@openrig/cli 0.2.0 → 0.3.1

package/daemon/dist/startup.js

@@ -71,6 +71,14 @@ import { WorkflowRuntime } from "./domain/workflow-runtime.js";
 import { makeWorkflowKeepalivePolicy } from "./domain/policies/workflow-keepalive.js";
 import { SpecReviewService } from "./domain/spec-review-service.js";
 import { SpecLibraryService } from "./domain/spec-library-service.js";
+// Phase 3a slice 3.3 — plugin discovery service.
+import { PluginDiscoveryService } from "./domain/plugin-discovery-service.js";
+// Slice 28 Checkpoint C-3 — skill-library discovery (SC-29 #11 cumulative).
+import { SkillLibraryDiscoveryService } from "./domain/skill-library-discovery.js";
+import { ContextPackLibraryService } from "./domain/context-packs/context-pack-library-service.js";
+import { AgentImageLibraryService } from "./domain/agent-images/agent-image-library-service.js";
+import { SnapshotCapturer } from "./domain/agent-images/snapshot-capturer.js";
+import { SettingsStore as ContextPackSettingsStore } from "./domain/user-settings/settings-store.js";
 import { WhoamiService } from "./domain/whoami-service.js";
 import { NodeCmuxService } from "./domain/node-cmux-service.js";
 import { createApp } from "./server.js";
@@ -111,12 +119,53 @@ import { workflowSpecsSchema } from "./db/migrations/033_workflow_specs.js";
 import { workflowInstancesSchema } from "./db/migrations/034_workflow_instances.js";
 import { workflowStepTrailsSchema } from "./db/migrations/035_workflow_step_trails.js";
 import { watchdogPolicyEnumExtensionSchema } from "./db/migrations/036_watchdog_policy_enum_extension.js";
+import { missionControlActionsSchema } from "./db/migrations/037_mission_control_actions.js";
+import { workspacePrimitiveSchema } from "./db/migrations/038_workspace_primitive.js";
+import { queueTargetRepoSchema } from "./db/migrations/039_queue_target_repo.js";
+// Slice 11 (release-0.3.1 workflow-spec-folder-discovery) — adds
+// status + error_message columns to workflow_specs so the scanner
+// can record diagnostic rows. SC-29 #10 declared verbatim in commit body.
+import { workflowSpecsDiagnosticSchema } from "./db/migrations/040_workflow_specs_diagnostic.js";
+import { MissionControlActionLog } from "./domain/mission-control/mission-control-action-log.js";
+import { MissionControlWriteContract } from "./domain/mission-control/mission-control-write-contract.js";
+import { MissionControlReadLayer } from "./domain/mission-control/mission-control-read-layer.js";
+import { MissionControlFleetCliCapability, makeLocalCliCapabilityProbe, } from "./domain/mission-control/mission-control-fleet-cli-capability.js";
+import { MissionControlAuditBrowse } from "./domain/mission-control/audit-browse.js";
+import { MissionControlNotificationDispatcher } from "./domain/mission-control/notification-dispatcher.js";
+import { NtfyNotificationAdapter } from "./domain/mission-control/notification-adapter-ntfy.js";
+import { WebhookNotificationAdapter } from "./domain/mission-control/notification-adapter-webhook.js";
 import { OPENRIG_HOME } from "./openrig-compat.js";
 import { getCompatibleOpenRigPath, getDefaultOpenRigPath, readOpenRigEnv, } from "./openrig-compat.js";
+const KNOWN_PROVIDER_AUTH_ENV = new Set([
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "OPENAI_BASE_URL",
+    "OPENAI_ORG_ID",
+    "OPENAI_PROJECT_ID",
+]);
+export function collectAllowlistedProviderAuthEnv(raw, env) {
+    const out = {};
+    for (const item of (raw ?? "").split(",")) {
+        const name = item.trim();
+        if (!name)
+            continue;
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(name))
+            continue;
+        if (!KNOWN_PROVIDER_AUTH_ENV.has(name))
+            continue;
+        const value = env[name];
+        if (typeof value === "string" && value.length > 0) {
+            out[name] = value;
+        }
+    }
+    return out;
+}
 export async function createDaemon(opts) {
     const dbPath = opts?.dbPath ?? ":memory:";
     const db = createDb(dbPath);
-    migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, inboxEntriesSchema, outboxEntriesSchema, projectClassificationsSchema, classifierLeasesSchema, viewsCustomSchema, watchdogJobsSchema, watchdogHistorySchema, workflowSpecsSchema, workflowInstancesSchema, workflowStepTrailsSchema, watchdogPolicyEnumExtensionSchema]);
+    migrate(db, [coreSchema, bindingsSessionsSchema, eventsSchema, snapshotsSchema, checkpointsSchema, resumeMetadataSchema, nodeSpecFieldsSchema, packagesSchema, installJournalSchema, journalSeqSchema, bootstrapSchema, discoverySchema, discoveryFkFix, agentspecRebootSchema, startupContextSchema, chatMessagesSchema, podNamespaceSchema, contextUsageSchema, externalCliAttachmentSchema, rigServicesSchema, seatHandoverObservabilitySchema, nodeCodexConfigProfileSchema, streamItemsSchema, queueItemsSchema, queueTransitionsSchema, inboxEntriesSchema, outboxEntriesSchema, projectClassificationsSchema, classifierLeasesSchema, viewsCustomSchema, watchdogJobsSchema, watchdogHistorySchema, workflowSpecsSchema, workflowInstancesSchema, workflowStepTrailsSchema, watchdogPolicyEnumExtensionSchema, missionControlActionsSchema, workspacePrimitiveSchema, queueTargetRepoSchema, workflowSpecsDiagnosticSchema]);
     const rigRepo = new RigRepository(db);
     const sessionRegistry = new SessionRegistry(db);
     const eventBus = new EventBus(db);
@@ -124,7 +173,12 @@ export async function createDaemon(opts) {
     // Reject `<member>@<unknown-rig>` shapes by checking the rig portion
     // against the rig registry. Bare ids without `@` are also rejected
     // (no canonical rig binding).
