@iowarp/clio-coder 0.4.0 → 0.4.2

package/src/entry/orchestrator.ts

@@ -11,7 +11,7 @@ import { loadDomains } from "../core/domain-loader.js";
 import type { SafeEventBus } from "../core/event-bus.js";
 import { expandInlineFileReferencesAsync } from "../core/file-references.js";
 import { setGitCommitAttributionEnabled } from "../core/git-commit-attribution.js";
-import { configureGuardrails } from "../core/guardrails.js";
+import { configureGuardrails, guardrailValuesFromSettings } from "../core/guardrails.js";
 import { HEADLESS_PERMISSION_DENIED_REASON } from "../core/headless-permission.js";
 import { rememberRecentModel } from "../core/recent-models.js";
 import { protectedResidencyModels } from "../core/residency-protection.js";
@@ -85,10 +85,10 @@ import {
 } from "../domains/middleware/dispatch-nudge.js";
 import {
 	createHookReceiptLog,
+	createMarketplaceOfferRegistration,
 	createMiddlewareToolChoiceControl,
 	createSkillsReminderRegistration,
-	type ExtensionHookRoot,
-	installUserHooks,
+	formatRegistrationConflict,
 	type MiddlewareContract,
 	MiddlewareDomainModule,
 	writeMiddlewareDiagnosticToStderr,
@@ -128,6 +128,7 @@ import { registerBuiltinRuntimes } from "../domains/providers/runtimes/builtins.
 import {
 	createResourcesDomainModule,
 	discoverMarketplaceSkills,
+	installSkill,
 	modelVisibleSkills,
 	type ResourcesContract,
 } from "../domains/resources/index.js";
@@ -179,6 +180,7 @@ import { createChatLoop } from "../interactive/chat-loop.js";
 import { type RunIo, startInteractive } from "../interactive/index.js";
 import { buildModelReplayAgentMessagesFromTurns } from "../interactive/model-session-replay.js";
 import type { BootOptions } from "./boot-options.js";
+import { createExtensionReloadCoordinator } from "./extension-reload.js";
 import { resolvePanesEnablement } from "./panes-activation.js";
 
 export type { BootOptions, HeadlessSamplingOverrides } from "./boot-options.js";
@@ -198,6 +200,7 @@ import { type AskUserHandler, cancelledAskUserResult } from "../tools/ask-user.j
 import { registerAllTools } from "../tools/bootstrap.js";
 import { isGitRepository, recoverCleanupReadyCompeteGroups } from "../tools/compete-worktrees.js";
 import { createDispatchBackgroundRegistry } from "../tools/dispatch-background.js";
+import { dispatchSchemaCompositionFor } from "../tools/dispatch-schema.js";
 import { createFileMutationObserver, createSkillActivationObserver } from "../tools/observers.js";
 import { createRegistry } from "../tools/registry.js";
 import { sweepExpiredToolOffloads } from "../tools/result-shaping.js";
@@ -229,11 +232,11 @@ function bannerConfigurationLine(): string {
 	}
 	// A dangling chat target normalizes to null in the schema, so a deleted
 	// target arrives here as no target at all rather than as a name to report.
-	const targetId = settings.orchestrator?.target;
+	const targetId = settings.chat?.target;
 	if (!targetId) {
 		return chalk.yellow("no model target configured. Run `clio-coder configure` to add one.");
 	}
-	const model = settings.orchestrator?.model;
+	const model = settings.chat?.model;
 	return chalk.dim(`target ${targetId}${model ? ` · model ${model}` : " · no default model"}`);
 }
 
@@ -256,7 +259,7 @@ function printJsonSessionHeader(meta: SessionMeta | null): Record<string, unknow
 		cwd: meta.cwd,
 		target: meta.target,
 		model: meta.model,
-		clioVersion: meta.clioVersion,
+		clioCoderVersion: meta.clioCoderVersion,
 	};
 }
 
@@ -266,17 +269,17 @@ function applyHeadlessSettingsOverlay(
 ): ClioSettings {
 	const next = structuredClone(settings);
 	if (!overrides) return next;
-	const previousTarget = next.orchestrator.target;
+	const previousTarget = next.chat.target;
 	if (overrides.target !== undefined) {
-		next.orchestrator.target = overrides.target;
-		if (overrides.model === undefined && (previousTarget !== overrides.target || !next.orchestrator.model)) {
+		next.chat.target = overrides.target;
+		if (overrides.model === undefined && (previousTarget !== overrides.target || !next.chat.model)) {
 			const target = next.targets.find((entry) => entry.id === overrides.target);
-			if (target) next.orchestrator.model = target.defaultModel ?? null;
+			if (target) next.chat.model = target.defaultModel ?? null;
 		}
 	}
-	if (overrides.model !== undefined) next.orchestrator.model = overrides.model;
-	if (overrides.thinking !== undefined) next.orchestrator.thinkingLevel = overrides.thinking;
-	if (overrides.autonomy !== undefined) next.autonomy = overrides.autonomy;
+	if (overrides.model !== undefined) next.chat.model = overrides.model;
+	if (overrides.thinking !== undefined) next.chat.thinkingLevel = overrides.thinking;
+	if (overrides.autonomy !== undefined) next.safety.autonomy = overrides.autonomy;
 	return next;
 }
 
@@ -307,9 +310,9 @@ function advanceThinkingLevel(current: ThinkingLevel, available: ReadonlyArray<T
  * model all send this placeholder so a local llama.cpp or LM Studio endpoint
  * works without the user inventing a credential.
