@pellux/goodvibes-agent 1.2.0 → 1.3.0

package/src/agent/setup-wizard.ts

@@ -3,6 +3,7 @@ export type AgentSetupWizardStatus = 'complete' | 'active' | 'blocked';
 export type AgentSetupWizardStepStatus = 'done' | 'current' | 'pending' | 'blocked';
 export type AgentSetupWizardCheckpointStatus = 'available' | 'none' | 'stale' | 'unavailable';
 export type AgentSetupWizardCloseoutStatus = 'complete' | 'ready-to-finish' | 'needs-smoke-evidence' | 'blocked';
+export type AgentSetupWizardReceiptSchemaStatus = 'certified' | 'legacy';
 
 export interface AgentSetupWizardSourceItem {
   readonly id: string;
@@ -25,6 +26,8 @@ export interface AgentSetupWizardSmokeHistory {
   readonly trend: string;
   readonly latestResult: string | null;
   readonly previousResult: string | null;
+  readonly latestEvidenceId?: string | null;
+  readonly latestEvidenceAt?: string | null;
   readonly resultCounts: Readonly<Record<string, number>>;
   readonly blockedCheckFrequency: readonly AgentSetupWizardBlockedCheckFrequency[];
   readonly inspectLatestRoute: string | null;
@@ -33,6 +36,26 @@ export interface AgentSetupWizardSmokeHistory {
   readonly reason?: string;
 }
 
+export type AgentSetupWizardDurableReceiptStatus = 'ready' | 'blocked' | 'failed' | 'unknown';
+
+export interface AgentSetupWizardDurableReceipt {
+  readonly stepId: string;
+  readonly stepLabel?: string;
+  readonly status: AgentSetupWizardDurableReceiptStatus;
+  readonly receiptId: string;
+  readonly recordedAt: string;
+  readonly summary: string;
+  readonly inspectRoute: string | null;
+  readonly source?: string;
+  readonly schemaStatus?: AgentSetupWizardReceiptSchemaStatus;
+  readonly schemaVersion?: string;
+  readonly provenance?: readonly string[];
+  readonly publicationGuarantee?: string;
+  readonly eventCursor?: string;
+  readonly eventSequence?: number;
+  readonly publisher?: string;
+}
+
 export interface AgentSetupWizardRepeatedBlocker {
   readonly setupItemId: string;
   readonly checkId: string;
@@ -52,6 +75,36 @@ export interface AgentSetupWizardStep {
   readonly backtrackRoute: string | null;
 }
 
+export type AgentSetupWizardStepHistoryKind = 'checkpoint' | 'setup-smoke' | 'durable-receipt';
+
+export interface AgentSetupWizardStepHistoryEntry {
+  readonly id: string;
+  readonly stepId: string;
+  readonly stepLabel: string;
+  readonly kind: AgentSetupWizardStepHistoryKind;
+  readonly receiptId: string;
+  readonly recordedAt: string;
+  readonly summary: string;
+  readonly inspectRoute: string | null;
+  readonly source?: string;
+  readonly receiptStatus?: string;
+  readonly satisfiesReceipt?: boolean;
+  readonly schemaStatus?: AgentSetupWizardReceiptSchemaStatus;
+  readonly schemaVersion?: string;
+  readonly provenance?: readonly string[];
+  readonly publicationGuarantee?: string;
+  readonly eventCursor?: string;
+  readonly eventSequence?: number;
+  readonly publisher?: string;
+}
+
+export interface AgentSetupWizardReceiptGap {
+  readonly stepId: string;
+  readonly stepLabel: string;
+  readonly requiredReceipt: string;
+  readonly summary: string;
+}
+
 export interface AgentSetupWizardCloseout {
   readonly status: AgentSetupWizardCloseoutStatus;
   readonly label: string;
@@ -107,6 +160,8 @@ export interface AgentSetupWizard {
   readonly reviewRoute: string;
   readonly repeatedBlocker: AgentSetupWizardRepeatedBlocker | null;
   readonly smokeHistory: AgentSetupWizardSmokeHistory;
+  readonly stepHistory: readonly AgentSetupWizardStepHistoryEntry[];
+  readonly receiptGaps: readonly AgentSetupWizardReceiptGap[];
   readonly closeout: AgentSetupWizardCloseout;
   readonly checkpoint: AgentSetupWizardCheckpoint;
   readonly steps: readonly AgentSetupWizardStep[];
@@ -120,6 +175,8 @@ export interface BuildAgentSetupWizardInput {
   readonly setupMarkerExists?: boolean;
   readonly finishRoute?: string;
   readonly finishUserRoute?: string;
+  readonly receiptRequiredStepIds?: readonly string[];
+  readonly durableReceipts?: readonly AgentSetupWizardDurableReceipt[];
   readonly repeatedBlockerAliases?: Readonly<Record<string, readonly string[]>>;
   readonly reviewRoute?: string;
 }
@@ -305,9 +362,168 @@ function buildStep(item: AgentSetupWizardSourceItem, currentId: string | null):
   };
 }
 
