@openrig/cli 0.3.1 → 0.3.2

package/daemon/dist/routes/bundles.js

@@ -5,18 +5,218 @@ import { Hono } from "hono";
 import { LegacyBundleAssembler as BundleAssembler } from "../domain/bundle-assembler.js";
 import { PodBundleAssembler } from "../domain/pod-bundle-assembler.js";
 import { computeIntegrity, writeIntegrity, verifyIntegrity } from "../domain/bundle-integrity.js";
-import { pack, verifyArchiveDigest } from "../domain/bundle-archive.js";
+import { pack, unpack, verifyArchiveDigest } from "../domain/bundle-archive.js";
 import { resolvePackage } from "../domain/package-resolve-helper.js";
 import { LegacyRigSpecSchema } from "../domain/rigspec-schema.js";
 import { RigSpecCodec } from "../domain/rigspec-codec.js";
 import { RigSpecSchema } from "../domain/rigspec-schema.js";
-import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest, serializePodBundleManifest, parsePodBundleManifest, validatePodBundleManifest } from "../domain/bundle-types.js";
+import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest, serializePodBundleManifest, parsePodBundleManifest, validatePodBundleManifest, validateLegacyBundleManifest, normalizeProvenanceBlock, normalizeCompatibilityBlock, isRelativeSafePath } from "../domain/bundle-types.js";
+import { fileURLToPath } from "node:url";
+import { detectBundleConflicts } from "../domain/bundle-conflict-detector.js";
+import { BundleAuditReader, BundleAuditWriter } from "../domain/bundle-audit.js";
+import { getDefaultOpenRigPath } from "../openrig-compat.js";
+import { routeSkills } from "../domain/bundle-skills-router.js";
+import { routePlugins } from "../domain/bundle-plugins-router.js";
+import { routeWorkflowSpecs } from "../domain/bundle-workflow-specs-router.js";
+import { routeContextPacks } from "../domain/bundle-context-packs-router.js";
+import { routeAgentImages } from "../domain/bundle-agent-images-router.js";
+import { SettingsStore as ContextPackSettingsStore } from "../domain/user-settings/settings-store.js";
+/**
+ * Read the daemon's own package.json version at call time (Item 1 / slice-05).
+ * Function-level read on purpose: module-level constants would mask test
+ * isolation per the audit-every-layer discipline. The read is cheap and
+ * only happens on bundle create.
+ */
+function getDaemonVersion() {
+    try {
+        const here = fileURLToPath(import.meta.url);
+        const pkgPath = nodePath.join(nodePath.dirname(here), "..", "..", "package.json");
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        return typeof pkg.version === "string" ? pkg.version : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * Compare two dotted numeric version strings (semver-ish). Returns -1 if
+ * a < b, 0 if equal, 1 if a > b. Non-numeric segments coerce to 0. Adequate
+ * for the 0.x.y / 1.x.y range; pre-release / build metadata not interpreted.
+ * Item-2 install-time version check (Checkpoint 3.3).
+ */
+function compareVersions(a, b) {
+    const partsA = a.split(".").map((p) => parseInt(p, 10) || 0);
+    const partsB = b.split(".").map((p) => parseInt(p, 10) || 0);
+    const maxLen = Math.max(partsA.length, partsB.length);
+    for (let i = 0; i < maxLen; i++) {
+        const va = partsA[i] ?? 0;
+        const vb = partsB[i] ?? 0;
+        if (va !== vb)
+            return va < vb ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Run the install-time compatibility check (Item 2 Checkpoint 3.3). Returns
+ * an array of failures (one per kind), or null if all checks pass. Missing
+ * fields in compat are no-ops (daemon-only check when min_cli_version absent;
+ * full pass when both absent). cliVersion undefined skips the CLI check
+ * silently (pre-Item-2 CLIs don't send it; honest backward compat).
+ */
+function checkBundleCompatibility(compat, daemonVersion, cliVersion) {
+    if (!compat)
+        return null;
+    const failures = [];
+    if (compat.minDaemonVersion && compareVersions(daemonVersion, compat.minDaemonVersion) < 0) {
+        failures.push({
+            reason: "daemon_version_mismatch",
+            required: compat.minDaemonVersion,
+            actual: daemonVersion,
+            description: `bundle requires daemon >= ${compat.minDaemonVersion}, current daemon is ${daemonVersion}`,
+        });
+    }
+    if (compat.minCliVersion && cliVersion && compareVersions(cliVersion, compat.minCliVersion) < 0) {
+        failures.push({
+            reason: "cli_version_mismatch",
+            required: compat.minCliVersion,
+            actual: cliVersion,
+            description: `bundle requires CLI >= ${compat.minCliVersion}, current CLI is ${cliVersion}`,
+        });
+    }
+    return failures.length > 0 ? failures : null;
+}
+/**
+ * Extract bundle.yaml manifest from a .rigbundle archive via the canonical
+ * safe-extraction path (unpack from domain/bundle-archive). unpack performs
+ * verifyArchiveDigest, then tar.list pre-scan rejecting symlinks / hardlinks
+ * / absolute paths / dot-dot traversal, then extracts, then verifies content
+ * integrity. Using unpack here keeps the install-time compat check inside the
+ * existing trust boundary — raw tar.extract on an untrusted archive would
+ * bypass the safety prescan (B1 regression fixed). Throws on archive / safety
+ * / parse failures; the caller converts these into a 3-part 400 response.
+ */
+async function extractManifestForCompatCheck(bundlePath) {
+    const meta = await extractInstallTimeMetadata(bundlePath);
+    return meta.bundleManifest;
+}
+/**
+ * Extract both the bundle.yaml manifest AND the rig name from the bundle's
+ * rig.yaml in one safe pass (Item 3 / slice-05 Checkpoint 4.2). The /install
+ * handler uses bundleManifest for the compat check (Item 2) and rigName for
+ * the conflict check (Item 3). Reuses unpack — single trust boundary.
+ */
+async function extractInstallTimeMetadata(bundlePath) {
+    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-meta-"));
+    try {
+        await unpack(bundlePath, tmpDir);
+        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
+        if (!fs.existsSync(manifestPath))
+            throw new Error("Bundle missing bundle.yaml");
+        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
+        const bundleManifest = parsePodBundleManifest(manifestYaml);
+        // B1 safety repair (slice-05 Checkpoint 4.2 / qitem-20260518204906): validate
+        // the parsed manifest BEFORE trusting any of its fields. The validators
+        // reject unsafe rig_spec values (isRelativeSafePath: no absolute, no ../,
+        // no backslash, no empty segments). Schema-version-aware: v2 uses pod-aware
+        // validator; everything else falls back to the v1 legacy validator. This is
+        // the same trust-boundary reuse as the unpack/B1 fix in Item 2.