+    const isHumanSeatSessionRef = (sessionRef) => {
+        return /^human(?:-[A-Za-z0-9._-]+)?@(kernel|host)$/.test(sessionRef);
+    };
     const topologyValidateRig = (sessionRef) => {
+        if (isHumanSeatSessionRef(sessionRef))
+            return true;
         const m = /^[^@]+@(.+)$/.exec(sessionRef);
         if (!m)
             return false;
@@ -167,6 +221,8 @@ export async function createDaemon(opts) {
     const activityHookUrl = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL") || undefined;
     const openRigPort = readOpenRigEnv("OPENRIG_PORT", "RIGGED_PORT") || undefined;
     const openRigHost = readOpenRigEnv("OPENRIG_HOST", "RIGGED_HOST") || undefined;
+    const startupSettings = new ContextPackSettingsStore().resolveConfig();
+    const providerAuthEnv = collectAllowlistedProviderAuthEnv(startupSettings.recoveryProviderAuthEnvAllowlistRaw, process.env);
     const transcriptStore = new TranscriptStore({
         enabled: transcriptsEnabled,
         transcriptsRoot: transcriptsPath,
@@ -185,6 +241,7 @@ export async function createDaemon(opts) {
             OPENRIG_HOST: openRigHost,
             OPENRIG_URL: activityHookUrl,
             OPENRIG_ACTIVITY_HOOK_TOKEN: activityHookToken,
+            ...providerAuthEnv,
         },
     });
     const snapshotRepo = new SnapshotRepository(db);
@@ -297,25 +354,161 @@ export async function createDaemon(opts) {
     const { ClaudeCodeAdapter } = await import("./adapters/claude-code-adapter.js");
     const { CodexRuntimeAdapter } = await import("./adapters/codex-runtime-adapter.js");
     const startupOrchestrator = new StartupOrchestrator({ db, sessionRegistry, eventBus, tmuxAdapter, readFile: (p) => fs.readFileSync(p, "utf-8") });
-    const activityHookRelayAssetPath = nodePath.resolve(import.meta.dirname, "../assets/openrig-activity-hook-relay.cjs");
+    const runtimeSettings = new ContextPackSettingsStore().resolveConfig();
     const claudeAdapter = new ClaudeCodeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), copyFile: (src, dest) => fs.copyFileSync(src, dest), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), activityHookRelayAssetPath });
+            } } w(dir, ""); return r; }, readdir: (dir) => fs.readdirSync(dir), homedir: os.homedir() }, stateDir: OPENRIG_HOME, collectorAssetPath: nodePath.resolve(import.meta.dirname, "../assets/claude-statusline-context.cjs"), autoDriveProviderPrompts: runtimeSettings.recoveryAutoDriveProviderPrompts });
     const codexAdapter = new CodexRuntimeAdapter({ tmux: tmuxAdapter, fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"), exists: (p) => fs.existsSync(p), mkdirp: (p) => fs.mkdirSync(p, { recursive: true }), listFiles: (dir) => { const r = []; function w(d, pre) { for (const e of fs.readdirSync(d, { withFileTypes: true })) {
                 if (e.isDirectory())
                     w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
                 else
                     r.push(pre ? nodePath.join(pre, e.name) : e.name);
-            } } w(dir, ""); return r; } }, activityHookRelayAssetPath });
+            } } w(dir, ""); return r; }, homedir: os.homedir() } });
+    // plugin-primitive Phase 3a slice 3.5 — ensure Codex feature flag
+    // codex_hooks = true is set in ~/.codex/config.toml so plugin-shipped
+    // hooks fire on Codex runtime. Slice 27 also creates the default
+    // user-owned Claude compaction extra-instructions placeholder.
+    // Operator can disable Codex hooks via OPENRIG_RUNTIME_CODEX_HOOKS_ENABLED
+    // or rig config set runtime.codex.hooks_enabled false.
