@haaaiawd/second-nature 0.1.6 → 0.1.8

package/index.js

@@ -1,26 +1,322 @@
-function createFallbackCommands() {
-    const commandNames = ["status", "policy", "credential", "quiet", "report", "session", "audit", "explain"];
-    return commandNames.map((name) => ({
-        name,
-        description: `Fallback command shell for ${name}`,
-        execute: async (_input) => ({
+/**
+ * Host-safe Second Nature plugin surface.
+ *
+ * Core logic:
+ * - keep register(api) synchronous so OpenClaw captures services/command/tool before return
+ * - avoid importing CLI/runtime DB modules at module-evaluation time because the packaged
+ *   runtime graph currently contains async sql.js bootstrap that breaks vm sandbox loading
+ * - expose a minimal in-memory activation spine so status/lifecycle stay truthful even when
+ *   the full workspace runtime is not loaded inside the host
+ *
+ * Dependencies:
+ * - only imports runtime lifecycle/service modules that are synchronous at load time
+ *
+ * Boundaries:
+ * - read-only operator flows stay available through command/tool surface
+ * - structured mutating flows such as policy set / credential verify remain unavailable here
+ * - full evidence-backed workspace runtime can be reintroduced later behind a host-safe boundary
+ *
+ * Test coverage:
+ * - tests/integration/cli/plugin-runtime-registration.test.ts
+ * - tests/integration/cli/plugin-packaging-walkthrough.test.ts
+ */
+import { startRuntimeService, } from "./runtime/core/second-nature/runtime/service-entry.js";
+import { getLifecycleState, recordRegistration, } from "./runtime/core/second-nature/runtime/lifecycle-service.js";
+const INTERNAL_RUNTIME_TRACE_PREFIX = "sn-runtime-";
+const HOST_SAFE_LIMITATION_MESSAGE = "Host-safe plugin package keeps synchronous register/load semantics, but mutating workspace runtime flows remain unavailable here.";
+let activationSpine = null;
+function trimRuntimeEvidence(spine) {
+    if (spine.runtimeEvidence.length > 12) {
+        spine.runtimeEvidence.splice(0, spine.runtimeEvidence.length - 12);
+    }
+}
+function latestRuntimeEvidence(spine) {
+    return spine.runtimeEvidence[spine.runtimeEvidence.length - 1];
+}
+function createUnavailableActionError(code, message, requiredUserInput, nextStep) {
+    return {
+        ok: false,
+        error: {
+            code,
+            message,
+            requiredUserInput,
+            nextStep,
+        },
+        message: HOST_SAFE_LIMITATION_MESSAGE,
+    };
+}
+function parseExplainSubject(subjectRaw) {
+    const trimmed = subjectRaw.trim();
+    if (!trimmed) {
+        throw new Error("explain_subject_invalid");
+    }
+    const separatorIndex = trimmed.indexOf(":");
+    if (separatorIndex === -1) {
+        throw new Error("explain_subject_requires_id");
+    }
+    const kind = trimmed.slice(0, separatorIndex).trim();
+    const id = trimmed.slice(separatorIndex + 1).trim();
+    if (!id) {
+        throw new Error("explain_subject_requires_id");
+    }
+    switch (kind) {
+        case "decision":
+            return { subjectType: "decision", subjectId: id };
+        case "platform":
+        case "platform-selection":
+            return { subjectType: "platform-selection", subjectId: id };
+        case "outreach":
+            return { subjectType: "outreach", subjectId: id };
+        case "soul":
+        case "soul-change":
+            return { subjectType: "soul-change", subjectId: id };
+        default:
+            throw new Error("explain_subject_unsupported");
+    }
+}
+function buildStatusPayload(spine) {
+    const runtimeEvidence = latestRuntimeEvidence(spine);
+    const updatedAt = runtimeEvidence?.createdAt ?? new Date(spine.lifecycleState.lastChangedAt).toISOString();
+    return {
+        ok: true,
+        data: {
+            runtime: {
+                host: "openclaw-plugin",
+                serviceStatus: spine.runtimeHandle.ready ? "running" : "idle",
+                updatedAt,
+            },
+            rhythm: {
+                mode: "active",
+                windowId: undefined,
+            },
+            quiet: {
+                mode: "unknown",
+                lastEvent: runtimeEvidence?.traceId,
+                interrupted: undefined,
+            },
+            connectors: [],
+            credentials: [],
+            risk: {
+                level: "low",
+                flags: [],
+            },
+        },
+    };
+}
+function buildQuietPayload(scope) {
+    return {
+        ok: true,
+        data: {
+            scope,
+            mode: "unknown",
+            sourceCount: 0,
+            reportCount: 0,
+            recentJournalCount: 0,
+        },
+    };
+}
+function buildReportPayload(day) {
+    return {
+        ok: true,
+        data: {
+            day: day && day.trim() ? day : new Date().toISOString().slice(0, 10),
+            summary: "",
+            highlights: [],
+            sourceRefs: [],
+        },
+    };
+}
+function buildSessionPayload(sessionId) {
+    if (!sessionId) {
+        return {
             ok: false,
-            command: name,
-            message: "Plugin loaded in packaging fallback mode; reinstall full workspace build for command runtime.",
-        }),
-    }));
+            error: {
+                code: "MISSING_SESSION_ID",
+                message: "session show requires sessionId",
+                requiredUserInput: ["session_id"],
+                nextStep: "reinvoke_session_with_session_id",
+            },
+        };
+    }
+    return {
+        ok: true,
+        data: {
+            requestedSessionId: sessionId,
