@pellux/goodvibes-agent 1.9.1 → 1.10.0

package/src/runtime/daemon-receipts.ts

@@ -0,0 +1,66 @@
+/**
+ * Connected-host receipt delivery.
+ *
+ * The daemon keeps honesty receipts ("updated from X to Y", "restarted
+ * after a crash at HH:MM", settings-migration notes) and delivers the
+ * undelivered ones ONLY to a `/status` read that opts in with
+ * `?receipts=consume` — a plain `/status` read is receipt-neutral. Delivery is
+ * destructive at the daemon (served exactly once to the consuming reader), so
+ * whichever read consumes them must render them or they are lost. The agent's
+ * consuming reader is a single `?receipts=consume` read issued once per attach
+ * (createSpineReceiptConsumer in session-spine-rest-transport.ts, wired through
+ * services.consumeDaemonReceipts); the frequent liveness keepalive probe stays
+ * plain and never touches receipts. Every consumed payload is pushed here.
+ *
+ * This feed buffers receipts captured before the renderer exists (the first
+ * consuming read can fire during boot, before the render sink attaches) and
+ * delivers each receipt exactly once (dedupe by id) as soon as — and whenever —
+ * a delivery sink is attached.
+ */
+
+/** One daemon honesty receipt, as served on the /status body. */
+export interface DaemonReceipt {
+  readonly id: string;
+  readonly text: string;
+  readonly at: number;
+}
+
+/** Parse the receipts array off a /status response body; [] when absent/malformed. */
+export function extractDaemonReceipts(body: unknown): DaemonReceipt[] {
+  if (typeof body !== 'object' || body === null) return [];
+  const receipts = (body as { receipts?: unknown }).receipts;
+  if (!Array.isArray(receipts)) return [];
+  const parsed: DaemonReceipt[] = [];
+  for (const entry of receipts) {
+    if (typeof entry !== 'object' || entry === null) continue;
+    const { id, text, at } = entry as { id?: unknown; text?: unknown; at?: unknown };
+    if (typeof id !== 'string' || id.length === 0 || typeof text !== 'string' || text.length === 0) continue;
+    parsed.push({ id, text, at: typeof at === 'number' ? at : Date.now() });
+  }
+  return parsed;
+}
+
+export class AgentDaemonReceiptFeed {
+  private readonly buffered: DaemonReceipt[] = [];
+  private readonly seen = new Set<string>();
+  private deliver: ((receipt: DaemonReceipt) => void) | null = null;
+
+  /** Ingest receipts from a /status read; buffers until a sink attaches. */
+  push(receipts: readonly DaemonReceipt[]): void {
+    for (const receipt of receipts) {
+      if (this.seen.has(receipt.id)) continue;
+      this.seen.add(receipt.id);
+      if (this.deliver) {
+        this.deliver(receipt);
+      } else {
+        this.buffered.push(receipt);
+      }
+    }
+  }
+
+  /** Attach the rendering sink; anything captured earlier flushes immediately. */
+  attach(deliver: (receipt: DaemonReceipt) => void): void {
+    this.deliver = deliver;
+    for (const receipt of this.buffered.splice(0)) deliver(receipt);
+  }
+}

package/src/runtime/diagnostics/panels/index.ts

@@ -17,7 +17,5 @@ export type { PolicyDiagnosticsSnapshot } from './policy.ts';
 export { ToolContractsPanel } from '@/runtime/index.ts';
 export { TransportPanel } from '@/runtime/index.ts';
 export type { TransportPanelSnapshot } from '@/runtime/index.ts';
-export { OpsPanel } from './ops.ts';
-export type { OpsAuditEntry } from './ops.ts';
 export { SecurityPanel } from '@/runtime/index.ts';
 export type { SecurityPanelSnapshot } from '@/runtime/index.ts';

