@openrig/cli 0.1.12 → 0.3.0

package/daemon/dist/startup.js

@@ -51,11 +51,30 @@ import { RigTeardownOrchestrator } from "./domain/rig-teardown.js";
 import { ResumeMetadataRefresher } from "./domain/resume-metadata-refresher.js";
 import { TranscriptStore } from "./domain/transcript-store.js";
 import { SessionTransport } from "./domain/session-transport.js";
+import { AgentActivityStore } from "./domain/agent-activity-store.js";
 import { HistoryQuery } from "./domain/history-query.js";
 import { AskService } from "./domain/ask-service.js";
 import { ChatRepository } from "./domain/chat-repository.js";
+import { StreamStore } from "./domain/stream-store.js";
+import { QueueRepository } from "./domain/queue-repository.js";
+import { InboxHandler } from "./domain/inbox-handler.js";
+import { OutboxHandler } from "./domain/outbox-handler.js";
+import { ProjectClassifier } from "./domain/project-classifier.js";
+import { ClassifierLeaseManager } from "./domain/classifier-lease-manager.js";
+import { ViewProjector } from "./domain/view-projector.js";
+import { wireViewEventBridge } from "./domain/view-event-bridge.js";
+import { WatchdogJobsRepository } from "./domain/watchdog-jobs-repository.js";
+import { WatchdogHistoryLog } from "./domain/watchdog-history-log.js";
+import { WatchdogPolicyEngine } from "./domain/watchdog-policy-engine.js";
+import { WatchdogScheduler } from "./domain/watchdog-scheduler.js";
+import { WorkflowRuntime } from "./domain/workflow-runtime.js";
+import { makeWorkflowKeepalivePolicy } from "./domain/policies/workflow-keepalive.js";
 import { SpecReviewService } from "./domain/spec-review-service.js";
 import { SpecLibraryService } from "./domain/spec-library-service.js";
+import { ContextPackLibraryService } from "./domain/context-packs/context-pack-library-service.js";
+import { AgentImageLibraryService } from "./domain/agent-images/agent-image-library-service.js";
+import { SnapshotCapturer } from "./domain/agent-images/snapshot-capturer.js";
+import { SettingsStore as ContextPackSettingsStore } from "./domain/user-settings/settings-store.js";
 import { WhoamiService } from "./domain/whoami-service.js";
 import { NodeCmuxService } from "./domain/node-cmux-service.js";
 import { createApp } from "./server.js";
@@ -80,15 +99,108 @@ import { podNamespaceSchema } from "./db/migrations/017_pod_namespace.js";
 import { contextUsageSchema } from "./db/migrations/018_context_usage.js";
 import { externalCliAttachmentSchema } from "./db/migrations/019_external_cli_attachment.js";
 import { rigServicesSchema } from "./db/migrations/020_rig_services.js";
+import { seatHandoverObservabilitySchema } from "./db/migrations/021_seat_handover_observability.js";
+import { nodeCodexConfigProfileSchema } from "./db/migrations/022_node_codex_config_profile.js";
+import { streamItemsSchema } from "./db/migrations/023_stream_items.js";
+import { queueItemsSchema } from "./db/migrations/024_queue_items.js";
+import { queueTransitionsSchema } from "./db/migrations/025_queue_transitions.js";
+import { inboxEntriesSchema } from "./db/migrations/026_inbox_entries.js";
+import { outboxEntriesSchema } from "./db/migrations/027_outbox_entries.js";
+import { projectClassificationsSchema } from "./db/migrations/028_project_classifications.js";
+import { classifierLeasesSchema } from "./db/migrations/029_classifier_leases.js";
+import { viewsCustomSchema } from "./db/migrations/030_views_custom.js";
+import { watchdogJobsSchema } from "./db/migrations/031_watchdog_jobs.js";
+import { watchdogHistorySchema } from "./db/migrations/032_watchdog_history.js";
+import { workflowSpecsSchema } from "./db/migrations/033_workflow_specs.js";
+import { workflowInstancesSchema } from "./db/migrations/034_workflow_instances.js";
+import { workflowStepTrailsSchema } from "./db/migrations/035_workflow_step_trails.js";
+import { watchdogPolicyEnumExtensionSchema } from "./db/migrations/036_watchdog_policy_enum_extension.js";
+import { missionControlActionsSchema } from "./db/migrations/037_mission_control_actions.js";
+import { workspacePrimitiveSchema } from "./db/migrations/038_workspace_primitive.js";
+import { queueTargetRepoSchema } from "./db/migrations/039_queue_target_repo.js";
+import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
+import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