+            traceId: sessionId,
+            decisionCount: 0,
+            attemptCount: 0,
+            governanceCount: 0,
+            keyFactors: [],
+            evidenceRefs: [],
+        },
+    };
+}
+function buildCredentialPayload(platformId) {
+    return {
+        ok: true,
+        data: {
+            platformId: platformId && platformId.trim() ? platformId : "unknown",
+            status: "missing",
+            nextStep: "provide_credential_context",
+        },
+    };
 }
-async function resolveCommandRouterSafe() {
+function buildExplainPayload(spine, subjectRaw) {
+    if (!subjectRaw?.trim()) {
+        return {
+            ok: false,
+            error: {
+                code: "MISSING_EXPLAIN_SUBJECT",
+                message: "explain requires subject",
+                requiredUserInput: ["subject"],
+                nextStep: "reinvoke_explain_with_subject",
+            },
+        };
+    }
+    let subject;
     try {
-        const mod = await import("./runtime/cli/index.js");
-        if (mod?.createCommandRouter) {
-            return mod.createCommandRouter();
-        }
+        subject = parseExplainSubject(subjectRaw);
     }
-    catch {
-        // fall through to fallback router
+    catch (error) {
+        const code = error.message;
+        if (code === "explain_subject_requires_id") {
+            return createUnavailableActionError("EXPLAIN_SUBJECT_REQUIRES_ID", "subject must include identifier", ["subject"], "reinvoke_explain_with_supported_subject");
+        }
+        if (code === "explain_subject_unsupported") {
+            return createUnavailableActionError("EXPLAIN_SUBJECT_UNSUPPORTED", "supported subjects are decision:<id>, platform:<id>, outreach:<id>, soul:<id>", ["subject"], "reinvoke_explain_with_supported_subject");
+        }
+        return createUnavailableActionError("EXPLAIN_SUBJECT_INVALID", "invalid explain subject", ["subject"], "reinvoke_explain_with_supported_subject");
     }
-    const commands = createFallbackCommands();
+    const runtimeEvidence = latestRuntimeEvidence(spine);
+    return {
+        ok: true,
+        data: {
+            subjectType: subject.subjectType,
+            conclusion: "Plugin surface is loaded in host-safe mode with a minimal activation spine.",
+            keyFactors: [
+                "synchronous_register",
+                `subject:${subject.subjectId}`,
+                runtimeEvidence?.capability ?? "runtime.activate",
+            ],
+            evidenceRefs: [
+                runtimeEvidence?.traceId ?? `${INTERNAL_RUNTIME_TRACE_PREFIX}none`,
+                `subject:${subjectRaw.trim()}`,
+                "host_safe_mode",
+            ],
+            nextStep: "use full workspace runtime for evidence-backed explain details",
+        },
+    };
+}
+function buildHeartbeatCheckPayload(spine, input) {
+    const runtimeEvidence = latestRuntimeEvidence(spine);
+    const updatedAt = runtimeEvidence?.createdAt ?? new Date(spine.lifecycleState.lastChangedAt).toISOString();
+    const timestamp = typeof input?.timestamp === "string" && input.timestamp.trim().length > 0 ? input.timestamp : updatedAt;
+    return {
+        ok: true,
+        status: "heartbeat_ok",
+        heartbeat: "HEARTBEAT_OK",
+        scope: "rhythm",
+        trigger: "heartbeat_bridge",
+        reasons: ["host_safe_bridge_ready"],
+        nextAction: "continue",
+        message: "Host-safe heartbeat bridge acknowledged the round. No additional action is required from this surface.",
+        data: {
+            runtime: {
+                host: "openclaw-plugin",
+                serviceStatus: spine.runtimeHandle.ready ? "running" : "idle",
+                updatedAt,
+            },
+            surface: {
+                tool: "second_nature_ops",
+                command: "second-nature heartbeat_check",
+            },
+            bridge: {
+                timestamp,
+                sessionContextProvided: typeof input?.sessionContext === "string" && input.sessionContext.trim().length > 0,
+                heartbeatChecklistProvided: typeof input?.heartbeatChecklist === "string" && input.heartbeatChecklist.trim().length > 0,
+                serviceEntryMode: "runtime_carrier_only",
+            },
+        },
+    };
+}
+function createHostSafeRouter(spine) {
+    const notImplemented = async (command) => ({
+        ok: false,
+        command,
+        message: HOST_SAFE_LIMITATION_MESSAGE,
+    });
+    const commands = [
+        {
+            name: "status",
+            description: "Show aggregated Second Nature status",
+            execute: async () => buildStatusPayload(spine),
+        },
+        {
+            name: "policy",
+            description: "Write or inspect policy state",
+            execute: async (input) => {
+                const action = typeof input?.action === "string" ? input.action : "show";
+                if (action === "set") {
+                    return createUnavailableActionError("HOST_SAFE_POLICY_SET_UNAVAILABLE", "policy set is unavailable in the host-safe plugin package", ["social_daily_limit", "quiet_enabled"], "run_workspace_runtime_or_reinstall_full_build");
+                }
+                return notImplemented("policy");
+            },
+        },
+        {
+            name: "credential",
+            description: "Inspect or recover credential state",
+            execute: async (input) => {
+                const action = typeof input?.action === "string" ? input.action : "show";
+                if (action === "verify") {