package/src/runtime/feature-enablement.ts

@@ -0,0 +1,176 @@
+/**
+ * feature-enablement.ts — explicit feature on/off requests over the dissolved
+ * feature model.
+ *
+ * The SDK dissolved the feature-flag category: every capability is enabled
+ * through a first-class settings key in its natural domain (FEATURE_SETTINGS
+ * describes each feature's binding). This module turns an EXPLICIT
+ * present-tense request — "enable feature X" from the CLI or an onboarding
+ * plan — into the domain-key write that honestly fulfills it:
+ * - boolean bindings write the key true/false;
+ * - enum bindings write the canonical enabled value (first enabledValues
+ *   entry) or a schema-honest disabled value;
+ * - constant bindings have no separate off switch, so the request fails with
+ *   the real settings keys to configure instead.
+ *
+ * This intentionally differs from the SDK's load-time MIGRATION of persisted
+ * legacy featureFlags entries (migrateLegacyFeatureToggles preserves
+ * historical AND-of-both-switches ambiguity); an explicit request has no such
+ * ambiguity — the operator wants the feature on or off now.
+ *
+ * Legacy `featureFlags` / `featureFlags.<id>` set-config keys from stored
+ * onboarding plans are accepted and expanded here so old plans keep working
+ * against the domain keys.
+ */
+import {
+  FEATURE_SETTINGS,
+  deriveFeatureState,
+  getFeatureSettingsBinding,
+} from '@/runtime/index.ts';
+import type { FeatureSetting } from '@/runtime/index.ts';
+import { CONFIG_SCHEMA } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigKey, ConfigManager, ConfigSetting } from '../config/index.ts';
+
+export type LegacyFeatureConfigKey = 'featureFlags' | `featureFlags.${string}`;
+
+export type FeatureEnablementRequest = 'enabled' | 'disabled';
+
+/** One domain-key write that fulfills an explicit feature request. */
+export interface FeatureEnablementWrite {
+  readonly key: ConfigKey;
+  readonly value: unknown;
+}
+
+const FEATURE_SETTINGS_BY_ID: ReadonlyMap<string, FeatureSetting> = new Map(
+  FEATURE_SETTINGS.map((feature) => [feature.id, feature]),
+);
+
+const CONFIG_SCHEMA_BY_KEY: ReadonlyMap<string, ConfigSetting> = new Map(
+  CONFIG_SCHEMA.map((setting) => [setting.key, setting]),
+);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+export function isLegacyFeatureConfigKey(key: string): key is LegacyFeatureConfigKey {
+  return key === 'featureFlags' || key.startsWith('featureFlags.');
+}
+
+export function isFeatureEnablementRequest(value: unknown): value is FeatureEnablementRequest {
+  return value === 'enabled' || value === 'disabled';
+}
+
+export function getFeatureSetting(featureId: string): FeatureSetting | null {
+  return FEATURE_SETTINGS_BY_ID.get(featureId) ?? null;
+}
+
+function knownFeatureIdsHint(): string {
+  return FEATURE_SETTINGS.map((feature) => feature.id).join(', ');
+}
+
+/** An enum key's honest "disabled" value: the schema default when it is not an enabled value, else the first non-enabled option. */
+function resolveEnumDisabledValue(feature: FeatureSetting): string {
+  const enabledValues = feature.enablement.enabledValues ?? [];
+  const schema = CONFIG_SCHEMA_BY_KEY.get(feature.enablement.key);
+  const schemaDefault = typeof schema?.default === 'string' ? schema.default : undefined;
+  if (schemaDefault !== undefined && !enabledValues.includes(schemaDefault)) return schemaDefault;
+  const candidate = (schema?.enumValues ?? []).find((value) => !enabledValues.includes(value));
+  if (candidate !== undefined) return candidate;
+  throw new Error(
+    `Feature "${feature.id}" cannot be disabled through ${feature.enablement.key}: `
+    + 'every allowed value keeps it enabled.',
+  );
+}
+
+/**
