@haaaiawd/second-nature 0.2.8 → 0.2.12

package/index.js

@@ -31,6 +31,12 @@
  *   illusion of a working plugin while agent sessions see no tool. We hit
  *   exactly that on 2026-05-06; the fix lives in plugin/openclaw.plugin.json
  *   under the `activation` block.
+ * - Cloud Feishu/OpenClaw sessions can report `capabilities=none`. In that
+ *   mode, binding activation to `onCapabilities:["tool"]` prevents the agent
+ *   tool from entering the session even though the plugin loaded. Therefore
+ *   the manifest keeps `activation.onStartup === true` for daemon loading and
+ *   declares the tool through `contracts.tools`, but does not require a session
+ *   capability to activate `second_nature_ops`.
  * - `Shape: non-capability` reported by `openclaw plugins info` is EXPECTED
  *   for this plugin. OpenClaw counts capabilities only across cli-backend /
  *   text-inference / speech / realtime-* / media-understanding /
@@ -91,6 +97,7 @@ const WORKSPACE_BRIDGE_COMMANDS = new Set([
     "session",
     "explain",
     "heartbeat_check",
+    "heartbeat_run",
     "fallback",
     "storage_smoke",
     // T1.2.8 (SN-CODE-03): capability probe surface via workspace bridge
@@ -146,8 +153,10 @@ async function ensureWorkspaceOpsBridge(spine) {
     return { ok: true, dispatch: opened.dispatch };
 }
 async function routeSecondNatureCommand(spine, command, input) {
+    // T-ROS.C.1-followup: heartbeat_run is an alias for heartbeat_check on the plugin surface.
+    const normalizedCommand = command === "heartbeat_run" ? "heartbeat_check" : command;
     const wr = spine.workspaceRootContext;
-    const useBridge = wr.resolution !== "unknown" && isWorkspaceBridgeCommand(command, input);
+    const useBridge = wr.resolution !== "unknown" && isWorkspaceBridgeCommand(normalizedCommand, input);
     if (useBridge) {
         const bridge = await ensureWorkspaceOpsBridge(spine);
         if (!bridge.ok) {
@@ -164,10 +173,10 @@ async function routeSecondNatureCommand(spine, command, input) {
                 },
             };
         }
-        const payload = (await bridge.dispatch(command, input));
+        const payload = (await bridge.dispatch(normalizedCommand, input));
         return withSetupNudge(spine, command, payload);
     }
-    const def = spine.router.resolve(command);
+    const def = spine.router.resolve(normalizedCommand);
     if (!def) {
         return { ok: false, message: `Unknown Second Nature command: ${command}` };
     }

package/openclaw.plugin.json

@@ -1,13 +1,10 @@
 {
   "id": "second-nature",
   "name": "Second Nature",
-  "version": "0.2.8",
-  "description": "OpenClaw native plugin with synchronous surface registration and bundled runtime spine. Set SECOND_NATURE_WORKSPACE_ROOT or tool workspaceRoot to the same path as the agent workspace. Agent inner guide is packaged as agent-inner-guide.md. Ops surface: loop_status, self_health, tool_affordance, heartbeat_digest, snapshot:capture, narrative:diff, timeline, restore, runtime_secret_bootstrap, connector:run, guidance_payload.",
+  "version": "0.2.12",
+  "description": "OpenClaw native plugin with synchronous surface registration and bundled runtime spine. Set SECOND_NATURE_WORKSPACE_ROOT or tool workspaceRoot to the same path as the agent workspace. Agent inner guide is packaged as agent-inner-guide.md. Ops surface: loop_status, self_health, tool_affordance, heartbeat_check, heartbeat_run, heartbeat_digest, snapshot:capture, narrative:diff, timeline, restore, runtime_secret_bootstrap, connector:run, guidance_payload.",
   "activation": {
-    "onStartup": true,
-    "onCapabilities": [
-      "tool"
-    ]
+    "onStartup": true
   },
   "contracts": {
     "commands": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haaaiawd/second-nature",
-  "version": "0.2.8",
+  "version": "0.2.12",
   "description": "OpenClaw native plugin with synchronous registration, a packaged runtime artifact, and operator-facing status/explain flows.",
   "keywords": [
     "openclaw",