+import { MissionControlReadLayer } from "./domain/mission-control/mission-control-read-layer.js";
+import { MissionControlFleetCliCapability, makeLocalCliCapabilityProbe, } from "./domain/mission-control/mission-control-fleet-cli-capability.js";
+import { MissionControlAuditBrowse } from "./domain/mission-control/audit-browse.js";
+import { MissionControlNotificationDispatcher } from "./domain/mission-control/notification-dispatcher.js";
+import { NtfyNotificationAdapter } from "./domain/mission-control/notification-adapter-ntfy.js";
+import { WebhookNotificationAdapter } from "./domain/mission-control/notification-adapter-webhook.js";
 import { OPENRIG_HOME } from "./openrig-compat.js";
 import { getCompatibleOpenRigPath, getDefaultOpenRigPath, readOpenRigEnv, } from "./openrig-compat.js";
+const KNOWN_PROVIDER_AUTH_ENV = new Set([
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "OPENAI_ORG_ID",
+    "OPENAI_PROJECT_ID",
+]);
+export function collectAllowlistedProviderAuthEnv(raw, env) {
+    const out = {};
+    for (const item of (raw ?? "").split(",")) {
+        const name = item.trim();
+        if (!name)
+            continue;
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(name))
+            continue;
+        if (!KNOWN_PROVIDER_AUTH_ENV.has(name))
+            continue;
+        const value = env[name];
+        if (typeof value === "string" && value.length > 0) {
+            out[name] = value;
+        }
+    }
+    return out;
+}
 export async function createDaemon(opts) {
     const dbPath = opts?.dbPath ?? ":memory:";
     const db = createDb(dbPath);
-    migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema]);
+    migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, inboxEntriesSchema, outboxEntriesSchema, projectClassificationsSchema, classifierLeasesSchema, viewsCustomSchema, watchdogJobsSchema, watchdogHistorySchema, workflowSpecsSchema, workflowInstancesSchema, workflowStepTrailsSchema, watchdogPolicyEnumExtensionSchema, missionControlActionsSchema, workspacePrimitiveSchema, queueTargetRepoSchema]);
     const rigRepo = new RigRepository(db);
     const sessionRegistry = new SessionRegistry(db);
     const eventBus = new EventBus(db);
+    // PL-004 Phase A revision (R1): topology-backed validateRig.
+    // Reject `<member>@<unknown-rig>` shapes by checking the rig portion
+    // against the rig registry. Bare ids without `@` are also rejected
+    // (no canonical rig binding).
+    const isHumanSeatSessionRef = (sessionRef) => {
+        return /^human(?:-[A-Za-z0-9._-]+)?@(kernel|host)$/.test(sessionRef);
+    };
+    const topologyValidateRig = (sessionRef) => {
+        if (isHumanSeatSessionRef(sessionRef))
+            return true;
+        const m = /^[^@]+@(.+)$/.exec(sessionRef);
+        if (!m)
+            return false;
+        const rigName = m[1];
+        return rigRepo.findRigsByName(rigName).length > 0;
+    };
+    // PL-004 Phase A — shared coordination services. Constructed early so
+    // both the queueRepo dep slot and inboxHandler can share one instance.
+    // Transport is wired after SessionTransport instantiation below via
+    // attachTransport().
+    const queueRepoInstance = new QueueRepository(db, eventBus, {
+        validateRig: topologyValidateRig,
+    });
+    // PL-004 Phase B — classifier lease manager. Constructed early so both
+    // the leaseManager dep slot and project-classifier can share one instance.
+    // isAlive is post-attached after whoami-service is constructed.
+    const classifierLeaseManagerInstance = new ClassifierLeaseManager(db, eventBus);
+    // PL-004 Phase B — view-projector. Constructed early so both the
+    // viewProjector dep slot and the view-event-bridge can share one instance.
+    const viewProjectorInstance = new ViewProjector(db, eventBus);
+    // PL-004 Phase B R1 (closes guard BLOCKER 2): wire the view event bridge
+    // so queue/inbox/project mutations emit view.changed for affected built-in
+    // views. SSE consumers on /api/views/:name/sse now receive change events
+    // when underlying state mutates.
+    wireViewEventBridge(eventBus, viewProjectorInstance);
+    // PL-004 Phase C — watchdog supervision tree. Repository + history-log
+    // are constructed early; the policy engine + scheduler are constructed
+    // after SessionTransport is available so the engine can wire delivery.
