyClassForCapability(capabilityId) {
+    return capabilityId.includes("read") ||
+        capabilityId.includes("discover") ||
+        capabilityId.includes("list") ||
+        capabilityId.includes("heartbeat")
+        ? "read_only"
+        : "idempotent_write";
+}
+function createCapabilityRegistry() {
+    const registry = new CapabilityContractRegistry();
+    for (const manifest of BUILT_IN_CAPABILITY_MANIFESTS) {
+        registry.register(manifest);
+    }
+    return registry;
+}
+function createAffordanceRegistry(registry, workspaceRoot) {
+    registry.reloadConnectors(workspaceRoot);
+    const v7 = new CapabilityContractRegistryV7();
+    for (const entry of registry.listConnectors()) {
+        v7.register({
+            platformId: entry.platformId,
+            capabilities: entry.capabilities.map((capabilityId) => ({
+                capabilityId,
+                intent: capabilityId,
+                probeConfig: {
+                    safeEndpoint: `connector://${entry.platformId}/${capabilityId}`,
+                    idempotencyClass: idempotencyClassForCapability(capabilityId),
+                },
+            })),
+            channelPriority: ["api_rest"],
+            credentialTypes: ["api_key"],
+            sourceRefPolicy: { minSourceRefs: 1 },
+        });
+    }
+    return v7;
+}
+function createWorkspaceAffordanceAssembler(registry, workspaceRoot) {
+    return createAffordanceAssembler({
+        registry: createAffordanceRegistry(registry, workspaceRoot),
+        probeReader: {
+            getLatestProbeResult() {
+                return undefined;
+            },
+        },
+        credentialRequired: () => false,
+    });
+}
+function stringifyDeltaField(delta, key) {
+    const value = delta[key];
+    if (value === undefined || value === null)
+        return undefined;
+    return typeof value === "string" ? value : JSON.stringify(value);
+}
+function asStringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string")
+        : [];
+}
+function createNarrativeTimelineDeps(stateDb) {
+    const historyStore = createHistoryDigestStore(stateDb);
+    return {
+        stateMemoryPort: {
+            async listNarrativeTimeline(from, to, opts) {
+                const rows = await historyStore.listNarrativeTimeline({
+                    limit: Math.max(opts?.limit ?? 100, 100),
+                });
+                return rows
+                    .filter((row) => row.createdAt >= from && row.createdAt <= to)
+                    .filter((row) => opts?.afterTimestamp ? row.createdAt > opts.afterTimestamp : true)
+                    .sort((a, b) => a.createdAt.localeCompare(b.createdAt))
+                    .slice(0, opts?.limit ?? rows.length)
+                    .map((row) => ({
+                    version: row.timelineId,
+                    createdAt: row.createdAt,
+                    triggerKind: row.entryType === "restore.applied" ||
+                        row.entryType === "goal.transition" ||
+                        row.entryType === "dream.projection" ||
+                        row.entryType === "owner.override"
+                        ? row.entryType
+                        : "heartbeat.decision",
+                    sourceRefs: asStringArray(row.delta.sourceRefs),
+                    reasonCode: stringifyDeltaField(row.delta, "reasonCode"),
+                    summaryText: stringifyDeltaField(row.delta, "summaryText") ??