package/runtime/cli/host-capability/probe-host-capability.js

@@ -7,7 +7,7 @@ function mergeEvidenceRefs(...groups) {
     const out = [];
     for (const group of groups) {
         for (const ref of group) {
-            const key = `${ref.kind}:${ref.id}`;
+            const key = `${ref.family}:${ref.id}`;
             if (!seen.has(key)) {
                 seen.add(key);
                 out.push(ref);

package/runtime/cli/host-capability/types.d.ts

@@ -3,15 +3,10 @@
  *
  * Test coverage: tests/unit/cli/host-capability.test.ts, tests/integration/cli/host-capability-probe.test.ts
  */
+import type { SourceRef } from "../../shared/types/v8-contracts.js";
+export type { SourceRef } from "../../shared/types/v8-contracts.js";
 export type DeliveryCapabilityStatus = "target_available" | "target_none" | "channel_missing" | "host_api_unavailable" | "host_unsupported" | "unknown";
 export type CapabilityVerdict = "pass" | "fail" | "unknown" | "not_applicable";
-export interface SourceRef {
-    id: string;
-    kind: "platform_item" | "workspace_artifact" | "decision_record" | "user_anchor" | "connector_result" | "host_report" | "fallback_artifact";
-    uri: string;
-    excerptHash?: string;
-    observedAt?: string;
-}
 export interface HostCapabilityDocReference {
     title: string;
     url: string;

package/runtime/cli/host-capability/types.js

@@ -1,6 +1 @@
-/**
- * Host capability probe contracts (cli-system v5 / ADR-007).
- *
- * Test coverage: tests/unit/cli/host-capability.test.ts, tests/integration/cli/host-capability-probe.test.ts
- */
 export {};

package/runtime/cli/ops/heartbeat-surface.d.ts

@@ -45,6 +45,8 @@ export interface HeartbeatSurfaceResult {
         capabilityClass?: string | null;
         impulseText?: string | null;
         atmosphereText?: string | null;
+        expressionBoundaryConstraints?: string[] | null;
+        expressionBoundaryStyle?: string | null;
         freshnessMs?: number;
         missingReason?: string;
     };