+function validIso(value: string | null | undefined): string | null {
+  if (!value || Number.isNaN(Date.parse(value))) return null;
+  return new Date(value).toISOString();
+}
+
+function setupReceiptKind(stepId: string): string {
+  if (stepId === 'runtime' || stepId === 'connected-host-readiness') return 'connected-host service status receipt';
+  if (stepId === 'connected-host-auth') return 'connected-host auth receipt';
+  if (stepId === 'install-smoke') return 'setup smoke evidence receipt';
+  if (stepId === 'browser-pwa') return 'connected-host browser/PWA first-run receipt';
+  return 'durable setup receipt';
+}
+
+function setupStepAliases(stepId: string): readonly string[] {
+  if (stepId === 'runtime' || stepId === 'connected-host-readiness') return ['runtime', 'connected-host-readiness'];
+  return [stepId];
+}
+
+function setupStepMatches(left: string, right: string): boolean {
+  const leftAliases = new Set(setupStepAliases(left));
+  return setupStepAliases(right).some((alias) => leftAliases.has(alias));
+}
+
+function durableReceiptSatisfies(receipt: AgentSetupWizardDurableReceipt): boolean {
+  return receipt.status === 'ready' && Boolean(validIso(receipt.recordedAt)) && receipt.receiptId.trim().length > 0;
+}
+
+export function setupStepHasSatisfyingReceipt(
+  receipts: readonly AgentSetupWizardDurableReceipt[],
+  stepId: string,
+): boolean {
+  return receipts.some((receipt) => durableReceiptSatisfies(receipt) && setupStepMatches(stepId, receipt.stepId));
+}
+
+function latestSatisfyingReceipt(
+  receipts: readonly AgentSetupWizardDurableReceipt[],
+  stepId: string,
+): AgentSetupWizardDurableReceipt | null {
+  return receipts
+    .filter((receipt) => durableReceiptSatisfies(receipt) && setupStepMatches(stepId, receipt.stepId))
+    .sort((left, right) => Date.parse(right.recordedAt) - Date.parse(left.recordedAt) || left.receiptId.localeCompare(right.receiptId))[0] ?? null;
+}
+
+function applyDurableReceiptStatus(
+  items: readonly AgentSetupWizardSourceItem[],
+  receipts: readonly AgentSetupWizardDurableReceipt[],
+): readonly AgentSetupWizardSourceItem[] {
+  if (receipts.length === 0) return items;
+  return items.map((item) => {
+    const receipt = latestSatisfyingReceipt(receipts, item.id);
+    if (!receipt) return item;
+    return {
+      ...item,
+      status: 'ready',
+      detail: `${item.detail} Durable receipt ${receipt.receiptId}: ${receipt.summary}`,
+    };
+  });
+}
+
+function buildStepHistory(input: {
+  readonly items: readonly AgentSetupWizardSourceItem[];
+  readonly smokeHistory: AgentSetupWizardSmokeHistory;
+  readonly checkpoint: AgentSetupWizardCheckpoint;
+  readonly durableReceipts: readonly AgentSetupWizardDurableReceipt[];
+}): readonly AgentSetupWizardStepHistoryEntry[] {
+  const byId = new Map(input.items.map((item) => [item.id, item]));
+  const history: AgentSetupWizardStepHistoryEntry[] = [];
+
+  const checkpointAt = validIso(input.checkpoint.savedAt);
+  if (input.checkpoint.status === 'available' && input.checkpoint.currentStepId && checkpointAt) {
+    const item = byId.get(input.checkpoint.currentStepId);
+    const stepLabel = item?.label ?? input.checkpoint.currentStepLabel ?? input.checkpoint.currentStepId;
+    const receiptId = `setup-wizard-checkpoint:${input.checkpoint.currentStepId}:${checkpointAt}`;
+    history.push({
+      id: `setup-step-history:${input.checkpoint.currentStepId}:checkpoint:${checkpointAt}`,
+      stepId: input.checkpoint.currentStepId,
+      stepLabel,
+      kind: 'checkpoint',
+      receiptId,
+      recordedAt: checkpointAt,
+      summary: `Saved checkpoint for ${stepLabel}.`,
+      inspectRoute: input.checkpoint.inspectRoute,
+      source: input.checkpoint.source ?? undefined,
+      satisfiesReceipt: false,
+    });
+  }
+
+  const smokeAt = validIso(input.smokeHistory.latestEvidenceAt);
+  if (input.smokeHistory.latestEvidenceId && smokeAt) {
+    const item = byId.get('install-smoke');