+                    return createUnavailableActionError("HOST_SAFE_CREDENTIAL_VERIFY_UNAVAILABLE", "credential verify is unavailable in the host-safe plugin package", ["verification_answer"], "run_workspace_runtime_or_reinstall_full_build");
+                }
+                const platformId = typeof input?.platformId === "string" ? input.platformId : undefined;
+                return buildCredentialPayload(platformId);
+            },
+        },
+        {
+            name: "quiet",
+            description: "Inspect Quiet lifecycle state",
+            execute: async (input) => {
+                const scope = typeof input?.scope === "string" ? input.scope : undefined;
+                return buildQuietPayload(scope);
+            },
+        },
+        {
+            name: "report",
+            description: "Show daily report artifacts",
+            execute: async (input) => {
+                const day = typeof input?.day === "string" ? input.day : undefined;
+                return buildReportPayload(day);
+            },
+        },
+        {
+            name: "session",
+            description: "Inspect continuity session details",
+            execute: async (input) => {
+                const sessionId = typeof input?.sessionId === "string" ? input.sessionId : undefined;
+                return buildSessionPayload(sessionId);
+            },
+        },
+        {
+            name: "audit",
+            description: "Inspect audit and evidence views",
+            execute: async () => notImplemented("audit"),
+        },
+        {
+            name: "explain",
+            description: "Answer why-question explain requests",
+            execute: async (input) => {
+                const subject = typeof input?.subject === "string" ? input.subject : undefined;
+                return buildExplainPayload(spine, subject);
+            },
+        },
+        {
+            name: "heartbeat_check",
+            description: "Acknowledge the shipping heartbeat bridge round",
+            execute: async (input) => buildHeartbeatCheckPayload(spine, input),
+        },
+    ];
     return {
         commands,
         resolve(name) {
@@ -28,51 +324,155 @@ async function resolveCommandRouterSafe() {
         },
     };
 }
-async function createRuntimeService() {
-    try {
-        const runtimeMod = await import("./runtime/core/second-nature/runtime/service-entry.js");
-        if (runtimeMod?.startRuntimeService) {
-            const handle = runtimeMod.startRuntimeService();
+function createActivationSpine() {
+    const spine = {
+        router: undefined,
+        runtimeHandle: startRuntimeService({ workspaceRoot: process.cwd() }),
+        lifecycleState: getLifecycleState(),
+        serviceStartRecorded: false,
+        runtimeEvidence: [],
+    };
+    spine.router = createHostSafeRouter(spine);
+    return spine;
+}
+function ensureActivationSpine() {
+    if (activationSpine) {
+        return activationSpine;
+    }
+    activationSpine = createActivationSpine();
+    return activationSpine;
+}
+function recordRuntimeEvidence(spine, origin) {
+    if (origin === "service_start" && spine.serviceStartRecorded) {
+        return;
+    }
+    if (origin === "service_start") {
+        spine.serviceStartRecorded = true;
+    }
+    spine.runtimeEvidence.push({
+        traceId: `${INTERNAL_RUNTIME_TRACE_PREFIX}${origin}-${spine.lifecycleState.registerCount}-${Date.now()}`,
+        capability: origin === "register"
+            ? spine.lifecycleState.registerCount === 1
+                ? "runtime.activate"
+                : "runtime.reload"
+            : "runtime.heartbeat",
+        origin,
+        createdAt: new Date().toISOString(),
+        status: "succeeded",
+    });
+    trimRuntimeEvidence(spine);
+}
+function refreshRegistrationState() {
+    const spine = ensureActivationSpine();
+    spine.runtimeHandle = startRuntimeService({ workspaceRoot: process.cwd() });
+    spine.lifecycleState = recordRegistration();
+    spine.serviceStartRecorded = false;
+    recordRuntimeEvidence(spine, "register");
+    return spine;
+}
+function parseCommandInput(rawArgs) {
+    const tokens = rawArgs?.trim().split(/\s+/).filter(Boolean) ?? [];
+    if (tokens.length === 0) {
+        return {
+            ok: false,
+            result: { ok: false, message: "Missing command argument." },
+        };
+    }
+    const [command, ...rest] = tokens;
+    if (command === "policy" && rest[0] === "set") {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                command,
+                message: "policy set requires structured args; use second_nature_ops instead.",
+            },
+        };
+    }
+    if (command === "credential" && rest[0] === "verify") {
+        return {
+            ok: false,
+            result: {
+                ok: false,
+                command,
+                message: "credential verify requires structured args; use second_nature_ops instead.",
+            },
+        };
+    }
+    switch (command) {
+        case "status":
+        case "quiet":
             return {
-                id: "second-nature-runtime",
-                start() {
-                    return { ready: handle.ready, version: handle.version };
-                },
+                ok: true,
+                command,
+                input: rest.length > 0 ? { scope: rest.join(" ") } : undefined,
+            };
+        case "report":
+            return {
+                ok: true,
+                command,
+                input: rest[0] ? { day: rest[0] } : undefined,
+            };
+        case "session":
+            return {
+                ok: true,