package/runtime/cli/ops/heartbeat-surface.js

@@ -1,6 +1,23 @@
 import { createWorkspaceHeartbeatRunner } from "./workspace-heartbeat-runner.js";
 // T-CP.R.2: v8 real runtime spine bridge
 import { runRealRuntimeHeartbeatCycle, } from "../../core/second-nature/control-plane/real-runtime-spine.js";
+async function refreshHeartbeatImpulseContext(state, now) {
+    const { assembleImpulseSync } = await import("../../guidance/impulse-assembler.js");
+    const { buildExpressionBoundary } = await import("../../guidance/output-guard.js");
+    const { getShortAtmosphereTemplate } = await import("../../guidance/template-registry.js");
+    const { writeImpulseContext } = await import("../../core/second-nature/guidance/impulse-context-writer.js");
+    const impulseResult = assembleImpulseSync({ sceneType: "heartbeat" });
+    const atmosphere = getShortAtmosphereTemplate("active", "low");
+    const expressionBoundary = buildExpressionBoundary("heartbeat");
+    const result = await writeImpulseContext(state, {
+        sceneType: "heartbeat",
+        impulseResult,
+        atmosphereText: atmosphere.text,
+        expressionBoundaryConstraints: expressionBoundary.constraints,
+        expressionBoundaryStyle: expressionBoundary.style,
+    }, { now });
+    return "id" in result ? result.id : undefined;
+}
 function mapCycleToSurface(cycle, surfaceMode) {
     const status = cycle.status === "runtime_carrier_only"
         ? "runtime_carrier_only"
@@ -111,6 +128,11 @@ export async function heartbeatCheck(input) {
                 }
                 else {
                     const spine = v8Result;
+                    const artifactId = await refreshHeartbeatImpulseContext(input.state, timestamp);
+                    if (artifactId) {
+                        spine.impulseContextArtifactId = artifactId;
+                        surfaceResult.reasons.push(`impulse_context_refreshed:${artifactId}`);
+                    }
                     surfaceResult.v8Spine = spine;
                     surfaceResult.livedExperienceLoopClaimed = Boolean(spine.cycleId && (spine.closureRef || spine.noActionReason));
                     surfaceResult.reasons = [
@@ -134,7 +156,7 @@ export async function heartbeatCheck(input) {
         if (input.state) {
             try {
                 const { readImpulseContext } = await import("../../core/second-nature/guidance/impulse-context-reader.js");
-                const ctx = await readImpulseContext(input.state, "social");
+                const ctx = await readImpulseContext(input.state, "heartbeat");
                 if (ctx.available) {
                     surfaceResult.impulseContext = {
                         available: true,
@@ -142,6 +164,8 @@ export async function heartbeatCheck(input) {
                         capabilityClass: ctx.artifact.capabilityClass,
                         impulseText: ctx.artifact.impulseText,
                         atmosphereText: ctx.artifact.atmosphereText,
+                        expressionBoundaryConstraints: ctx.artifact.expressionBoundaryConstraints,
+                        expressionBoundaryStyle: ctx.artifact.expressionBoundaryStyle,
                         freshnessMs: ctx.freshnessMs,
                     };
                     surfaceResult.reasons.push(`impulse_context:${ctx.artifact.id}`);
@@ -154,8 +178,13 @@ export async function heartbeatCheck(input) {
                     surfaceResult.reasons.push(`impulse_context_missing:${ctx.reason}`);
                 }
             }
-            catch {
-                // Non-fatal: impulse context is advisory
+            catch (readErr) {
+                const msg = readErr instanceof Error ? readErr.message : String(readErr);
+                surfaceResult.impulseContext = {
+                    available: false,
+                    missingReason: `read_exception:${msg.slice(0, 120)}`,
+                };
+                surfaceResult.reasons.push(`impulse_context_read_failed:${msg.slice(0, 120)}`);
             }
         }
         return surfaceResult;

package/runtime/cli/ops/manual-run-dispatcher.d.ts

@@ -29,6 +29,7 @@ import type { CapabilityContractRegistryV7 } from "../../connectors/base/manifes
 import type { AppendOnlyAuditStore } from "../../observability/audit/append-only-audit-store.js";
 import { type HeartbeatCheckInput, type HeartbeatSurfaceResult } from "./heartbeat-surface.js";
 import type { RuntimeOpsEnvelope } from "./ops-router.js";
+import type { StateDatabase } from "../../storage/db/index.js";
 export interface ManualTriggerContext {
     triggerSource: "manual_run";
     affectsHeartbeatCadence: false;
@@ -47,6 +48,11 @@ export interface ConnectorRunResult {
     experienceId: string;
     triggerSource: "manual_run";
     affectsHeartbeatCadence: false;
+    evidence?: {
+        v7EvidenceId?: string;
+        v8EvidenceIds: string[];
+        emptyReason?: string;
+    };
 }
 export interface WetProbeRunInput {
     platformId: string;
@@ -77,5 +83,9 @@ export interface ManualRunDispatcherDeps {
     wetProbeRunner: WetProbeRunner;
     registryV7: CapabilityContractRegistryV7;
     auditStore?: AppendOnlyAuditStore;
+    /** Workspace state database for evidence persistence (v7 life_evidence + v8 EvidenceItem). */
+    state?: StateDatabase;
+    /** Workspace root required for v7 life evidence JSON artifacts. */
+    workspaceRoot?: string;
 }
 export declare function createManualRunDispatcher(deps: ManualRunDispatcherDeps): ManualRunDispatcher;