+    try {
+        const { SettingsStore, ensureDefaultClaudeCompactionFiles, } = await import("./domain/user-settings/settings-store.js");
+        ensureDefaultClaudeCompactionFiles(OPENRIG_HOME);
+        const settingsStore = new SettingsStore();
+        const enabled = settingsStore.resolveOne("runtime.codex.hooks_enabled").value;
+        codexAdapter.ensureCodexFeatureFlag(enabled);
+    }
+    catch (err) {
+        console.error(`[openrig] runtime setup warning: ${err.message}`);
+    }
+    // plugin-primitive Phase 3a slice 3.2 — vendor openrig-core plugin to
+    // ~/.openrig/plugins/openrig-core/ on first launch. Auto-fetch from
+    // github.com/mvschwarz/openrig-plugins is best-effort + 404-tolerant
+    // (repo currently empty per founder authorization 2026-05-10; vendored
+    // copy is the source of truth at v0).
+    try {
+        const { PluginVendorService } = await import("./domain/plugin-vendor-service.js");
+        const vendoredAssetsDir = nodePath.resolve(import.meta.dirname, "../assets/plugins");
+        const userPluginsDir = getDefaultOpenRigPath("plugins");
+        const realFs = {
+            readFile: (p) => fs.readFileSync(p, "utf-8"),
+            writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
+            exists: (p) => fs.existsSync(p),
+            mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+            listFiles: (dir) => {
+                const r = [];
+                function w(d, pre) {
+                    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+                        if (e.isDirectory())
+                            w(nodePath.join(d, e.name), nodePath.join(pre, e.name));
+                        else
+                            r.push(pre ? nodePath.join(pre, e.name) : e.name);
+                    }
+                }
+                w(dir, "");
+                return r;
+            },
+        };
+        const httpClient = async (url, opts) => {
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), opts?.timeoutMs ?? 5000);
+            try {
+                const resp = await fetch(url, { signal: ctrl.signal });
+                return { ok: resp.ok, status: resp.status };
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        };
+        const vendorService = new PluginVendorService({
+            vendoredAssetsDir,
+            userPluginsDir,
+            fs: realFs,
+            httpClient,
+            logger: (...args) => console.log("[openrig]", ...args),
+        });
+        await vendorService.ensureLatest("openrig-core");
+    }
+    catch (err) {
+        console.error(`[openrig] plugin vendor setup warning: ${err.message}`);
+    }
+    // PL-014 Item 6: hoist ContextPackLibraryService construction so the
+    // PodRigInstantiator can resolve `kind: context_pack` startup_files
+    // entries at materialize time. Same instance is returned to deps
+    // below so /api/context-packs/* shares it.
+    const contextPackLibrary = (() => {
+        const userPacksRoot = getDefaultOpenRigPath("context-packs");
+        try {
+            fs.mkdirSync(userPacksRoot, { recursive: true });
+        }
+        catch { /* best-effort */ }
+        const roots = [
+            { path: userPacksRoot, sourceType: "user_file" },
+        ];
+        try {
+            const settingsStore = new ContextPackSettingsStore();
+            const cfg = settingsStore.resolveConfig();
+            const workspacePacksRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "context-packs");
+            if (workspacePacksRoot !== userPacksRoot && fs.existsSync(workspacePacksRoot)) {
+                roots.push({ path: workspacePacksRoot, sourceType: "workspace" });
+            }
+        }
+        catch { /* settings unavailable; fall through with user-file root only */ }
+        const builtinPacksRoot = nodePath.resolve(import.meta.dirname, "../context-packs");
+        if (fs.existsSync(builtinPacksRoot)) {
+            roots.unshift({ path: builtinPacksRoot, sourceType: "builtin" });
+        }
+        const lib = new ContextPackLibraryService({ roots });
+        lib.scan();
+        return lib;
+    })();
+    // PL-016 Item 2 + Item 4: hoist AgentImageLibraryService construction
+    // so the PodRigInstantiator can resolve `session_source: mode:
+    // agent_image` at materialize time. Same instance returned to deps
+    // below so /api/agent-images/* + the SnapshotCapturer share it.