+        const schemaVersion = bundleManifest["schema_version"];
+        if (schemaVersion === 2) {
+            const v2Validation = validatePodBundleManifest(bundleManifest);
+            if (!v2Validation.valid) {
+                throw new Error(`Invalid v2 bundle manifest: ${v2Validation.errors.join("; ")}`);
+            }
+        }
+        else {
+            const v1Validation = validateLegacyBundleManifest(bundleManifest, { requireIntegrity: false });
+            if (!v1Validation.valid) {
+                throw new Error(`Invalid v1 bundle manifest: ${v1Validation.errors.join("; ")}`);
+            }
+        }
+        // Rig name lives in the bundle's rig.yaml (path referenced by bundle.yaml's
+        // rig_spec field; defaults to rig.yaml for legacy bundles). Read + parse;
+        // missing-or-malformed rig name leaves rigName undefined which the detector
+        // fail-opens on (no rig name to compare).
+        //
+        // B1 safety repair (defense-in-depth alongside the validator above): resolve
+        // rig_spec inside tmpDir and require the result to stay inside tmpDir
+        // before reading, mirroring bundle-source-resolver.ts:60-63. The validator
+        // should have already rejected unsafe rig_spec; this is the second line.
+        let rigName;
+        const rigSpecRel = typeof bundleManifest["rig_spec"] === "string" ? bundleManifest["rig_spec"] : "rig.yaml";
+        const rigSpecPath = nodePath.resolve(tmpDir, rigSpecRel);
+        const tmpDirResolved = nodePath.resolve(tmpDir);
+        if (rigSpecPath !== tmpDirResolved && !rigSpecPath.startsWith(tmpDirResolved + nodePath.sep)) {
+            throw new Error(`Rig spec path '${rigSpecRel}' escapes bundle workspace`);
+        }
+        if (fs.existsSync(rigSpecPath)) {
+            try {
+                const rigYaml = fs.readFileSync(rigSpecPath, "utf-8");
+                const rigParsed = parsePodBundleManifest(rigYaml);
+                if (typeof rigParsed["name"] === "string" && rigParsed["name"].length > 0) {
+                    rigName = rigParsed["name"];
+                }
+            }
+            catch {
+                // rig.yaml malformed — leave rigName undefined; conflict check skips
+            }
+        }
+        return { bundleManifest, rigName };
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Sanitize raw compatibility from request body into a BundleCompatibility
+ * object. Only known typed fields accepted; unknown fields dropped silently.
+ * Returns undefined if input is missing or has no usable fields.
+ */
+function compatibilityFromRequestBody(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const c = raw;
+    const result = {};
+    if (typeof c["minDaemonVersion"] === "string")
+        result.minDaemonVersion = c["minDaemonVersion"];
+    if (typeof c["minCliVersion"] === "string")
+        result.minCliVersion = c["minCliVersion"];
+    if (typeof c["schemaVersion"] === "number")
+        result.schemaVersion = c["schemaVersion"];
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+/**
+ * Normalize raw provenance from request body into a BundleProvenance object.
+ * Only string fields are accepted; unknown/non-string fields are dropped
+ * silently. Returns undefined if the input is missing or has no usable
+ * fields. Daemon-side daemonVersion injection is the caller's responsibility.
+ */
+function provenanceFromRequestBody(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const p = raw;
+    const result = {};
+    if (typeof p["sourceHost"] === "string")
+        result.sourceHost = p["sourceHost"];
+    if (typeof p["authorSession"] === "string")
+        result.authorSession = p["authorSession"];
+    if (typeof p["sourceRigId"] === "string")
+        result.sourceRigId = p["sourceRigId"];
+    if (typeof p["sourceRigName"] === "string")
+        result.sourceRigName = p["sourceRigName"];
+    if (typeof p["cliVersion"] === "string")
+        result.cliVersion = p["cliVersion"];
+    if (typeof p["notes"] === "string")
+        result.notes = p["notes"];
+    return Object.keys(result).length > 0 ? result : undefined;
+}
 export const bundleRoutes = new Hono();
 function getDeps(c) {
     return {
         eventBus: c.get("eventBus"),
         bootstrapOrchestrator: c.get("bootstrapOrchestrator"),
         bootstrapRepo: c.get("bootstrapRepo"),
+        rigRepo: c.get("rigRepo"),
     };
 }
 function realFsOps() {
@@ -64,6 +264,535 @@ function podAssemblerFsOps() {
         listFiles: (dir) => realFsOps().listFiles(dir),
     };
 }
+/** Item 6 / slice-05 Checkpoint 7.3d: real PluginsRouterFsOps backed by node:fs. */
+function pluginsRouterFsOps() {
+    return {
+        exists: (p) => fs.existsSync(p),
+        isDirectory: (p) => { try {
+            return fs.statSync(p).isDirectory();
+        }
+        catch {
+            return false;
+        } },
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+        copyDir: (s, d) => fs.cpSync(s, d, { recursive: true }),
+    };
+}
+/** Item 6 / slice-05 Checkpoint 7.3e step 3: real WorkflowSpecsRouterFsOps backed by node:fs. */
+function workflowSpecsRouterFsOps() {
+    return {
+        exists: (p) => fs.existsSync(p),
+        readFile: (p) => fs.readFileSync(p, "utf-8"),
+        writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+    };
+}
+/** Item 6 / slice-05 Checkpoint 7.3f step 3: real ContextPacksRouterFsOps backed by node:fs. */
+function contextPacksRouterFsOps() {
+    return {
+        exists: (p) => fs.existsSync(p),
+        isDirectory: (p) => { try {
+            return fs.statSync(p).isDirectory();
+        }
+        catch {
+            return false;
+        } },
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+        copyDir: (s, d) => fs.cpSync(s, d, { recursive: true }),
+    };
+}
+/** Item 6 / slice-05 Checkpoint 7.3g step 3: real AgentImagesRouterFsOps backed by node:fs. */
+function agentImagesRouterFsOps() {
+    return {
+        exists: (p) => fs.existsSync(p),
+        isDirectory: (p) => { try {
+            return fs.statSync(p).isDirectory();
+        }
+        catch {
+            return false;
+        } },
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+        copyDir: (s, d) => fs.cpSync(s, d, { recursive: true }),
+    };
+}
+/**
+ * Item 6 / slice-05 Checkpoint 7.3g step 3: extract the bundle safely
+ * (banked unpack trust boundary) and route any declared agent_images to
+ * the operator agent-images library. Returns null when bundle has no
+ * agent_images[] (no-op).