package/runtime/cli/ops/manual-run-dispatcher.js

@@ -25,6 +25,9 @@
 import * as crypto from "node:crypto";
 import { recordConnectorAttemptAudit } from "../../observability/services/audit-closure-recorders.js";
 import { heartbeatCheck, } from "./heartbeat-surface.js";
+import { appendLifeEvidence } from "../../storage/life-evidence/append-life-evidence.js";
+import { mapLifeEvidence } from "../../connectors/base/map-life-evidence.js";
+import { normalizeConnectorEvidence } from "../../connectors/evidence-normalizer.js";
 function buildManualContext(input) {
     return {
         triggerSource: "manual_run",
@@ -40,6 +43,7 @@ export function createManualRunDispatcher(deps) {
             const decisionId = `manual:${crypto.randomUUID()}`;
             const intentId = `manual-run:${input.platformId}:${input.capabilityId}`;
             const idempotencyKey = `idem:manual:${crypto.randomUUID()}`;
+            const now = new Date().toISOString();
             const connectorResult = await deps.connectorExecutor.executeEffect({
                 platformId: input.platformId,
                 intent: input.capabilityId,
@@ -64,11 +68,56 @@ export function createManualRunDispatcher(deps) {
                 decisionId,
                 intentId,
             });
+            const evidenceSummary = {
+                v8EvidenceIds: [],
+            };
+            if (connectorResult.status === "success" && deps.state) {
+                const capabilityIntent = input.capabilityId;
+                // v7 life evidence double-write (parity with heartbeat loop)
+                try {
+                    if (deps.workspaceRoot) {
+                        const lifeCandidate = mapLifeEvidence({
+                            platformId: input.platformId,
+                            intent: capabilityIntent,
+                            result: connectorResult,
+                            observedAt: now,
+                        });
+                        if (lifeCandidate) {
+                            const lifeAck = await appendLifeEvidence(deps.state, deps.workspaceRoot, lifeCandidate);
+                            evidenceSummary.v7EvidenceId = lifeAck.evidenceId;
+                        }
+                    }
+                }
+                catch (v7Err) {
+                    const msg = v7Err instanceof Error ? v7Err.message : String(v7Err);
+                    console.warn(`[connector:run] v7 life evidence append failed for ${input.platformId}: ${msg}`);
+                }
+                // v8 EvidenceItem content-bearing write
+                try {
+                    const v8Result = await normalizeConnectorEvidence(deps.state, {
+                        status: "success",
+                        platformId: input.platformId,
+                        capabilityId: input.capabilityId,
+                        data: connectorResult.data,
+                        observedAt: now,
+                    });
+                    evidenceSummary.v8EvidenceIds = v8Result.evidenceIds;
+                    evidenceSummary.emptyReason = v8Result.emptyReason;
+                    if (v8Result.degraded) {
+                        console.warn(`[connector:run] v8 evidence normalization degraded for ${input.platformId}: ${v8Result.degraded.reason}`);
+                    }
+                }
+                catch (v8Err) {
+                    const msg = v8Err instanceof Error ? v8Err.message : String(v8Err);
+                    console.warn(`[connector:run] v8 evidence normalization failed for ${input.platformId}: ${msg}`);
+                }
+            }
             const runResult = {
                 connectorResult,
                 experienceId,
                 triggerSource: ctx.triggerSource,
                 affectsHeartbeatCadence: ctx.affectsHeartbeatCadence,
+                evidence: evidenceSummary,
             };
             return {
                 ok: connectorResult.status === "success",