+                        `${row.entryType}:${row.subjectId}`,
+                }));
+            },
+            async getNarrativeSnapshot(version) {
+                const rows = await historyStore.listNarrativeTimeline({ limit: 500 });
+                const row = rows.find((candidate) => candidate.timelineId === version || candidate.subjectId === version);
+                if (!row)
+                    return null;
+                const delta = row.delta;
+                return {
+                    version,
+                    focus: delta.focus,
+                    progress: delta.progress,
+                    nextIntent: delta.nextIntent,
+                    toneSignal: delta.toneSignal,
+                    acceptedGoalId: delta.acceptedGoalId,
+                    sourceRefs: asStringArray(delta.sourceRefs),
+                    lastChangeReasonCode: stringifyDeltaField(delta, "reasonCode"),
+                };
+            },
+        },
+    };
+}
+function createSecretAnchorDeps(stateDb) {
+    return {
+        runtimeOpsPort: {
+            getEncryptionKeyPath: () => "SECOND_NATURE_ENCRYPTION_KEY",
+            checkKeyPathExists: async () => {
+                const key = process.env.SECOND_NATURE_ENCRYPTION_KEY?.trim();
+                return Boolean(key && key.length >= 32);
+            },
+        },
+        credentialPort: {
+            verifySampleDecrypt: async () => {
+                const result = stateDb.sqlite.exec(`SELECT platform_id, encrypted_value
+           FROM credential_records
+           WHERE encrypted_value IS NOT NULL AND encrypted_value != ''
+           LIMIT 3`);
+                if (result.length === 0 || result[0].values.length === 0) {
+                    return { status: "ok", checkedIds: [] };
+                }
+                const checkedIds = [];
+                for (const row of result[0].values) {
+                    const platformId = String(row[0] ?? "unknown");
+                    const encryptedValue = typeof row[1] === "string" ? row[1] : "";
+                    checkedIds.push(platformId);
+                    const probe = probeCredentialHealth(platformId, encryptedValue, undefined);
+                    if (probe.keyHealth === "wrong_key") {
+                        return { status: "wrong_key", checkedIds };
+                    }
+                    if (probe.keyHealth !== "ok") {
+                        return { status: "error", checkedIds };
+                    }
+                }
+                return { status: "ok", checkedIds };
+            },
+        },
+    };
+}
 export function createCliRuntimeDeps(overrides = {}) {
     const workspaceRoot = overrides.workspaceRoot ?? process.cwd();
     const stateDb = overrides.stateDb ?? createStateDatabase();
@@ -79,6 +236,11 @@ export function createCliRuntimeDeps(overrides = {}) {
             builtInManifests: BUILT_IN_CONNECTOR_MANIFESTS,
             snapshotStore: createRegistrySnapshotStore(),
         });
+    const capabilityRegistry = overrides.capabilityRegistry ?? createCapabilityRegistry();
+    const affordanceAssembler = overrides.affordanceAssembler ??
+        createWorkspaceAffordanceAssembler(registry, workspaceRoot);
+    const narrativeTimelineDeps = overrides.narrativeTimelineDeps ?? createNarrativeTimelineDeps(stateDb);
+    const secretAnchorDeps = overrides.secretAnchorDeps ?? createSecretAnchorDeps(stateDb);
     const restoreSnapshotStore = overrides.restoreSnapshotStore ?? createRestoreSnapshotStore(stateDb);
     return {
         stateDb,
@@ -88,7 +250,11 @@ export function createCliRuntimeDeps(overrides = {}) {
         actionBridge,
         runtimeRecorder,
         connectorExecutor,
+        capabilityRegistry,
         registry,
+        affordanceAssembler,
+        narrativeTimelineDeps,
+        secretAnchorDeps,
         restoreSnapshotStore,
     };
 }
@@ -104,7 +270,11 @@ export function createCommandRouter(options = {}) {
         workspaceRoot,
         observabilityDb: runtime.observabilityDb,
         connectorExecutor: runtime.connectorExecutor,
+        connectorRegistry: runtime.capabilityRegistry,
         registry: runtime.registry,
+        toolAffordancePort: runtime.affordanceAssembler,
+        narrativeTimelineDeps: runtime.narrativeTimelineDeps,
+        secretAnchorDeps: runtime.secretAnchorDeps,
         restoreSnapshotStore: runtime.restoreSnapshotStore,
     });
     const commands = createCliCommands({

package/runtime/cli/ops/heartbeat-surface.d.ts

@@ -10,6 +10,7 @@ import type { CliReadModels } from "../read-models/index.js";
 import type { RuntimeDecisionRecorder } from "../../observability/services/runtime-decision-recorder.js";
 import type { StateDatabase } from "../../storage/db/index.js";
 import type { ConnectorExecutor } from "../../core/second-nature/orchestrator/effect-dispatcher.js";
+import type { CapabilityContractRegistry } from "../../connectors/base/manifest.js";
 export type HeartbeatSurfaceStatus = "heartbeat_ok" | "intent_selected" | "denied" | "deferred" | "runtime_carrier_only" | "delivery_unavailable";
 export interface HeartbeatSurfaceResult {
     ok: boolean;
@@ -47,5 +48,7 @@ export interface HeartbeatCheckInput {
      * connector-system instead of returning connector_dispatch_unwired.
