@moorline/core 0.0.1 → 0.0.3

package/dist/core/system/projection/managementReadModel/packageTrust.js

@@ -0,0 +1,40 @@
+function sourceLabel(entry) {
+    if (entry.source.kind === 'local_dir' || entry.source.kind === 'local_archive') {
+        return entry.source.path;
+    }
+    if (entry.source.provenance?.type === 'npm') {
+        return entry.source.provenance.packageName;
+    }
+    return entry.source.url;
+}
+export function managedTrustForPackage(entry, fallbackSource) {
+    if (!entry) {
+        return {
+            level: 'local',
+            source: fallbackSource
+        };
+    }
+    if (entry.source.kind === 'local_dir' || entry.source.kind === 'local_archive') {
+        return {
+            level: 'local',
+            source: sourceLabel(entry)
+        };
+    }
+    if (entry.source.provenance?.type === 'npm') {
+        return {
+            level: 'npm',
+            source: sourceLabel(entry)
+        };
+    }
+    return {
+        level: 'direct_url',
+        source: sourceLabel(entry)
+    };
+}
+export function editableFromPackage(entry) {
+    return !entry || entry.source.kind === 'local_dir';
+}
+export function removableFromPackage(entry) {
+    return entry !== null;
+}
+//# sourceMappingURL=packageTrust.js.map

package/dist/core/system/projection/managementReadModel/packageTrust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageTrust.js","sourceRoot":"","sources":["../../../../../../../../src/core/system/projection/managementReadModel/packageTrust.ts"],"names":[],"mappings":"AAGA,SAAS,WAAW,CAAC,KAA2B;IAC9C,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAkC,EAAE,cAAsB;IAC/F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAC/E,OAAO;YACL,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAkC;IACpE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAkC;IACrE,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC"}

package/dist/core/system/projection/managementReadModel/pluginDiskRecords.d.ts

@@ -1,7 +1,6 @@
 import type { PluginManifest } from '../../../extension/plugins/pluginManifest.js';
 interface PluginDiskRecord {
     pluginPath: string;
-    packageGroup: 'official' | 'local';
     manifest?: PluginManifest;
     error?: string;
     pluginId: string;

package/dist/core/system/projection/managementReadModel/pluginDiskRecords.js

@@ -18,21 +18,13 @@ export function listPluginRecords(rootDir) {
         }
         const manifestPath = join(current, 'manifest.json');
         if (existsSync(manifestPath)) {
-            const segments = current.split(/[\\/]/u).filter(Boolean);
-            const packagesIndex = segments.lastIndexOf('packages');
-            const packageGroup = packagesIndex >= 0 &&
-                segments[packagesIndex + 1] === 'plugins' &&
-                segments[packagesIndex + 2] === 'official'
-                ? 'official'
-                : 'local';
             try {
                 const raw = JSON.parse(readFileSync(manifestPath, 'utf8'));
                 const manifest = validatePluginManifest(raw);
                 records.push({
                     manifest,
                     pluginId: manifest.id,
-                    pluginPath: current,
-                    packageGroup
+                    pluginPath: current
                 });
             }
             catch (error) {
@@ -40,7 +32,6 @@ export function listPluginRecords(rootDir) {
                 records.push({
                     pluginId: `invalid:${normalized.split('/').filter(Boolean).at(-1) ?? 'plugin'}`,
                     pluginPath: current,
-                    packageGroup,
                     error: error instanceof Error ? error.message : String(error)
                 });
             }

package/dist/core/system/projection/managementReadModel/pluginDiskRecords.js.map

@@ -1 +1 @@
-{"version":3,"file":"pluginDiskRecords.js","sourceRoot":"","sources":["../../../../../../../../src/core/system/projection/managementReadModel/pluginDiskRecords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAUtF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,YAAY,GAChB,aAAa,IAAI,CAAC;gBAClB,QAAQ,CAAC,aAAa,GAAG,CAAC,CAAC,KAAK,SAAS;gBACzC,QAAQ,CAAC,aAAa,GAAG,CAAC,CAAC,KAAK,UAAU;gBACxC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAmB,CAAC;gBAC7E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,UAAU,EAAE,OAAO;oBACnB,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE;oBAC/E,UAAU,EAAE,OAAO;oBACnB,YAAY;oBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpF,CAAC"}
+{"version":3,"file":"pluginDiskRecords.js","sourceRoot":"","sources":["../../../../../../../../src/core/system/projection/managementReadModel/pluginDiskRecords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAStF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAmB,CAAC;gBAC7E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACrB,UAAU,EAAE,OAAO;iBACpB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,WAAW,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE;oBAC/E,UAAU,EAAE,OAAO;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/core/system/projection/managementReadModelService.d.ts