+    const agentImageRootBuilder = () => {
+        const userImagesRoot = getDefaultOpenRigPath("agent-images");
+        try {
+            fs.mkdirSync(userImagesRoot, { recursive: true });
+        }
+        catch { /* best-effort */ }
+        const roots = [
+            { path: userImagesRoot, sourceType: "user_file" },
+        ];
+        try {
+            const settingsStore = new ContextPackSettingsStore();
+            const cfg = settingsStore.resolveConfig();
+            const workspaceImagesRoot = nodePath.join(cfg.workspaceRoot, ".openrig", "agent-images");
+            if (workspaceImagesRoot !== userImagesRoot && fs.existsSync(workspaceImagesRoot)) {
+                roots.push({ path: workspaceImagesRoot, sourceType: "workspace" });
+            }
+        }
+        catch { /* settings unavailable */ }
+        return { userImagesRoot, roots };
+    };
+    const agentImageLibrary = (() => {
+        const { roots } = agentImageRootBuilder();
+        const lib = new AgentImageLibraryService({ roots });
+        lib.scan();
+        return lib;
+    })();
+    const snapshotCapturer = new SnapshotCapturer({
+        db,
+        rigRepo,
+        sessionRegistry,
+        agentImageLibrary,
+        targetRoot: getDefaultOpenRigPath("agent-images"),
+    });
     const podInstantiator = new PodRigInstantiator({
         db, rigRepo, podRepo,
         sessionRegistry, eventBus, nodeLauncher, startupOrchestrator,
         fsOps: { readFile: (p) => fs.readFileSync(p, "utf-8"), exists: (p) => fs.existsSync(p) },
         adapters: { "claude-code": claudeAdapter, "codex": codexAdapter, "terminal": new (await import("./adapters/terminal-adapter.js")).TerminalAdapter() },
         tmuxAdapter,
+        contextPackLibrary,
+        agentImageLibrary,
     });
     const podBundleSourceResolver = new PodBundleSourceResolver();
     const bootstrapOrchestrator = new BootstrapOrchestrator({
@@ -325,6 +518,55 @@ export async function createDaemon(opts) {
         bundleSourceResolver, podInstantiator, podBundleSourceResolver,
         serviceOrchestrator, rigRepo,
     });
+    // V0.3.1 slice 05 kernel-rig-as-default — auto-boot the kernel rig
+    // on daemon-start. Forward-fix #3 architectural: the bootstrap is
+    // FIRED in the background, not awaited. createDaemon completes as
+    // soon as the tracker is created so server.ts can bind healthz
+    // independent of kernel-agent readiness. A broken kernel agent no
+    // longer keeps the daemon HTTP surface from starting.
+    //
+    // Tracker state is exposed via /api/kernel/status (route below) and
+    // the CLI's `rig daemon start --wait-for-kernel` flag polls it.
+    // After the configurable degraded-timer window (default 90s; env
+    // override OPENRIG_KERNEL_DEGRADED_MS for ops + test fixtures), the
+    // tracker emits a single `kernel.agent.degraded` event for
+    // observability. The kernel rig is still the only rig the daemon
+    // auto-boots; other rigs require explicit operator-initiated
+    // `rig up` / `rig restore` per amended IMPL-PRD §16.2.
+    let kernelBootTracker;
+    try {
+        const { bootKernelIfNeeded } = await import("./domain/kernel-boot.js");
+        const degradedRaw = readOpenRigEnv("OPENRIG_KERNEL_DEGRADED_MS");
+        const degradedTimeoutMs = degradedRaw && /^\d+$/.test(degradedRaw)
+            ? parseInt(degradedRaw, 10)
+            : undefined;
+        kernelBootTracker = await bootKernelIfNeeded({
+            rigRepo,
+            sessionRegistry,
+            eventBus,
+            bootstrapOrchestrator,
+            specsDir: nodePath.resolve(nodePath.dirname(new URL(import.meta.url).pathname), "..", "specs"),
+            // V0.3.1 slice 05 — kernel members run against the operator's
+            // workspace, not the daemon installation tree. Without this
+            // cwdOverride, BootstrapOrchestrator refuses with
+            // "cwd is inside the OpenRig installation". Use the resolved
+            // workspace.root setting as the per-operator default.
+            cwdOverride: runtimeSettings.workspaceRoot,
+            degradedTimeoutMs,
+        });
+        try {
+            // eslint-disable-next-line no-console
+            console.log(`kernel-boot: tracker-state=${kernelBootTracker.getStatus().kernelState}`);
+        }
+        catch { /* logging must never throw */ }
+    }
+    catch (err) {
+        try {
+            // eslint-disable-next-line no-console
+            console.warn(`kernel-boot: skipped due to error: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        catch { /* logging must never throw */ }
+    }
     // Discovery services
     const tmuxScanner = new TmuxDiscoveryScanner({ tmuxAdapter });
     const sessionFingerprinter = new SessionFingerprinter({
@@ -470,6 +712,7 @@ export async function createDaemon(opts) {
         contextUsageStore,
         serviceOrchestrator,
         composeAdapter,
+        kernelBootTracker,
         specReviewService,
         specLibraryService: (() => {
             const userSpecsRoot = getDefaultOpenRigPath("specs");
@@ -494,6 +737,56 @@ export async function createDaemon(opts) {
             lib.scan();
             return lib;
         })(),
+        // Phase 3a slice 3.3 — plugin discovery service.
+        // SC-29 EXCEPTION #8 verbatim: see packages/daemon/src/routes/plugins.ts
+        // header. Filesystem-scan over 3 source roots + agent.yaml-parse for
+        // used-by reverse query. No SQL; no mutation. Spec library directory
+        // for used-by uses the same default user spec root as SpecLibraryService
+        // above; one root at v0 (multi-root expansion deferred to a later slice
+        // when spec library hooks its full root list through to discovery).