      */
     connectorExecutor?: ConnectorExecutor;
+    /** Capability registry used by planner to avoid platform/capability protocol mismatches. */
+    connectorRegistry?: CapabilityContractRegistry;
 }
 export declare function heartbeatCheck(input: HeartbeatCheckInput): Promise<HeartbeatSurfaceResult>;

package/runtime/cli/ops/heartbeat-surface.js

@@ -74,6 +74,7 @@ export async function heartbeatCheck(input) {
         state: input.state,
         workspaceRoot: input.workspaceRoot ?? process.cwd(),
         connectorExecutor: input.connectorExecutor,
+        connectorRegistry: input.connectorRegistry,
     });
     const cycle = await run(signal);
     return mapCycleToSurface(cycle, "workspace_full_runtime");

package/runtime/cli/ops/ops-router.d.ts

@@ -10,6 +10,8 @@ import { type NarrativeTimelineDeps } from "../../observability/services/narrati
 import { type SecretAnchorDeps } from "../../observability/services/runtime-secret-anchor-view.js";
 import { AppendOnlyAuditStore } from "../../observability/audit/append-only-audit-store.js";
 import type { RestoreSnapshotStore } from "../../storage/services/restore-snapshot-store.js";
+import type { CapabilityContractRegistry } from "../../connectors/base/manifest.js";
+import type { AffordanceAssembler } from "../../core/second-nature/body/tool-affordance/affordance-assembler.js";
 /** Unified response envelope for all v7 runtime-ops commands. */
 export interface RuntimeOpsEnvelope<T = unknown> {
     ok: boolean;
@@ -49,6 +51,8 @@ export interface OpsRouterDeps {
      * connector-system instead of returning connector_dispatch_unwired.
      */
     connectorExecutor?: ConnectorExecutor;
+    /** Capability registry used by heartbeat planner to avoid platform/capability mismatches. */
+    connectorRegistry?: CapabilityContractRegistry;
     /**
      * T1.2.3: DynamicConnectorRegistry for connector:status and connector:test commands.
      */
@@ -67,6 +71,8 @@ export interface OpsRouterDeps {
      * Deps for narrative timeline (narrative:diff, timeline commands).
      */
     narrativeTimelineDeps?: NarrativeTimelineDeps;
+    /** Port for tool_affordance command. */
+    toolAffordancePort?: AffordanceAssembler;
     /**
      * Deps for runtime_secret_bootstrap (key anchor health check).
      */

package/runtime/cli/ops/ops-router.js

@@ -5,7 +5,9 @@
  * heartbeat_digest, narrative:diff, timeline, restore, runtime_secret_bootstrap.
  * All commands return RuntimeOpsEnvelope.