@@ -8,7 +8,9 @@ export declare class ManagementReadModelService {
     private buildManagementContributions;
     private buildPackageConfig;
     private buildSessions;
-    private buildMissions;
+    private buildExternalResources;
+    private buildWorkItems;
+    private buildGateRuns;
     private buildPlugins;
     private buildSkills;
     private buildServices;

package/dist/core/system/projection/managementReadModelService.js

@@ -1,21 +1,21 @@
-import { join } from 'node:path';
+import { join, relative, resolve } from 'node:path';
 import { createPackageApplyPlan } from '../../extension/packages/packageApplyPlanner.js';
 import { desiredPackageRefsFromConfig, isPackageActivated, packageActivationUniqueKey } from '../../extension/packages/packageActivation.js';
 import { resolvePackageConfigSchema } from '../../extension/packages/packageConfigSchema.js';
 import { PackageInventoryStore } from '../../extension/packages/packageInventoryStore.js';
 import { evaluateRuntimeStartability } from '../../extension/packages/runtimeStartability.js';
-import { configuredApiAdapterConfig } from '../../../types/config.js';
 import { GitHistoryService } from '../vcs/gitHistoryService.js';
 import { detectMoorlineRuntimeMode, readMoorlineReleaseManifest, resolveMoorlineAssetRoot } from '../release/releaseArtifacts.js';
 import { loadRuntimePackageLoadReport } from '../release/runtimePackageLoadReport.js';
 import { readConfigMigrationWarning, runtimePaths } from '../config/configStore.js';
 import { readRecentAuditEvents } from './managementReadModel/auditEvents.js';
 import { buildServiceObjects } from './managementReadModel/objects/serviceObjects.js';
+import { editableFromPackage, managedTrustForPackage, removableFromPackage } from './managementReadModel/packageTrust.js';
 import { listPluginRecords } from './managementReadModel/pluginDiskRecords.js';
 import { buildProviderAlignment } from './managementReadModel/providerAlignment.js';
 import { summarize } from './managementReadModel/text.js';
 import { readRuntimeOrchestrationHealth } from '../../runtime/execution/orchestrationHealth.js';
-import { isOfficialPluginId, toPluginPackageId } from '../../extension/plugins/pluginId.js';
+import { toPluginPackageId } from '../../extension/plugins/pluginId.js';
 import { parsePendingRequestQuestions } from './pendingRequestQuestions.js';
 function dataOnlyPresentation(runtimeRoot) {
     return {
@@ -56,7 +56,7 @@ function dataOnlyPresentation(runtimeRoot) {
             },
             updates: {
                 appUpdates: '',
-                officialPackageUpdates: '',
+                packageUpdates: '',
                 localPackageHandling: '',
                 operatorTrigger: ''
             }
@@ -66,12 +66,10 @@ function dataOnlyPresentation(runtimeRoot) {
 function configRootForPackage(input) {
     if (input.surface === 'api-adapter') {
         if (input.packageId === input.config.surfaces.apiAdapter.activePackageId) {
-            return input.packageId === 'official/http'
-                ? { ...configuredApiAdapterConfig(input.config) }
-                : {
-                    ...input.config.surfaces.apiAdapter.config,
-                    ...(input.config.surfaces.apiAdapter.configByPackageId?.[input.packageId] ?? {})
-                };
+            return {
+                ...input.config.surfaces.apiAdapter.config,
+                ...(input.config.surfaces.apiAdapter.configByPackageId?.[input.packageId] ?? {})
+            };
         }
         return {
             ...(input.config.surfaces.apiAdapter.configByPackageId?.[input.packageId] ?? {})
@@ -97,6 +95,28 @@ function configRootForPackage(input) {
 function configValueIsSet(value) {
     return value !== undefined && value !== null && !(typeof value === 'string' && value.trim().length === 0);
 }
+function pathContains(rootPath, candidatePath) {
+    const relativePath = relative(resolve(rootPath), resolve(candidatePath));
+    return relativePath === '' || (!relativePath.startsWith('..') && !relativePath.startsWith('/') && !relativePath.startsWith('\\'));
+}
+function runtimeSqliteObjectBase(label) {
+    return {
+        controls: ['inspect'],
+        mutability: {
+            editable: false,
+            installable: false,
+            removable: false
+        },
+        trust: {
+            level: 'operator',
+            source: 'runtime SQLite state'
+        },
+        sourceOfTruth: {
+            kind: 'sqlite',
+            label
+        }
+    };
+}
 function schemaFieldType(property) {
     return property.type ?? 'string';
 }
@@ -115,18 +135,20 @@ export class ManagementReadModelService {
         const applyPlan = createPackageApplyPlan(this.deps.config, inventory);
         const runtimeStartability = evaluateRuntimeStartability(this.deps.config, inventory);
         const sessions = this.buildSessions();