+    const watchdogJobsRepoInstance = new WatchdogJobsRepository(db);
+    const watchdogHistoryLogInstance = new WatchdogHistoryLog(db);
     const tmuxAdapter = new TmuxAdapter(opts?.tmuxExec ?? execCommand);
     // cmuxFactory takes precedence (for tests), then cmuxExec-based CLI transport, then default
     const cmuxFactory = opts?.cmuxFactory
@@ -97,6 +209,12 @@ export async function createDaemon(opts) {
     // Read transcript config from env (passed by CLI via PNS-T02 config surface)
     const transcriptsEnabled = readOpenRigEnv("OPENRIG_TRANSCRIPTS_ENABLED", "RIGGED_TRANSCRIPTS_ENABLED") !== "false";
     const transcriptsPath = readOpenRigEnv("OPENRIG_TRANSCRIPTS_PATH", "RIGGED_TRANSCRIPTS_PATH") || undefined;
+    const activityHookToken = readOpenRigEnv("OPENRIG_ACTIVITY_HOOK_TOKEN", "RIGGED_ACTIVITY_HOOK_TOKEN") || undefined;
+    const activityHookUrl = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL") || undefined;
+    const openRigPort = readOpenRigEnv("OPENRIG_PORT", "RIGGED_PORT") || undefined;
+    const openRigHost = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST") || undefined;
+    const startupSettings = new ContextPackSettingsStore().resolveConfig();
+    const providerAuthEnv = collectAllowlistedProviderAuthEnv(startupSettings.recoveryProviderAuthEnvAllowlistRaw, process.env);
     const transcriptStore = new TranscriptStore({
         enabled: transcriptsEnabled,
         transcriptsRoot: transcriptsPath,
@@ -108,6 +226,15 @@ export async function createDaemon(opts) {
         eventBus,
         tmuxAdapter,
         transcriptStore,
+        sessionEnv: {
+            PATH: process.env.PATH,
+            OPENRIG_HOME,
+            OPENRIG_PORT: openRigPort,
+            OPENRIG_HOST: openRigHost,
+            OPENRIG_URL: activityHookUrl,
+            OPENRIG_ACTIVITY_HOOK_TOKEN: activityHookToken,
+            ...providerAuthEnv,
+        },
     });
     const snapshotRepo = new SnapshotRepository(db);
     const checkpointStore = new CheckpointStore(db);
@@ -126,12 +253,42 @@ export async function createDaemon(opts) {
     });
     // Connect to cmux at startup — degrades gracefully if absent
     await cmuxAdapter.connect();
-    // Reconcile all managed rigs — marks stale sessions as detached
+    // Reconcile all managed rigs — marks stale sessions as detached.
+    // Capture aggregate counts and log a compact summary so cold-start truth
+    // repair is visible in daemon output instead of silently swallowed.
     const reconciler = new Reconciler({ db, sessionRegistry, eventBus, tmuxAdapter });
     const rigs = rigRepo.listRigs();
+    let reconcileChecked = 0;
+    let reconcileDetached = 0;
+    let reconcileErrors = 0;
     for (const rig of rigs) {
-        await reconciler.reconcile(rig.id);
+        try {
+            const result = await reconciler.reconcile(rig.id);
+            reconcileChecked += result.checked;
+            reconcileDetached += result.detached;
+            reconcileErrors += result.errors.length;
+            for (const e of result.errors) {
+                try {
+                    // eslint-disable-next-line no-console
+                    console.warn(`startup reconcile warning: rig=${rig.id} session=${e.sessionId} error=${e.error}`);
+                }
+                catch { /* logging must never throw */ }
+            }
+        }
+        catch (err) {
+            reconcileErrors += 1;
+            try {
+                // eslint-disable-next-line no-console
+                console.warn(`startup reconcile warning: rig=${rig.id} error=${err instanceof Error ? err.message : String(err)}`);
+            }
+            catch { /* logging must never throw */ }
+        }
+    }
+    try {
+        // eslint-disable-next-line no-console
+        console.log(`startup reconcile: rigs=${rigs.length} checked=${reconcileChecked} detached=${reconcileDetached} errors=${reconcileErrors}`);
     }
+    catch { /* logging must never throw */ }
     const podRepo = new PodRepository(db);
     const rigSpecExporter = new RigSpecExporter({ rigRepo, sessionRegistry, podRepo });
     const rigSpecPreflight = new RigSpecPreflight({
@@ -189,24 +346,95 @@ export async function createDaemon(opts) {
     const { ClaudeCodeAdapter } = await import("./adapters/claude-code-adapter.js");
     const { CodexRuntimeAdapter } = await import("./adapters/codex-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
+    const activityHookRelayAssetPath = nodePath.resolve(import.meta.dirname, "../assets/openrig-activity-hook-relay.cjs");
+    const runtimeSettings = new ContextPackSettingsStore().resolveConfig();
     const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs") });
+            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), activityHookRelayAssetPath, autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts });
     const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; } } });
+            } } w(dir, ""); return r; } }, activityHookRelayAssetPath });
+    // PL-014 Item 6: hoist ContextPackLibraryService construction so the
+    // PodRigInstantiator can resolve `kind: context_pack` startup_files
+    // entries at materialize time. Same instance is returned to deps
+    // below so /api/context-packs/* shares it.