  */
+import { createHash } from "node:crypto";
 import fs from "node:fs";
+import path from "node:path";
 import { heartbeatCheck, } from "./heartbeat-surface.js";
 import { showOperatorFallback, OperatorFallbackNotFoundError, } from "./show-operator-fallback.js";
 import { probeHostCapability } from "../host-capability/probe-host-capability.js";
@@ -21,16 +23,137 @@ import { generateHeartbeatDigest, } from "../../observability/services/heartbeat
 import { queryNarrativeTimeline, queryNarrativeDiff, } from "../../observability/services/narrative-timeline-query-service.js";
 import { viewSecretAnchor, } from "../../observability/services/runtime-secret-anchor-view.js";
 import { writeRestoreAudit, } from "../../observability/services/restore-audit-service.js";
+import { createHistoryDigestStore } from "../../storage/services/history-digest-store.js";
 // T-ROS.C.3: ManualRunDispatcher and its deps
 import { createManualRunDispatcher, } from "./manual-run-dispatcher.js";
 import { createExperienceWriter } from "../../core/second-nature/body/tool-experience/experience-writer.js";
-import { createToolExperienceStore } from "../../storage/services/tool-experience-store.js";
+import { createCapabilityProbeResultStore, createToolExperienceStore, } from "../../storage/services/tool-experience-store.js";
 import { createWetProbeRunner } from "../../connectors/base/wet-probe-runner.js";
 import { CapabilityContractRegistryV7 } from "../../connectors/base/manifest-v7.js";
 function coerceProbeOnlyFlag(input) {
     const v = input?.probeOnly;
     return v === true || v === "true" || v === 1 || v === "1";
 }
+const SNAPSHOT_TABLE_BY_KIND = {
+    identity_profile: "identity_profile",
+    agent_goal: "agent_goal",
+    tool_experience: "tool_experience",
+    daily_diary: "daily_diary_index",
+    dream_output: "dream_output_index",
+    narrative_timeline: "narrative_timeline",
+};
+const DEFAULT_SNAPSHOT_KINDS = [
+    "identity_profile",
+    "agent_goal",
+    "tool_experience",
+    "daily_diary",
+    "dream_output",
+    "narrative_timeline",
+];
+function coerceRestorableKinds(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const valid = new Set(DEFAULT_SNAPSHOT_KINDS);
+    return value.filter((item) => typeof item === "string" && valid.has(item));
+}
+function tableExists(state, table) {
+    const result = state.sqlite.exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1`, [table]);
+    return result.length > 0 && result[0].values.length > 0;
+}
+function readRowsFromTable(state, table) {
+    const result = state.sqlite.exec(`SELECT * FROM ${table}`);
+    if (result.length === 0 || result[0].values.length === 0)
+        return [];
+    const columns = result[0].columns;
+    return result[0].values.map((row) => {
+        const out = {};
+        columns.forEach((column, index) => {
+            out[column] = row[index];
+        });
+        return out;
+    });
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string")
+        : [];
+}
+function textInput(input, key) {
+    const value = input?.[key];
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function buildSnapshotNarrativeDelta(input, snapshotId, rowCounts) {
+    const explicit = input?.narrativeSnapshot &&
+        typeof input.narrativeSnapshot === "object" &&
+        !Array.isArray(input.narrativeSnapshot)
+        ? input.narrativeSnapshot
+        : {};
+    const from = (key) => input?.[key] ?? explicit[key];
+    const sourceRefs = stringArray(from("sourceRefs"));
+    return {
+        focus: from("focus") ?? "workspace_state",
+        progress: from("progress") ??