+    const result = input.smokeHistory.latestResult ?? 'unknown';
+    const ready = result === 'ready-for-user-run';
+    history.push({
+      id: `setup-step-history:install-smoke:setup-smoke:${input.smokeHistory.latestEvidenceId}`,
+      stepId: 'install-smoke',
+      stepLabel: item?.label ?? 'Install smoke',
+      kind: 'setup-smoke',
+      receiptId: input.smokeHistory.latestEvidenceId,
+      recordedAt: smokeAt,
+      summary: `Latest setup smoke evidence is ${result}.`,
+      inspectRoute: input.smokeHistory.inspectLatestRoute,
+      source: 'agent-setup-smoke-evidence',
+      receiptStatus: result,
+      satisfiesReceipt: ready,
+    });
+  }
+
+  for (const receipt of input.durableReceipts) {
+    const recordedAt = validIso(receipt.recordedAt);
+    if (!recordedAt || receipt.receiptId.trim().length === 0) continue;
+    const item = input.items.find((candidate) => setupStepMatches(candidate.id, receipt.stepId));
+    const stepLabel = receipt.stepLabel ?? item?.label ?? receipt.stepId;
+    history.push({
+      id: `setup-step-history:${receipt.stepId}:durable-receipt:${receipt.receiptId}`,
+      stepId: receipt.stepId,
+      stepLabel,
+      kind: 'durable-receipt',
+      receiptId: receipt.receiptId,
+      recordedAt,
+      summary: receipt.summary,
+      inspectRoute: receipt.inspectRoute,
+      source: receipt.source,
+      receiptStatus: receipt.status,
+      satisfiesReceipt: durableReceiptSatisfies(receipt),
+      schemaStatus: receipt.schemaStatus,
+      schemaVersion: receipt.schemaVersion,
+      provenance: receipt.provenance,
+      publicationGuarantee: receipt.publicationGuarantee,
+      eventCursor: receipt.eventCursor,
+      eventSequence: receipt.eventSequence,
+      publisher: receipt.publisher,
+    });
+  }
+
+  return history.sort((left, right) => Date.parse(right.recordedAt) - Date.parse(left.recordedAt) || left.id.localeCompare(right.id));
+}
+
+function buildReceiptGaps(input: {
+  readonly items: readonly AgentSetupWizardSourceItem[];
+  readonly stepHistory: readonly AgentSetupWizardStepHistoryEntry[];
+  readonly receiptRequiredStepIds: readonly string[];
+}): readonly AgentSetupWizardReceiptGap[] {
+  return input.receiptRequiredStepIds
+    .filter((stepId) => !input.stepHistory.some((entry) => entry.satisfiesReceipt === true && setupStepMatches(stepId, entry.stepId)))
+    .map((stepId) => {
+      const item = input.items.find((candidate) => candidate.id === stepId);
+      const stepLabel = item?.label ?? stepId;
+      const requiredReceipt = setupReceiptKind(stepId);
+      return {
+        stepId,
+        stepLabel,
+        requiredReceipt,
+        summary: `${stepLabel} still needs a stable ${requiredReceipt} id and timestamp before release closeout can count it as durable setup evidence.`,
+      };
+    });
+}
+
 function buildCloseout(input: {
   readonly items: readonly AgentSetupWizardSourceItem[];
   readonly smokeHistory: AgentSetupWizardSmokeHistory;
+  readonly setupSmokeReceiptReady: boolean;
+  readonly stepHistory: readonly AgentSetupWizardStepHistoryEntry[];
   readonly criticalStepIds: readonly string[];
   readonly setupMarkerExists: boolean;
   readonly reviewRoute: string;
@@ -318,14 +534,21 @@ function buildCloseout(input: {
   const primaryBlocker = input.items.find((item) => (
     critical.has(item.id) && item.status === 'blocked'
   )) ?? null;
-  const smokeReady = input.smokeHistory.status === 'available' && input.smokeHistory.latestResult === 'ready-for-user-run';
+  const smokeReady = input.setupSmokeReceiptReady
+    || (input.smokeHistory.status === 'available' && input.smokeHistory.latestResult === 'ready-for-user-run');
   const latestSmoke = input.smokeHistory.status === 'available'
     ? input.smokeHistory.latestResult ?? 'unknown'
-    : input.smokeHistory.status;
+    : input.setupSmokeReceiptReady ? 'durable receipt ready' : input.smokeHistory.status;