+    const contextPackLibrary = (() => {
+        const userPacksRoot = getDefaultOpenRigPath("context-packs");
+        try {
+            fs.mkdirSync(userPacksRoot, { recursive: true });
+        }
+        catch { /* best-effort */ }
+        const roots = [
+            { path: userPacksRoot, sourceType: "user_file" },
+        ];
+        try {
+            const settingsStore = new ContextPackSettingsStore();
+            const cfg = settingsStore.resolveConfig();
+            const workspacePacksRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "context-packs");
+            if (workspacePacksRoot !== userPacksRoot && fs.existsSync(workspacePacksRoot)) {
+                roots.push({ path: workspacePacksRoot, sourceType: "workspace" });
+            }
+        }
+        catch { /* settings unavailable; fall through with user-file root only */ }
+        const builtinPacksRoot = nodePath.resolve(import.meta.dirname, "../context-packs");
+        if (fs.existsSync(builtinPacksRoot)) {
+            roots.unshift({ path: builtinPacksRoot, sourceType: "builtin" });
+        }
+        const lib = new ContextPackLibraryService({ roots });
+        lib.scan();
+        return lib;
+    })();
+    // PL-016 Item 2 + Item 4: hoist AgentImageLibraryService construction
+    // so the PodRigInstantiator can resolve `session_source: mode:
+    // agent_image` at materialize time. Same instance returned to deps
+    // below so /api/agent-images/* + the SnapshotCapturer share it.
+    const agentImageRootBuilder = () => {
+        const userImagesRoot = getDefaultOpenRigPath("agent-images");
+        try {
+            fs.mkdirSync(userImagesRoot, { recursive: true });
+        }
+        catch { /* best-effort */ }
+        const roots = [
+            { path: userImagesRoot, sourceType: "user_file" },
+        ];
+        try {
+            const settingsStore = new ContextPackSettingsStore();
+            const cfg = settingsStore.resolveConfig();
+            const workspaceImagesRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "agent-images");
+            if (workspaceImagesRoot !== userImagesRoot && fs.existsSync(workspaceImagesRoot)) {
+                roots.push({ path: workspaceImagesRoot, sourceType: "workspace" });
+            }
+        }
+        catch { /* settings unavailable */ }
+        return { userImagesRoot, roots };
+    };
+    const agentImageLibrary = (() => {
+        const { roots } = agentImageRootBuilder();
+        const lib = new AgentImageLibraryService({ roots });
+        lib.scan();
+        return lib;
+    })();
+    const snapshotCapturer = new SnapshotCapturer({
+        db,
+        rigRepo,
+        sessionRegistry,
+        agentImageLibrary,
+        targetRoot: getDefaultOpenRigPath("agent-images"),
+    });
     const podInstantiator = new PodRigInstantiator({
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
         adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         tmuxAdapter,
+        contextPackLibrary,
+        agentImageLibrary,
     });
     const podBundleSourceResolver = new PodBundleSourceResolver();
     const bootstrapOrchestrator = new BootstrapOrchestrator({
@@ -247,6 +475,7 @@ export async function createDaemon(opts) {
     const contextUsageStore = new ContextUsageStore(db, { stateDir: OPENRIG_HOME });
     const whoamiService = new WhoamiService({ db, rigRepo, sessionRegistry, transcriptStore, contextUsageStore });
     const nodeCmuxService = new NodeCmuxService(rigRepo, sessionRegistry, cmuxAdapter);
+    const agentActivityStore = new AgentActivityStore({ db, eventBus });
     const deps = {
         rigRepo,
         sessionRegistry,
@@ -287,8 +516,40 @@ export async function createDaemon(opts) {
         podBundleSourceResolver,
         runtimeAdapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         transcriptStore,
-        sessionTransport: new SessionTransport({ db, rigRepo, sessionRegistry, tmuxAdapter }),
+        sessionTransport: (() => {
+            const t = new SessionTransport({ db, rigRepo, sessionRegistry, tmuxAdapter, agentActivityStore });
+            // PL-004 Phase A revision (R1): wire QueueRepository's wake-path so
+            // create / handoff / handoff-and-complete nudge by default.
+            queueRepoInstance.attachTransport(t);
+            // PL-004 Phase B: wire classifier-lease-manager liveness check from
+            // the sessions table. Lease holder is "alive" iff there is at least
+            // one row in `sessions` with session_name == classifierSession AND
+            // status == 'running'.
+            classifierLeaseManagerInstance.attachIsAlive((classifierSession) => {
+                try {
+                    const row = db
+                        .prepare(`SELECT 1 FROM sessions WHERE session_name = ? AND status = 'running' LIMIT 1`)
+                        .get(classifierSession);
+                    return row !== undefined;
+                }
+                catch {
+                    // Conservative: on lookup error, treat as alive (do not falsely
+                    // trigger deadness-based lease expiry).