+            `snapshot_captured:${Object.entries(rowCounts)
+                .map(([kind, count]) => `${kind}=${count}`)
+                .join(",")}`,
+        nextIntent: from("nextIntent") ?? "restore_ready",
+        toneSignal: from("toneSignal") ?? "system_maintenance",
+        acceptedGoalId: from("acceptedGoalId") ?? undefined,
+        sourceRefs: sourceRefs.length > 0
+            ? sourceRefs
+            : [`restore_snapshot:${snapshotId}`, "runtime_ops:snapshot_capture"],
+        reasonCode: from("reasonCode") ?? "snapshot_captured",
+        summaryText: from("summaryText") ?? `Captured restore snapshot ${snapshotId}`,
+    };
+}
+function hashNarrativeSnapshot(input) {
+    return createHash("sha256")
+        .update(JSON.stringify({
+        previousHash: input.previousHash,
+        snapshotId: input.snapshotId,
+        delta: input.delta,
+        createdAt: input.createdAt,
+    }))
+        .digest("hex");
+}
+function resolveManifestPath(manifestPath, workspaceRoot) {
+    if (path.isAbsolute(manifestPath))
+        return manifestPath;
+    return path.join(workspaceRoot ?? process.cwd(), manifestPath);
+}
+function registerConnectorForWetProbe(input) {
+    if (input.entry.manifestPath) {
+        try {
+            const manifestText = fs.readFileSync(resolveManifestPath(input.entry.manifestPath, input.workspaceRoot), "utf-8");
+            const parsed = JSON.parse(manifestText);
+            const registered = input.registryV7.register(parsed);
+            if (registered.ok && input.registryV7.hasCapability(input.entry.platformId, input.selectedCapabilityId)) {
+                return;
+            }
+        }
+        catch {
+            // Non-v7 or YAML workspace manifests are projected below.
+        }
+    }
+    input.registryV7.register({
+        platformId: input.entry.platformId,
+        capabilities: input.entry.capabilities.map((capabilityId) => ({
+            capabilityId,
+            intent: capabilityId,
+            probeConfig: capabilityId === input.selectedCapabilityId && input.safeEndpoint
+                ? {
+                    safeEndpoint: input.safeEndpoint,
+                    idempotencyClass: "read_only",
+                }
+                : undefined,
+        })),
+        channelPriority: ["runtime_ops"],
+        credentialTypes: ["runtime_ops_probe"],
+    });
+}
 /**
  * T1.2.8 — static local adapter: all checks return `unknown` when no real host is available.
  * Allows `capability_probe` to be called from CLI / workspace bridge without requiring a live host.
@@ -63,6 +186,8 @@ export function createOpsRouter(deps) {
             state: input.state ?? deps.state,
             workspaceRoot: input.workspaceRoot ?? deps.workspaceRoot,
             connectorExecutor: input.connectorExecutor ?? deps.connectorExecutor,
+            connectorRegistry: input
+                ?.connectorRegistry ?? deps.connectorRegistry,
         }),
         async dispatch(command, input) {
             if (command === "heartbeat_check") {
@@ -91,6 +216,8 @@ export function createOpsRouter(deps) {
                     scopeHint: input?.scopeHint,
                     connectorExecutor: input
                         ?.connectorExecutor ?? deps.connectorExecutor,
+                    connectorRegistry: input
+                        ?.connectorRegistry ?? deps.connectorRegistry,
                 });
             }
             if (command === "fallback") {
@@ -244,8 +371,11 @@ export function createOpsRouter(deps) {
                 });
             }
             if (command === "connector_test") {
-                // v7 T-ROS.C.1: --wet flag (wet=true) sets dryRun=false + marks triggerSource:"manual_run"
-                const isWet = input?.wet === true || input?.wet === "true";
+                // v7 T-V7C.C.1: dryRun=false is the canonical wet probe switch.