-        const missions = this.buildMissions();
         const plugins = this.buildPlugins(inventory);
         const skills = this.buildSkills(inventory);
-        const services = this.buildServices();
+        const services = this.buildServices(inventory.installed);
         const pendingRequests = this.buildPendingRequests();
         const providerThreads = this.buildProviderThreads();
-        const sidecars = this.buildSidecars();
+        const sidecars = this.buildSidecars(inventory.installed);
+        const externalResources = this.buildExternalResources();
+        const workItems = this.buildWorkItems();
+        const gateRuns = this.buildGateRuns();
         const managementContributions = this.buildManagementContributions();
         const managementSurface = this.deps.getManagementSurface();
         const providerDiagnostics = this.deps.provider.getDiagnostics();
         const auditLogPath = join(this.deps.runtimeRoot, 'logs', 'policy-audit.jsonl');
-        const namespaceState = this.deps.getNamespaceState();
+        const surfaceState = this.deps.getSurfaceState();
         const homeRoot = this.deps.homeRoot;
         const historyStatus = this.history.statusSync(homeRoot);
         const historyEntries = historyStatus.gitAvailable ? this.history.listSync(homeRoot, 30) : [];
@@ -148,7 +170,7 @@ export class ManagementReadModelService {
             setup: {
                 runtimeRoot: this.deps.runtimeRoot,
                 installationStatePath: join(this.deps.runtimeRoot, 'state', 'installation.json'),
-                namespaceBootstrapped: namespaceState !== null,
+                surfaceBootstrapped: surfaceState !== null,
                 providerConnected,
                 readyForSessions: runtimeStartability.startable,
                 nextAction: runtimeStartability.startable
@@ -169,9 +191,7 @@ export class ManagementReadModelService {
                             ? { packageId: this.deps.config.surfaces.transport.activePackageId }
                             : {}),
                     scopeId: typeof this.deps.config.transport?.scopeId === 'string' ? this.deps.config.transport.scopeId : '',
-                    applicationId: typeof this.deps.config.transport?.applicationId === 'string' ? this.deps.config.transport.applicationId : '',
-                    actorId: typeof this.deps.config.transport?.actorId === 'string' ? this.deps.config.transport.actorId : '',
-                    invitePermissions: typeof this.deps.config.transport?.invitePermissions === 'string' ? this.deps.config.transport.invitePermissions : ''
+                    config: this.deps.config.transport?.config ?? {}
                 },
                 provider: {
                     kind: this.deps.config.provider?.kind ?? this.deps.config.surfaces.provider.activePackageId ?? 'unselected',
@@ -201,7 +221,7 @@ export class ManagementReadModelService {
                     }
                 }
             },
-            namespace: namespaceState,
+            surface: surfaceState,
             runtime: {
                 status: this.deps.getRuntimeStatus(),
                 control: this.deps.getRuntimeControlStatus(),
@@ -220,7 +240,6 @@ export class ManagementReadModelService {
                 alignment: buildProviderAlignment(providerDiagnostics.capabilityMetadata)
             },
             packages: {
-                catalog: this.deps.packageCatalog,
                 installed: inventory.installed
                     .map((entry) => {
                     const selected = (entry.surface === 'api-adapter' && this.deps.config.surfaces.apiAdapter.activePackageId === entry.packageId) ||
@@ -287,7 +306,7 @@ export class ManagementReadModelService {
                     title: activity.title,
                     detail: activity.detail,
                     threadId: activity.threadId,
-                    spaceId: activity.spaceId,
+                    transportResourceId: activity.transportResourceId,
                     createdAt: activity.createdAt
                 }))
             },
@@ -302,24 +321,28 @@ export class ManagementReadModelService {
             },
             overview: {
                 sessions: sessions.length,
-                missions: missions.length,
                 pendingRequests: pendingRequests.length,
                 plugins: plugins.length,
                 skills: skills.length,
                 services: services.length,
                 providerThreads: providerThreads.length,
-                sidecars: sidecars.length
+                sidecars: sidecars.length,
+                externalResources: externalResources.length,
+                workItems: workItems.length,
+                gateRuns: gateRuns.length
             },
             objects: {
                 sessions,
-                missions,
                 plugins,
                 skills,