+                    return true;
+                }
+            });
+            return t;
+        })(),
         chatRepo: new ChatRepository(db),
+        streamStore: new StreamStore(db, eventBus),
+        queueRepo: queueRepoInstance,
+        inboxHandler: new InboxHandler(db, eventBus, queueRepoInstance),
+        outboxHandler: new OutboxHandler(db),
+        classifierLeaseManager: classifierLeaseManagerInstance,
+        projectClassifier: new ProjectClassifier(db, eventBus, classifierLeaseManagerInstance),
+        viewProjector: viewProjectorInstance,
+        watchdogJobsRepo: watchdogJobsRepoInstance,
+        watchdogHistoryLog: watchdogHistoryLogInstance,
         askService: (() => {
             const psProjectionService = new PsProjectionService({ db });
             const execDep = (cmd, args) => new Promise((resolve) => {
@@ -323,6 +584,8 @@ export async function createDaemon(opts) {
         })(),
         whoamiService,
         nodeCmuxService,
+        agentActivityStore,
+        activityHookToken,
         contextUsageStore,
         serviceOrchestrator,
         composeAdapter,
@@ -350,6 +613,32 @@ export async function createDaemon(opts) {
             lib.scan();
             return lib;
         })(),
+        // PL-014 Item 6: same instance hoisted earlier so the
+        // PodRigInstantiator can resolve `kind: context_pack` startup_files
+        // entries — sharing the cache means /api/context-packs/* + the
+        // instantiator see consistent state.
+        contextPackLibrary,
+        // PL-016 — agent_image typed primitive. Shared library + capturer
+        // + spec-roots supplier across /api/agent-images/* and the
+        // PodRigInstantiator's session_source: mode: agent_image dispatch.
+        agentImageLibrary,
+        snapshotCapturer,
+        agentImageSpecRoots: () => {
+            // Spec-library roots scanned by the evidence guard. v0: user
+            // specs under ~/.openrig/specs + workspace-local specs root
+            // (from the SettingsStore-resolved workspace.specsRoot).
+            const userSpecsRoot = getDefaultOpenRigPath("specs");
+            const roots = [userSpecsRoot];
+            try {
+                const settingsStore = new ContextPackSettingsStore();
+                const cfg = settingsStore.resolveConfig();
+                if (cfg.workspaceSpecsRoot && cfg.workspaceSpecsRoot !== userSpecsRoot) {
+                    roots.push(cfg.workspaceSpecsRoot);
+                }
+            }
+            catch { /* settings unavailable */ }
+            return roots;
+        },
     };
     // Copy bundled reference docs to ~/.openrig/reference/ so agents can find them at a stable path
     try {
@@ -365,10 +654,298 @@ export async function createDaemon(opts) {
         }
     }
     catch { /* best-effort — reference docs are not critical to daemon operation */ }
-    const app = createApp(deps);
-    // Context monitor — caller (index.ts) starts polling after listen
+    // PL-004 Phase C — watchdog policy engine + scheduler. Wired here
+    // (after deps construction) so the engine can dispatch deliveries
+    // through the live SessionTransport. Scheduler is started by
+    // index.ts after listen() so the daemon's HTTP surface is ready
+    // before the scheduler's first tick.
+    // PL-004 Phase D — workflow runtime + workflow-keepalive policy.
+    // Workflow runtime is constructed first; then the watchdog policy
+    // engine is constructed with workflow-keepalive injected via
+    // additionalPolicies (orch-ratified Phase D extension point per
+    // slice IMPL § Write Set / § Driver Handoff Contract).
+    const queueRepoForWorkflow = deps.queueRepo;
+    let workflowRuntime;
+    if (queueRepoForWorkflow) {
+        workflowRuntime = new WorkflowRuntime({
+            db,
+            eventBus,
+            queueRepo: queueRepoForWorkflow,
+        });
+        deps.workflowRuntime = workflowRuntime;
+        // Seed built-in starter workflow_specs into the cache. Idempotent
+        // + workspace-surface-respecting — operator
+        // overrides at workspace paths are preserved (skip-if-cached).
+        // Errors are collected into the result for diagnostic logging but
+        // do NOT block startup; a malformed bundled spec should not bring
+        // the daemon down.
+        const { loadStarterWorkflowSpecs, defaultBuiltinSpecsDir } = await import("./domain/workflow/starter-spec-loader.js");
+        const builtinSpecsDir = defaultBuiltinSpecsDir();
+        const starterResult = loadStarterWorkflowSpecs({
+            cache: workflowRuntime.specCache,
+            builtinDir: builtinSpecsDir,
+        });
+        // Surface the resolved path to the routes layer so
+        // GET /api/workflow/specs can compute the per-row isBuiltIn flag.