+  const satisfyingSetupReceipts = input.stepHistory.filter((entry) => entry.kind === 'durable-receipt' && entry.satisfiesReceipt === true);
+  const certifiedSetupReceipts = satisfyingSetupReceipts.filter((entry) => entry.schemaStatus === 'certified');
+  const eventStreamSetupReceipts = satisfyingSetupReceipts.filter((entry) => entry.eventCursor);
   const evidence = [
     `critical setup blockers: ${primaryBlocker ? `${primaryBlocker.label} (${primaryBlocker.status})` : 'none'}`,
     `setup marker: ${input.setupMarkerExists ? 'present' : 'missing'}`,
     `latest setup smoke: ${latestSmoke}`,
+    `setup smoke receipt: ${input.setupSmokeReceiptReady ? 'ready' : 'missing'}`,
+    `certified setup receipts: ${certifiedSetupReceipts.length}/${satisfyingSetupReceipts.length}`,
+    `setup receipt event streams: ${eventStreamSetupReceipts.length}`,
     `setup smoke history: ${input.smokeHistory.status}; total ${input.smokeHistory.total}; trend ${input.smokeHistory.trend}`,
   ];
   const policy = 'Setup closeout is advisory until a confirmed finish route writes the local onboarding marker. Optional setup recommendations do not block closeout, but unresolved critical blockers or missing ready setup smoke evidence do.';
@@ -401,14 +624,23 @@ function buildCloseout(input: {
 export function buildAgentSetupWizard(input: BuildAgentSetupWizardInput): AgentSetupWizard {
   const smokeHistory = input.smokeHistory ?? emptyAgentSetupSmokeHistory();
   const inputCheckpoint = input.checkpoint ?? emptyAgentSetupWizardCheckpoint();
-  const repeated = itemFromRepeatedBlockers(input.items, smokeHistory, input.repeatedBlockerAliases ?? {});
-  const blocking = firstBlockingItem(input.items);
-  const rawCheckpointItem = itemFromCheckpoint(input.items, inputCheckpoint);
+  const durableReceipts = input.durableReceipts ?? [];
+  const items = applyDurableReceiptStatus(input.items, durableReceipts);
+  const repeated = itemFromRepeatedBlockers(items, smokeHistory, input.repeatedBlockerAliases ?? {});
+  const blocking = firstBlockingItem(items);
+  const rawCheckpointItem = itemFromCheckpoint(items, inputCheckpoint);
   const checkpointItem = blocking && rawCheckpointItem?.id !== blocking.id ? null : rawCheckpointItem;
-  const checkpoint = buildCheckpoint(inputCheckpoint, input.items, checkpointItem, blocking);
-  const current = repeated?.item ?? blocking ?? checkpointItem ?? firstAttentionItem(input.items);
+  const checkpoint = buildCheckpoint(inputCheckpoint, items, checkpointItem, blocking);
+  const current = repeated?.item ?? blocking ?? checkpointItem ?? firstAttentionItem(items);
   const currentId = current?.id ?? null;
-  const steps = input.items.map((item) => buildStep(item, currentId));
+  const steps = items.map((item) => buildStep(item, currentId));
+  const stepHistory = buildStepHistory({ items, smokeHistory, checkpoint, durableReceipts });
+  const setupSmokeReceiptReady = stepHistory.some((entry) => entry.satisfiesReceipt === true && setupStepMatches('install-smoke', entry.stepId));
+  const receiptGaps = buildReceiptGaps({
+    items,
+    stepHistory,
+    receiptRequiredStepIds: input.receiptRequiredStepIds ?? [],
+  });
   const completedSteps = steps.filter((step) => step.status === 'done').length;
   const status: AgentSetupWizardStatus = completedSteps === steps.length
     ? 'complete'
@@ -432,9 +664,13 @@ export function buildAgentSetupWizard(input: BuildAgentSetupWizardInput): AgentS
     reviewRoute: input.reviewRoute ?? DEFAULT_AGENT_SETUP_WIZARD_REVIEW_ROUTE,
     repeatedBlocker: repeated?.blocker ?? null,
     smokeHistory,
+    stepHistory,
+    receiptGaps,
     closeout: buildCloseout({
-      items: input.items,
+      items,
       smokeHistory,
+      setupSmokeReceiptReady,
+      stepHistory,
       criticalStepIds: input.closeoutCriticalStepIds ?? [],
       setupMarkerExists: input.setupMarkerExists === true,
       reviewRoute: input.reviewRoute ?? DEFAULT_AGENT_SETUP_WIZARD_REVIEW_ROUTE,