+ *
+ * Target resolution: <openrigHome>/agent-images — per startup.ts:523
+ * (the user-file root the live AgentImageLibraryService is constructed
+ * against). No SettingsStore complexity; canonical path is OPENRIG_HOME-
+ * rooted per agent-image-types.ts:9-10.
+ *
+ * Per the e7a0b253 PRD-coherent contract: agent_images entries are paths
+ * to image DIRECTORIES (not manifest paths — distinct shape from
+ * context_packs). The router enforces sourceAbs isDirectory + manifest.yaml
+ * inside the dir is a file before copying the whole image dir.
+ *
+ * Mirror of routeContextPacksAfterBootstrap pattern with the dir-path
+ * contract adaptation. bundlePath-only signature per 5f410eee B1 lesson.
+ */
+async function routeAgentImagesAfterBootstrap(bundlePath) {
+    const targetAgentImagesDir = getDefaultOpenRigPath("agent-images");
+    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-agent-images-route-"));
+    try {
+        await unpack(bundlePath, tmpDir);
+        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
+        if (!fs.existsSync(manifestPath))
+            return null;
+        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
+        const manifest = parsePodBundleManifest(manifestYaml);
+        const rawAgentImages = manifest["agent_images"];
+        if (!Array.isArray(rawAgentImages) || rawAgentImages.length === 0)
+            return null;
+        const declaredAgentImages = rawAgentImages.filter((s) => typeof s === "string" && s.length > 0);
+        if (declaredAgentImages.length === 0)
+            return null;
+        return routeAgentImages({
+            bundleRoot: tmpDir,
+            declaredAgentImages,
+            targetAgentImagesDir,
+        }, agentImagesRouterFsOps());
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Item 6 / slice-05 Checkpoint 7.3f step 3: extract the bundle safely
+ * (banked unpack trust boundary) and route any declared context_packs to
+ * the operator context-packs library. Returns null when bundle has no
+ * context_packs[] (no-op).
+ *
+ * Target resolution: <openrigHome>/context-packs — per startup.ts:496
+ * (the user-file root the live ContextPackLibraryService is constructed
+ * against). No SettingsStore complexity (unlike workflow_specs);
+ * context-packs canonical path is OPENRIG_HOME-rooted per
+ * context-pack-types.ts:9-10.
+ *
+ * Mirror of routeSkillsAfterBootstrap / routePluginsAfterBootstrap /
+ * routeWorkflowSpecsAfterBootstrap pattern: takes bundlePath only
+ * (decoupled from installMeta per the 5f410eee B1 lesson; routing must
+ * fire on the dual-override path too).
+ */
+async function routeContextPacksAfterBootstrap(bundlePath) {
+    const targetContextPacksDir = getDefaultOpenRigPath("context-packs");
+    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-context-packs-route-"));
+    try {
+        await unpack(bundlePath, tmpDir);
+        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
+        if (!fs.existsSync(manifestPath))
+            return null;
+        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
+        const manifest = parsePodBundleManifest(manifestYaml);
+        const rawContextPacks = manifest["context_packs"];
+        if (!Array.isArray(rawContextPacks) || rawContextPacks.length === 0)
+            return null;
+        const declaredContextPacks = rawContextPacks.filter((s) => typeof s === "string" && s.length > 0);
+        if (declaredContextPacks.length === 0)
+            return null;
+        return routeContextPacks({
+            bundleRoot: tmpDir,
+            declaredContextPacks,
+            targetContextPacksDir,
+        }, contextPacksRouterFsOps());
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Item 6 / slice-05 Checkpoint 7.3e step 3: extract the bundle safely
+ * (banked unpack trust boundary) and route any declared workflow_specs to
+ * the operator workflow-specs library. Returns null when bundle has no
+ * workflow_specs[] (no-op), no manifest, or workspaceSpecsRoot unresolved.
+ *
+ * Target resolution per the CALLER CONTRACT in
+ * bundle-workflow-specs-router.ts: SettingsStore is the sole authority.
+ * Resolved as nodePath.join(workspaceSpecsRoot, "workflows") — the path
+ * that spec-library-workflow-scanner actually reads (startup.ts:903-916).
+ * If SettingsStore cannot resolve workspaceSpecsRoot (settings not yet
+ * initialized / config error), we return null and the install lifecycle
+ * proceeds without workflow_specs routing — mirror of startup.ts:910-916
+ * try/catch posture.
+ *
+ * Mirror of routeSkillsAfterBootstrap / routePluginsAfterBootstrap pattern:
+ * takes bundlePath only (decoupled from installMeta per the 5f410eee B1
+ * lesson; routing must fire on the dual-override path too).
+ */
+async function routeWorkflowSpecsAfterBootstrap(bundlePath) {
+    let workspaceSpecsRoot;
+    try {
+        const settingsStore = new ContextPackSettingsStore();
+        workspaceSpecsRoot = settingsStore.resolveConfig().workspaceSpecsRoot;
+    }
+    catch {
+        return null; // settings unresolvable; no-op routing
+    }
+    if (!workspaceSpecsRoot)
+        return null;
+    const targetWorkflowSpecsDir = nodePath.join(workspaceSpecsRoot, "workflows");
+    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-workflow-specs-route-"));
+    try {
+        await unpack(bundlePath, tmpDir);
+        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
+        if (!fs.existsSync(manifestPath))
+            return null;
+        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
+        const manifest = parsePodBundleManifest(manifestYaml);
+        const rawWorkflowSpecs = manifest["workflow_specs"];
+        if (!Array.isArray(rawWorkflowSpecs) || rawWorkflowSpecs.length === 0)
+            return null;
+        const declaredWorkflowSpecs = rawWorkflowSpecs.filter((s) => typeof s === "string" && s.length > 0);
+        if (declaredWorkflowSpecs.length === 0)
+            return null;
+        return routeWorkflowSpecs({
+            bundleRoot: tmpDir,
+            declaredWorkflowSpecs,
+            targetWorkflowSpecsDir,
+        }, workflowSpecsRouterFsOps());
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Item 6 / slice-05 Checkpoint 7.3d: extract the bundle safely (banked unpack
+ * trust boundary) and route any declared plugin references to the operator
+ * plugins library (<OPENRIG_HOME>/plugins/<id>/). Returns null when bundle
+ * has no plugins[] (no-op). Mirror of routeSkillsAfterBootstrap pattern —
+ * takes bundlePath only (decoupled from installMeta per the 5f410eee B1
+ * lesson; routing must fire on the dual-override path too).