+        // bug-fix slice plugin-discovery-respects-openrig-home: route the
+        // openrigPluginsDir through the OPENRIG_HOME-aware resolver so
+        // discovery + vendor (which already uses the helper at line 428)
+        // resolve to the same root. Operator-level test isolation + the
+        // slice 22 populated-VM-env story both depend on this symmetry.
+        // claudeCacheDir / codexCacheDir remain homedir-anchored because
+        // those cache locations belong to the runtime tools, not to the
+        // OpenRig state root.
+        pluginDiscoveryService: new PluginDiscoveryService({
+            openrigPluginsDir: getDefaultOpenRigPath("plugins"),
+            claudeCacheDir: nodePath.join(os.homedir(), ".claude", "plugins", "cache"),
+            codexCacheDir: nodePath.join(os.homedir(), ".codex", "plugins", "cache"),
+            specLibraryDir: getDefaultOpenRigPath("specs"),
+        }),
+        // Slice 28 Checkpoint C-3 — skillLibraryDiscoveryService is constructed
+        // AFTER filesAllowlist resolution below (deps.skillLibraryDiscoveryService
+        // assignment near filesAllowlist binding).
+        // PL-014 Item 6: same instance hoisted earlier so the
+        // PodRigInstantiator can resolve `kind: context_pack` startup_files
+        // entries — sharing the cache means /api/context-packs/* + the
+        // instantiator see consistent state.
+        contextPackLibrary,
+        // PL-016 — agent_image typed primitive. Shared library + capturer
+        // + spec-roots supplier across /api/agent-images/* and the
+        // PodRigInstantiator's session_source: mode: agent_image dispatch.
+        agentImageLibrary,
+        snapshotCapturer,
+        agentImageSpecRoots: () => {
+            // Spec-library roots scanned by the evidence guard. v0: user
+            // specs under ~/.openrig/specs + workspace-local specs root
+            // (from the SettingsStore-resolved workspace.specsRoot).
+            const userSpecsRoot = getDefaultOpenRigPath("specs");
+            const roots = [userSpecsRoot];
+            try {
+                const settingsStore = new ContextPackSettingsStore();
+                const cfg = settingsStore.resolveConfig();
+                if (cfg.workspaceSpecsRoot && cfg.workspaceSpecsRoot !== userSpecsRoot) {
+                    roots.push(cfg.workspaceSpecsRoot);
+                }
+            }
+            catch { /* settings unavailable */ }
+            return roots;
+        },
     };
     // Copy bundled reference docs to ~/.openrig/reference/ so agents can find them at a stable path
     try {
@@ -528,6 +821,278 @@ export async function createDaemon(opts) {
             queueRepo: queueRepoForWorkflow,
         });
         deps.workflowRuntime = workflowRuntime;
+        // Seed built-in starter workflow_specs into the cache. Idempotent
+        // + workspace-surface-respecting — operator
+        // overrides at workspace paths are preserved (skip-if-cached).
+        // Errors are collected into the result for diagnostic logging but
+        // do NOT block startup; a malformed bundled spec should not bring
+        // the daemon down.
+        const { loadStarterWorkflowSpecs, defaultBuiltinSpecsDir } = await import("./domain/workflow/starter-spec-loader.js");
+        const builtinSpecsDir = defaultBuiltinSpecsDir();
+        const starterResult = loadStarterWorkflowSpecs({
+            cache: workflowRuntime.specCache,
+            builtinDir: builtinSpecsDir,
+        });
+        // Surface the resolved path to the routes layer so
+        // GET /api/workflow/specs can compute the per-row isBuiltIn flag.
+        deps.workflowBuiltinSpecsDir = builtinSpecsDir;
+        // Slice 11 (workflow-spec-folder-discovery) — expose the shared
+        // WorkflowSpecCache + the resolved workspace workflows folder so
+        // GET /api/specs/library can opportunistically discover operator-
+        // dropped YAML on each list request. Folder path is
+        // `<workspace.specs_root>/workflows`; SettingsStore resolves
+        // workspaceSpecsRoot from env > config > workspace-default.
+        deps.workflowSpecCache = workflowRuntime.specCache;
+        try {
+            const settingsStore = new ContextPackSettingsStore();
+            const cfg = settingsStore.resolveConfig();
+            if (cfg.workspaceSpecsRoot) {
+                deps.workflowsFolderDir = nodePath.join(cfg.workspaceSpecsRoot, "workflows");
+            }
+        }
+        catch { /* settings unavailable — folder scan stays disabled */ }
+        if (starterResult.errors.length > 0) {
+            console.warn(`[starter-spec-loader] ${starterResult.errors.length} spec(s) failed to load:`, starterResult.errors);
+        }
+    }
+    // PL-005 Phase A: Mission Control / Queue Observability services.