+                const isWet = input?.wet === true ||
+                    input?.wet === "true" ||
+                    input?.dryRun === false ||
+                    input?.dryRun === "false";
                 const result = await connectorTest(deps.registry, {
                     platformId: typeof input?.platformId === "string" ? input.platformId : "",
                     dryRun: isWet ? false : (input?.dryRun === false ? false : true),
@@ -253,12 +383,76 @@ export function createOpsRouter(deps) {
                         ? input.workspaceRoot
                         : deps.workspaceRoot,
                 });
-                if (isWet && result.ok) {
-                    // Annotate result with manual trigger context (DR-038 / T-ROS.C.3)
-                    result.triggerSource = "manual_run";
-                    result.affectsHeartbeatCadence = false;
+                if (!isWet || !result.ok) {
+                    return result;
+                }
+                const data = result.data && typeof result.data === "object"
+                    ? result.data
+                    : {};
+                const capabilities = Array.isArray(data.capabilities)
+                    ? data.capabilities.filter((item) => typeof item === "string")
+                    : [];
+                const capabilityId = textInput(input, "capabilityId") ?? capabilities[0] ?? "";
+                if (!capabilityId) {
+                    return {
+                        ok: false,
+                        command: "connector_test",
+                        error: {
+                            code: "MISSING_CAPABILITY_ID",
+                            message: "wet connector_test requires capabilityId or at least one connector capability",
+                            requiredUserInput: ["capabilityId"],
+                            nextStep: "reinvoke_with_capability_id",
+                        },
+                    };
+                }
+                const platformId = String(data.platformId ?? input?.platformId ?? "");
+                const registryEntry = deps.registry?.describeConnector(platformId);
+                if (!registryEntry) {
+                    return result;
+                }
+                const registryV7 = new CapabilityContractRegistryV7();
+                registerConnectorForWetProbe({
+                    registryV7,
+                    entry: {
+                        platformId: registryEntry.platformId,
+                        capabilities: registryEntry.capabilities,
+                        manifestPath: registryEntry.manifestPath,
+                    },
+                    workspaceRoot: typeof input?.workspaceRoot === "string"
+                        ? input.workspaceRoot
+                        : deps.workspaceRoot,
+                    selectedCapabilityId: capabilityId,
+                    safeEndpoint: textInput(input, "safeEndpoint"),
+                });
+                const wetResult = await createWetProbeRunner().runWetProbe(platformId, capabilityId, registryV7);
+                const warnings = [];
+                let persistedProbeResult = false;
+                if (deps.state) {
+                    await createCapabilityProbeResultStore(deps.state).appendProbeResult(wetResult.probeResult);
+                    persistedProbeResult = true;
                 }
-                return result;
+                else {
+                    warnings.push("state_db_unavailable:capability_probe_result_not_persisted");
+                }
+                return {
+                    ok: wetResult.probeResult.actualStatus !== "unavailable",
+                    command: "connector_test",
+                    data: {
+                        ...data,
+                        dryRun: false,
+                        capabilityId,
+                        actualStatus: wetResult.probeResult.actualStatus,
+                        httpStatus: wetResult.probeResult.httpStatus ?? wetResult.httpStatus,
+                        probeResultId: wetResult.probeResult.probeResultId,
+                        probeConfigRef: wetResult.probeResult.probeConfigRef,
+                        sampleResponseRef: wetResult.probeResult.sampleResponseRef,
+                        persistedProbeResult,
+                        triggerSource: "manual_run",
+                        affectsHeartbeatCadence: false,
+                        note: "wet probe mode: executed safe probe endpoint and persisted capability_probe_result when state DB is available",
+                    },
+                    warnings,
+                };
             }
             if (command === "connector:run") {
                 // T-ROS.C.3: manual connector execution — isolated from heartbeat cadence
@@ -431,6 +625,38 @@ export function createOpsRouter(deps) {
              */
             if (command === "tool_affordance") {
                 const generatedAt = new Date().toISOString();
+                if (deps.toolAffordancePort) {
+                    const allStatuses = [
+                        "safe",
+                        "exploratory",
+                        "needs_auth",
+                        "painful",
+                        "unavailable",
+                    ];
+                    const platformIds = Array.isArray(input?.platformIds)
+                        ? input.platformIds.filter((item) => typeof item === "string")
+                        : typeof input?.platformId === "string"
+                            ? [input.platformId]
+                            : undefined;
+                    const data = await deps.toolAffordancePort.assembleAffordanceMap({
+                        platformIds,
+                        allowedStatuses: allStatuses,
+                        goalKind: typeof input?.goalKind === "string" ? input.goalKind : undefined,
+                    });
+                    const envelope = {
+                        ok: true,
+                        command: "tool_affordance",
+                        runtimeMode: "workspace_full_runtime",
+                        surfaceMode: "cli",
+                        generatedAt,
+                        data,
+                        warnings: [],
+                        sourceRefs: [
+                            "core/second-nature/body/tool-affordance/affordance-assembler.ts",
+                        ],
+                    };
+                    return envelope;
+                }
                 const envelope = {
                     ok: false,
                     command: "tool_affordance",
@@ -506,6 +732,102 @@ export function createOpsRouter(deps) {
                     return envelope;
                 }
             }
+            /**
+             * [G6] snapshot:capture — production capture path for RestoreSnapshot +
+             * NarrativeTimeline. This gives restore and narrative:diff real state to consume.