package/src/input/agent-workspace-categories.ts

@@ -455,8 +455,8 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
     detail: 'Voice, media, browser tools, and image-capable flows are first-class Agent tools. Connected-host administration stays outside Agent and side effects stay explicit.',
     actions: [
       { id: 'voice-workflow-posture', label: 'Voice workflows', detail: 'Inspect push-to-talk, voice memo transcription, spoken responses, and wake-word readiness with device action:"voice".', kind: 'guidance', safety: 'read-only' },
-      { id: 'device-capability-map', label: 'Device capability map', detail: 'Inspect pairing, mobile command routing, browser/PWA, notifications, browser/desktop control, and camera/location readiness with device action:"status" without claiming unpublished contracts.', kind: 'guidance', safety: 'read-only' },
-      { id: 'browser-cockpit-readiness', label: 'Browser/PWA readiness', detail: 'Inspect the connected browser cockpit/PWA route, workspace category coverage, mobile controls, and first-run receipt gaps with computer action:"browser" before opening a browser.', kind: 'guidance', safety: 'read-only' },
+      { id: 'device-capability-map', label: 'Device capability map', detail: 'Inspect pairing, mobile command routing, browser/PWA, notifications, browser/desktop control, and certified camera/location readiness with device action:"status" without claiming uncertified contracts.', kind: 'guidance', safety: 'read-only' },
+      { id: 'browser-cockpit-readiness', label: 'Browser/PWA readiness', detail: 'Inspect the connected browser cockpit/PWA route, certified workspace category coverage, mobile controls, and first-run receipt evidence with computer action:"browser" before opening a browser.', kind: 'guidance', safety: 'read-only' },
       { id: 'tts-config', label: 'Configure live TTS', detail: 'Open the settings workspace at the TTS group.', command: '/config tts', kind: 'command', safety: 'safe' },
       { id: 'tts-provider', label: 'Choose TTS provider', detail: 'Open provider/model routing for spoken responses through the settings flow.', command: '/config tts.provider', kind: 'command', safety: 'safe' },
       { id: 'voice-review', label: 'Voice review', detail: 'Inspect local voice posture before enabling spoken interaction.', command: '/voice review', kind: 'command', safety: 'read-only' },

package/src/input/agent-workspace-onboarding-categories.ts

@@ -103,10 +103,10 @@ export const AGENT_WORKSPACE_ONBOARDING_DETAIL_CATEGORIES: readonly AgentWorkspa
     summary: 'Create/import memory, personas, skills, routines, notes, and Knowledge.',
     detail: 'Use this page to seed the assistant with durable local context. These forms create Agent-owned records or ingest reviewed sources.',
     actions: [
-      { id: 'context-vibe-status', label: 'Inspect VIBE.md', detail: 'Show project/global VIBE.md personality files, blocked files, and init paths before relying on a custom assistant feel.', command: '/vibe status', kind: 'command', safety: 'read-only' },
-      { id: 'context-project-files', label: 'Inspect project context', detail: 'List secret-scanned .hermes.md, HERMES.md, AGENTS.md, CLAUDE.md, SOUL.md, and Cursor context files with blocked/truncated status.', command: 'context action:"files"', kind: 'guidance', safety: 'read-only' },
-      { id: 'context-project-file', label: 'Inspect one context file', detail: 'Inspect one loaded or blocked project context file by id, target, or query through the read-only context-file route.', command: 'context action:"file"', kind: 'guidance', safety: 'read-only' },
-      { id: 'context-prompt-context', label: 'Prompt context', detail: 'Inspect the applied prompt context order, selected memory/persona/skill/routine records, suppressed context, and approximate token budget.', command: 'context action:"prompt"', kind: 'guidance', safety: 'read-only' },
+      { id: 'context-vibe-status', label: 'Inspect VIBE.md', detail: 'Show project/global VIBE.md personality files, blocked files, and init paths before relying on a custom assistant feel.', kind: 'guidance', safety: 'read-only' },
+      { id: 'context-project-files', label: 'Inspect project context', detail: 'List secret-scanned .hermes.md, HERMES.md, AGENTS.md, CLAUDE.md, SOUL.md, and Cursor context files with blocked/truncated status.', kind: 'guidance', safety: 'read-only' },
+      { id: 'context-project-file', label: 'Inspect one context file', detail: 'Inspect one loaded or blocked project context file by id, target, or query through the read-only context-file control.', kind: 'guidance', safety: 'read-only' },
+      { id: 'context-prompt-context', label: 'Prompt context', detail: 'Inspect the applied prompt context order, selected memory/persona/skill/routine records, suppressed context, and approximate token budget.', kind: 'guidance', safety: 'read-only' },
       { id: 'context-profile-from-discovered', label: 'Profile from discovered files', detail: 'Create an isolated Agent profile from reviewed local persona, skill, and routine files.', editorKind: 'profile-from-discovered', kind: 'editor', safety: 'safe' },
       { id: 'context-persona-discovery', label: 'Import persona files', detail: 'Import discovered persona files into the Agent persona registry.', editorKind: 'persona-discovery-import', kind: 'editor', safety: 'safe' },
       { id: 'context-skill-discovery', label: 'Import skill files', detail: 'Import discovered skill files into the Agent skill registry.', editorKind: 'skill-discovery-import', kind: 'editor', safety: 'safe' },