+ */
+async function routePluginsAfterBootstrap(bundlePath) {
+    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-plugins-route-"));
+    try {
+        await unpack(bundlePath, tmpDir);
+        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
+        if (!fs.existsSync(manifestPath))
+            return null;
+        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
+        const manifest = parsePodBundleManifest(manifestYaml);
+        const rawPlugins = manifest["plugins"];
+        if (!Array.isArray(rawPlugins) || rawPlugins.length === 0)
+            return null;
+        const declaredPlugins = [];
+        for (const entry of rawPlugins) {
+            if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                continue;
+            const p = entry;
+            const s = p["source"];
+            if (typeof p["id"] !== "string" || !p["id"])
+                continue;
+            if (!s || typeof s !== "object" || Array.isArray(s))
+                continue;
+            const src = s;
+            if (src["kind"] !== "local" || typeof src["path"] !== "string" || !src["path"])
+                continue;
+            declaredPlugins.push({ id: p["id"], source: { kind: "local", path: src["path"] } });
+        }
+        if (declaredPlugins.length === 0)
+            return null;
+        return routePlugins({
+            bundleRoot: tmpDir,
+            declaredPlugins,
+            targetPluginsDir: getDefaultOpenRigPath("plugins"),
+        }, pluginsRouterFsOps());
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/** Item 6 / slice-05 Checkpoint 7.3: real SkillsRouterFsOps backed by node:fs. */
+function skillsRouterFsOps() {
+    return {
+        exists: (p) => fs.existsSync(p),
+        readFile: (p) => fs.readFileSync(p, "utf-8"),
+        writeFile: (p, c) => fs.writeFileSync(p, c, "utf-8"),
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+    };
+}
+/**
+ * Item 6 / slice-05 Checkpoint 7.3: extract the bundle safely (banked unpack
+ * trust boundary) and route any declared skills to the operator skills
+ * library. Returns null when bundle has no skills[] (no-op).
+ *
+ * B1 repair (qitem-20260518220247-22f5257a): takes bundlePath only and does
+ * its own safe unpack + parse. Previously coupled to installMeta from the
+ * pre-check extraction, which is null when operator passes --skip-version-
+ * check AND --force together; that incorrectly suppressed post-install
+ * skills routing on the dual-override path. Skills routing is independent
+ * of the pre-check decisions and should fire whenever an install completes
+ * successfully with a bundle that declares skills.
+ *
+ * Best-effort: returns null on any extract/parse failure (caller has the
+ * outer try/catch). Single unpack call per invocation; the manifest re-parse
+ * is cheap vs. the unpack cost which is required either way to access the
+ * skill source files for routing.
+ */
+async function routeSkillsAfterBootstrap(bundlePath) {
+    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-skills-route-"));
+    try {
+        await unpack(bundlePath, tmpDir);
+        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
+        if (!fs.existsSync(manifestPath))
+            return null;
+        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
+        const manifest = parsePodBundleManifest(manifestYaml);
+        const rawSkills = manifest["skills"];
+        if (!Array.isArray(rawSkills) || rawSkills.length === 0)
+            return null;
+        const declaredSkills = rawSkills.filter((s) => typeof s === "string" && s.length > 0);
+        if (declaredSkills.length === 0)
+            return null;
+        return routeSkills({
+            bundleRoot: tmpDir,
+            declaredSkills,
+            targetSkillsDir: getDefaultOpenRigPath("skills"),
+        }, skillsRouterFsOps());
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/** Item 4 / slice-05 Checkpoint 5.2: real BundleAuditFsOps backed by node:fs. */
+function auditFsOps() {
+    return {
+        appendFile: (p, c) => fs.appendFileSync(p, c, "utf-8"),
+        readFile: (p) => fs.readFileSync(p, "utf-8"),
+        exists: (p) => fs.existsSync(p),
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+    };
+}
+/**
+ * Audit file path resolved at call time via getDefaultOpenRigPath
+ * ("bundle-audit.jsonl"). Function-level read (no module-level constant)
+ * so OPENRIG_HOME env changes between requests / tests are honored.
+ */
+function bundleAuditPath() {
+    return getDefaultOpenRigPath("bundle-audit.jsonl");
+}
+/**
+ * Item 4 / slice-05 Checkpoint 5.3: append a bundle install audit record.
+ * Best-effort — audit failures are logged via the eventBus shape but never
+ * fail the install response (the install already happened or failed; the
+ * audit is a side-channel record). bundleManifest is optional; when present,
+ * provenance.source_host is mirrored into the record.
+ */
+function writeInstallAudit(opts) {
+    try {
+        const writer = new BundleAuditWriter({
+            opts: { auditPath: bundleAuditPath() },
+            fsOps: auditFsOps(),
+        });
+        const provenance = normalizeProvenanceBlock(opts.bundleManifest?.["provenance"]);
+        const record = {
+            installedAt: new Date().toISOString(),
+            bundlePath: opts.bundlePath,
+            outcome: opts.outcome,
+        };
+        if (opts.targetRigId)
+            record.targetRigId = opts.targetRigId;
+        if (opts.targetRigName)
+            record.targetRigName = opts.targetRigName;
+        if (opts.cliVersion)
+            record.cliVersion = opts.cliVersion;
+        record.daemonVersion = getDaemonVersion();
+        if (provenance?.sourceHost)
+            record.sourceHost = provenance.sourceHost;
+        writer.append(record);
+    }
+    catch {
+        // Audit-write failure is side-channel; never fail the install response.
+        // Future enhancement: surface via eventBus (out of scope this commit).
+    }
+}
+function consumeAuthorBundleYaml(sourceRoot, staging) {
+    const authorBundlePath = nodePath.join(sourceRoot, "bundle.yaml");
+    if (!fs.existsSync(authorBundlePath))
+        return {};
+    // Canonicalize sourceRoot before vendoring (banked 79a89d40 B1 guard
+    // catch: lexical containment + dereference allows symlinks under
+    // sourceRoot to escape). realpath the root once; every declared path's
+    // realpath must stay within this boundary.