package/runtime/cli/ops/ops-router.js

@@ -325,9 +325,9 @@ function createStaticUnknownAdapter(workspaceRoot) {
                     evidenceRefs: [
                         {
                             id: `delivery:${parsed.manifest.platformId}`,
-                            kind: "workspace_artifact",
+                            family: "audit",
                             uri: `workspace://connectors/${parsed.manifest.platformId}/manifest.yaml`,
-                            observedAt: now,
+                            redactionClass: "none",
                         },
                     ],
                 };
@@ -785,6 +785,8 @@ export function createOpsRouter(deps) {
                     wetProbeRunner,
                     registryV7,
                     auditStore: deps.auditStore,
+                    state: deps.state,
+                    workspaceRoot: typeof input?.workspaceRoot === "string" ? input.workspaceRoot : process.cwd(),
                 });
                 return dispatcher.runConnector({
                     platformId,
@@ -1525,7 +1527,7 @@ export function createOpsRouter(deps) {
                 const platformId = typeof input?.platformId === "string"
                     ? input.platformId
                     : undefined;
-                const validSceneTypes = ["social", "reply", "outreach", "quiet", "explain", "user_reply"];
+                const validSceneTypes = ["social", "reply", "outreach", "quiet", "heartbeat", "explain", "user_reply"];
                 if (!validSceneTypes.includes(sceneType)) {
                     const envelope = {
                         ok: false,

package/runtime/cli/ops/workspace-heartbeat-runner.js

@@ -4,6 +4,7 @@ import { createAgentGoalStore } from "../../storage/goal/agent-goal-store.js";
 import { createNarrativeStateStore } from "../../storage/narrative/narrative-state-store.js";
 import { createRelationshipMemoryStore } from "../../storage/relationship/relationship-memory-store.js";
 import { createIdentityProfileStore } from "../../storage/services/identity-profile-store.js";
+import { toCanonicalSourceRef } from "../../shared/source-ref-compat.js";
 import { generateHeartbeatDigest, } from "../../observability/services/heartbeat-digest-assembler.js";
 import { createHistoryDigestStore } from "../../storage/services/history-digest-store.js";
 export async function loadSnapshotInputsForWorkspaceHeartbeat(readModels, options = {}) {
@@ -26,11 +27,7 @@ export async function loadSnapshotInputsForWorkspaceHeartbeat(readModels, option
             const snapshot = await loadLifeEvidenceSnapshot(options.state, options.workspaceRoot, { limit: 50 }, 
             // Skip repair gate here — runner is called inside a live cycle; gate ran at startup.
             { runRepairGate: false });
-            lifeEvidenceRefs = snapshot.evidenceRefs.map((ref) => ({
-                id: ref.id,
-                kind: ref.kind,
-                uri: ref.uri,
-            }));
+            lifeEvidenceRefs = snapshot.evidenceRefs.map((ref) => toCanonicalSourceRef(ref));
             platformEventCount = snapshot.platformEvents.length;
             workEventCount = snapshot.workEvents.length;
             if (snapshot.empty) {

package/runtime/connectors/base/normalized-evidence-content.js

@@ -185,12 +185,15 @@ function extractMetrics(item) {
 // ───────────────────────────────────────────────────────────────
 // Item extraction from connector payload
 // ───────────────────────────────────────────────────────────────
-function extractItems(data) {
+function extractItems(data, depth = 4) {
+    if (depth <= 0)
+        return [];
     if (Array.isArray(data))
         return data;
     if (!isRecord(data))
         return [];
-    for (const key of ["items", "data", "results", "posts", "nodes", "agents", "edges", "entries", "feed"]) {
+    const ARRAY_KEYS = ["items", "data", "results", "posts", "nodes", "agents", "edges", "entries", "feed"];
+    for (const key of ARRAY_KEYS) {
         const candidate = data[key];
         if (Array.isArray(candidate))
             return candidate;
@@ -198,6 +201,16 @@ function extractItems(data) {
     // If the payload itself looks like a single item, treat it as one-item array.
     if ("id" in data || "title" in data || "content" in data)
         return [data];
+    // Recurse into nested record-valued fields (e.g. real connector runners wrap
+    // the platform response in { capability, channel, data: apiResponse }).
+    for (const key of ARRAY_KEYS) {
+        const candidate = data[key];
+        if (isRecord(candidate)) {
+            const nested = extractItems(candidate, depth - 1);
+            if (nested.length > 0)
+                return nested;
+        }
+    }
     return [];
 }
 function normalizeSingleItem(item, options) {