package/src/input/agent-workspace-settings.ts

@@ -173,10 +173,31 @@ function valuesMatch(left: unknown, right: unknown): boolean {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 
+function isSecretLikeSettingKey(key: string): boolean {
+  const normalized = key.replace(/([a-z0-9])([A-Z])/g, '$1.$2').toLowerCase();
+  if (normalized.endsWith('secret.policy')) return false;
+  return /(?:secret|token|password|api[-_.]?key|api\.key|signing)/i.test(normalized);
+}
+
+function compactSettingValue(key: string, value: unknown): string {
+  if (value === undefined || value === null) return '(unset)';
+  if (isSecretLikeSettingKey(key)) return value === '' ? '(empty)' : '(secret)';
+  if (typeof value === 'boolean') return value ? 'true' : 'false';
+  if (typeof value === 'number') return Number.isFinite(value) ? String(value) : '(invalid)';
+  if (typeof value === 'string') {
+    if (value.length === 0) return '(empty)';
+    if (value.startsWith('goodvibes://secrets/')) return '(secret)';
+    return value.length > 36 ? `${value.slice(0, 33)}...` : value;
+  }
+  if (Array.isArray(value)) return `[${value.length} item${value.length === 1 ? '' : 's'}]`;
+  if (isRecord(value)) return '{...}';
+  return String(value);
+}
+
 function redactImportValue(key: string, value: unknown): unknown {
   if (typeof value !== 'string') return value;
   if (!value) return value;
-  if (/(?:secret|token|password|api[-_.]?key|signing)/i.test(key)) {
+  if (isSecretLikeSettingKey(key)) {
     return value.startsWith('goodvibes://secrets/') ? '<secret-ref>' : '<redacted>';
   }
   return value;
@@ -369,6 +390,36 @@ export function buildAgentWorkspaceSettingActionEffect(
   };
 }
 
+export function buildAgentWorkspaceSettingActionPreview(
+  context: CommandContext | null,
+  action: AgentWorkspaceAction,
+): string | null {
+  const settingKey = action.settingKey?.trim();
+  const configManager = context?.platform?.configManager;
+  if (!settingKey || !configManager) return null;
+
+  const setting = agentWorkspaceSettingSchema(context, settingKey);
+  const currentValue = configManager.get(settingKey as ConfigKey);
+  let proposedValue: unknown;
+
+  if (action.settingValueHint !== undefined) {
+    proposedValue = action.settingValueHint;
+  } else if (setting?.type === 'boolean') {
+    proposedValue = !Boolean(currentValue);
+  } else if (setting?.type === 'enum' && setting.enumValues && setting.enumValues.length > 0) {
+    const currentIndex = Math.max(0, setting.enumValues.indexOf(String(currentValue)));
+    proposedValue = setting.enumValues[(currentIndex + 1) % setting.enumValues.length]!;
+  } else if (setting?.type === 'number' || setting?.type === 'string') {
+    proposedValue = 'edit value';
+  } else if (typeof currentValue === 'boolean') {
+    proposedValue = !currentValue;
+  } else {
+    proposedValue = 'choose value';
+  }
+
+  return `${settingKey}: ${compactSettingValue(settingKey, currentValue)} -> ${compactSettingValue(settingKey, proposedValue)}`;
+}
+
 export async function applyAgentWorkspaceSettingValue(
   context: CommandContext | null,
   setting: ConfigSetting,

package/src/input/agent-workspace-setup-snapshot.ts

@@ -2,7 +2,7 @@ import type { ArtifactDescriptor } from '@pellux/goodvibes-sdk/platform/artifact
 import type { CommandContext } from './command-registry.ts';
 import { readSetupWizardCheckpoint } from '../agent/setup-wizard-checkpoint.ts';
 import { readOnboardingCompletionMarker } from '../runtime/onboarding/index.ts';
-import { DEFAULT_AGENT_SETUP_WIZARD_CLEAR_CHECKPOINT_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_INSPECT_CHECKPOINT_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_MARK_CHECKPOINT_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_RERUN_SMOKE_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_SAVE_SMOKE_ROUTE, buildAgentSetupWizard, emptyAgentSetupSmokeHistory, emptyAgentSetupWizardCheckpoint, type AgentSetupWizard, type AgentSetupWizardBlockedCheckFrequency, type AgentSetupWizardCheckpoint, type AgentSetupWizardSmokeHistory, type AgentSetupWizardSourceItem } from '../agent/setup-wizard.ts';
+import { DEFAULT_AGENT_SETUP_WIZARD_CLEAR_CHECKPOINT_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_INSPECT_CHECKPOINT_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_MARK_CHECKPOINT_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_RERUN_SMOKE_ROUTE, DEFAULT_AGENT_SETUP_WIZARD_SAVE_SMOKE_ROUTE, buildAgentSetupWizard, emptyAgentSetupSmokeHistory, emptyAgentSetupWizardCheckpoint, type AgentSetupWizard, type AgentSetupWizardBlockedCheckFrequency, type AgentSetupWizardCheckpoint, type AgentSetupWizardDurableReceipt, type AgentSetupWizardSmokeHistory, type AgentSetupWizardSourceItem } from '../agent/setup-wizard.ts';
 import type { AgentWorkspaceSetupChecklistItem } from './agent-workspace-setup.ts';
 import { readArtifactMetadataString, readArtifactMetadataStringList } from './agent-workspace-artifact-metadata.ts';
 