+        deps.workflowBuiltinSpecsDir = builtinSpecsDir;
+        if (starterResult.errors.length > 0) {
+            console.warn(`[starter-spec-loader] ${starterResult.errors.length} spec(s) failed to load:`, starterResult.errors);
+        }
+    }
+    // PL-005 Phase A: Mission Control / Queue Observability services.
+    // Wired AFTER WorkflowRuntime so all PL-004 daemon-backed coordination
+    // surfaces are available. Mission Control reads from queue/view/stream
+    // surfaces and writes through the atomic 7-verb contract.
+    if (deps.queueRepo && deps.viewProjector) {
+        const mcActionLog = new MissionControlActionLog(db);
+        const mcWriteContract = new MissionControlWriteContract({
+            db,
+            eventBus,
+            queueRepo: deps.queueRepo,
+            actionLog: mcActionLog,
+        });
+        const mcFleetCliCapability = new MissionControlFleetCliCapability({
+            db,
+            eventBus,
+            rigRepo,
+            // R1 fix per guard PL-005 Phase A review: wire the production
+            // capability probe so /api/mission-control/cli-capabilities
+            // honestly reports drift when MISSION_CONTROL_DESIRED_FIELDS
+            // are missing from the local CLI's allow-list. Without this
+            // probe injection, the production path defaulted to a no-op
+            // that always reported staleCliCount=0 even when the audit-
+            // row-5 case (recoveryGuidance not in CLI allow-list) was
+            // present.
+            probeRig: makeLocalCliCapabilityProbe(),
+        });
+        const mcReadLayer = new MissionControlReadLayer({
+            db,
+            queueRepo: deps.queueRepo,
+            viewProjector: deps.viewProjector,
+            streamStore: deps.streamStore,
+            fleetCliCapability: mcFleetCliCapability,
+        });
+        deps.missionControlActionLog = mcActionLog;
+        deps.missionControlWriteContract = mcWriteContract;
+        deps.missionControlFleetCliCapability = mcFleetCliCapability;
+        deps.missionControlReadLayer = mcReadLayer;
+        // PL-005 Phase B: audit-history browse layer (read-only) +
+        // notification dispatcher + bearer-token plumbing.
+        const mcAuditBrowse = new MissionControlAuditBrowse(db);
+        deps.missionControlAuditBrowse = mcAuditBrowse;
+        // Bearer token from createDaemon options is propagated to the
+        // routes constructor via deps so the auth middleware is mounted
+        // at route mount time (not per-request).
+        deps.missionControlBearerToken = opts?.bearerToken ?? null;
+        // Notification dispatcher: chosen mechanism via env config.
+        // OPENRIG_NOTIFICATIONS_MECHANISM=ntfy|webhook|none (default none).
+        // OPENRIG_NOTIFICATIONS_TARGET=<topic url | webhook url>.
+        // OPENRIG_NOTIFICATIONS_INCLUDE_VERB_COMPLETION=1 to opt into the
+        // verb-completion trigger (default off; only human-gate arrivals
+        // trigger by default per planner brief).
+        // No legacy alias for these env vars (new in Phase B).
+        const mechanism = process.env.OPENRIG_NOTIFICATIONS_MECHANISM ?? "none";
+        const target = process.env.OPENRIG_NOTIFICATIONS_TARGET ?? "";
+        const missionControlBaseUrl = process.env.OPENRIG_MISSION_CONTROL_BASE_URL ??
+            process.env.OPENRIG_URL ??
+            process.env.RIGGED_URL;
+        const includeVerbCompletion = process.env.OPENRIG_NOTIFICATIONS_INCLUDE_VERB_COMPLETION === "1";
+        if (mechanism !== "none" && target.length > 0) {
+            let adapter;
+            if (mechanism === "ntfy") {
+                adapter = new NtfyNotificationAdapter({ topicUrl: target });
+            }
+            else if (mechanism === "webhook") {
+                adapter = new WebhookNotificationAdapter({ endpointUrl: target });
+            }
+            else {
+                throw new Error(`OPENRIG_NOTIFICATIONS_MECHANISM='${mechanism}' is not recognized; supported: ntfy | webhook | none`);
+            }
+            const dispatcher = new MissionControlNotificationDispatcher({
+                db,
+                eventBus,
+                adapter,
+                includeVerbCompletion,
+                missionControlBaseUrl,
+            });
+            dispatcher.start();
+            deps.missionControlNotificationDispatcher = dispatcher;
+        }
+    }
+    // Slice Story View v0 — slice indexer + per-tab projector.