package/runtime/connectors/manifest/manifest-schema.d.ts

@@ -116,7 +116,7 @@ export declare const connectorManifestV6Schema: z.ZodObject<{
 export type ConnectorManifestV6 = z.infer<typeof connectorManifestV6Schema>;
 export interface ConnectorConflict {
     platformId: string;
-    existingSource: "built_in" | "workspace";
+    existingSource: "built_in" | "workspace" | "workspace_shadow";
     attemptedSource: "built_in" | "workspace";
     reason: string;
 }
@@ -127,7 +127,7 @@ export interface ConnectorManifestValidationError {
 }
 export interface ConnectorInventoryEntry {
     platformId: string;
-    source: "built_in" | "workspace";
+    source: "built_in" | "workspace" | "workspace_shadow";
     manifestPath?: string;
     trustStatus: ConnectorTrustStatus;
     executable: boolean;

package/runtime/connectors/registry/dynamic-connector-registry.js

@@ -41,6 +41,12 @@ function manifestToInventoryEntry(manifest, source, manifestPath) {
         validationErrors: [],
     };
 }
+function isSafeBuiltInShadow(manifest) {
+    const reason = manifest.trust?.reason?.trim();
+    if (!manifest.trust?.override || !reason)
+        return false;
+    return manifest.runner.kind === "declarative_http" || manifest.runner.kind === "scriptable_node";
+}
 /**
  * DynamicConnectorRegistry scans workspace manifests, validates, classifies trust,
  * merges built-in entries, applies fail-closed conflict policy, and publishes
@@ -79,11 +85,20 @@ export class DynamicConnectorRegistry {
             }
             const manifest = parseResult.manifest;
             const manifestPath = path.relative(workspaceRoot, file.path);
-            // Duplicate platformId without override -> fail-closed
+            // Duplicate platformId without explicit safe override -> fail-closed.
+            // Built-ins may be shadowed only by an auditable workspace manifest with
+            // a trusted runner kind, so operators can repair endpoint config without
+            // silently replacing native code.
             if (builtInMap.has(manifest.platformId) || dynamicMap.has(manifest.platformId)) {
                 const existing = builtInMap.get(manifest.platformId) ?? dynamicMap.get(manifest.platformId);
                 const allowOverride = manifest.trust?.override === true;
                 const isTrustedSource = existing.source === "built_in";
+                if (isTrustedSource && isSafeBuiltInShadow(manifest)) {
+                    const entry = manifestToInventoryEntry(manifest, "workspace_shadow", manifestPath);
+                    dynamicMap.set(manifest.platformId, entry);
+                    registered++;
+                    continue;
+                }
                 if (!allowOverride || isTrustedSource) {
                     conflicts.push({
                         platformId: manifest.platformId,