                 services,
                 managementContributions,
                 pendingRequests,
                 providerThreads,
-                sidecars
+                sidecars,
+                externalResources,
+                workItems,
+                gateRuns
             }
         };
     }
@@ -335,29 +358,6 @@ export class ManagementReadModelService {
     }
     buildPackageConfig(installed) {
         const configTargets = [...installed];
-        if (this.deps.config.surfaces.apiAdapter.activePackageId === 'official/http' &&
-            !configTargets.some((entry) => entry.surface === 'api-adapter' && entry.packageId === 'official/http')) {
-            configTargets.push({
-                family: 'installable',
-                kind: 'api-adapter',
-                surface: 'api-adapter',
-                packageId: 'official/http',
-                name: 'Official HTTP API adapter',
-                version: '0.0.1',
-                installedAt: '',
-                installPath: '',
-                source: {
-                    kind: 'local_dir',
-                    path: 'built-in'
-                },
-                manifestPath: '',
-                manifestHash: 'built-in',
-                dependencies: [],
-                activation: {
-                    uniqueKey: 'api-adapter'
-                }
-            });
-        }
         return configTargets
             .filter((entry) => entry.kind !== 'bundle')
             .map((entry) => {
@@ -419,7 +419,7 @@ export class ManagementReadModelService {
         return this.deps.snapshots.listSessions().map((snapshot) => ({
             id: snapshot.session.sessionId,
             kind: 'session',
-            name: snapshot.session.spaceName,
+            name: snapshot.session.transportResourceName,
             summary: summarize(snapshot.session.summary ?? snapshot.session.objective ?? null),
             controls: ['inspect', 'archive', 'delete_archived', 'provider_start', 'provider_stop', 'interrupt_turn'],
             mutability: {
@@ -429,7 +429,7 @@ export class ManagementReadModelService {
             },
             trust: {
                 level: 'operator',
-                source: 'local SQLite runtime state'
+                source: 'runtime SQLite state'
             },
             sourceOfTruth: {
                 kind: 'sqlite',
@@ -445,7 +445,7 @@ export class ManagementReadModelService {
                     providerStatus: snapshot.provider?.status ?? snapshot.session.providerStatus
                 }
             },
-            spaceId: snapshot.session.spaceId,
+            transportResourceId: snapshot.session.transportResourceId,
             threadId: snapshot.session.threadId,
             lifecycleStatus: snapshot.session.lifecycleStatus,
             runtimeMode: snapshot.session.runtimeMode,
@@ -461,57 +461,83 @@ export class ManagementReadModelService {
             waitState: snapshot.receipt?.state ?? 'idle',
             providerStatus: snapshot.provider?.status ?? snapshot.session.providerStatus,
             pendingRequestCount: snapshot.pendingRequests.length,
-            recentActivityCount: snapshot.recentActivities.length
+            recentActivityCount: snapshot.recentActivities.length,
+            externalResources: this.deps.store?.listExternalResourcesForSession(snapshot.session.sessionId) ?? []
         }));
     }
-    buildMissions() {
-        return this.deps.missions.list().map((mission) => ({
-            id: mission.missionId,
-            kind: 'mission',
-            name: mission.title,
-            summary: summarize(mission.goal),
-            controls: mission.lifecycleStatus === 'draft'
-                ? ['inspect', 'configure', 'archive', 'delete_archived']
-                : ['inspect', 'pause', 'resume', 'stop', 'run_now', 'archive', 'delete_archived'],
-            mutability: {
-                editable: true,
-                installable: false,
-                removable: mission.archivedAt !== null
-            },
-            trust: {
-                level: 'operator',
-                source: 'local SQLite runtime state'
+    buildExternalResources() {
+        return (this.deps.store?.listExternalResources({ limit: 100 }) ?? []).map((resource) => ({
+            id: `${resource.provider}:${resource.kind}:${resource.id}`,
+            kind: 'external_resource',
+            name: resource.title ?? resource.id,
+            summary: summarize(resource.url ?? resource.state ?? null),
+            ...runtimeSqliteObjectBase('runtime_external_resources'),
+            runtimeState: {
+                status: resource.state ?? 'seen',
+                updatedAt: resource.lastSeenAt,
+                details: {
+                    provider: resource.provider,
+                    kind: resource.kind,
+                    externalId: resource.id
+                }