  */
-const LOCAL_API_KEY_FALLBACK = "clio-local-target";
+const LOCAL_API_KEY_FALLBACK = "clio-coder-local-target";
 
-export async function resolveApiKeyForTarget(
+async function resolveApiKeyForTarget(
 	target: TargetDescriptor,
 	providers: ProvidersContract,
 	signal?: AbortSignal,
@@ -347,8 +350,8 @@ function createBackgroundMemoryModelClient(
 	timeoutMs: number,
 	bus: Pick<SafeEventBus, "emit"> | null,
 ): BackgroundMemoryRoute | null {
-	const targetId = settings.background.target?.trim();
-	const wireModelId = settings.background.model?.trim();
+	const targetId = settings.context.memory.target?.trim();
+	const wireModelId = settings.context.memory.model?.trim();
 	if (!targetId || !wireModelId) return null;
 	// One model cannot both drive the action agent and think its way through a
 	// memory step: the memory call would contend with the agent's own decoding on
@@ -445,8 +448,8 @@ function createBackgroundMemoryModelClient(
  */
 function agentRoleToolWarnings(providers: ProvidersContract, settings: Readonly<ClioSettings>): string[] {
 	const roles: ReadonlyArray<{ label: string; target: string | null; model: string | null }> = [
-		{ label: "orchestrator", target: settings.orchestrator.target, model: settings.orchestrator.model },
-		{ label: "workers.default", target: settings.workers.default.target, model: settings.workers.default.model },
+		{ label: "orchestrator", target: settings.chat.target, model: settings.chat.model },
+		{ label: "workers.default", target: settings.fleet.default.target, model: settings.fleet.default.model },
 	];
 	const warnings: string[] = [];
 	for (const role of roles) {
@@ -478,12 +481,12 @@ function backgroundSharesReasoningModelWithOrchestrator(
 	providers: ProvidersContract,
 	settings: Readonly<ClioSettings>,
 ): boolean {
-	const backgroundModel = settings.background.model?.trim();
-	const orchestratorModel = settings.orchestrator.model?.trim();
+	const backgroundModel = settings.context.memory.model?.trim();
+	const orchestratorModel = settings.chat.model?.trim();
 	if (!backgroundModel || backgroundModel !== orchestratorModel) return false;
-	if (settings.background.target?.trim() !== settings.orchestrator.target?.trim()) return false;
+	if (settings.context.memory.target?.trim() !== settings.chat.target?.trim()) return false;
 	try {
-		const status = providers.list().find((entry) => entry.target.id === settings.background.target?.trim());
+		const status = providers.list().find((entry) => entry.target.id === settings.context.memory.target?.trim());
 		if (!status) return false;
 		return resolveModelCapabilities(status, backgroundModel, providers.knowledgeBase).reasoning === true;
 	} catch {
@@ -493,7 +496,7 @@ function backgroundSharesReasoningModelWithOrchestrator(
 	}
 }
 
-export function synthesizeOrchestratorModel(
+function synthesizeOrchestratorModel(
 	providers: ProvidersContract,
 	target: TargetDescriptor,
 	wireModelId: string,
@@ -526,8 +529,8 @@ async function resolveCompactionModel(
 	settings: ClioSettings,
 	providers: ProvidersContract,
 ): Promise<CompactionResolution | null> {
-	const targetId = settings.orchestrator?.target ?? null;
-	const wireModelId = settings.orchestrator?.model ?? null;
+	const targetId = settings.chat?.target ?? null;
+	const wireModelId = settings.chat?.model ?? null;
 	if (!targetId || !wireModelId) return null;
 	const target = resolveTarget(providers, targetId);
 	if (!target) return null;
@@ -607,7 +610,7 @@ function appendProtectedArtifactRegistryEvent(
  * subprocess, which makes this the only recording path there is. Returns how
  * many were folded.