package/runtime/connectors/services/connector-executor-adapter.js

@@ -51,7 +51,13 @@ function channelPriorityForRunner(manifest) {
         return ["browser"];
     return ["api_rest"];
 }
-function registerWorkspaceManifests(registry, workspaceRoot) {
+function isSafeBuiltInShadow(manifest) {
+    const reason = manifest.trust?.reason?.trim();
+    if (!manifest.trust?.override || !reason)
+        return false;
+    return manifest.runner.kind === "declarative_http" || manifest.runner.kind === "scriptable_node";
+}
+function registerWorkspaceManifests(registry, builtInPlatformIds, workspaceRoot) {
     if (!workspaceRoot)
         return;
     for (const file of scanConnectorManifests(workspaceRoot)) {
@@ -59,6 +65,12 @@ function registerWorkspaceManifests(registry, workspaceRoot) {
         if (!parsed.ok)
             continue;
         const manifest = parsed.manifest;
+        // Built-in platforms may only be shadowed by auditable, trusted-runner manifests.
+        // Unsafe shadows are ignored by execution registry; they remain visible in
+        // DynamicConnectorRegistry conflicts for diagnostics.
+        if (builtInPlatformIds.has(manifest.platformId) && !isSafeBuiltInShadow(manifest)) {
+            continue;
+        }
         try {
             registry.register({
                 platformId: manifest.platformId,
@@ -187,6 +199,10 @@ function createMoltbookMockRunner(workspaceRoot) {
                             source: "mock",
                             items: Array.isArray(data.items) ? data.items : [],
                         },
+                        // Duplicate items at payload top-level so v8 evidence normalizer
+                        // can extract content-bearing evidence without re-implementing
+                        // the legacy v7 nested shape.
+                        items: Array.isArray(data.items) ? data.items : [],
                     },
                 };
             }
@@ -197,8 +213,8 @@ function createMoltbookMockRunner(workspaceRoot) {
                     latencyMs: Date.now() - started,
                     success: false,
                     error: {
-                        code: "mock_read_error",
-                        detail: String(err),
+                        code: "configuration_missing",
+                        detail: `moltbook mock unreadable: ${err instanceof Error ? err.message : String(err)}`,
                     },
                 };
             }
@@ -420,9 +436,13 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
             const workspaceManifest = workspaceManifestResult?.manifest;
             const isBuiltInPlatform = platformId === "moltbook" ||
                 platformId === "evomap" ||
-                platformId === "agent-world";
+                platformId === "agent-world" ||
+                platformId === "instreet";
+            const effectiveWorkspaceManifest = workspaceManifest && (!isBuiltInPlatform || isSafeBuiltInShadow(workspaceManifest))
+                ? workspaceManifest
+                : undefined;
             const requiresCredential = isBuiltInPlatform ||
-                Boolean(workspaceManifest?.credentials.some((credential) => credential.required !== false));
+                Boolean(effectiveWorkspaceManifest?.credentials.some((credential) => credential.required !== false));
             const credential = requiresCredential
                 ? await vault.loadCredentialContext(platformId)
                 : undefined;
@@ -444,9 +464,33 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
             const activeCredential = credential?.status === "active" && credential.encryptedValue
                 ? { encryptedValue: credential.encryptedValue }
                 : undefined;
+            // Safe workspace shadows of built-in platforms take precedence over built-in runners.
+            if (effectiveWorkspaceManifest && effectiveWorkspaceManifest.runner.kind === "declarative_http") {
+                const httpRunner = createDeclarativeHttpRunner(effectiveWorkspaceManifest, activeCredential);
+                return httpRunner.run(_plan, request);
+            }
+            if (effectiveWorkspaceManifest && effectiveWorkspaceManifest.runner.kind === "scriptable_node") {
+                if (!workspaceManifestResult) {
+                    return {
+                        platformId,
+                        channel: request.preferredChannel ?? "api_rest",
+                        latencyMs: Date.now() - started,
+                        success: false,
+                        error: {
+                            code: "configuration_missing",
+                            detail: "scriptable_node requires workspace manifest with manifestDir",
+                        },
+                    };
+                }
+                const scriptRunner = createScriptableNodeRunner(effectiveWorkspaceManifest, workspaceManifestResult.manifestDir, activeCredential);