             },
-            sourceOfTruth: {
-                kind: 'sqlite',
-                label: 'runtime_missions'
+            resource
+        }));
+    }
+    buildWorkItems() {
+        return (this.deps.store?.listWorkItems({ limit: 100 }) ?? []).map((workItem) => ({
+            id: workItem.workItemId,
+            kind: 'work_item',
+            name: `${workItem.queue}:${workItem.workItemId}`,
+            summary: summarize(workItem.phase ?? workItem.lastError ?? null),
+            ...runtimeSqliteObjectBase('runtime_work_items'),
+            runtimeState: {
+                status: workItem.status,
+                updatedAt: workItem.updatedAt,
+                details: {
+                    packageId: workItem.packageId,
+                    queue: workItem.queue,
+                    attempts: workItem.attempts,
+                    sessionId: workItem.sessionId ?? null,
+                    externalResource: workItem.externalResource ?? null
+                }
             },
+            workItem
+        }));
+    }
+    buildGateRuns() {
+        return (this.deps.store?.listGateRuns({ limit: 100 }) ?? []).map((gateRun) => ({
+            id: gateRun.gateRunId,
+            kind: 'gate_run',
+            name: gateRun.gateId,
+            summary: summarize(gateRun.stderr || gateRun.stdout || null),
+            ...runtimeSqliteObjectBase('runtime_gate_runs'),
             runtimeState: {
-                status: mission.lifecycleStatus,
-                updatedAt: mission.updatedAt,
+                status: gateRun.status,
+                updatedAt: gateRun.completedAt ?? gateRun.startedAt,
                 details: {
-                    nextRunAt: mission.nextRunAt,
-                    pausedAt: mission.pausedAt,
-                    archivedAt: mission.archivedAt
+                    packageId: gateRun.packageId,
+                    command: gateRun.command,
+                    required: gateRun.required,
+                    exitCode: gateRun.exitCode,
+                    workItemId: gateRun.workItemId ?? null,
+                    sessionId: gateRun.sessionId ?? null
                 }
             },
-            spaceId: mission.spaceId,
-            threadId: mission.threadId,
-            lifecycleStatus: mission.lifecycleStatus,
-            runtimeMode: mission.runtimeMode,
-            goal: mission.goal,
-            scheduleText: mission.scheduleText,
-            nextRunAt: mission.nextRunAt,
-            lastRunAt: this.deps.missions.listRuns(mission.missionId, 1)[0]?.startedAt ?? null,
-            pausedAt: mission.pausedAt,
-            archivedAt: mission.archivedAt
+            gateRun
         }));
     }
     buildPlugins(inventory) {
         const enabledPluginIds = new Set(this.deps.config.surfaces.plugins.enabledPackageIds);
-        const installedPluginIds = new Set(inventory.installed.filter((entry) => entry.kind === 'plugin').map((entry) => entry.packageId));
+        const installedPlugins = inventory.installed.filter((entry) => entry.kind === 'plugin');
+        const installedPluginIds = new Set(installedPlugins.map((entry) => entry.packageId));
         const pluginsRoot = join(this.deps.runtimeRoot, 'packages', 'plugins');
         return listPluginRecords(pluginsRoot).map((record) => {
+            const normalizedPluginId = record.manifest ? toPluginPackageId(record.manifest.id) : null;
+            const installedPlugin = normalizedPluginId
+                ? installedPlugins.find((entry) => entry.packageId === normalizedPluginId) ?? null
+                : installedPlugins.find((entry) => pathContains(entry.installPath, record.pluginPath)) ?? null;
+            const trust = managedTrustForPackage(installedPlugin, record.pluginPath);
             if (!record.manifest) {
                 return {
                     id: record.pluginId,
@@ -520,14 +546,11 @@ export class ManagementReadModelService {
                     summary: summarize(record.error ?? 'Malformed plugin manifest'),
                     controls: ['inspect'],
                     mutability: {
-                        editable: record.packageGroup === 'local',
+                        editable: editableFromPackage(installedPlugin),
                         installable: true,
-                        removable: record.packageGroup === 'local'
-                    },
-                    trust: {
-                        level: record.packageGroup === 'official' ? 'official' : 'local',
-                        source: record.packageGroup === 'official' ? 'bundled official runtime package' : 'runtime plugin directory'
+                        removable: removableFromPackage(installedPlugin)
                     },
+                    trust,
                     sourceOfTruth: {
                         kind: 'filesystem',
                         label: 'plugin manifest',