+ * The domain-key write that fulfills an explicit enable/disable request for
+ * one feature. Throws with real guidance for unknown ids and for constant
+ * bindings (whose own domain keys govern activation directly).
+ */
+export function resolveFeatureEnablementWrite(
+  featureId: string,
+  desired: FeatureEnablementRequest,
+): FeatureEnablementWrite {
+  const feature = FEATURE_SETTINGS_BY_ID.get(featureId);
+  if (!feature) {
+    throw new Error(`Unknown feature "${featureId}". Known features: ${knownFeatureIdsHint()}.`);
+  }
+  const { key, kind, enabledValues } = feature.enablement;
+  if (kind === 'boolean') {
+    return { key, value: desired === 'enabled' };
+  }
+  if (kind === 'enum') {
+    if (desired === 'enabled') {
+      const canonical = enabledValues?.[0];
+      if (canonical === undefined) {
+        throw new Error(`Feature "${featureId}" has no enabled value declared for ${key}.`);
+      }
+      return { key, value: canonical };
+    }
+    return { key, value: resolveEnumDisabledValue(feature) };
+  }
+  // constant: always available; its associated domain keys govern activation.
+  throw new Error(
+    `Feature "${featureId}" is always available and has no separate on/off switch; `
+    + `configure its settings directly: ${feature.settings.join(', ')}.`,
+  );
+}
+
+/** Whether a feature is currently enabled, derived from its bound domain settings key. */
+export function isFeatureEnabledInConfig(
+  config: Pick<ConfigManager, 'get'>,
+  featureId: string,
+): boolean {
+  const binding = getFeatureSettingsBinding(featureId);
+  if (!binding) return false;
+  return deriveFeatureState(binding, config.get(binding.key)) === 'enabled';
+}
+
+/**
+ * Expand a legacy `featureFlags` / `featureFlags.<id>` set-config value into
+ * the domain-key writes that fulfill it. Validates shape with the historical
+ * error wording; unknown ids and constant bindings throw with real guidance.
+ */
+export function expandLegacyFeatureConfigValue(
+  key: LegacyFeatureConfigKey,
+  value: unknown,
+): readonly FeatureEnablementWrite[] {
+  if (key === 'featureFlags') {
+    if (!isRecord(value)) throw new Error('featureFlags expects an object value.');
+    const writes: FeatureEnablementWrite[] = [];
+    for (const [featureId, state] of Object.entries(value)) {
+      if (featureId.trim().length === 0) throw new Error('featureFlags cannot contain an empty feature id.');
+      if (!isFeatureEnablementRequest(state)) {
+        throw new Error(`featureFlags.${featureId} expects enabled or disabled.`);
+      }
+      writes.push(resolveFeatureEnablementWrite(featureId, state));
+    }
+    return writes;
+  }
+
+  const featureId = key.slice('featureFlags.'.length);
+  if (featureId.trim().length === 0) throw new Error('featureFlags requires a feature id.');
+  if (!isFeatureEnablementRequest(value)) {
+    throw new Error(`Config key ${key} expects enabled or disabled.`);
+  }
+  return [resolveFeatureEnablementWrite(featureId, value)];
+}
+
+/**
+ * The feature ids a legacy set-config operation addresses (for verification:
+ * each id's DERIVED state must match the requested one after apply).
+ */
+export function legacyFeatureConfigTargets(
+  key: LegacyFeatureConfigKey,
+  value: unknown,
+): ReadonlyArray<{ readonly featureId: string; readonly desired: FeatureEnablementRequest }> {
+  if (key === 'featureFlags') {
+    if (!isRecord(value)) return [];
+    return Object.entries(value)
+      .filter((entry): entry is [string, FeatureEnablementRequest] => isFeatureEnablementRequest(entry[1]))
+      .map(([featureId, desired]) => ({ featureId, desired }));
+  }
+  const featureId = key.slice('featureFlags.'.length);
+  return isFeatureEnablementRequest(value) ? [{ featureId, desired: value }] : [];
+}