  */
-export function foldDispatchSkillActivations(
+function foldDispatchSkillActivations(
 	session: SessionContract | undefined,
 	payload: { runId?: unknown; skillActivations?: ReadonlyArray<unknown> } | undefined,
 ): number {
@@ -648,7 +651,7 @@ async function runCompactionFlow(
 	}
 	const resolved = await resolveCompactionModel(settings, providers);
 	if (!resolved) {
-		throw new Error("no model configured; set orchestrator.target + orchestrator.model");
+		throw new Error("no model configured; set chat.target + chat.model");
 	}
 	// Summarize only the active branch: after a /tree switch the raw file
 	// still holds abandoned sibling turns, and a summary that folds them in
@@ -704,7 +707,7 @@ async function runCompactionFlow(
  * a thrown read/model/persistence failure from the legitimate null no-op that
  * `runCompactionFlow` returns for an empty session or an unavailable cut.
  */
-export function createProductionAutoCompact(
+function createProductionAutoCompact(
 	session: SessionContract,
 	getSettings: () => ClioSettings,
 	providers: ProvidersContract,
@@ -751,11 +754,11 @@ function estimateTokensAfterCompaction(entries: ReadonlyArray<SessionEntry>, res
  * ids or target/model refs. Absent scope is a no-op so unconfigured users
  * feel nothing.
  */
-export function advanceScopedTarget(
+function advanceScopedTarget(
 	settings: Readonly<ClioSettings>,
 	direction: "forward" | "backward",
 ): { target: string; model: string | null } | null {
-	const scope = settings.scope ?? [];
+	const scope = settings.chat.modelPicker.cycleSet ?? [];
 	if (scope.length === 0) return null;
 	const registry = getRuntimeRegistry();
 	if (registry.list().length === 0) registerBuiltinRuntimes(registry);
@@ -767,8 +770,8 @@ export function advanceScopedTarget(
 		return runtime !== null && isOrchestratorEligibleRuntime(runtime);
 	});
 	if (filteredScope.length === 0) return null;
-	const activeTarget = settings.orchestrator.target ?? "";
-	const activeModel = settings.orchestrator.model ?? "";
+	const activeTarget = settings.chat.target ?? "";
+	const activeModel = settings.chat.model ?? "";
 	const activeCombinedRef = activeTarget.length > 0 && activeModel.length > 0 ? `${activeTarget}/${activeModel}` : "";
 	const idx = filteredScope.findIndex((entry) => entry === activeCombinedRef || entry === activeTarget);
 	const base = idx === -1 ? 0 : idx + (direction === "forward" ? 1 : filteredScope.length - 1);
@@ -866,7 +869,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// is why `panes.enabled` is a restart-scoped row: the decision runs once,
 	// here. An inactive rung loads nothing: the whole extension, mux domain
 	// included, lives behind the dynamic import below.
-	const muxEnablement = resolvePanesEnablement(options.panes, options.startupSettings?.panes.enabled);
+	const muxEnablement = resolvePanesEnablement(options.panes, options.startupSettings?.interface.panes.enabled);
 	const withPanes = muxInteractive && muxEnablement !== "off" ? await import("./with-panes.js") : null;
 
 	const result = await loadDomains(
@@ -956,7 +959,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			bootStderr("Clio Coder: --api-key supplied but providers domain unavailable; ignoring.\n");
 		} else {
 			const settingsNow = applyHeadlessSettingsOverlay(config?.get() ?? readSettings(), options.headless);
-			const activeTargetId = settingsNow.orchestrator?.target;
+			const activeTargetId = settingsNow.chat?.target;
 			const target = resolveTarget(providers, activeTargetId);
 			const runtime = target ? providers.getRuntime(target.runtime) : null;
 			if (target && runtime) {
@@ -1024,7 +1027,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			else resolvedResumeId = latest.id;
 		}
 	}
-	const resumeId = resolvedResumeId ?? process.env.CLIO_CODER_RESUME_SESSION_ID?.trim();
+	const resumeId = resolvedResumeId;
 	let resumedSessionAtBoot = false;
 	if (resumeId && session && headlessResumeFailure === null) {
 		try {
@@ -1036,7 +1039,6 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			else bootStderr(`Clio Coder: failed to resume session ${resumeId}: ${detail}\n`);
 		}
 	}
-	Reflect.deleteProperty(process.env, "CLIO_CODER_RESUME_SESSION_ID");
 	if (headlessResumeFailure !== null) {
 		bootStderr(`clio-coder run: ${headlessResumeFailure}\n`);
 		await termination.shutdown(2);
@@ -1048,6 +1050,20 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// middleware.hookFailed (the interactive warn notice consumes it) and keep
 	// stderr for non-interactive runs, which have no notice subscriber.
 	middleware.setDiagnosticSink((diagnostic) => {
+		if (diagnostic.kind === "registration_conflict") {
+			// Registration bookkeeping has no hook occurrence; the affected owner
+			// today declares user hooks, which never run on on_compaction, so the
+			// payload's hook slot carries that as the "no evaluation" marker.