@@ -30,6 +30,12 @@ function setupSmokeEvidenceTrend(artifacts: readonly ArtifactDescriptor[]): stri
   return 'unchanged';
 }
 
+function artifactCreatedAtIso(artifact: ArtifactDescriptor): string | null {
+  const createdAt = artifact.createdAt;
+  if (typeof createdAt !== 'number' || !Number.isFinite(createdAt)) return null;
+  return new Date(createdAt).toISOString();
+}
+
 function setupSmokeBlockedCheckFrequency(artifacts: readonly ArtifactDescriptor[]): readonly AgentSetupWizardBlockedCheckFrequency[] {
   const counts = new Map<string, number>();
   for (const artifact of artifacts) {
@@ -67,6 +73,8 @@ export function buildSetupSmokeHistory(artifacts: readonly ArtifactDescriptor[],
     trend: setupSmokeEvidenceTrend(setupSmokeArtifacts),
     latestResult: readArtifactMetadataString(latest.metadata, 'result') || 'unknown',
     previousResult: previous ? readArtifactMetadataString(previous.metadata, 'result') || 'unknown' : null,
+    latestEvidenceId: latest.id,
+    latestEvidenceAt: artifactCreatedAtIso(latest),
     resultCounts,
     blockedCheckFrequency: setupSmokeBlockedCheckFrequency(setupSmokeArtifacts),
     inspectLatestRoute: `agent_artifacts show artifactId:"${latest.id}" includeContent:false`,
@@ -136,6 +144,7 @@ function setupChecklistModelRoute(item: AgentWorkspaceSetupChecklistItem): strin
   if (item.id === 'memory') return 'memory action:"status"';
   if (item.id === 'notes') return 'personal_ops action:"lane" laneId:"notes"';
   if (item.id === 'channels') return 'channels action:"status"';
+  if (item.id === 'browser-pwa') return 'computer action:"browser" includeParameters:true';
   if (item.id === 'voice-media') return 'device action:"voice"';
   return `agent_harness mode:"setup_item" setupItemId:"${item.id}"`;
 }
@@ -149,6 +158,7 @@ function setupChecklistActionId(item: AgentWorkspaceSetupChecklistItem): string
   if (item.id === 'skills') return 'skill-search';
   if (item.id === 'routines') return 'routine-search';
   if (item.id === 'channels') return 'channel-show';
+  if (item.id === 'browser-pwa') return 'browser-cockpit-readiness';
   if (item.id === 'voice-media') return 'voice-enable';
   return item.id;
 }
@@ -167,7 +177,9 @@ export function buildWorkspaceSetupWizard(
   smokeHistory: AgentSetupWizardSmokeHistory,
   checkpoint: AgentSetupWizardCheckpoint,
   setupMarkerExists: boolean,
+  durableReceipts: readonly AgentSetupWizardDurableReceipt[] = [],
 ): AgentSetupWizard {
+  const browserPwaNeedsReceipt = checklist.some((item) => item.id === 'browser-pwa' && item.status !== 'ready');
   const items: AgentSetupWizardSourceItem[] = checklist.map((item) => ({
     id: item.id,
     label: item.label,
@@ -182,6 +194,13 @@ export function buildWorkspaceSetupWizard(
     smokeHistory,
     checkpoint,
     closeoutCriticalStepIds: ['runtime', 'connected-host-auth', 'provider-model'],
+    receiptRequiredStepIds: [
+      'runtime',
+      'connected-host-auth',
+      'install-smoke',
+      ...(browserPwaNeedsReceipt ? ['browser-pwa'] : []),
+    ],
+    durableReceipts,
     setupMarkerExists,
     repeatedBlockerAliases: SETUP_WIZARD_SNAPSHOT_BLOCKER_ALIASES,
   });