+                command,
+                input: rest[0] ? { sessionId: rest[0] } : undefined,
+            };
+        case "credential":
+            return {
+                ok: true,
+                command,
+                input: rest[0] ? { platformId: rest[0] } : undefined,
+            };
+        case "heartbeat_check":
+            return {
+                ok: true,
+                command,
+                input: rest.length > 0
+                    ? {
+                        timestamp: rest[0],
+                        sessionContext: rest.length > 1 ? rest.slice(1).join(" ") : undefined,
+                    }
+                    : undefined,
+            };
+        case "explain":
+            return {
+                ok: true,
+                command,
+                input: rest.length > 0 ? { subject: rest.join(" ") } : undefined,
+            };
+        default:
+            return {
+                ok: true,
+                command,
+                input: undefined,
             };
-        }
-    }
-    catch {
-        // fall through to minimal service shell
     }
+}
+function createRuntimeService() {
     return {
         id: "second-nature-runtime",
         start() {
-            return { ready: true, version: "0.1.6-minimal" };
+            const spine = ensureActivationSpine();
+            recordRuntimeEvidence(spine, "service_start");
+            return {
+                ready: spine.runtimeHandle.ready,
+                version: spine.runtimeHandle.version,
+            };
         },
     };
 }
-async function createLifecycleService() {
-    try {
-        const lifecycleMod = await import("./runtime/core/second-nature/runtime/lifecycle-service.js");
-        if (lifecycleMod?.recordRegistration) {
-            return {
-                id: "second-nature-lifecycle",
-                start() {
-                    const state = lifecycleMod.recordRegistration();
-                    return { phase: state.phase, registerCount: state.registerCount };
-                },
-            };
-        }
-    }
-    catch {
-        // fall through to minimal lifecycle shell
-    }
-    let registerCount = 0;
+function createLifecycleService() {
     return {
         id: "second-nature-lifecycle",
         start() {
-            registerCount += 1;
-            return { phase: registerCount === 1 ? "loading" : "reloading", registerCount };
+            const spine = ensureActivationSpine();
+            return {
+                phase: spine.lifecycleState.phase,
+                registerCount: spine.lifecycleState.registerCount,
+                lastChangedAt: spine.lifecycleState.lastChangedAt,
+            };
         },
     };
 }
@@ -80,33 +480,30 @@ export default {
     id: "second-nature",
     name: "Second Nature",
     description: "Registers command/tool/service surface with load-reload lifecycle semantics.",
-    async register(api) {
-        const router = await resolveCommandRouterSafe();
-        const runtimeService = await createRuntimeService();
-        const lifecycleService = await createLifecycleService();
+    register(api) {
+        const runtimeService = createRuntimeService();
+        const lifecycleService = createLifecycleService();
         api.registerService(runtimeService);
         api.registerService(lifecycleService);
-        api.registerCli(({ program }) => {
-            void program;
-        }, { commands: ["second-nature"] });
         api.registerCommand({
             name: "second-nature",
             description: "Route Agent-facing operational commands for Second Nature.",
             acceptsArgs: true,
             handler: async (ctx) => {
-                const command = ctx.args?.trim();
-                if (!command) {
+                const spine = ensureActivationSpine();
+                const parsed = parseCommandInput(ctx.args);
+                if (!parsed.ok) {
                     return {
-                        text: JSON.stringify({ ok: false, message: "Missing command argument." }),
+                        text: JSON.stringify(parsed.result),
                     };
                 }
-                const resolved = router.resolve(command);
+                const resolved = spine.router.resolve(parsed.command);
                 if (!resolved) {
                     return {
-                        text: JSON.stringify({ ok: false, command, message: "Unknown Second Nature command." }),
+                        text: JSON.stringify({ ok: false, command: parsed.command, message: "Unknown Second Nature command." }),
                     };
                 }
-                const result = await resolved.execute();
+                const result = await resolved.execute(parsed.input);
                 return {
                     text: JSON.stringify(result),
                 };
@@ -120,12 +517,13 @@ export default {
                 additionalProperties: false,
                 properties: {
                     command: { type: "string" },
-                    args: { type: "object", additionalProperties: true }
+                    args: { type: "object", additionalProperties: true },
                 },
-                required: ["command"]
+                required: ["command"],
             },
             async execute(_id, params) {
-                const resolved = router.resolve(params.command);
+                const spine = ensureActivationSpine();
+                const resolved = spine.router.resolve(params.command);
                 if (!resolved) {
                     return {
                         content: [