+			bus.emit(BusChannels.MiddlewareHookFailed, {
+				kind: "registration_conflict",
+				registrationId: diagnostic.registrationId,
+				hook: "on_compaction",
+				at: Date.now(),
+				message: formatRegistrationConflict(diagnostic),
+			});
+			if (!interactive) writeMiddlewareDiagnosticToStderr(diagnostic);
+			return;
+		}
 		bus.emit(BusChannels.MiddlewareHookFailed, {
 			kind: diagnostic.kind,
 			registrationId: diagnostic.registrationId,
@@ -1076,20 +1092,19 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		bus.on(BusChannels.RuntimeNotice, (payload: unknown) => {
 			const notice = payload as { level?: string; message?: string } | undefined;
 			if (typeof notice?.message !== "string") return;
-			process.stderr.write(`[clio:runtime] ${notice.level ?? "info"}: ${notice.message}\n`);
+			process.stderr.write(`[clio-coder:runtime] ${notice.level ?? "info"}: ${notice.message}\n`);
 		});
 	}
 
-	// Guardrail policy (tool-call budgets, tool byte caps, dispatch ledger cap)
-	// resolves settings-first with env as emergency override; install the
-	// settings section before any guard registration or tool reads it.
+	// Install guardrail policy before any guard registration or tool reads it.
+	// The effective session view replaces this boot projection below.
 	const resolvedSettings = config?.get() ?? readSettings();
-	configureGuardrails(resolvedSettings.guardrails);
+	configureGuardrails(guardrailValuesFromSettings(resolvedSettings));
 
-	// The run event journal resolves the same way for the same reason: the sink
-	// sits on the dispatch event path, where reading settings.yaml would be both
-	// a cost and a throw site, so the composition root installs the value once.
-	configureRunEventJournal(resolvedSettings.panes.journal);
+	// The journal sink sits on the dispatch event path, where reading settings
+	// would be both a cost and a throw site. The effective session view replaces
+	// this boot projection below.
+	configureRunEventJournal(resolvedSettings.fleet.history.journal);
 
 	// Guard registrations on the middleware contract, in order: loop guard,
 	// protected artifacts (last among guards so it absorbs protect_path effects
@@ -1102,7 +1117,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			safety,
 			bus,
 			turnBlockBudget: INTERACTIVE_LOOP_BLOCK_BUDGET,
-			turnToolCallBudget: readOrchTurnToolCallBudget(),
+			turnToolCallBudget: () => readOrchTurnToolCallBudget(),
 			// Interactive/headless/ACP all share this orchestrator guard: at the
 			// block budget, lock tools for the rest of the turn so the model
 			// answers from what it gathered instead of hard-cancelling a turn that
@@ -1183,7 +1198,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		taskMemoryBank.clear();
 		taskMemorySessionId = currentSessionId;
 	};
-	const memorySettings = (config?.get() ?? readSettings()).memory.intervention;
+	const memorySettings = (config?.get() ?? readSettings()).context.memory;
 	// Bound late: the registration is built here, but the buffer a deferred
 	// reminder lands in belongs to the chat loop that has not been composed yet.
 	let deferredMemoryReminderSink: ((message: string) => void) | null = null;
@@ -1233,12 +1248,12 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		})
 			.then((result) => {
 				for (const error of result.errors) {
-					process.stderr.write(`[clio:memory] proposed record not written for ${error}\n`);
+					process.stderr.write(`[clio-coder:memory] proposed record not written for ${error}\n`);
 				}
 			})
 			.catch((error: unknown) => {
 				process.stderr.write(
-					`[clio:memory] proposed records not written: ${error instanceof Error ? error.message : String(error)}\n`,
+					`[clio-coder:memory] proposed records not written: ${error instanceof Error ? error.message : String(error)}\n`,
 				);
 			});
 	};
@@ -1252,14 +1267,21 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		onDeferredReminder: (message) => deferredMemoryReminderSink?.(message),
 		getSettings: () => {
 			ensureTaskMemorySession();
-			return effectiveSettingsForDispatch?.().memory.intervention ?? memorySettings;
+			const memory = effectiveSettingsForDispatch?.().context.memory ?? memorySettings;
+			return {
+				enabled: memory.enabled,
+				everyNTools: memory.cadenceToolCalls,
+				windowSteps: memory.trajectorySteps,
+				maxTokens: memory.maxOutputTokens,
+				timeoutMs: memory.timeoutMs,
+			};
 		},
 		getModelClient: () => {
 			const settings = effectiveSettingsForDispatch?.();
 			backgroundMemoryRoute =
 				settings === undefined
 					? null
-					: createBackgroundMemoryModelClient(providers, settings, settings.memory.intervention.timeoutMs, bus);
+					: createBackgroundMemoryModelClient(providers, settings, settings.context.memory.timeoutMs, bus);
 			return backgroundMemoryRoute?.client ?? null;
 		},
 		getModelMaxTokens: (configuredMaxTokens) =>
@@ -1290,24 +1312,26 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// same effect machinery. They register after the guards, so safety stays
 	// authoritative: a hook may add effects (including request block_tool) but
 	// cannot grant a permission safety would deny. Loading is best-effort.