package/src/runtime/index.ts

@@ -13,10 +13,6 @@ import {
   shell,
   transport,
 } from '@pellux/goodvibes-sdk/platform/runtime';
-import {
-  createFeatureFlagManager as createSdkFeatureFlagManager,
-  FEATURE_FLAG_MAP,
-} from '@pellux/goodvibes-sdk/platform/runtime/state';
 import { existsSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import type {
@@ -26,7 +22,6 @@ import type {
   shell as Shell,
   transport as Transport,
 } from '@pellux/goodvibes-sdk/platform/runtime';
-import type { FeatureFlagManager, FlagConfig } from '@pellux/goodvibes-sdk/platform/runtime/state';
 
 // Local runtime entry points.
 export { bootstrapRuntime } from './bootstrap.ts';
@@ -35,22 +30,10 @@ export type { BootstrapContext } from './bootstrap.ts';
 export { createUiRuntimeServices } from './ui-services.ts';
 export type { UiRuntimeServices } from './ui-services.ts';
 
-export function createFeatureFlagManager(): FeatureFlagManager {
-  const manager = createSdkFeatureFlagManager();
-  const originalLoadFromConfig = manager.loadFromConfig.bind(manager);
-
-  manager.loadFromConfig = (config: FlagConfig): void => {
-    originalLoadFromConfig({
-      flags: Object.fromEntries(
-        Object.entries(config.flags).filter(([id]) => FEATURE_FLAG_MAP.has(id)),
-      ) as FlagConfig['flags'],
-    });
-  };
-
-  return manager;
-}
-
-// Public runtime exports.
+// Public runtime exports. createFeatureFlagManager comes straight from the
+// SDK state surface below: gate states are seeded from domain settings keys
+// via deriveFeatureStates (exported there too), so the old local wrapper that
+// filtered unknown persisted featureFlags-category ids has nothing to filter.
 export * from '@pellux/goodvibes-sdk/platform/runtime/state';
 export * from '@pellux/goodvibes-sdk/platform/runtime/store';
 export * from '@pellux/goodvibes-sdk/platform/runtime/ui';
@@ -101,9 +84,10 @@ export const registerHostRuntimeEvents = bootstrap.registerHostRuntimeEvents;
 // Shared adopt-or-spawn policy (daemon-adoption-policy.ts): probes the
 // configured host/port, band-checks any GoodVibes daemon found there, and
 // only ever ADOPTS a compatible one — Agent passes `adoptOnly: true` at the
-// call site (bootstrap.ts) so it never spawns or embeds a daemon itself. This
-// replaces a local stub that hard-declared every daemon 'external' without
-// probing or version-checking it (an unsafe divergence, resolved SDK-side).
+// call site (bootstrap-external-services.ts) so it never spawns or embeds a
+// daemon itself. A daemon that is INSTALLED on this machine but stopped is
+// handled separately at boot: one start through the platform service manager,
+// then a fresh adopt-only probe (see runtime/connected-host-autostart.ts).
 export const startHostServices = bootstrap.startHostServices;
 export const startExternalServices = bootstrap.startHostServices;
 export const registerBootstrapHookBridge = bootstrap.registerBootstrapHookBridge;
@@ -223,10 +207,10 @@ export type RemoteRuntimeEventsOptions = Transport.RemoteRuntimeEventsOptions;
 export type RemoteRuntimeEvents = Transport.RemoteRuntimeEvents;
 export type SerializedRuntimeEnvelope = Transport.SerializedRuntimeEnvelope;
 