+                return scriptRunner.run(_plan, request);
+            }
             if (platformId === "moltbook") {
                 const baseUrl = process.env.SECOND_NATURE_MOLTBOOK_BASE_URL;
                 if (baseUrl) {
+                    const effectivePlan = request.intent === "feed.read" && _plan.channel !== "api_rest"
+                        ? { ..._plan, channel: "api_rest", endpointMode: "rest_json", degraded: false }
+                        : _plan;
                     const apiClient = createMoltbookApiClient({
                         baseUrl,
                         accessToken: activeCredential.encryptedValue,
@@ -457,13 +501,13 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
                         skillRunner: {
                             run: async () => {
                                 throw {
-                                    code: "protocol_mismatch",
+                                    code: "configuration_missing",
                                     detail: "moltbook_skill_runner_not_configured",
                                 };
                             },
                         },
                     });
-                    return runner.run(_plan, request);
+                    return runner.run(effectivePlan, request);
                 }
                 // Mock fallback when real API is not configured
                 const mockRunner = createMoltbookMockRunner(workspaceRoot);
@@ -579,28 +623,6 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
                     },
                 };
             }
-            // Wave 83: workspace declarative_http connector fallback
-            if (workspaceManifest && workspaceManifest.runner.kind === "declarative_http") {
-                const httpRunner = createDeclarativeHttpRunner(workspaceManifest, activeCredential);
-                return httpRunner.run(_plan, request);
-            }
-            // Wave 90: workspace scriptable_node connector
-            if (workspaceManifest && workspaceManifest.runner.kind === "scriptable_node") {
-                if (!workspaceManifestResult) {
-                    return {
-                        platformId,
-                        channel: request.preferredChannel ?? "api_rest",
-                        latencyMs: Date.now() - started,
-                        success: false,
-                        error: {
-                            code: "configuration_missing",
-                            detail: "scriptable_node requires workspace manifest with manifestDir",
-                        },
-                    };
-                }
-                const scriptRunner = createScriptableNodeRunner(workspaceManifest, workspaceManifestResult.manifestDir, activeCredential);
-                return scriptRunner.run(_plan, request);
-            }
             return {
                 platformId,
                 channel: request.preferredChannel ?? "api_rest",
@@ -617,11 +639,12 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
 export function createConnectorExecutorAdapter(options) {
     const vault = createCredentialVault(options.stateDb.db);
     const registry = new CapabilityContractRegistry();
-    registry.register({ ...moltbookManifest });
-    registry.register({ ...evomapManifest });
-    registry.register({ ...agentWorldManifest });
-    registry.register({ ...instreetManifest });
-    registerWorkspaceManifests(registry, options.workspaceRoot);
+    const builtInManifests = [moltbookManifest, evomapManifest, agentWorldManifest, instreetManifest];
+    const builtInPlatformIds = new Set(builtInManifests.map((m) => m.platformId));
+    for (const manifest of builtInManifests) {
+        registry.register({ ...manifest });
+    }
+    registerWorkspaceManifests(registry, builtInPlatformIds, options.workspaceRoot);
     const cooldownPort = createConnectorCooldownPort(options.stateDb);
     const routeContextPort = createCredentialRouteContextPort(vault, options.stateDb);
     const routePlanner = new ConnectorRoutePlanner(registry, routeContextPort, new ChannelHealthStore());
@@ -637,7 +660,7 @@ export function createConnectorExecutorAdapter(options) {
     });
     return {
         async executeEffect(input) {
-            registerWorkspaceManifests(registry, options.workspaceRoot);
+            registerWorkspaceManifests(registry, builtInPlatformIds, options.workspaceRoot);
             return policy.executeWithPolicy(input.intent, {
                 platformId: input.platformId,
                 intent: input.intent,

package/runtime/core/second-nature/action/action-closure-recorder.d.ts

@@ -43,6 +43,8 @@ export interface ActionClosureRecord {
 }
 export interface RecordClosureOptions {
     now?: string;
+    platformId?: string;
+    capabilityId?: string;
 }
 export type RecordClosureResult = {
     status: "recorded";