+    // Wired AFTER WorkflowRuntime so all PL-004 daemon-backed coordination
+    // surfaces are available. Mission Control reads from queue/view/stream
+    // surfaces and writes through the atomic 7-verb contract.
+    if (deps.queueRepo && deps.viewProjector) {
+        const mcActionLog = new MissionControlActionLog(db);
+        const mcWriteContract = new MissionControlWriteContract({
+            db,
+            eventBus,
+            queueRepo: deps.queueRepo,
+            actionLog: mcActionLog,
+        });
+        const mcFleetCliCapability = new MissionControlFleetCliCapability({
+            db,
+            eventBus,
+            rigRepo,
+            // R1 fix per guard PL-005 Phase A review: wire the production
+            // capability probe so /api/mission-control/cli-capabilities
+            // honestly reports drift when MISSION_CONTROL_DESIRED_FIELDS
+            // are missing from the local CLI's allow-list. Without this
+            // probe injection, the production path defaulted to a no-op
+            // that always reported staleCliCount=0 even when the audit-
+            // row-5 case (recoveryGuidance not in CLI allow-list) was
+            // present.
+            probeRig: makeLocalCliCapabilityProbe(),
+        });
+        // V0.3.1 slice 05 kernel-rig-as-default — cascade the resolved
+        // workspace.operator_seat_name setting into the mission-control
+        // read layer so my-queue routes to the operator's configured seat
+        // (default `operator-${USER}@kernel`) instead of the legacy
+        // hardcoded constant. The setting reads OPENRIG_WORKSPACE_OPERATOR_SEAT_NAME
+        // env var first, then ~/.openrig/config.json, then the derived
+        // default — same cascade as every other typed setting.
+        const mcReadLayer = new MissionControlReadLayer({
+            db,
+            queueRepo: deps.queueRepo,
+            viewProjector: deps.viewProjector,
+            streamStore: deps.streamStore,
+            fleetCliCapability: mcFleetCliCapability,
+            defaultOperatorSession: runtimeSettings.workspaceOperatorSeatName,
+        });
+        deps.missionControlActionLog = mcActionLog;
+        deps.missionControlWriteContract = mcWriteContract;
+        deps.missionControlFleetCliCapability = mcFleetCliCapability;
+        deps.missionControlReadLayer = mcReadLayer;
+        // PL-005 Phase B: audit-history browse layer (read-only) +
+        // notification dispatcher + bearer-token plumbing.
+        const mcAuditBrowse = new MissionControlAuditBrowse(db);
+        deps.missionControlAuditBrowse = mcAuditBrowse;
+        // Bearer token from createDaemon options is propagated to the
+        // routes constructor via deps so the auth middleware is mounted
+        // at route mount time (not per-request).
+        deps.missionControlBearerToken = opts?.bearerToken ?? null;
+        // Notification dispatcher: chosen mechanism via env config.
+        // OPENRIG_NOTIFICATIONS_MECHANISM=ntfy|webhook|none (default none).
+        // OPENRIG_NOTIFICATIONS_TARGET=<topic url | webhook url>.
+        // OPENRIG_NOTIFICATIONS_INCLUDE_VERB_COMPLETION=1 to opt into the
+        // verb-completion trigger (default off; only human-gate arrivals
+        // trigger by default per planner brief).
+        // No legacy alias for these env vars (new in Phase B).
+        const mechanism = process.env.OPENRIG_NOTIFICATIONS_MECHANISM ?? "none";
+        const target = process.env.OPENRIG_NOTIFICATIONS_TARGET ?? "";
+        const missionControlBaseUrl = process.env.OPENRIG_MISSION_CONTROL_BASE_URL ??
+            process.env.OPENRIG_URL ??
+            process.env.RIGGED_URL;
+        const includeVerbCompletion = process.env.OPENRIG_NOTIFICATIONS_INCLUDE_VERB_COMPLETION === "1";
+        if (mechanism !== "none" && target.length > 0) {
+            let adapter;
+            if (mechanism === "ntfy") {
+                adapter = new NtfyNotificationAdapter({ topicUrl: target });
+            }
+            else if (mechanism === "webhook") {
+                adapter = new WebhookNotificationAdapter({ endpointUrl: target });
+            }
+            else {
+                throw new Error(`OPENRIG_NOTIFICATIONS_MECHANISM='${mechanism}' is not recognized; supported: ntfy | webhook | none`);
+            }
+            const dispatcher = new MissionControlNotificationDispatcher({
+                db,
+                eventBus,
+                adapter,
+                includeVerbCompletion,
+                missionControlBaseUrl,
+            });
+            dispatcher.start();
+            deps.missionControlNotificationDispatcher = dispatcher;
+        }
+    }
+    // Slice Story View v0 — slice indexer + per-tab projector.