-// Operations compatibility aliases.
-export const OpsControlPlane = operations.OpsControlPlane;
-export const OpsIllegalActionError = operations.OpsIllegalActionError;
-export const OpsTargetNotFoundError = operations.OpsTargetNotFoundError;
+// Operations compatibility aliases. (OpsControlPlane and its error classes
+// are deliberately NOT re-exported: the Agent never constructs the ops
+// intervention plane — connected-host tasks are read-only by product policy,
+// with mutations routed to /workplan and /delegate.)
 export const ToolContractVerifier = operations.ToolContractVerifier;
 export const McpLifecycleManager = operations.McpLifecycleManager;
 export const McpPermissionManager = operations.McpPermissionManager;
@@ -354,7 +338,6 @@ export type DistributedRuntimeSnapshotStore = Operations.DistributedRuntimeSnaps
 export type RemoteRunnerRegistry = Operations.RemoteRunnerRegistry;
 export type RemoteSupervisor = Operations.RemoteSupervisor;
 export type DistributedRuntimeManager = Operations.DistributedRuntimeManager;
-export type OpsControlPlane = Operations.OpsControlPlane;
 export type RuntimeTransitionResult = Operations.RuntimeTransitionResult;
 export type RetentionClass = Operations.RetentionClass;
 export type RetentionClassConfig = Operations.RetentionClassConfig;

package/src/runtime/memory-spine-adoption.ts

@@ -22,6 +22,18 @@ export interface MemorySpineAdoptionOptions {
   /** The existing daemon-adoption signal — reuse services.sessionSpineClient.probeReachability() in production. */
   readonly probeReachability: () => Promise<'unknown' | 'online' | 'offline'>;
   readonly deactivateReason?: string;
+  /**
+   * Called exactly on the transition INTO adoption (reachable AND not yet
+   * active) — i.e. once per (re)attach to a daemon, at boot and again whenever a
+   * daemon reappears after a loss. The agent wires this to the single
+   * `?receipts=consume` /status read the daemon delivers its one-shot honesty
+   * receipts to (see services.consumeDaemonReceipts / daemon-receipts.ts):
+   * reusing the existing adoption edge instead of inventing a second signal, per
+   * the same reuse this reconciler already documents for reachability. Best
+   * effort — its rejection is swallowed here so a failed receipt read can never
+   * undo the adoption that just happened.
+   */
+  readonly onAttach?: () => void | Promise<void>;
 }
 
 /**
@@ -42,6 +54,12 @@ export async function reconcileMemorySpineAdoption(options: MemorySpineAdoptionO
   const reachable = (await options.probeReachability()) === 'online';
   if (reachable && !options.memorySpineClient.active) {
     options.memorySpineClient.activate(options.transport);
+    if (options.onAttach) {
+      // Adoption already happened synchronously above; a receipt-read failure
+      // must not propagate and make the caller log a false "reachability
+      // recheck failed", nor undo the adoption.
+      await Promise.resolve().then(() => options.onAttach!()).catch(() => {});
+    }
     return;
   }
   if (!reachable && options.memorySpineClient.active) {

package/src/runtime/onboarding/apply.ts

@@ -14,11 +14,9 @@ import { AgentPersonaRegistry, assertNoSecretLikeText } from '../../agent/person
 import { AgentRoutineRegistry } from '../../agent/routine-registry.ts';
 import { AgentSkillRegistry } from '../../agent/skill-registry.ts';
 import {
-  isFeatureFlagConfigKey,
-  mergeFeatureFlagConfigValue,
-  readFeatureFlagConfigValue,
-  type FeatureFlagConfigKey,
-} from '../surface-feature-flags.ts';
+  expandLegacyFeatureConfigValue,
+  isLegacyFeatureConfigKey,
+} from '../feature-enablement.ts';
 import {
   getOnboardingRuntimeStatePath,
   readOnboardingRuntimeState,
@@ -50,25 +48,13 @@ function isMalformedGoodVibesSecretReferenceValue(value: string): boolean {
   return normalized.startsWith('goodvibes://') && !isGoodVibesSecretReferenceValue(normalized);
 }
 