+	// The coordinator is the only writer of the "user-hooks" owner and the only
+	// caller of the extensions reload; it publishes the extension generation
+	// and the hook registrations with two adjacent assignments on one stack
+	// and emits extensions.reloaded only after both. The boot generation is
+	// published here too (the extensions bundle publishes nothing at start),
+	// so no consumer ever sees extension resources paired with hooks from a
+	// different generation. The owner slot is anchored here, so user hooks
+	// keep evaluating after the guards and before the assessors below.
 	const hookReceiptLog = createHookReceiptLog({ persistPath: join(clioStateDir(), "hook-receipts.json") });
-	const extensionHookRoots: ExtensionHookRoot[] = (extensions?.list(process.cwd()) ?? [])
-		.filter((ext) => ext.enabled && ext.effective)
-		.map((ext) => ({ id: ext.id, rootPath: ext.rootPath }));
-	const userHooks = installUserHooks({
-		cwd: process.cwd(),
-		extensions: extensionHookRoots,
-		registerHook: (registration) => middleware.registerHook(registration),
+	const extensionReload = createExtensionReloadCoordinator({
+		extensions,
+		middleware,
+		cwd: () => process.cwd(),
 		recordReceipt: (receipt) => hookReceiptLog.record(receipt),
+		report: (line) => {
+			if (!interactive) process.stderr.write(`${line}\n`);
+		},
+		onCommitted: (event) => bus.emit(BusChannels.ExtensionsReloaded, event),
 	});
-	if (!interactive) {
-		for (const issue of userHooks.fileIssues) {
-			process.stderr.write(`[clio:hooks] ${issue.message}\n`);
-		}
-		for (const issue of userHooks.issues) {
-			process.stderr.write(`[clio:hooks] ${issue.source.sourcePath}#${issue.index}: ${issue.issues.join("; ")}\n`);
-		}
-	}
+	extensionReload.applyBoot();
 	termination.onDrain(() => hookReceiptLog.flush());
 	// Autonomy is hot-reloaded for interactive and headless admissions. ACP
 	// server prompts use the snapshot captured at session/new.
@@ -1317,11 +1341,29 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// through these two functions so a fallback added to one surface cannot
 	// silently skip another.
 	const resolveBaselineAutonomy = (): AutonomyLevel =>
-		effectiveSettingsForDispatch?.().autonomy ??
+		effectiveSettingsForDispatch?.().safety.autonomy ??
 		options.headless?.autonomy ??
-		(config?.get() ?? readSettings()).autonomy ??
+		(config?.get() ?? readSettings()).safety.autonomy ??
 		"auto-edit";
 	const resolveEffectiveAutonomy = (): AutonomyLevel => activeAcpSessionAutonomy ?? resolveBaselineAutonomy();
+	// Marketplace self-promotion: coordinator-only by this wiring (never a
+	// dispatch worker), local matcher, consented installs and full-auto
+	// autonomous installs both pass the own-marketplace source gate inside the
+	// registration. Registered here because it needs the effective-autonomy
+	// resolution defined one line up.
+	if (resources) {
+		middleware.registerHook(
+			createMarketplaceOfferRegistration({
+				listInstalledSkillNames: () => resources.skills(process.cwd()).items.map((skill) => skill.name),
+				listMarketplaceEntries: () => discoverMarketplaceSkills({ cwd: process.cwd() }).skills,
+				getAutonomy: resolveEffectiveAutonomy,
+				installEntry: (entry, scope) => {
+					const installed = installSkill({ source: entry.sourceUrl, scope, name: entry.name, cwd: process.cwd() });
+					return { path: installed.path, sourceUrl: installed.sourceUrl, installedHash: installed.installedHash };
+				},
+			}),
+		);
+	}
 	const middlewareToolChoice = createMiddlewareToolChoiceControl();
 	const toolRegistry = createRegistry({
 		safety,
@@ -1466,9 +1508,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		// always refusing.