@@ -545,11 +568,10 @@ export class ManagementReadModelService {
                     pluginType: 'invalid',
                     capabilities: [],
                     hooks: [],
-                    commands: [],
-                    packageGroup: record.packageGroup
+                    commands: []
                 };
             }
-            const normalizedPluginId = toPluginPackageId(record.manifest.id);
+            const pluginPackageId = toPluginPackageId(record.manifest.id);
             return {
                 id: record.manifest.id,
                 kind: 'plugin',
@@ -557,22 +579,19 @@ export class ManagementReadModelService {
                 summary: summarize(record.manifest.description ?? null),
                 controls: ['inspect'],
                 mutability: {
-                    editable: record.packageGroup === 'local',
+                    editable: editableFromPackage(installedPlugin),
                     installable: true,
-                    removable: record.packageGroup === 'local'
-                },
-                trust: {
-                    level: record.packageGroup === 'official' ? 'official' : 'local',
-                    source: record.packageGroup === 'official' ? 'bundled official runtime package' : 'runtime plugin directory'
+                    removable: removableFromPackage(installedPlugin)
                 },
+                trust,
                 sourceOfTruth: {
                     kind: 'filesystem',
                     label: 'plugin manifest',
                     path: record.pluginPath
                 },
                 runtimeState: {
-                    status: installedPluginIds.has(normalizedPluginId)
-                        ? enabledPluginIds.has(normalizedPluginId)
+                    status: installedPluginIds.has(pluginPackageId)
+                        ? enabledPluginIds.has(pluginPackageId)
                             ? 'enabled'
                             : 'disabled'
                         : 'available',
@@ -589,8 +608,7 @@ export class ManagementReadModelService {
                 pluginType: record.manifest.type,
                 capabilities: [...record.manifest.capabilities],
                 hooks: [...(record.manifest.hooks ?? [])],
-                commands: [],
-                packageGroup: record.packageGroup
+                commands: []
             };
         });
     }
@@ -640,8 +658,8 @@ export class ManagementReadModelService {
             };
         });
     }
-    buildServices() {
-        return buildServiceObjects(this.deps);
+    buildServices(installed) {
+        return buildServiceObjects(this.deps, installed);
     }
     buildPendingRequests() {
         return this.deps.snapshots.overview().openRequests.map((request) => ({
@@ -668,12 +686,12 @@ export class ManagementReadModelService {
                 updatedAt: request.createdAt,
                 details: {
                     threadId: request.threadId,
-                    spaceId: request.spaceId,
+                    transportResourceId: request.transportResourceId,
                     requesterUserId: request.requesterUserId
                 }
             },
             threadId: request.threadId,
-            spaceId: request.spaceId,
+            transportResourceId: request.transportResourceId,
             requestType: request.requestType,
             requesterUserId: request.requesterUserId,
             createdAt: request.createdAt,
@@ -714,14 +732,15 @@ export class ManagementReadModelService {
                     }
                 },
                 threadId: session.threadId,
-                spaceId: snapshot?.session.spaceId ?? null,
+                transportResourceId: snapshot?.session.transportResourceId ?? null,
                 providerThreadId: snapshot?.provider?.providerThreadId ?? session.resumeCursor?.threadId ?? null,
                 runtimeMode: session.runtimeMode,
                 model: session.model ?? null
             };
         });
     }
-    buildSidecars() {
+    buildSidecars(installed) {
+        const installedPlugins = installed.filter((entry) => entry.kind === 'plugin');
         return this.deps.sidecars.listSidecars().map((sidecar) => ({
             id: sidecar.sidecarId,
             kind: 'sidecar',
@@ -733,10 +752,7 @@ export class ManagementReadModelService {
                 installable: false,
                 removable: false
             },
-            trust: {
-                level: isOfficialPluginId(sidecar.pluginId) ? 'official' : 'local',
-                source: sidecar.pluginId
-            },
+            trust: managedTrustForPackage(installedPlugins.find((entry) => entry.packageId === toPluginPackageId(sidecar.pluginId)) ?? null, sidecar.pluginId),
             sourceOfTruth: {
                 kind: 'sqlite',
                 label: 'managed_sidecars'