+    //
+    // User Settings v0 graduates `OPENRIG_SLICES_ROOT` env-var into the
+    // typed `workspace.slices_root` setting (resolution chain: env >
+    // config-file > default `<workspace.root>/missions`). Backward-compat:
+    // operators with OPENRIG_SLICES_ROOT set continue to work because the
+    // settings store reads env in the same resolution slot. Operators
+    // setting via `rig config set workspace.slices_root <path>` or via the
+    // System drawer Settings panel UI now flow through the indexer too —
+    // closes the PRD § Scenario B requirement that wasn't wired in v0.
+    //
+    //   OPENRIG_SLICES_ROOT             legacy short env var (still honored
+    //                                   if set; preferred route is settings)
+    //   OPENRIG_WORKSPACE_SLICES_ROOT   typed-key env override
+    //   workspace.slices_root           typed setting in ~/.openrig/config.json
+    //   workspace.root                  cascade fallback (default ~/.openrig/workspace)
+    //   workspace.dogfood_evidence_root typed setting for proof packet assets
+    //   OPENRIG_DOGFOOD_EVIDENCE_ROOT   env override for compatibility
+    //
+    // When the resolved slicesRoot path doesn't exist on disk, the indexer
+    // is still constructed but isReady() returns false — the routes return
+    // a clear "slices_root_not_configured" 503 with a setup hint.
+    {
+        // Prefer the legacy short env var if explicitly set (existing
+        // dogfood / test daemons rely on it). Otherwise fall back to the
+        // settings-resolved path (env > file > default cascade inside
+        // SettingsStore). The SettingsStore is constructed locally here
+        // so the slices block doesn't depend on the User Settings v0 wiring
+        // block ordering further below.
+        const legacyEnvSlicesRoot = readOpenRigEnv("OPENRIG_SLICES_ROOT", "RIGGED_SLICES_ROOT") ?? "";
+        let resolvedSlicesRoot = "";
+        let resolvedWorkspaceRoot = "";
+        let resolvedDogfoodRoot = "";
+        if (!legacyEnvSlicesRoot) {
+            try {
+                const { SettingsStore: SettingsStoreCtor } = await import("./domain/user-settings/settings-store.js");
+                const resolvedConfig = new SettingsStoreCtor().resolveConfig();
+                resolvedSlicesRoot = resolvedConfig.workspaceSlicesRoot;
+                resolvedWorkspaceRoot = resolvedConfig.workspaceRoot;
+                resolvedDogfoodRoot = resolvedConfig.workspaceDogfoodEvidenceRoot;
+            }
+            catch {
+                // SettingsStore unavailable — keep slicesRoot empty; routes return 503.
+            }
+        }
+        else {
+            try {
+                const { SettingsStore: SettingsStoreCtor } = await import("./domain/user-settings/settings-store.js");
+                const resolvedConfig = new SettingsStoreCtor().resolveConfig();
+                resolvedDogfoodRoot = resolvedConfig.workspaceDogfoodEvidenceRoot;
+            }
+            catch {
+                // SettingsStore unavailable — proof packets remain disabled.
+            }
+        }
+        const slicesRoot = legacyEnvSlicesRoot || resolvedSlicesRoot;
+        const additionalSliceRoots = resolvedWorkspaceRoot
+            ? [
+                nodePath.join(resolvedWorkspaceRoot, "missions"),
+                nodePath.join(resolvedWorkspaceRoot, "slices"),
+            ].filter((root) => root !== slicesRoot)
+            : [];
+        const { SliceIndexer } = await import("./domain/slices/slice-indexer.js");
+        const { SliceDetailProjector } = await import("./domain/slices/slice-detail-projector.js");
+        const sliceIndexer = new SliceIndexer({
+            slicesRoot,
+            additionalSliceRoots,
+            dogfoodEvidenceRoot: resolvedDogfoodRoot || null,
+            db,
+        });
+        // Slice Story View v1: pass workflowRuntime.specCache so the
+        // projector can resolve a bound workflow_instance's spec for
+        // spec-graph + phase + current-step projection. When the workflow
+        // runtime is not constructed (queueRepo absent — same condition
+        // already guards the workflowRuntime block above), the projector
+        // silently degrades to v0 behavior (workflowBinding=null,
+        // specGraph=null, phaseDefinitions=null, currentStep=null).
+        const sliceDetailProjector = new SliceDetailProjector({
+            db,
+            indexer: sliceIndexer,
+            workflowSpecCache: workflowRuntime?.specCache,
+        });
+        deps.sliceIndexer = sliceIndexer;
+        deps.sliceDetailProjector = sliceDetailProjector;
+    }
+    // UI Enhancement Pack v0:
+    //   - file allowlist (item 3) from OPENRIG_FILES_ALLOWLIST
+    //   - atomic write service (item 4) wired only when allowlist non-empty
+    //   - progress scan-roots (item 1B) from OPENRIG_PROGRESS_SCAN_ROOTS
+    //
+    // Empty env → empty allowlist / no-roots indexer; routes return 503
+    // with structured config hints so the UI can surface a setup message
+    // instead of a generic error.