 		...(panes && mux?.mode !== "none" ? { panes } : {}),
 		getCostCeilingUsd: () => result.getContract<SchedulingContract>("scheduling")?.ceilingUsd() ?? 0,
-		...(config ? { getWorkerRosters: () => config.get().workers.rosters } : {}),
+		...(config ? { getWorkerRosters: () => config.get().fleet.rosters } : {}),
+		...(config ? { getDispatchSchemaComposition: () => dispatchSchemaCompositionFor(config.get().fleet) } : {}),
 		getSkillLoaderOptions: () => ({
-			trustProjectCompatRoots: config?.get().skills.trustProjectCompatRoots === true,
+			trustProjectCompatRoots: config?.get().integrations.projectResources.trustProjectImports === true,
 			disableDiscovery: options.noSkills === true || options.headless?.noSkills === true,
 			...(options.skillPaths && options.skillPaths.length > 0
 				? { explicitSkillPaths: options.skillPaths }
@@ -1491,8 +1534,13 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// view, so the live session reflects them immediately while settings.yaml
 	// (the global default for new sessions) stays untouched until the operator
 	// chooses to save globally.
+	// Overrides are keyed by settings path, the same ids the /settings overlay
+	// commits (`setAtPath` walks the dotted path). The headless `--autonomy`
+	// flag was keyed by the bare word, which wrote a top-level `autonomy` key
+	// nothing reads, so `run --autonomy full-auto` compiled and admitted at
+	// whatever settings.yaml said.
 	const sessionOverrides: SessionOverrides = new Map(
-		options.headless?.autonomy === undefined ? [] : [["autonomy", options.headless.autonomy]],
+		options.headless?.autonomy === undefined ? [] : [["safety.autonomy", options.headless.autonomy]],
 	);
 	// The effective view is derived by deep-cloning the saved snapshot, and it
 	// is read on the tool-admission hot path (every call resolves autonomy
@@ -1507,9 +1555,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	let cachedSettingsView: ClioSettings | null = null;
 	const bumpSessionState = (): void => {
 		sessionStateGeneration += 1;
-		// Child-process seams read the effective setting from the environment,
-		// and the session view may override the saved value.
-		setGitCommitAttributionEnabled(getCurrentSettings().attribution.gitCommits);
+		const settings = getCurrentSettings();
+		configureGuardrails(guardrailValuesFromSettings(settings));
+		configureRunEventJournal(settings.fleet.history.journal);
+		setGitCommitAttributionEnabled(settings.integrations.git.commitAttribution);
 	};
 	const getCurrentSettings = (): ClioSettings => {
 		// Recents live in the data dir (core/recent-models.ts), never in
@@ -1535,20 +1584,17 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	};
 	effectiveSettingsForDispatch = getCurrentSettings;
 	bumpSessionState();
-	// The config bundle publishes the saved value on reload; a session-scoped
-	// override must win, so re-derive from the session view after it.
-	const unsubscribeCommitAttributionSync = bus.on(BusChannels.ConfigHotReload, () => bumpSessionState());
-	termination.onDrain(() => unsubscribeCommitAttributionSync());
+	// The config bundle publishes saved values on reload; session-scoped
+	// overrides must win, so re-derive every process-local projection from the
+	// effective session view after it.
+	const unsubscribeSettingsProjectionSync = bus.on(BusChannels.ConfigHotReload, () => bumpSessionState());
+	termination.onDrain(() => unsubscribeSettingsProjectionSync());
 	const getTaskMemorySeedOffer = (): { source: string; count: number } | null => {
-		return taskMemoryHandoffSeedOffer(process.cwd(), getCurrentSettings().memory.intervention.enabled);
+		return taskMemoryHandoffSeedOffer(process.cwd(), getCurrentSettings().context.memory.enabled);
 	};
 	const seedCurrentTaskMemoryFromHandoff = () => {
 		ensureTaskMemorySession();
-		return seedTaskMemoryFromNewestHandoff(
-			taskMemoryBank,
-			process.cwd(),
-			getCurrentSettings().memory.intervention.enabled,
-		);
+		return seedTaskMemoryFromNewestHandoff(taskMemoryBank, process.cwd(), getCurrentSettings().context.memory.enabled);
 	};
 	if (resumedSessionAtBoot) {
 		const offer = getTaskMemorySeedOffer();
@@ -1568,7 +1614,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// routing change updates the set on the next read.