+             */
+            if (command === "snapshot:capture") {
+                const generatedAt = new Date().toISOString();
+                if (!deps.state || !deps.restoreSnapshotStore) {
+                    const envelope = {
+                        ok: false,
+                        command: "snapshot:capture",
+                        runtimeMode: "unavailable",
+                        surfaceMode: "cli",
+                        generatedAt,
+                        error: {
+                            code: "SNAPSHOT_CAPTURE_DEPS_UNAVAILABLE",
+                            message: "snapshot:capture requires state DB and RestoreSnapshotStore in OpsRouterDeps",
+                            nextStep: "wire_state_and_restore_snapshot_store_into_ops_router",
+                        },
+                        warnings: [],
+                        sourceRefs: [],
+                    };
+                    return envelope;
+                }
+                const snapshotId = textInput(input, "snapshotId") ??
+                    `snapshot:${Date.now()}:${Math.random().toString(36).slice(2, 8)}`;
+                const requestedKinds = coerceRestorableKinds(input?.entityWhitelist) ?? [...DEFAULT_SNAPSHOT_KINDS];
+                const rowCounts = {};
+                const warnings = [];
+                for (const kind of requestedKinds) {
+                    const table = SNAPSHOT_TABLE_BY_KIND[kind];
+                    if (!tableExists(deps.state, table)) {
+                        rowCounts[kind] = 0;
+                        warnings.push(`table_missing:${kind}:${table}`);
+                        continue;
+                    }
+                    rowCounts[kind] = readRowsFromTable(deps.state, table).length;
+                }
+                const historyStore = createHistoryDigestStore(deps.state);
+                const previousHash = (await historyStore.listNarrativeTimeline({ limit: 1 }))[0]?.currentHash ?? "";
+                const delta = buildSnapshotNarrativeDelta(input, snapshotId, rowCounts);
+                const currentHash = hashNarrativeSnapshot({
+                    previousHash,
+                    snapshotId,
+                    delta,
+                    createdAt: generatedAt,
+                });
+                await historyStore.appendNarrativeTimeline({
+                    timelineId: snapshotId,
+                    entryType: "owner.override",
+                    subjectId: textInput(input, "subjectId") ?? snapshotId,
+                    delta,
+                    previousHash,
+                    currentHash,
+                    createdAt: generatedAt,
+                });
+                const payload = {};
+                const capturedKinds = [];
+                for (const kind of requestedKinds) {
+                    const table = SNAPSHOT_TABLE_BY_KIND[kind];
+                    if (!tableExists(deps.state, table))
+                        continue;
+                    const rows = readRowsFromTable(deps.state, table);
+                    rowCounts[kind] = rows.length;
+                    if (rows.length > 0) {
+                        payload[kind] = rows;
+                        capturedKinds.push(kind);
+                    }
+                }
+                const snapshot = await deps.restoreSnapshotStore.captureSnapshot({
+                    snapshotId,
+                    entityWhitelist: requestedKinds,
+                    payload,
+                    capturedAt: generatedAt,
+                });
+                const envelope = {
+                    ok: true,
+                    command: "snapshot:capture",
+                    runtimeMode: "workspace_full_runtime",
+                    surfaceMode: "cli",
+                    generatedAt,
+                    data: {
+                        snapshotId: snapshot.snapshotId,
+                        capturedAt: snapshot.capturedAt,
+                        entityWhitelist: snapshot.entityWhitelist,
+                        capturedKinds,
+                        rowCounts,
+                        narrativeVersion: snapshotId,
+                    },
+                    warnings,
+                    sourceRefs: [
+                        "storage/services/restore-snapshot-store.ts",
+                        "storage/services/history-digest-store.ts",
+                    ],
+                };
+                return envelope;
+            }
             /**
              * [G6] narrative:diff — queryNarrativeDiff between two versions.