package/openclaw.plugin.json

@@ -1,13 +1,20 @@
 {
   "id": "second-nature",
   "name": "Second Nature",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "entry": "./index.js",
-  "description": "OpenClaw native plugin package for continuity, explain, and recovery operations.",
+  "description": "OpenClaw native plugin package with synchronous surface registration and a bundled runtime spine.",
   "capabilities": {
-    "commands": ["second-nature"],
-    "tools": ["second_nature_ops"],
-    "services": ["second-nature-runtime", "second-nature-lifecycle"]
+    "commands": [
+      "second-nature"
+    ],
+    "tools": [
+      "second_nature_ops"
+    ],
+    "services": [
+      "second-nature-runtime",
+      "second-nature-lifecycle"
+    ]
   },
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@haaaiawd/second-nature",
-  "version": "0.1.6",
-  "description": "OpenClaw native plugin for long-running agent continuity, Quiet memory curation, and explainable operator flows.",
+  "version": "0.1.8",
+  "description": "OpenClaw native plugin with synchronous registration, a packaged runtime artifact, and operator-facing status/explain flows.",
   "keywords": [
     "openclaw",
     "plugin",

package/runtime/cli/read-models/index.js

@@ -1,9 +1,11 @@
+import { desc } from "drizzle-orm";
 import { createQuietInputLoader } from "../../storage/services/quiet-input-loader.js";
 import { AssetRepository } from "../../storage/repositories/asset-repository.js";
 import { CredentialRepository } from "../../storage/repositories/credential-repository.js";
 import { EvidenceQueryEngine } from "../../observability/query/evidence-query-engine.js";
-import { executionAttempts } from "../../observability/db/schema/index.js";
-import { desc } from "drizzle-orm";
+import { decisionLedger, executionAttempts } from "../../observability/db/schema/index.js";
+const INTERNAL_RUNTIME_PLATFORM_ID = "second-nature-runtime";
+const INTERNAL_RUNTIME_TRACE_PREFIX = "sn-runtime-";
 function buildCredentialNextStep(status) {
     if (status === "pending_verification")
         return "submit_verification_answer";
@@ -11,6 +13,24 @@ function buildCredentialNextStep(status) {
         return "refresh_credential_context";
     return undefined;
 }
+function mapRuntimeStatus(attempt) {
+    if (!attempt) {
+        return "unknown";
+    }
+    if (attempt.failureClass || attempt.status === "failed") {
+        return "degraded";
+    }
+    return "running";
+}
+function mapConnectorStatus(attempt) {
+    if (!attempt) {
+        return "unknown";
+    }
+    if (attempt.failureClass || attempt.status === "failed") {
+        return "degraded";
+    }
+    return "healthy";
+}
 export function createCliReadModels(deps) {
     const assetRepository = new AssetRepository(deps.stateDb);
     const credentialRepository = new CredentialRepository(deps.stateDb);
@@ -18,15 +38,28 @@ export function createCliReadModels(deps) {
     const evidenceQuery = new EvidenceQueryEngine(deps.observabilityDb);
     return {
         async loadStatus(_scope) {
-            let latestAttempt;
+            let recentAttempts = [];
+            let recentDecisions = [];
             let credentials = [];
             try {
-                latestAttempt = await deps.observabilityDb.db.query.executionAttempts.findFirst({
-                    orderBy: [desc(executionAttempts.startedAt)],
-                });
+                recentAttempts = await deps.observabilityDb.db
+                    .select()
+                    .from(executionAttempts)
+                    .orderBy(desc(executionAttempts.startedAt), desc(executionAttempts.finishedAt))
+                    .limit(50);
+            }
+            catch {
+                recentAttempts = [];
+            }
+            try {
+                recentDecisions = await deps.observabilityDb.db
+                    .select()
+                    .from(decisionLedger)
+                    .orderBy(desc(decisionLedger.createdAt))
+                    .limit(50);
             }
             catch {
-                latestAttempt = undefined;
+                recentDecisions = [];
             }
             try {
                 credentials = await deps.stateDb.db.query.credentialRecords.findMany();
@@ -34,28 +67,40 @@ export function createCliReadModels(deps) {
             catch {
                 credentials = [];
             }
-            const connectorSummary = latestAttempt
-                ? [{
-                        platformId: latestAttempt.platformId,
-                        status: latestAttempt.failureClass ? "degraded" : "healthy",
-                        channel: latestAttempt.channel,
-                        failureClass: latestAttempt.failureClass ?? undefined,
-                    }]
+            const latestRuntimeAttempt = recentAttempts.find((attempt) => attempt.platformId === INTERNAL_RUNTIME_PLATFORM_ID);
+            const latestConnectorAttempt = recentAttempts.find((attempt) => attempt.platformId !== INTERNAL_RUNTIME_PLATFORM_ID);
+            const latestRuntimeDecision = recentDecisions.find((decision) => decision.traceId.startsWith(INTERNAL_RUNTIME_TRACE_PREFIX));
+            const runtimeUpdatedAt = latestRuntimeAttempt?.finishedAt ?? latestRuntimeAttempt?.startedAt ?? latestRuntimeDecision?.createdAt ?? "";
+            const quietMode = latestRuntimeDecision?.mode === "quiet" ||
+                latestRuntimeDecision?.mode === "maintenance_only" ||
+                latestRuntimeDecision?.mode === "paused_for_interrupt"
+                ? latestRuntimeDecision.mode
+                : "unknown";
+            const riskFlags = [latestRuntimeAttempt?.failureClass, latestConnectorAttempt?.failureClass].filter((value) => Boolean(value));
+            const connectorSummary = latestConnectorAttempt
+                ? [
+                    {
+                        platformId: latestConnectorAttempt.platformId,
+                        status: mapConnectorStatus(latestConnectorAttempt),
+                        channel: latestConnectorAttempt.channel,
+                        failureClass: latestConnectorAttempt.failureClass ?? undefined,
+                    },
+                ]
                 : [];
             return {
                 runtime: {
                     host: "openclaw-plugin",
-                    serviceStatus: latestAttempt ? (latestAttempt.failureClass ? "degraded" : "running") : "unknown",
-                    updatedAt: new Date().toISOString(),
+                    serviceStatus: mapRuntimeStatus(latestRuntimeAttempt),
+                    updatedAt: runtimeUpdatedAt,
                 },
                 rhythm: {
-                    mode: "unknown",
+                    mode: latestRuntimeDecision?.mode ?? "unknown",
                     windowId: undefined,
                 },
                 quiet: {
-                    mode: "unknown",
-                    lastEvent: undefined,
-                    interrupted: undefined,
+                    mode: quietMode,
+                    lastEvent: latestRuntimeDecision?.traceId,
+                    interrupted: latestRuntimeDecision?.mode === "paused_for_interrupt" ? true : undefined,
                 },
                 connectors: connectorSummary,
                 credentials: credentials.map((item) => ({
@@ -64,8 +109,8 @@ export function createCliReadModels(deps) {
                     nextStep: buildCredentialNextStep(item.status),
                 })),
                 risk: {
-                    level: latestAttempt?.failureClass ? "medium" : "low",
-                    flags: latestAttempt?.failureClass ? [latestAttempt.failureClass] : [],
+                    level: riskFlags.length > 0 ? "medium" : "low",
+                    flags: riskFlags,
                 },
             };
         },