-function validateFeatureFlagConfigValue(operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>): boolean {
-  if (!isFeatureFlagConfigKey(operation.key)) return false;
-
-  if (operation.key === 'featureFlags') {
-    if (!isPlainObject(operation.value)) throw new Error('featureFlags expects an object value.');
-    for (const [flagId, state] of Object.entries(operation.value)) {
-      if (flagId.trim().length === 0) throw new Error('featureFlags cannot contain an empty feature id.');
-      if (state !== 'enabled' && state !== 'disabled') {
-        throw new Error(`featureFlags.${flagId} expects enabled or disabled.`);
-      }
-    }
-    return true;
-  }
-
-  const flagId = operation.key.slice('featureFlags.'.length);
-  if (flagId.trim().length === 0) throw new Error('featureFlags requires a feature id.');
-  if (operation.value !== 'enabled' && operation.value !== 'disabled') {
-    throw new Error(`Config key ${operation.key} expects enabled or disabled.`);
-  }
+function validateLegacyFeatureConfigValue(operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>): boolean {
+  if (!isLegacyFeatureConfigKey(operation.key)) return false;
+  // Throws with real guidance on malformed shapes, unknown feature ids, and
+  // always-available (constant-binding) features. The legacy featureFlags
+  // namespace dissolved onto domain settings keys; the expansion below is
+  // exactly what apply will write.
+  expandLegacyFeatureConfigValue(operation.key, operation.value);
   return true;
 }
 
@@ -77,7 +63,7 @@ function validateConfigValue(operation: Extract<OnboardingApplyOperation, { kind
     throw new Error(`Config key ${operation.key} only accepts goodvibes://secrets/... secret references.`);
   }
 
-  if (validateFeatureFlagConfigValue(operation)) return;
+  if (validateLegacyFeatureConfigValue(operation)) return;
 
   const schema = CONFIG_SCHEMA.find((entry) => entry.key === operation.key);
   if (!schema) {
@@ -252,6 +238,21 @@ function applyConfigOperation(
   if ((operation.scope ?? 'global') === 'project') {
     const path = deps.shellPaths.resolveProjectPath(GOODVIBES_AGENT_SURFACE_ROOT, 'settings.json');
     const existing = readJsonObject(path);
+    if (isLegacyFeatureConfigKey(operation.key)) {
+      // Legacy featureFlags keys dissolved onto domain settings keys: persist
+      // the translated domain-key writes, never a featureFlags record.
+      const writes = expandLegacyFeatureConfigValue(operation.key, operation.value);
+      let updated = existing;
+      for (const write of writes) {
+        updated = setNestedValue(updated, write.key, write.value);
+      }
+      writeJsonObject(path, updated);
+      deps.config.load();
+      return {
+        kind: operation.kind,
+        summary: `Persisted ${writes.map((write) => write.key).join(', ')} (legacy ${operation.key}) in project onboarding settings.`,
+      };
+    }
     const updated = setNestedValue(existing, operation.key, operation.value);
     writeJsonObject(path, updated);
     deps.config.load();
@@ -262,11 +263,17 @@ function applyConfigOperation(
     };
   }
 
-  if (isFeatureFlagConfigKey(operation.key)) {
-    mergeFeatureFlagConfigValue(deps.config, operation.key, operation.value);
-  } else {
-    deps.config.setDynamic(operation.key, operation.value);
+  if (isLegacyFeatureConfigKey(operation.key)) {
+    const writes = expandLegacyFeatureConfigValue(operation.key, operation.value);
+    for (const write of writes) {
+      deps.config.setDynamic(write.key, write.value);
+    }
+    return {
+      kind: operation.kind,
+      summary: `Updated ${writes.map((write) => write.key).join(', ')} (legacy ${operation.key}) in global onboarding settings.`,
+    };
   }
+  deps.config.setDynamic(operation.key, operation.value);
   return {
     kind: operation.kind,
     summary: `Updated ${operation.key} in global onboarding settings.`,
@@ -319,15 +326,21 @@ async function buildRollbackAction(
       );
     }
 