+    const sourceRootReal = fs.realpathSync(sourceRoot);
+    const stagingResolved = nodePath.resolve(staging);
+    /** Realpath-contain check: the actual file/dir behind `absPath` (after
+     * symlink resolution) must live under sourceRootReal. Catches symlinks
+     * whose targets escape the source tree even when the lexical path is
+     * inside sourceRoot. Throws on escape. */
+    const assertSourceRealContained = (absPath, kindLabel, declared) => {
+        let realPath;
+        try {
+            realPath = fs.realpathSync(absPath);
+        }
+        catch (err) {
+            throw new Error(`author bundle ${kindLabel} '${declared}' does not exist in source: ${err.message}`);
+        }
+        if (realPath !== sourceRootReal && !realPath.startsWith(sourceRootReal + nodePath.sep)) {
+            throw new Error(`author bundle ${kindLabel} '${declared}' resolves outside bundle source root (symlink escape); rejected`);
+        }
+        return realPath;
+    };
+    /** Pre-walk a directory tree with lstat; for every symlink encountered,
+     * realpath-check containment under sourceRootReal. Regular files and
+     * dirs need no special check (they're inherently contained — the
+     * problem class is symlinks escaping). Throws on any escape. */
+    const assertNoSymlinkEscapeInTree = (dirAbs, kindLabel, declared) => {
+        const stack = [dirAbs];
+        while (stack.length > 0) {
+            const cur = stack.pop();
+            let entries;
+            try {
+                entries = fs.readdirSync(cur, { withFileTypes: true });
+            }
+            catch {
+                // Unreadable dir — skip; cpSync will surface the failure if material
+                continue;
+            }
+            for (const entry of entries) {
+                const entryAbs = nodePath.join(cur, entry.name);
+                if (entry.isSymbolicLink()) {
+                    // Realpath the symlink target; reject if escapes sourceRootReal
+                    let entryReal;
+                    try {
+                        entryReal = fs.realpathSync(entryAbs);
+                    }
+                    catch (err) {
+                        throw new Error(`author bundle ${kindLabel} '${declared}' has unreadable symlink at '${nodePath.relative(sourceRootReal, entryAbs)}': ${err.message}`);
+                    }
+                    if (entryReal !== sourceRootReal && !entryReal.startsWith(sourceRootReal + nodePath.sep)) {
+                        throw new Error(`author bundle ${kindLabel} '${declared}' contains nested symlink at '${nodePath.relative(sourceRootReal, entryAbs)}' escaping bundle source root; rejected`);
+                    }
+                    // If the symlink target is a directory under sourceRoot, walk it
+                    // (cpSync with dereference:true will follow it; we need to
+                    // validate any nested symlinks too)
+                    try {
+                        const st = fs.statSync(entryReal);
+                        if (st.isDirectory())
+                            stack.push(entryReal);
+                    }
+                    catch { /* unreadable — skip */ }
+                }
+                else if (entry.isDirectory()) {
+                    stack.push(entryAbs);
+                }
+            }
+        }
+    };
+    const authorYaml = fs.readFileSync(authorBundlePath, "utf-8");
+    const authorParsed = parsePodBundleManifest(authorYaml);
+    const result = {};
+    const vendorFile = (declared, kindLabel) => {
+        if (!isRelativeSafePath(declared))
+            throw new Error(`author bundle ${kindLabel} path '${declared}' is not safe`);
+        const sourceAbs = nodePath.resolve(sourceRootReal, declared);
+        // Lexical containment + realpath containment (banked 79a89d40 B1)
+        if (sourceAbs !== sourceRootReal && !sourceAbs.startsWith(sourceRootReal + nodePath.sep)) {
+            throw new Error(`author bundle ${kindLabel} path '${declared}' escapes bundle source root`);
+        }
+        if (!fs.existsSync(sourceAbs))
+            throw new Error(`author bundle ${kindLabel} '${declared}' does not exist in source`);
+        assertSourceRealContained(sourceAbs, kindLabel, declared);
+        const targetAbs = nodePath.resolve(staging, declared);
+        if (!targetAbs.startsWith(stagingResolved + nodePath.sep)) {
+            throw new Error(`author bundle ${kindLabel} target '${declared}' escapes staging`);
+        }
+        fs.mkdirSync(nodePath.dirname(targetAbs), { recursive: true });
+        // readFileSync follows the symlink; we already validated its realpath
+        // stays in sourceRootReal. Write as regular file (tar safety).
+        const content = fs.readFileSync(sourceAbs);
+        fs.writeFileSync(targetAbs, content);
+    };
+    const vendorDir = (declared, kindLabel) => {
+        if (!isRelativeSafePath(declared))
+            throw new Error(`author bundle ${kindLabel} path '${declared}' is not safe`);
+        const sourceAbs = nodePath.resolve(sourceRootReal, declared);
+        if (sourceAbs !== sourceRootReal && !sourceAbs.startsWith(sourceRootReal + nodePath.sep)) {
+            throw new Error(`author bundle ${kindLabel} path '${declared}' escapes bundle source root`);
+        }
+        if (!fs.existsSync(sourceAbs))
+            throw new Error(`author bundle ${kindLabel} '${declared}' does not exist in source`);
+        // Realpath-validate the declared dir itself (catches symlink-to-outside-dir)
+        const sourceReal = assertSourceRealContained(sourceAbs, kindLabel, declared);
+        // Pre-walk the realpath-resolved dir to catch nested symlink escapes
+        // before cpSync dereferences anything
+        assertNoSymlinkEscapeInTree(sourceReal, kindLabel, declared);
+        const targetAbs = nodePath.resolve(staging, declared);
+        if (!targetAbs.startsWith(stagingResolved + nodePath.sep)) {
+            throw new Error(`author bundle ${kindLabel} target '${declared}' escapes staging`);
+        }
+        fs.mkdirSync(nodePath.dirname(targetAbs), { recursive: true });
+        // dereference: true → symlinks followed (now validated safe) and
+        // written as regular files for tar safety
+        fs.cpSync(sourceAbs, targetAbs, { recursive: true, dereference: true });
+    };
+    // skills[] — file paths
+    const rawSkills = authorParsed["skills"];
+    if (Array.isArray(rawSkills) && rawSkills.length > 0) {
+        const skills = rawSkills.filter((s) => typeof s === "string" && s.length > 0);
+        for (const declared of skills)
+            vendorFile(declared, "skill");
+        if (skills.length > 0)
+            result.skills = skills;
+    }
+    // plugins[] — dir paths via source.path
+    const rawPlugins = authorParsed["plugins"];
+    if (Array.isArray(rawPlugins) && rawPlugins.length > 0) {
+        const plugins = [];
+        for (const entry of rawPlugins) {
+            if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                continue;
+            const p = entry;
+            const s = p["source"];
+            if (typeof p["id"] !== "string" || !p["id"])
+                continue;
+            if (!s || typeof s !== "object" || Array.isArray(s))
+                continue;
+            const src = s;
+            if (src["kind"] !== "local" || typeof src["path"] !== "string" || !src["path"])
+                continue;
+            vendorDir(src["path"], `plugin '${p["id"]}'`);
+            plugins.push({ id: p["id"], source: { kind: "local", path: src["path"] } });
+        }
+        if (plugins.length > 0)
+            result.plugins = plugins;
+    }
+    // workflow_specs[] — file paths
+    const rawWorkflowSpecs = authorParsed["workflow_specs"];
+    if (Array.isArray(rawWorkflowSpecs) && rawWorkflowSpecs.length > 0) {
+        const workflowSpecs = rawWorkflowSpecs.filter((s) => typeof s === "string" && s.length > 0);
+        for (const declared of workflowSpecs)
+            vendorFile(declared, "workflow_spec");
+        if (workflowSpecs.length > 0)
+            result.workflowSpecs = workflowSpecs;
+    }
+    // context_packs[] — manifest.yaml paths; vendor the parent dir
+    const rawContextPacks = authorParsed["context_packs"];
+    if (Array.isArray(rawContextPacks) && rawContextPacks.length > 0) {
+        const contextPacks = rawContextPacks.filter((s) => typeof s === "string" && s.length > 0);
+        for (const declared of contextPacks) {
+            const parentRel = nodePath.dirname(declared);
+            if (parentRel === ".")