 	setProtectedModelsProvider(() => protectedResidencyModels(getCurrentSettings()));
 
-	const validatedKeybindings = validateKeybindings((config?.get() ?? readSettings()).keybindings ?? {});
+	const validatedKeybindings = validateKeybindings((config?.get() ?? readSettings()).interface.keybindings ?? {});
 	const invalidBindings = validatedKeybindings.invalid;
 	if (invalidBindings.length > 0) {
 		const notice = formatInvalidKeybindingNotice(invalidBindings);
@@ -1627,10 +1673,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	const readAcpSafeSettings = (): AcpSafeSettingsSnapshot => {
 		const settings = getCurrentSettings();
 		return {
-			target: settings.orchestrator.target,
-			model: settings.orchestrator.model,
-			thinkingLevel: settings.orchestrator.thinkingLevel ?? "off",
-			autonomy: settings.autonomy,
+			target: settings.chat.target,
+			model: settings.chat.model,
+			thinkingLevel: settings.chat.thinkingLevel ?? "off",
+			autonomy: settings.safety.autonomy,
 		};
 	};
 	/**
@@ -1640,15 +1686,15 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	 */
 	const commitAcpSafeSettings = (patch: AcpSafeSettingsPatch): AcpSafeSettingsSnapshot => {
 		const orchestrator: NonNullable<RoutingPatch["orchestrator"]> = {};
-		if (patch["orchestrator.target"] !== undefined) orchestrator.target = patch["orchestrator.target"];
-		if (patch["orchestrator.model"] !== undefined) orchestrator.model = patch["orchestrator.model"];
-		if (patch["orchestrator.thinkingLevel"] !== undefined) {
-			orchestrator.thinkingLevel = patch["orchestrator.thinkingLevel"];
+		if (patch["chat.target"] !== undefined) orchestrator.target = patch["chat.target"];
+		if (patch["chat.model"] !== undefined) orchestrator.model = patch["chat.model"];
+		if (patch["chat.thinkingLevel"] !== undefined) {
+			orchestrator.thinkingLevel = patch["chat.thinkingLevel"];
 		}
 		const routingPatch: RoutingPatch | null = Object.keys(orchestrator).length > 0 ? { orchestrator } : null;
 		persistSavedMutation((saved) => {
 			if (routingPatch !== null) mergeRoutingPatchIntoSettings(saved, routingPatch);
-			if (patch.autonomy !== undefined) saved.autonomy = patch.autonomy;
+			if (patch["safety.autonomy"] !== undefined) saved.safety.autonomy = patch["safety.autonomy"];
 		});
 		if (routingPatch !== null) {
 			applyRoutingPatch(sessionRouting, routingPatch);
@@ -1747,7 +1793,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	middleware.registerHook(
 		createWatchdogRegistration({
 			firesOnThisSurface: interactive,
-			getSettings: () => (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).watchdog,
+			getSettings: () => (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).safety.review,
 			getScope: () => {
 				const board = taskBoard.snapshot();
 				if (board === null) return null;
@@ -1759,7 +1805,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 					dispatch,
 					bus,
 					...(agents ? { getAgentRoleFacts: agentRoleFactsResolver((id: string) => agents.getSpec(id)) } : {}),
-					target: (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).watchdog.target,
+					target: (effectiveSettingsForDispatch?.() ?? getCurrentSettings()).safety.review.target,
 					...(deferredWatchdogNoticeSink ? { emitNotice: deferredWatchdogNoticeSink } : {}),
 				}),
 		}),
@@ -1805,7 +1851,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			try {
 				const records = loadMemoryRecordsSync(clioDataDir());
 				const settings = getCurrentSettings();
-				const targetId = session?.current()?.target ?? settings.orchestrator?.target;
+				const targetId = session?.current()?.target ?? settings.chat?.target;
 				const runtimeId = targetId ? providers.getTarget(targetId)?.runtime : undefined;
 				return buildMemoryPromptSection(records, {
 					scopes: ["global", "repo", "runtime"],
@@ -1821,7 +1867,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			const meta = session?.current();
 			if (!meta) throw new Error("task memory handoff requires an active session");
 			const settings = getCurrentSettings();
-			const targetId = meta.target ?? settings.orchestrator?.target;
+			const targetId = meta.target ?? settings.chat?.target;
 			const runtimeId = targetId ? providers.getTarget(targetId)?.runtime : undefined;
 			return renderTaskMemoryHandoffSource(taskMemoryBank.snapshot(), {
 				sessionId: meta.id,
@@ -1869,7 +1915,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		await chat.whenSettled();
 	});
 
-	// A boot-time resume (CLIO_CODER_RESUME_SESSION_ID) must replay the resumed
+	// A boot-time resume (headless --session or --continue) must replay the resumed
 	// session into the chat loop the same way the interactive /resume overlay
 	// does. Without this, the first submit runs with an empty provider context
 	// and parents its user turn at null, appending a second root that silently
@@ -1930,7 +1976,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				try {
 					session.appendEntry({
 						kind: "custom",
-						customType: "clio.routing-notice",
+						customType: "clio-coder.routing-notice",
 						parentTurnId: null,
 						data: { kind: notice.kind, level: notice.level, text: notice.text },
 					});
@@ -1964,8 +2010,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				routing: () => {
 					const settings = getCurrentSettings();
 					return {
-						target: settings.orchestrator.target,
-						model: settings.orchestrator.model,
+						target: settings.chat.target,
+						model: settings.chat.model,
 					};
 				},
 				onActiveSessionAutonomyChange: (level) => {
@@ -1977,11 +2023,11 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				// as a provider's failure body, is kept off the wire and written to
 				// the unstructured stderr tail instead.