+    //
+    // User Settings v0 graduates `OPENRIG_SLICES_ROOT` env-var into the
+    // typed `workspace.slices_root` setting (resolution chain: env >
+    // config-file > default `<workspace.root>/missions`). Backward-compat:
+    // operators with OPENRIG_SLICES_ROOT set continue to work because the
+    // settings store reads env in the same resolution slot. Operators
+    // setting via `rig config set workspace.slices_root <path>` or via the
+    // System drawer Settings panel UI now flow through the indexer too —
+    // closes the PRD § Scenario B requirement that wasn't wired in v0.
+    //
+    //   OPENRIG_SLICES_ROOT             legacy short env var (still honored
+    //                                   if set; preferred route is settings)
+    //   OPENRIG_WORKSPACE_SLICES_ROOT   typed-key env override
+    //   workspace.slices_root           typed setting in ~/.openrig/config.json
+    //   workspace.root                  cascade fallback (default ~/.openrig/workspace)
+    //   workspace.dogfood_evidence_root typed setting for proof packet assets
+    //   OPENRIG_DOGFOOD_EVIDENCE_ROOT   env override for compatibility
+    //
+    // When the resolved slicesRoot path doesn't exist on disk, the indexer
+    // is still constructed but isReady() returns false — the routes return
+    // a clear "slices_root_not_configured" 503 with a setup hint.
+    {
+        // Prefer the legacy short env var if explicitly set (existing
+        // dogfood / test daemons rely on it). Otherwise fall back to the
+        // settings-resolved path (env > file > default cascade inside
+        // SettingsStore). The SettingsStore is constructed locally here
+        // so the slices block doesn't depend on the User Settings v0 wiring
+        // block ordering further below.
+        const legacyEnvSlicesRoot = readOpenRigEnv("OPENRIG_SLICES_ROOT", "RIGGED_SLICES_ROOT") ?? "";
+        let resolvedSlicesRoot = "";
+        let resolvedWorkspaceRoot = "";
+        let resolvedDogfoodRoot = "";
+        if (!legacyEnvSlicesRoot) {
+            try {
+                const { SettingsStore: SettingsStoreCtor } = await import("./domain/user-settings/settings-store.js");
+                const resolvedConfig = new SettingsStoreCtor().resolveConfig();
+                resolvedSlicesRoot = resolvedConfig.workspaceSlicesRoot;
+                resolvedWorkspaceRoot = resolvedConfig.workspaceRoot;
+                resolvedDogfoodRoot = resolvedConfig.workspaceDogfoodEvidenceRoot;
+            }
+            catch {
+                // SettingsStore unavailable — keep slicesRoot empty; routes return 503.
+            }
+        }
+        else {
+            try {
+                const { SettingsStore: SettingsStoreCtor } = await import("./domain/user-settings/settings-store.js");
+                const resolvedConfig = new SettingsStoreCtor().resolveConfig();
+                resolvedDogfoodRoot = resolvedConfig.workspaceDogfoodEvidenceRoot;
+            }
+            catch {
+                // SettingsStore unavailable — proof packets remain disabled.
+            }
+        }
+        const slicesRoot = legacyEnvSlicesRoot || resolvedSlicesRoot;
+        const additionalSliceRoots = resolvedWorkspaceRoot
+            ? [
+                nodePath.join(resolvedWorkspaceRoot, "missions"),
+                nodePath.join(resolvedWorkspaceRoot, "slices"),
+            ].filter((root) => root !== slicesRoot)
+            : [];
+        const { SliceIndexer } = await import("./domain/slices/slice-indexer.js");
+        const { SliceDetailProjector } = await import("./domain/slices/slice-detail-projector.js");
+        const sliceIndexer = new SliceIndexer({
+            slicesRoot,
+            additionalSliceRoots,
+            dogfoodEvidenceRoot: resolvedDogfoodRoot || null,
+            db,
+        });
+        // Slice Story View v1: pass workflowRuntime.specCache so the
+        // projector can resolve a bound workflow_instance's spec for
+        // spec-graph + phase + current-step projection. When the workflow
+        // runtime is not constructed (queueRepo absent — same condition
+        // already guards the workflowRuntime block above), the projector
+        // silently degrades to v0 behavior (workflowBinding=null,
+        // specGraph=null, phaseDefinitions=null, currentStep=null).
+        const sliceDetailProjector = new SliceDetailProjector({
+            db,
+            indexer: sliceIndexer,
+            workflowSpecCache: workflowRuntime?.specCache,
+        });
+        deps.sliceIndexer = sliceIndexer;
+        deps.sliceDetailProjector = sliceDetailProjector;
+    }
+    // UI Enhancement Pack v0:
+    //   - file allowlist (item 3) from OPENRIG_FILES_ALLOWLIST
+    //   - atomic write service (item 4) wired only when allowlist non-empty
+    //   - progress scan-roots (item 1B) from OPENRIG_PROGRESS_SCAN_ROOTS
+    //
+    // Empty env → empty allowlist / no-roots indexer; routes return 503
+    // with structured config hints so the UI can surface a setup message
+    // instead of a generic error.