+                continue; // declared at root; nothing meaningful to vendor
+            vendorDir(parentRel, `context_pack parent of '${declared}'`);
+        }
+        if (contextPacks.length > 0)
+            result.contextPacks = contextPacks;
+    }
+    // agent_images[] — dir paths
+    const rawAgentImages = authorParsed["agent_images"];
+    if (Array.isArray(rawAgentImages) && rawAgentImages.length > 0) {
+        const agentImages = rawAgentImages.filter((s) => typeof s === "string" && s.length > 0);
+        for (const declared of agentImages)
+            vendorDir(declared, "agent_image");
+        if (agentImages.length > 0)
+            result.agentImages = agentImages;
+    }
+    return result;
+}
 // POST /api/bundles/create
 bundleRoutes.post("/create", async (c) => {
     const { eventBus } = getDeps(c);
@@ -74,6 +803,13 @@ bundleRoutes.post("/create", async (c) => {
     const outputPath = typeof body["outputPath"] === "string" ? body["outputPath"] : "";
     const rigRoot = typeof body["rigRoot"] === "string" ? body["rigRoot"] : undefined;
     const includePackages = Array.isArray(body["includePackages"]) ? body["includePackages"] : undefined;
+    // Item 1 / slice-05: build provenance from request body + inject daemonVersion server-side
+    const clientProvenance = provenanceFromRequestBody(body["provenance"]);
+    const provenance = clientProvenance
+        ? { ...clientProvenance, daemonVersion: getDaemonVersion() }
+        : undefined;
+    // Item 2 / slice-05: build compatibility from request body (no server-side fields)
+    const compatibility = compatibilityFromRequestBody(body["compatibility"]);
     if (!specPath || !bundleName || !bundleVersion || !outputPath) {
         return c.json({ error: "specPath, bundleName, bundleVersion, and outputPath are required" }, 400);
     }
@@ -91,7 +827,22 @@ bundleRoutes.post("/create", async (c) => {
             const tmpStaging = fs.mkdtempSync(nodePath.join(os.tmpdir(), "pod-bundle-create-"));
             try {
                 const assembler = new PodBundleAssembler({ fsOps: podAssemblerFsOps() });
-                const result = assembler.assemble({ rigRoot: effectiveRigRoot, rigSpecPath: nodePath.resolve(specPath), outputDir: tmpStaging, bundleName, bundleVersion });
+                const result = assembler.assemble({ rigRoot: effectiveRigRoot, rigSpecPath: nodePath.resolve(specPath), outputDir: tmpStaging, bundleName, bundleVersion, provenance, compatibility });
+                // Item 6 / Checkpoint 7.5 (QA-20260601 A2 repair): auto-detect
+                // author bundle.yaml at the rig source root; vendor declared
+                // cross-primitive content into staging + carry the fields onto
+                // the manifest. computeIntegrity below covers the vendored content.
+                const authorPrimitives = consumeAuthorBundleYaml(effectiveRigRoot, tmpStaging);
+                if (authorPrimitives.skills)
+                    result.manifest.skills = authorPrimitives.skills;
+                if (authorPrimitives.plugins)
+                    result.manifest.plugins = authorPrimitives.plugins;
+                if (authorPrimitives.workflowSpecs)
+                    result.manifest.workflowSpecs = authorPrimitives.workflowSpecs;
+                if (authorPrimitives.contextPacks)
+                    result.manifest.contextPacks = authorPrimitives.contextPacks;
+                if (authorPrimitives.agentImages)
+                    result.manifest.agentImages = authorPrimitives.agentImages;
                 const integrity = computeIntegrity(tmpStaging, integrityFsOps());
                 result.manifest.integrity = integrity;
                 fs.writeFileSync(nodePath.join(tmpStaging, "bundle.yaml"), serializePodBundleManifest(result.manifest), "utf-8");
@@ -144,8 +895,29 @@ bundleRoutes.post("/create", async (c) => {
         try {
             const assembler = new BundleAssembler({ fsOps: assemblerFsOps() });
             const manifest = assembler.assemble({
-                specPath: nodePath.resolve(specPath), packages, outputDir: tmpStaging, bundleName, bundleVersion,
+                specPath: nodePath.resolve(specPath), packages, outputDir: tmpStaging, bundleName, bundleVersion, provenance, compatibility,
             });
+            // Item 6 / Checkpoint 7.5 (QA-20260601 A2 repair, legacy path mirror):
+            // auto-detect author bundle.yaml in source dir; vendor + carry
+            // cross-primitive fields before integrity. Re-serialize bundle.yaml
+            // since the assembler already wrote one without these fields.