 				diagnostics: (line) => {
-					process.stderr.write(`[clio:acp] ${line}\n`);
+					process.stderr.write(`[clio-coder:acp] ${line}\n`);
 				},
 				permissionTimeoutMs:
 					options.acp.permissionTimeoutMs ??
-					config?.get().delegation.defaults.permissionTimeoutMs ??
+					config?.get().integrations.externalAgents.defaults.permissionTimeoutMs ??
 					DEFAULT_DELEGATION_PERMISSION_TIMEOUT_MS,
 			});
 			// Same ordering the termination drain hook relies on: an aborted turn's
@@ -2094,6 +2140,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		...(initialNotices.length > 0 ? { initialNotices } : {}),
 		...(resources ? { resources } : {}),
 		...(extensions ? { extensions } : {}),
+		reloadExtensions: () => extensionReload.reload(),
 		...(interop ? { interop } : {}),
 		...(share ? { share } : {}),
 		...(mux ? { mux } : {}),
@@ -2122,8 +2169,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			const settings = getCurrentSettings();
 			const bank = taskMemoryBank.snapshot();
 			return {
-				enabled: settings.memory.intervention.enabled,
-				tier: settings.background.target && settings.background.model ? "llm" : "rules",
+				enabled: settings.context.memory.enabled,
+				tier: settings.context.memory.target && settings.context.memory.model ? "llm" : "rules",
 				size: taskMemoryBankSize(bank),
 				lastDecision: memoryIntervention.lastDecision(),
 				bank,
@@ -2225,25 +2272,21 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		onSetThinkingLevel: (level, scope) => {
 			const current = getCurrentSettings();
 			const nextLevel =
-				resolveModelRuntimeCapabilitiesForProviders(
-					providers,
-					current.orchestrator.target,
-					current.orchestrator.model,
-					level,
-				)?.thinking.effectiveLevel ?? "off";
+				resolveModelRuntimeCapabilitiesForProviders(providers, current.chat.target, current.chat.model, level)?.thinking
+					.effectiveLevel ?? "off";
 			applyRoutingAtScope({ orchestrator: { thinkingLevel: nextLevel } }, scope ?? "global");
 		},
 		onCycleThinking: () => {
 			const current = getCurrentSettings();
 			const thinking = resolveModelRuntimeCapabilitiesForProviders(
 				providers,
-				current.orchestrator.target,
-				current.orchestrator.model,
-				current.orchestrator.thinkingLevel ?? "off",
+				current.chat.target,
+				current.chat.model,
+				current.chat.thinkingLevel ?? "off",
 			)?.thinking;
 			const effectiveAvailable = thinking?.supportedLevels ?? (["off"] as ThinkingLevel[]);
 			const nextLevel = advanceThinkingLevel(
-				thinking?.effectiveLevel ?? current.orchestrator.thinkingLevel ?? "off",
+				thinking?.effectiveLevel ?? current.chat.thinkingLevel ?? "off",
 				effectiveAvailable,
 			);
 			updateSessionRouting({ orchestrator: { thinkingLevel: nextLevel } });
@@ -2268,7 +2311,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			applyRoutingAtScope({ orchestrator: { target, model } }, scope);
 			// Recents live in the state dir, not settings.yaml, and are how a swap
 			// stays reachable in the picker. A session-scoped swap still earns one.
-			rememberRecentModel(`${target}/${model}`, getCurrentSettings().modelSelector.recentLimit);
+			rememberRecentModel(`${target}/${model}`, getCurrentSettings().chat.modelPicker.recentLimit);
 		},
 		writeSettings: (next) => applySettingsBlob(next),
 		commitSetting: (id, next, scope) => commitSetting(id, next, scope),
@@ -2289,8 +2332,8 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 					onNewSession: () => {
 						const settings = getCurrentSettings();
 						const input: { cwd: string; target?: string; model?: string } = { cwd: process.cwd() };
-						if (settings.orchestrator.target) input.target = settings.orchestrator.target;
-						if (settings.orchestrator.model) input.model = settings.orchestrator.model;
+						if (settings.chat.target) input.target = settings.chat.target;
+						if (settings.chat.model) input.model = settings.chat.model;
 						session.create(input);
 						taskBoard.snapshot();
 						ensureTaskMemorySession();