package/src/input/agent-workspace-setup.ts

@@ -18,6 +18,7 @@ export interface AgentWorkspaceSetupChecklistInput {
   readonly connectedHostTokenReadable: boolean;
   readonly connectedHostTokenPath: string;
   readonly connectedHostTokenError?: string | null;
+  readonly connectedHostAuthReceiptReady?: boolean;
   readonly activeSubscriptionCount: number;
   readonly pendingSubscriptionCount: number;
   readonly availableSubscriptionProviderCount: number;
@@ -41,6 +42,10 @@ export interface AgentWorkspaceSetupChecklistInput {
   readonly readyChannelCount: number;
   readonly voiceProviderCount: number;
   readonly mediaProviderCount: number;
+  readonly installSmokeReceiptReady?: boolean;
+  readonly browserPwaEnabled: boolean;
+  readonly browserPwaPublicBaseUrl: string;
+  readonly browserPwaFirstRunReceiptStatus: 'published' | 'not-published';
   readonly runtimeProfileCount: number;
   readonly runtimeStarterTemplateCount: number;
 }
@@ -58,14 +63,19 @@ function sampleNames(summary: AgentBehaviorDiscoverySummary): string {
 export function buildAgentWorkspaceSetupChecklist(input: AgentWorkspaceSetupChecklistInput): readonly AgentWorkspaceSetupChecklistItem[] {
   const providerReady = input.provider !== 'unknown' && input.model !== 'unknown';
   const tokenPathKnown = input.connectedHostTokenPath !== '(Agent home unavailable)';
-  const connectedHostAuthStatus: AgentWorkspaceSetupStatus = input.connectedHostTokenReadable
+  const connectedHostAuthReceiptReady = input.connectedHostAuthReceiptReady === true;
+  const connectedHostAuthStatus: AgentWorkspaceSetupStatus = input.connectedHostTokenReadable || connectedHostAuthReceiptReady
     ? 'ready'
     : tokenPathKnown
       ? 'blocked'
       : 'recommended';
-  const installSmokeReady = providerReady && input.connectedHostTokenReadable;
+  const installSmokePrerequisitesReady = providerReady && (input.connectedHostTokenReadable || connectedHostAuthReceiptReady);
+  const installSmokeReceiptReady = input.installSmokeReceiptReady === true;
   const hasActivePersona = input.activePersonaName !== '(none)' && input.activePersonaName !== '(unavailable)';
   const discoveredBehaviorCount = input.discoveredPersonas.count + input.discoveredSkills.count + input.discoveredRoutines.count;
+  const browserPwaUrl = input.browserPwaPublicBaseUrl.trim();
+  const browserPwaHasPublicUrl = browserPwaUrl.length > 0 && browserPwaUrl !== '(not configured)';
+  const browserPwaReceiptPublished = input.browserPwaFirstRunReceiptStatus === 'published';
   return [
     {
       id: 'runtime',
@@ -78,7 +88,9 @@ export function buildAgentWorkspaceSetupChecklist(input: AgentWorkspaceSetupChec
       id: 'connected-host-auth',
       label: 'Connected-host auth',
       status: connectedHostAuthStatus,
-      detail: input.connectedHostTokenReadable
+      detail: connectedHostAuthReceiptReady
+        ? `Durable connected-host auth receipt is ready${input.connectedHostTokenReadable ? ` and Agent has a readable operator token at ${input.connectedHostTokenPath}` : ''}.`
+        : input.connectedHostTokenReadable
         ? `Agent has a readable connected-host operator token at ${input.connectedHostTokenPath}.`
         : input.connectedHostTokenError
           ? `The connected-host operator token exists but cannot be read at ${input.connectedHostTokenPath}. Use the confirmed setup token provisioning route, then rerun auth review.`
@@ -99,8 +111,10 @@ export function buildAgentWorkspaceSetupChecklist(input: AgentWorkspaceSetupChec
     {
       id: 'install-smoke',
       label: 'Install smoke',
-      status: installSmokeReady ? 'recommended' : tokenPathKnown ? 'blocked' : 'recommended',
-      detail: installSmokeReady
+      status: installSmokeReceiptReady ? 'ready' : installSmokePrerequisitesReady ? 'recommended' : tokenPathKnown ? 'blocked' : 'recommended',
+      detail: installSmokeReceiptReady
+        ? 'Durable setup smoke receipt is ready for release closeout; rerun smoke only after install, host, auth, or model changes.'
+        : installSmokePrerequisitesReady
         ? 'Run setup smoke after install or migration to prove package start, connected host, auth, model route, setup posture, and first assistant turn.'
         : 'Resolve connected-host auth and provider/model setup before treating the first assistant turn as install-ready.',
       command: 'Start -> Install smoke',
@@ -208,6 +222,19 @@ export function buildAgentWorkspaceSetupChecklist(input: AgentWorkspaceSetupChec
         : 'Pair or review channels only when you want the assistant reachable outside this terminal.',
       command: 'Channels',
     },
+    {
+      id: 'browser-pwa',
+      label: 'Browser/PWA',
+      status: browserPwaReceiptPublished ? 'ready' : 'recommended',
+      detail: browserPwaReceiptPublished
+        ? `Connected-host browser/PWA first-run receipt is published${browserPwaHasPublicUrl ? ` for ${browserPwaUrl}` : ''}.`
+        : input.browserPwaEnabled
+          ? browserPwaHasPublicUrl
+            ? `Browser cockpit is openable at ${browserPwaUrl}, but the connected-host browser/PWA first-run completion receipt is not published yet. Terminal Agent remains primary until that receipt exists.`
+            : 'Browser cockpit is enabled through the connected-host web endpoint, but the connected-host browser/PWA first-run completion receipt is not published yet.'
+          : 'Enable the connected-host web endpoint and publish the browser/PWA first-run completion receipt before treating browser access as setup-ready.',
+      command: 'Voice & Media -> Browser/PWA readiness',
+    },
     {
       id: 'voice-media',
       label: 'Voice and media',