-    const previous = isFeatureFlagConfigKey(operation.key)
-      ? readFeatureFlagConfigValue(deps.config, operation.key)
-      : deps.config.get(operation.key);
+    const operationKey = operation.key;
+    if (isLegacyFeatureConfigKey(operationKey)) {
+      // Snapshot the domain settings keys the translated writes will touch and
+      // restore those exact values — no featureFlags category exists to merge.
+      const writes = expandLegacyFeatureConfigValue(operationKey, operation.value);
+      const previousValues = writes.map((write) => ({ key: write.key, previous: deps.config.get(write.key) }));
+      return () => {
+        for (const entry of previousValues) {
+          deps.config.setDynamic(entry.key, entry.previous);
+        }
+      };
+    }
+    const previous = deps.config.get(operationKey);
     return () => {
-      if (isFeatureFlagConfigKey(operation.key)) {
-        mergeFeatureFlagConfigValue(deps.config, operation.key, previous ?? 'disabled');
-      } else {
-        deps.config.setDynamic(operation.key, previous);
-      }
+      deps.config.setDynamic(operationKey, previous);
     };
   }
 

package/src/runtime/onboarding/types.ts

@@ -1,6 +1,6 @@
 import type { ConfigManager, ConfigKey, GoodVibesConfig } from '../../config/index.ts';
 import type { SecretsManager, SecretRecord, SecretStorageReview } from '../../config/secrets.ts';
-import type { FeatureFlagConfigKey } from '../surface-feature-flags.ts';
+import type { LegacyFeatureConfigKey } from '../feature-enablement.ts';
 import type { LocalAuthSnapshot, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import type { ShellPathService } from '@/runtime/index.ts';
 import type {
@@ -226,7 +226,7 @@ export interface OnboardingStepDerivationState {
 export type OnboardingApplyOperation =
   | {
       readonly kind: 'set-config';
-      readonly key: ConfigKey | FeatureFlagConfigKey;
+      readonly key: ConfigKey | LegacyFeatureConfigKey;
       readonly value: unknown;
       readonly scope?: 'global' | 'project';
     }

package/src/runtime/onboarding/verify.ts

@@ -6,7 +6,7 @@ import { AgentPersonaRegistry } from '../../agent/persona-registry.ts';
 import { AgentRoutineRegistry } from '../../agent/routine-registry.ts';
 import { readAgentRuntimeProfileSelection, resolveAgentRuntimeProfileHome } from '../../agent/runtime-profile.ts';
 import { AgentSkillRegistry } from '../../agent/skill-registry.ts';
-import { isFeatureFlagConfigKey, readFeatureFlagConfigValue } from '../surface-feature-flags.ts';
+import { isFeatureEnabledInConfig, isLegacyFeatureConfigKey, legacyFeatureConfigTargets } from '../feature-enablement.ts';
 import { readOnboardingRuntimeState } from './state.ts';
 import type {
   OnboardingApplyOperation,
@@ -51,9 +51,27 @@ function verifyConfigOperation(
   deps: OnboardingVerificationDependencies,
   operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>,
 ): OnboardingVerificationItem {
-  const actual = isFeatureFlagConfigKey(operation.key)
-    ? readFeatureFlagConfigValue(deps.config, operation.key)
-    : deps.config.get(operation.key);
+  if (isLegacyFeatureConfigKey(operation.key)) {
+    // Legacy featureFlags keys dissolved onto domain settings keys: verify the
+    // DERIVED enablement of every addressed feature, not a category readback.
+    const targets = legacyFeatureConfigTargets(operation.key, operation.value);
+    const mismatched = targets.filter((target) => (
+      (isFeatureEnabledInConfig(deps.config, target.featureId) ? 'enabled' : 'disabled') !== target.desired
+    ));
+    const ok = targets.length > 0 && mismatched.length === 0;
+    return {
+      id: `config:${operation.key}`,
+      status: ok ? 'pass' : 'fail',
+      message: ok
+        ? `${operation.key} matches the requested onboarding value (derived from the domain settings keys).`
+        : `${operation.key} does not match the requested onboarding value${
+          mismatched.length > 0 ? ` (mismatched: ${mismatched.map((target) => target.featureId).join(', ')})` : ''
+        }.`,
+      target: operation.key,
+    };
+  }
+
+  const actual = deps.config.get(operation.key);
   const ok = isDeepEqual(actual, operation.value);
 
   return {