+    {
+        const { decodeAllowlist } = await import("./domain/files/path-safety.js");
+        const { FileWriteService } = await import("./domain/files/file-write-service.js");
+        const { ProgressIndexer, decodeProgressScanRoots } = await import("./domain/progress/progress-indexer.js");
+        // User Settings v0 — UEP env-vars graduated to typed settings.
+        // Resolution: env > settings file > empty. SettingsStore handles
+        // the env > file > default precedence; we just decode the raw
+        // string into structured roots.
+        const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
+        const settingsStore = new SettingsStore();
+        deps.settingsStore = settingsStore;
+        const cfg = settingsStore.resolveConfig();
+        // Preview Terminal v0 (PL-018) — per-session rate limiter for the
+        // /preview route. 1-second window per (session, lines) cache key:
+        // short enough that legitimate polling at the operator's refresh
+        // interval (`ui.preview.refresh_interval_seconds`, default 3s) always
+        // sees fresh content, but multiple pinned-pane requests for the same
+        // seat within a single second collapse to one tmux capture.
+        const { PreviewRateLimiter } = await import("./domain/preview/preview-rate-limiter.js");
+        deps.previewRateLimiter = new PreviewRateLimiter(1000);
+        const filesAllowlist = decodeAllowlist(cfg.filesAllowlistRaw);
+        deps.filesAllowlist = filesAllowlist;
+        deps.fileWriteService = filesAllowlist.length > 0
+            ? new FileWriteService({
+                allowlist: filesAllowlist,
+                auditFilePath: nodePath.join(OPENRIG_HOME, "file-edit-audit.jsonl"),
+            })
+            : null;
+        deps.progressIndexer = new ProgressIndexer({ roots: decodeProgressScanRoots(cfg.progressScanRootsRaw) });
+        // Operator Surface Reconciliation v0 — steering composer (item 1).
+        // Reads typed workspace settings by default while preserving the
+        // OPENRIG_STEERING_* env override family for non-canonical layouts.
+        const { SteeringComposer, steeringOptsFromSettings } = await import("./domain/steering/steering-composer.js");
+        deps.steeringComposer = new SteeringComposer(steeringOptsFromSettings({
+            workspaceRoot: cfg.workspaceRoot,
+            workspaceSteeringPath: cfg.workspaceSteeringPath,
+        }));
+        // Workflows in Spec Library + Activation Lens v0 — active lens
+        // persistence under OPENRIG_HOME/active-workflow-lens.json. Same
+        // file-backed pattern as UI Enhancement Pack v0's audit JSONL —
+        // honors OPENRIG_HOME so isolated test/dogfood daemons keep their
+        // own lens state instead of bleeding into the operator's host.
+        const { ActiveLensStore } = await import("./domain/active-lens-store.js");
+        deps.activeLensStore = new ActiveLensStore({
+            filePath: nodePath.join(OPENRIG_HOME, "active-workflow-lens.json"),
+        });
+    }
+    const sessionTransport = deps.sessionTransport;
+    if (sessionTransport) {
+        const watchdogPolicyEngine = new WatchdogPolicyEngine({
+            jobsRepo: watchdogJobsRepoInstance,
+            historyLog: watchdogHistoryLogInstance,
+            eventBus,
+            deliver: async ({ targetSession, message }) => {
+                try {
+                    const result = await sessionTransport.send(targetSession, message);
+                    return result.ok ? { status: "ok" } : { status: "failed", error: result.error };
+                }
+                catch (err) {
+                    return { status: "failed", error: err instanceof Error ? err.message : String(err) };
+                }
+            },
+            // PL-004 Phase D: register workflow-keepalive policy alongside
+            // Phase C's three built-in policies. workflow-keepalive reads
+            // SQLite workflow_instances directly via the new Phase D tables
+            // (audit row 18: SQLite-source-only, no markdown read).
+            additionalPolicies: [makeWorkflowKeepalivePolicy({ db })],
+        });
+        const watchdogScheduler = new WatchdogScheduler({
+            jobsRepo: watchdogJobsRepoInstance,
+            policyEngine: watchdogPolicyEngine,
+        });
+        deps.watchdogPolicyEngine = watchdogPolicyEngine;
+        deps.watchdogScheduler = watchdogScheduler;
+    }
+    // Context monitor — constructed before createApp so routes can access pollOnce for refresh.
+    // Caller (index.ts) starts polling after listen.
     const { ContextMonitor } = await import("./domain/context-monitor.js");
     const contextMonitor = new ContextMonitor(db, contextUsageStore, claudeAdapter);
+    deps.contextMonitor = contextMonitor;
+    const app = createApp(deps);
     return { app, db, deps, contextMonitor };
 }
 //# sourceMappingURL=startup.js.map