+            const legacyAuthorPrimitives = consumeAuthorBundleYaml(specDir, tmpStaging);
+            const hasLegacyPrimitives = legacyAuthorPrimitives.skills || legacyAuthorPrimitives.plugins ||
+                legacyAuthorPrimitives.workflowSpecs || legacyAuthorPrimitives.contextPacks || legacyAuthorPrimitives.agentImages;
+            if (hasLegacyPrimitives) {
+                if (legacyAuthorPrimitives.skills)
+                    manifest.skills = legacyAuthorPrimitives.skills;
+                if (legacyAuthorPrimitives.plugins)
+                    manifest.plugins = legacyAuthorPrimitives.plugins;
+                if (legacyAuthorPrimitives.workflowSpecs)
+                    manifest.workflowSpecs = legacyAuthorPrimitives.workflowSpecs;
+                if (legacyAuthorPrimitives.contextPacks)
+                    manifest.contextPacks = legacyAuthorPrimitives.contextPacks;
+                if (legacyAuthorPrimitives.agentImages)
+                    manifest.agentImages = legacyAuthorPrimitives.agentImages;
+                const { serializeLegacyBundleManifest } = await import("../domain/bundle-types.js");
+                fs.writeFileSync(nodePath.join(tmpStaging, "bundle.yaml"), serializeLegacyBundleManifest(manifest), "utf-8");
+            }
             const integrity = computeIntegrity(tmpStaging, integrityFsOps());
             writeIntegrity(tmpStaging, integrity, integrityFsOps());
             const archiveHash = await pack(tmpStaging, nodePath.resolve(outputPath));
@@ -224,6 +996,35 @@ bundleRoutes.post("/inspect", async (c) => {
                     algorithm: integritySection.algorithm ?? "sha256",
                     files: integritySection.files ?? {},
                 } : undefined,
+                // Item 1 / slice-05: surface provenance in normalized camelCase so the
+                // /api/bundles/inspect contract is one shape regardless of v1 vs v2
+                // (v1 path normalizes through normalizeLegacyBundleManifest below).
+                // Field is optional; undefined when bundle has no provenance.
+                provenance: normalizeProvenanceBlock(rawParsed["provenance"]),
+                // Item 2 / slice-05: surface compatibility normalized to camelCase
+                // (same single-contract reason as provenance above). v1 already
+                // surfaces via the normalizer at the end of this handler.
+                compatibility: normalizeCompatibilityBlock(rawParsed["compatibility"]),
+                // Item 6 / Checkpoint 7.5 / QA-20260601 C1 repair: surface the 5
+                // cross-primitive blocks normalized to camelCase so /inspect's
+                // contract carries the same shape v1's normalizer already
+                // surfaces. Raw YAML keys are snake_case; expose camelCase to
+                // match the rest of the v2 inspect contract.
+                skills: Array.isArray(rawParsed["skills"])
+                    ? rawParsed["skills"].filter((s) => typeof s === "string")
+                    : undefined,
+                plugins: Array.isArray(rawParsed["plugins"])
+                    ? rawParsed["plugins"].filter((p) => p && typeof p === "object")
+                    : undefined,
+                workflowSpecs: Array.isArray(rawParsed["workflow_specs"])
+                    ? rawParsed["workflow_specs"].filter((s) => typeof s === "string")
+                    : undefined,
+                contextPacks: Array.isArray(rawParsed["context_packs"])
+                    ? rawParsed["context_packs"].filter((s) => typeof s === "string")
+                    : undefined,
+                agentImages: Array.isArray(rawParsed["agent_images"])
+                    ? rawParsed["agent_images"].filter((s) => typeof s === "string")
+                    : undefined,
             };
             const integrityCompat = integritySection ? {
                 schemaVersion: 2,
@@ -252,23 +1053,110 @@ bundleRoutes.post("/inspect", async (c) => {
         fs.rmSync(tmpDir, { recursive: true, force: true });
     }
 });
+// GET /api/bundles/history — Item 4 / slice-05 Checkpoint 5.2
+// Returns the install audit JSONL records (optionally filtered by rig name
+// and / or since timestamp). Read-only — no audit-write side effects.
+// Empty audit file returns []. Reader fails-open on malformed JSONL lines
+// (forward-compat with future record-shape evolutions).
+bundleRoutes.get("/history", async (c) => {
+    const rig = c.req.query("rig");
+    const since = c.req.query("since");
+    const reader = new BundleAuditReader({
+        opts: { auditPath: bundleAuditPath() },
+        fsOps: auditFsOps(),
+    });
+    const records = reader.list({
+        rig: typeof rig === "string" && rig.length > 0 ? rig : undefined,
+        since: typeof since === "string" && since.length > 0 ? since : undefined,
+    });
+    return c.json({ records, total: records.length }, 200);
+});
 // POST /api/bundles/install — reuses full bootstrap lifecycle
 bundleRoutes.post("/install", async (c) => {
-    const { bootstrapOrchestrator, bootstrapRepo, eventBus } = getDeps(c);
+    const { bootstrapOrchestrator, bootstrapRepo, eventBus, rigRepo } = getDeps(c);
     const body = await c.req.json().catch(() => ({}));
     const bundlePath = typeof body["bundlePath"] === "string" ? body["bundlePath"] : "";
     const plan = body["plan"] === true;
     const autoApprove = body["autoApprove"] === true;
     const targetRoot = typeof body["targetRoot"] === "string" ? body["targetRoot"] : undefined;
+    // Item 2 / slice-05 Checkpoint 3.3: install-time compatibility check inputs
+    const skipVersionCheck = body["skipVersionCheck"] === true;
+    const clientCliVersion = typeof body["cliVersion"] === "string" ? body["cliVersion"] : undefined;
+    // Item 3 / slice-05 Checkpoint 4.2: install-time conflict check inputs
+    const force = body["force"] === true;
     if (!bundlePath)
         return c.json({ error: "bundlePath is required" }, 400);
     if (!plan && !targetRoot)
         return c.json({ error: "targetRoot is required for apply mode" }, 400);
-    // Concurrency lock
+    // Concurrency lock — runs BEFORE compat check so the existing 409
+    // semantic (concurrent install detection) is preserved verbatim.
     if (!bootstrapOrchestrator.tryAcquire(bundlePath)) {
         return c.json({ error: "Bundle install already in progress", code: "conflict" }, 409);
     }
     try {
+        // Item 2 / slice-05 Checkpoint 3.3: install-time compatibility check
+        // Runs AFTER the lock + BEFORE bootstrap delegation. Mismatch returns a
+        // 3-part error and exits the lifecycle (lock releases via the outer
+        // finally). Operator override via --skip-version-check (request body
+        // skipVersionCheck=true).
+        // Item 2 + Item 3 / slice-05: single safe extract pass yields both the
+        // bundle manifest (for compat check) and the rig name (for conflict check).