package/runtime/connectors/base/policy-layer.js

@@ -108,40 +108,23 @@ export function createConnectorPolicyLayer(ctx) {
             }
             let lastFailure;
             for (let attempt = 1; attempt <= retryPolicy.maxRetries; attempt += 1) {
-                const traceId = makeTraceId(request, plan);
-                const attemptId = `attempt-${traceId}-${attempt}`;
+                const traceId = `${makeTraceId(request, plan)}:${attempt}`;
                 if (ctx.telemetry) {
-                    await ctx.telemetry.recordExecutionAttempt({
-                        id: attemptId,
+                    await ctx.telemetry.startAttempt({
                         traceId,
                         decisionId: identity.decisionId,
                         intentId: identity.intentId,
                         platformId: request.platformId,
                         capability: request.intent,
                         channel: plan.channel,
-                        status: "started",
                         retryPolicy: JSON.stringify(retryPolicy),
                         idempotencyKey: request.idempotencyKey,
-                        startedAt: new Date().toISOString(),
                     });
                 }
                 const raw = await ctx.executionRunner.run(plan, request);
                 if (raw.success) {
                     if (ctx.telemetry) {
-                        await ctx.telemetry.recordExecutionAttempt({
-                            id: `${attemptId}-done`,
-                            traceId,
-                            decisionId: identity.decisionId,
-                            intentId: identity.intentId,
-                            platformId: request.platformId,
-                            capability: request.intent,
-                            channel: plan.channel,
-                            status: "succeeded",
-                            retryPolicy: JSON.stringify(retryPolicy),
-                            idempotencyKey: request.idempotencyKey,
-                            startedAt: new Date().toISOString(),
-                            finishedAt: new Date().toISOString(),
-                        });
+                        await ctx.telemetry.completeAttempt(traceId, "succeeded");
                     }
                     return {
                         status: "success",
@@ -161,21 +144,7 @@ export function createConnectorPolicyLayer(ctx) {
                     channel: raw.channel,
                 };
                 if (ctx.telemetry) {
-                    await ctx.telemetry.recordExecutionAttempt({
-                        id: `${attemptId}-failed`,
-                        traceId,
-                        decisionId: identity.decisionId,
-                        intentId: identity.intentId,
-                        platformId: request.platformId,
-                        capability: request.intent,
-                        channel: plan.channel,
-                        status: "failed",
-                        failureClass: classified.class,
-                        retryPolicy: JSON.stringify(retryPolicy),
-                        idempotencyKey: request.idempotencyKey,
-                        startedAt: new Date().toISOString(),
-                        finishedAt: new Date().toISOString(),
-                    });
+                    await ctx.telemetry.completeAttempt(traceId, "failed", undefined, classified.class);
                 }
                 if (ctx.cooldownPort) {
                     await ctx.cooldownPort.markFailure(request.platformId, intent, classified.class, classified.retryAfterMs);