+    {
+        const { decodeAllowlist } = await import("./domain/files/path-safety.js");
+        const { FileWriteService } = await import("./domain/files/file-write-service.js");
+        const { ProgressIndexer, decodeProgressScanRoots } = await import("./domain/progress/progress-indexer.js");
+        // User Settings v0 — UEP env-vars graduated to typed settings.
+        // Resolution: env > settings file > empty. SettingsStore handles
+        // the env > file > default precedence; we just decode the raw
+        // string into structured roots.
+        const { SettingsStore } = await import("./domain/user-settings/settings-store.js");
+        const settingsStore = new SettingsStore();
+        deps.settingsStore = settingsStore;
+        const cfg = settingsStore.resolveConfig();
+        // Preview Terminal v0 (PL-018) — per-session rate limiter for the
+        // /preview route. 1-second window per (session, lines) cache key:
+        // short enough that legitimate polling at the operator's refresh
+        // interval (`ui.preview.refresh_interval_seconds`, default 3s) always
+        // sees fresh content, but multiple pinned-pane requests for the same
+        // seat within a single second collapse to one tmux capture.
+        const { PreviewRateLimiter } = await import("./domain/preview/preview-rate-limiter.js");
+        deps.previewRateLimiter = new PreviewRateLimiter(1000);
+        const filesAllowlist = decodeAllowlist(cfg.filesAllowlistRaw);
+        deps.filesAllowlist = filesAllowlist;
+        deps.fileWriteService = filesAllowlist.length > 0
+            ? new FileWriteService({
+                allowlist: filesAllowlist,
+                auditFilePath: nodePath.join(OPENRIG_HOME, "file-edit-audit.jsonl"),
+            })
+            : null;
+        // Slice 28 Checkpoint C-3 — SkillLibraryDiscoveryService. sharedSkillsDir
+        // resolves to the daemon's bundled `specs/agents/shared/skills/`
+        // directory via import.meta.url (independent of operator allowlist
+        // configuration; closes HG-5 on the founder-walk VM where the operator
+        // allowlist doesn't include the daemon source tree). filesAllowlist
+        // is also passed so workspace `.openrig/skills/` skills surface via
+        // the same daemon endpoint.
+        deps.skillLibraryDiscoveryService = new SkillLibraryDiscoveryService({
+            sharedSkillsDir: nodePath.resolve(nodePath.dirname(new URL(import.meta.url).pathname), "..", "specs", "agents", "shared", "skills"),
+            filesAllowlist,
+        });
+        deps.progressIndexer = new ProgressIndexer({ roots: decodeProgressScanRoots(cfg.progressScanRootsRaw) });
+        // Operator Surface Reconciliation v0 — steering composer (item 1).
+        // Reads typed workspace settings by default while preserving the
+        // OPENRIG_STEERING_* env override family for non-canonical layouts.
+        const { SteeringComposer, steeringOptsFromSettings } = await import("./domain/steering/steering-composer.js");
+        deps.steeringComposer = new SteeringComposer(steeringOptsFromSettings({
+            workspaceRoot: cfg.workspaceRoot,
+            workspaceSteeringPath: cfg.workspaceSteeringPath,
+        }));
+        // Workflows in Spec Library + Activation Lens v0 — active lens
+        // persistence under OPENRIG_HOME/active-workflow-lens.json. Same
+        // file-backed pattern as UI Enhancement Pack v0's audit JSONL —
+        // honors OPENRIG_HOME so isolated test/dogfood daemons keep their
+        // own lens state instead of bleeding into the operator's host.
+        const { ActiveLensStore } = await import("./domain/active-lens-store.js");
+        deps.activeLensStore = new ActiveLensStore({
+            filePath: nodePath.join(OPENRIG_HOME, "active-workflow-lens.json"),
+        });
     }
     const sessionTransport = deps.sessionTransport;
     if (sessionTransport) {
@@ -559,8 +1124,15 @@ export async function createDaemon(opts) {
     }
     // Context monitor — constructed before createApp so routes can access pollOnce for refresh.
     // Caller (index.ts) starts polling after listen.
+    // Slice 27: wire ClaudeCompactionEnforcer when sessionTransport is
+    // available (it always is in the assembled deps; the conditional keeps
+    // the type narrow for downstream consumers).
     const { ContextMonitor } = await import("./domain/context-monitor.js");
-    const contextMonitor = new ContextMonitor(db, contextUsageStore, claudeAdapter);
+    const { ClaudeCompactionEnforcer } = await import("./domain/claude-compaction-enforcer.js");
+    const compactionEnforcer = deps.sessionTransport
+        ? new ClaudeCompactionEnforcer(new ContextPackSettingsStore(), deps.sessionTransport)
+        : undefined;
+    const contextMonitor = new ContextMonitor(db, contextUsageStore, claudeAdapter, compactionEnforcer);
     deps.contextMonitor = contextMonitor;
     const app = createApp(deps);
     return { app, db, deps, contextMonitor };