              * Requires narrativeTimelineDeps in OpsRouterDeps.

package/runtime/storage/services/history-digest-store.js

@@ -32,6 +32,12 @@ export function createHistoryDigestStore(database) {
     const { sqlite } = database;
     return {
         async appendNarrativeTimeline(entry) {
+            const deltaGate = validateWritePayload({
+                delta: entry.delta,
+                sourceRefs: ["narrative:append"],
+            });
+            if (!deltaGate.ok)
+                throw new Error(deltaGate.reason ?? "write_validation_failed");
             const gate = validateWritePayload({
                 timelineId: entry.timelineId,
                 entryType: entry.entryType,
@@ -40,7 +46,7 @@ export function createHistoryDigestStore(database) {
                 previousHash: entry.previousHash,
                 currentHash: entry.currentHash,
                 sourceRefs: ["narrative:append"],
-            });
+            }, { runSensitivityScan: false });
             if (!gate.ok)
                 throw new Error(gate.reason ?? "write_validation_failed");
             sqlite.run(`INSERT INTO narrative_timeline

package/runtime/storage/services/restore-snapshot-store.js

@@ -26,6 +26,14 @@ const ALL_RESTORABLE_KINDS = [
     "dream_output",
     "narrative_timeline",
 ];
+const TABLE_BY_KIND = {
+    identity_profile: "identity_profile",
+    agent_goal: "agent_goal",
+    tool_experience: "tool_experience",
+    daily_diary: "daily_diary_index",
+    dream_output: "dream_output_index",
+    narrative_timeline: "narrative_timeline",
+};
 const DEFAULT_EXCLUDED_KINDS = [
     "credential",
     "raw_private_message",
@@ -172,7 +180,8 @@ export function createRestoreSnapshotStore(database, options = {}) {
                         const columns = keys.join(", ");
                         const placeholders = keys.map(() => "?").join(", ");
                         const values = keys.map((k) => row[k]);
-                        sqlite.run(`INSERT OR REPLACE INTO ${kind} (${columns}) VALUES (${placeholders})`, values);
+                        const table = TABLE_BY_KIND[kind];
+                        sqlite.run(`INSERT OR REPLACE INTO ${table} (${columns}) VALUES (${placeholders})`, values);
                     }
                     completedEntities.push(kind);
                 }

package/workspace-ops-bridge.js

@@ -71,9 +71,13 @@ export async function openWorkspaceOpsBridge(workspaceRoot) {
             state: stateDb,
             workspaceRoot: resolvedRoot,
             connectorExecutor: deps.connectorExecutor,
+            connectorRegistry: deps.capabilityRegistry,
             registry: deps.registry,
+            toolAffordancePort: deps.affordanceAssembler,
             // v7 (T-ROS.C.2): in-memory audit store for heartbeat_digest / restore / self_health
             auditStore,
+            narrativeTimelineDeps: deps.narrativeTimelineDeps,
+            secretAnchorDeps: deps.secretAnchorDeps,
             restoreSnapshotStore: deps.restoreSnapshotStore,
         });
         const commands = commandsMod.createCliCommands({