package/runtime/observability/db/index.js

@@ -6,6 +6,73 @@ import { fileURLToPath } from "node:url";
 import * as schema from "./schema/index.js";
 // Pre-initialize sql.js WASM at module load time
 const SQL = await initSqlJs();
+const OBSERVABILITY_SCHEMA_SQL = `
+  CREATE TABLE IF NOT EXISTS decision_ledger (
+    id TEXT PRIMARY KEY,
+    tick_id TEXT NOT NULL,
+    trace_id TEXT NOT NULL,
+    intent_id TEXT,
+    platform_id TEXT,
+    verdict TEXT NOT NULL,
+    mode TEXT NOT NULL,
+    reasons TEXT NOT NULL,
+    reason_codes TEXT NOT NULL,
+    decision_basis TEXT NOT NULL,
+    evidence_refs TEXT NOT NULL,
+    model_eval_ref TEXT,
+    created_at TEXT NOT NULL
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS decision_trace_idx ON decision_ledger(trace_id);
+  CREATE INDEX IF NOT EXISTS decision_tick_idx ON decision_ledger(tick_id);
+  CREATE TABLE IF NOT EXISTS execution_attempts (
+    id TEXT PRIMARY KEY,
+    trace_id TEXT NOT NULL,
+    decision_id TEXT NOT NULL,
+    intent_id TEXT NOT NULL,
+    platform_id TEXT NOT NULL,
+    capability TEXT NOT NULL,
+    channel TEXT NOT NULL,
+    status TEXT NOT NULL,
+    commit_state TEXT,
+    failure_class TEXT,
+    retry_policy TEXT,
+    idempotency_key TEXT,
+    started_at TEXT,
+    finished_at TEXT
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS attempt_trace_idx ON execution_attempts(trace_id);
+  CREATE INDEX IF NOT EXISTS attempt_decision_idx ON execution_attempts(decision_id);
+  CREATE INDEX IF NOT EXISTS attempt_platform_idx ON execution_attempts(platform_id);
+  CREATE TABLE IF NOT EXISTS governance_audit (
+    id TEXT PRIMARY KEY,
+    event_type TEXT NOT NULL,
+    proposal_id TEXT,
+    target_asset_id TEXT,
+    asset_path TEXT,
+    status_from TEXT,
+    status_to TEXT NOT NULL,
+    before_hash TEXT,
+    after_hash TEXT,
+    supporting_sources TEXT,
+    reason TEXT,
+    verification_deadline TEXT,
+    attempts_remaining INTEGER,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS audit_proposal_idx ON governance_audit(proposal_id);
+  CREATE INDEX IF NOT EXISTS audit_asset_idx ON governance_audit(target_asset_id);
+  CREATE INDEX IF NOT EXISTS audit_event_idx ON governance_audit(event_type);
+  CREATE TABLE IF NOT EXISTS redaction_manifest (
+    id TEXT PRIMARY KEY,
+    event_id TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    field_name TEXT NOT NULL,
+    action TEXT NOT NULL,
+    original_value_hash TEXT,
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS redact_event_idx ON redaction_manifest(event_id);
+`;
 function resolveDbPath(filename) {
     if (path.isAbsolute(filename) || filename === ":memory:") {
         return filename;
@@ -18,6 +85,9 @@ function resolveDbPath(filename) {
     }
     return path.join(dataDir, filename);
 }
+function bootstrapObservabilitySchema(sqlite) {
+    sqlite.exec(OBSERVABILITY_SCHEMA_SQL);
+}
 export function createObservabilityDatabase(filename = "observability.db") {
     const dbPath = resolveDbPath(filename);
     const isMemory = filename === ":memory:";
@@ -26,6 +96,7 @@ export function createObservabilityDatabase(filename = "observability.db") {
         dbBuffer = fs.readFileSync(dbPath);
     }
     const sqlite = new SQL.Database(dbBuffer);
+    bootstrapObservabilitySchema(sqlite);
     const db = drizzle(sqlite, { schema });
     return {
         sqlite,

package/runtime/observability/services/execution-telemetry.d.ts

@@ -7,7 +7,6 @@ export interface ExecutionAttemptInput {
     platformId: string;
     capability: string;
     channel: string;
-    status: ExecutionAttempt["status"];
     commitState?: IntentCommitState;
     failureClass?: string;
     retryPolicy?: string;