+        // Caller can skip the compat check via skipVersionCheck; the conflict check
+        // also runs from this same extract pass unless --force bypasses it.
+        let installMeta = null;
+        if (!skipVersionCheck || !force) {
+            try {
+                installMeta = await extractInstallTimeMetadata(bundlePath);
+            }
+            catch (err) {
+                return c.json({
+                    error: "Bundle install pre-check could not run (extraction failed)",
+                    detail: err.message,
+                    resolutions: [
+                        "confirm the bundle path is correct and the archive is readable",
+                        "pass --skip-version-check and --force to bypass both pre-checks (NOT recommended unless intentional)",
+                    ],
+                }, 400);
+            }
+        }
+        if (!skipVersionCheck && installMeta) {
+            const compatibility = normalizeCompatibilityBlock(installMeta.bundleManifest["compatibility"]);
+            const failures = checkBundleCompatibility(compatibility, getDaemonVersion(), clientCliVersion);
+            if (failures) {
+                return c.json({
+                    error: "Bundle compatibility check failed",
+                    failures,
+                    resolutions: [
+                        "upgrade the affected runtime to the required version (recommended)",
+                        "use a bundle with relaxed minimum requirements",
+                        "pass --skip-version-check to bypass for an operator-explicit override (NOT recommended for routine use)",
+                    ],
+                }, 400);
+            }
+        }
+        // Item 3 / slice-05 Checkpoint 4.2: install-time conflict check
+        // Runs AFTER the compat check + BEFORE bootstrap delegation. Mismatch
+        // returns a 400 with the 3-part error shape (error + conflicts[] +
+        // resolutions[]). Operator override via --force (request body force=true).
+        // The check fails CLOSED on extraction failure (handled above) and
+        // fail-OPEN on missing rig name in the bundle (no rig name to compare).
+        if (!force && installMeta && rigRepo) {
+            const runningRigs = rigRepo.listRigs().map((r) => ({ rigId: r.id, name: r.name }));
+            const report = detectBundleConflicts({
+                bundleRigName: installMeta.rigName ?? "",
+                runningRigs,
+            });
+            if (report.hasConflicts) {
+                return c.json({
+                    error: "Bundle install conflict check failed",
+                    conflicts: report.conflicts,
+                    resolutions: [
+                        "stop the conflicting running rig and re-attempt install",
+                        "use --force to bypass for an operator-explicit override (NOT recommended for routine use; conflicts may produce partial install state)",
+                    ],
+                }, 400);
+            }
+        }
         if (plan) {
             // Plan mode: no run lifecycle
             try {
@@ -309,21 +1197,92 @@ bundleRoutes.post("/install", async (c) => {
             });
             if (result.status === "completed") {
                 eventBus.emit({ type: "bootstrap.completed", runId: result.runId, rigId: result.rigId, sourceRef: bundlePath });
-                return c.json(result, 201);
+                writeInstallAudit({
+                    bundlePath, outcome: "success", targetRigId: result.rigId,
+                    targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
+                    bundleManifest: installMeta?.bundleManifest,
+                });
+                // Item 6 / Checkpoint 7.3: route any declared skills after successful
+                // install. Best-effort: a routing failure does NOT fail the install
+                // response (the install already succeeded; skills routing is a side-
+                // channel post-install step). Routing result included in response body
+                // so operators see what landed.
+                let skillsRouting = null;
+                let pluginsRouting = null;
+                let workflowSpecsRouting = null;
+                let contextPacksRouting = null;
+                let agentImagesRouting = null;
+                try {
+                    skillsRouting = await routeSkillsAfterBootstrap(bundlePath);
+                }
+                catch {
+                    // Side-channel failure; install already succeeded
+                }
+                try {
+                    pluginsRouting = await routePluginsAfterBootstrap(bundlePath);
+                }
+                catch {
+                    // Side-channel failure; install already succeeded
+                }
+                try {
+                    workflowSpecsRouting = await routeWorkflowSpecsAfterBootstrap(bundlePath);
+                }
+                catch {
+                    // Side-channel failure; install already succeeded
+                }
+                try {
+                    contextPacksRouting = await routeContextPacksAfterBootstrap(bundlePath);
+                }
+                catch {
+                    // Side-channel failure; install already succeeded
+                }
+                try {
+                    agentImagesRouting = await routeAgentImagesAfterBootstrap(bundlePath);
+                }
+                catch {
+                    // Side-channel failure; install already succeeded
+                }
+                const extras = {};
+                if (skillsRouting)
+                    extras.skillsRouting = skillsRouting;
+                if (pluginsRouting)
+                    extras.pluginsRouting = pluginsRouting;
+                if (workflowSpecsRouting)
+                    extras.workflowSpecsRouting = workflowSpecsRouting;
+                if (contextPacksRouting)
+                    extras.contextPacksRouting = contextPacksRouting;
+                if (agentImagesRouting)
+                    extras.agentImagesRouting = agentImagesRouting;
+                return c.json(Object.keys(extras).length > 0 ? { ...result, ...extras } : result, 201);
             }
             if (result.status === "partial") {
                 const ok = result.stages.filter((s) => s.status === "ok").length;
                 const fail = result.stages.filter((s) => s.status === "failed" || s.status === "blocked").length;
                 eventBus.emit({ type: "bootstrap.partial", runId: result.runId, sourceRef: bundlePath, rigId: result.rigId, completed: ok, failed: fail });
+                writeInstallAudit({
+                    bundlePath, outcome: "partial", targetRigId: result.rigId,
+                    targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
+                    bundleManifest: installMeta?.bundleManifest,
+                });
                 return c.json(result, 200);
             }
             eventBus.emit({ type: "bootstrap.failed", runId: result.runId, sourceRef: bundlePath, error: result.errors[0] ?? "failed" });
+            writeInstallAudit({
+                bundlePath, outcome: "failed",
+                targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
+                bundleManifest: installMeta?.bundleManifest,
+            });
             const hasBlocked = result.stages.some((s) => s.status === "blocked");
             return c.json(result, hasBlocked ? 409 : 500);
         }
         catch (err) {
             bootstrapRepo.updateRunStatus(run.id, "failed");
             eventBus.emit({ type: "bootstrap.failed", runId: run.id, sourceRef: bundlePath, error: err.message });
+            writeInstallAudit({
+                bundlePath, outcome: "failed",
+                targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
+                bundleManifest: installMeta?.bundleManifest,
+            });
             return c.json({ runId: run.id, status: "failed", error: err.message }, 500);
         }
     }