package/runtime/storage/db/index.js

@@ -6,6 +6,65 @@ import { fileURLToPath } from "node:url";
 import * as schema from "./schema/index.js";
 // Pre-initialize sql.js WASM at module load time
 const SQL = await initSqlJs();
+const STATE_SCHEMA_SQL = `
+  CREATE TABLE IF NOT EXISTS credential_records (
+    platform_id TEXT PRIMARY KEY,
+    credential_type TEXT NOT NULL,
+    encrypted_value TEXT NOT NULL,
+    status TEXT NOT NULL,
+    verification_code TEXT,
+    challenge_text TEXT,
+    expires_at TEXT,
+    attempts_remaining INTEGER,
+    updated_at TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS policy_records (
+    platform_id TEXT PRIMARY KEY,
+    social_daily_limit INTEGER NOT NULL,
+    quiet_enabled INTEGER NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS asset_registry (
+    id TEXT PRIMARY KEY,
+    kind TEXT NOT NULL,
+    path TEXT NOT NULL,
+    hash TEXT NOT NULL,
+    version INTEGER NOT NULL DEFAULT 1,
+    layer TEXT NOT NULL,
+    last_indexed_at TEXT NOT NULL
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS asset_registry_path_idx ON asset_registry(path);
+  CREATE TABLE IF NOT EXISTS intent_commit_records (
+    id TEXT PRIMARY KEY,
+    intent_id TEXT NOT NULL,
+    decision_id TEXT NOT NULL,
+    checkpoint_id TEXT,
+    state TEXT NOT NULL,
+    outcome_ref TEXT,
+    metadata_json TEXT,
+    updated_at TEXT NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS proposal_records (
+    id TEXT PRIMARY KEY,
+    target_asset_id TEXT NOT NULL,
+    before_hash TEXT,
+    after_hash TEXT,
+    status TEXT NOT NULL,
+    proposed_diff TEXT NOT NULL,
+    reason TEXT NOT NULL,
+    supporting_sources TEXT NOT NULL,
+    confidence REAL NOT NULL,
+    created_at TEXT NOT NULL,
+    applied_at TEXT
+  );
+  CREATE TABLE IF NOT EXISTS provenance_edges (
+    id TEXT PRIMARY KEY,
+    from_id TEXT NOT NULL,
+    to_id TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  );
+`;
 function resolveDbPath(filename) {
     if (path.isAbsolute(filename) || filename === ":memory:") {
         return filename;
@@ -18,6 +77,9 @@ function resolveDbPath(filename) {
     }
     return path.join(dataDir, filename);
 }
+function bootstrapStateSchema(sqlite) {
+    sqlite.exec(STATE_SCHEMA_SQL);
+}
 export function createStateDatabase(filename = "state.db") {
     const dbPath = resolveDbPath(filename);
     const isMemory = filename === ":memory:";
@@ -26,6 +88,7 @@ export function createStateDatabase(filename = "state.db") {
         dbBuffer = fs.readFileSync(dbPath);
     }
     const sqlite = new SQL.Database(dbBuffer);
+    bootstrapStateSchema(sqlite);
     const db = drizzle(sqlite, { schema });
     return {
         sqlite,

package/runtime/cli/action-bridge.d.ts

@@ -1,11 +0,0 @@
-import type { StateAPI } from "../storage/state-api.js";
-export interface PolicyWriteInput {
-    platformId: string;
-    socialDailyLimit: number;
-    quietEnabled: boolean;
-}
-export interface ActionBridge {
-    savePolicy(input: PolicyWriteInput): Promise<void>;
-    verifyCredential(platformId: string, answer: string): Promise<void>;
-}
-export declare function createActionBridge(stateApi: StateAPI): ActionBridge;

package/runtime/cli/index.d.ts

@@ -1,25 +0,0 @@
-import { type ObservabilityDatabase } from "../observability/db/index.js";
-import { type StateDatabase, type StateAPI } from "../storage/index.js";
-import { type ActionBridge } from "./action-bridge.js";
-import { type CliCommandDefinition } from "./commands/index.js";
-import { type CliReadModels } from "./read-models/index.js";
-export interface CommandRouter {
-    commands: CliCommandDefinition[];
-    resolve(name: string): CliCommandDefinition | undefined;
-}
-export interface CommandRouterDeps {
-    commands: CliCommandDefinition[];
-}
-export interface CliRuntimeDeps {
-    stateDb: StateDatabase;
-    observabilityDb: ObservabilityDatabase;
-    stateApi: StateAPI;
-    readModels: CliReadModels;
-    actionBridge: ActionBridge;
-}
-export interface CreateCommandRouterOptions {
-    deps?: Partial<CliRuntimeDeps>;
-}
-export declare function createCliRuntimeDeps(overrides?: Partial<CliRuntimeDeps>): CliRuntimeDeps;
-export declare function createCommandRouter(options?: CreateCommandRouterOptions): CommandRouter;
-export declare function closeCliRuntimeDeps(deps: Pick<CliRuntimeDeps, "stateDb" | "observabilityDb">): void;