@pellux/goodvibes-tui 1.16.1 → 1.17.0

package/src/runtime/durability-services.ts

@@ -0,0 +1,55 @@
+/**
+ * durability-services.ts — the data-safety and remembered-decision stores the
+ * daemon composition wires (mirrors the SDK's own createRuntimeServices):
+ *
+ *  - StoreSnapshotScheduler: a daily snapshot of every SQLite store this
+ *    runtime writes (memory store, memory vector index, code index store),
+ *    bounded by the retention engine. Timers are unref'd so an undisposed
+ *    scheduler cannot pin the event loop; hosts that tear down a runtime
+ *    stop() it themselves.
+ *  - UserPermissionRuleStore: durable user-origin permission rules
+ *    (remembered approvals) — one store per project, shared by every
+ *    PermissionManager built on this runtime; permissions.rules.*
+ *    lists/deletes. Background init is fail-safe (asks just prompt).
+ *  - One credential chain (env -> secrets -> subscription): boot applies
+ *    secrets-backed keys; every secrets write/delete re-registers builtins
+ *    LIVE (no restart) — badges/picker/chat read the same instances.
+ */
+import { join } from 'node:path';
+import { resolveMemoryVectorDbPath } from '@pellux/goodvibes-sdk/platform/state';
+import { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
+import { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+export interface DurabilityServicesInput {
+  readonly configManager: { getControlPlaneConfigDir(): string };
+  readonly secretsManager: { onDidChange(listener: (key: string) => void): () => void };
+  readonly providerRegistry: { refreshProviderCredentials(): Promise<void> };
+  readonly memoryDbPath: string;
+  readonly codeIndexDbPath: string;
+}
+
+export interface DurabilityServices {
+  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly userPermissionRuleStore: UserPermissionRuleStore;
+}
+
+export function createDurabilityServices(input: DurabilityServicesInput): DurabilityServices {
+  const { configManager, secretsManager, providerRegistry } = input;
+  secretsManager.onDidChange(() => void providerRegistry.refreshProviderCredentials().catch((error) => logger.warn('live credential refresh failed', { error: summarizeError(error) })));
+  void providerRegistry.refreshProviderCredentials().catch((error) => logger.warn('boot credential refresh failed', { error: summarizeError(error) }));
+
+  const storeSnapshotScheduler = new StoreSnapshotScheduler({
+    stores: [
+      { name: 'memory store', dbPath: input.memoryDbPath },
+      { name: 'memory vector index', dbPath: resolveMemoryVectorDbPath(input.memoryDbPath) },
+      { name: 'code index store', dbPath: input.codeIndexDbPath },
+    ],
+  });
+  storeSnapshotScheduler.start();
+
+  const userPermissionRuleStore = new UserPermissionRuleStore(join(configManager.getControlPlaneConfigDir(), 'permission-rules.json'));
+  void userPermissionRuleStore.init().catch((error) => logger.warn('user permission rule store init failed; asks will prompt', { error: summarizeError(error) }));
+
+  return { storeSnapshotScheduler, userPermissionRuleStore };
+}

package/src/runtime/embedded-service-factories.ts

@@ -0,0 +1,40 @@
+/**
+ * embedded-service-factories.ts — the factories startExternalServices uses to
+ * construct the interactive session's embedded DaemonServer + HttpListener
+ * (extracted from bootstrap.ts for file-size hygiene).
+ *
+ * The embedded DaemonServer suppresses the facade's internal auto-updater:
+ * that loop compares the sdk package's version — not this binary's — against
+ * this repo's releases, so inside the interactive session it would find an
+ * "update" hourly and exit the user's process on "restart". Clients update at
+ * launch (cli/launch-auto-update.ts); the embedded daemon runs no update loop
+ * at all. See daemon/lifecycle.ts.
+ */
+import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
+import { createSafeHostServeFactory } from '../daemon/safe-serve.ts';
+import type { startExternalServices } from '@/runtime/index.ts';
+
+export type ExternalServiceFactories = NonNullable<Parameters<typeof startExternalServices>[4]>;
+
+export function createEmbeddedServiceFactories(sharedDaemonToken: string): ExternalServiceFactories {
+  return {
+    sharedDaemonToken,
+    createDaemonServer: (bus, userAuth, runtimeServices) => {
+      // No updateArtifact: the embedded daemon keeps updates host-managed (the
+      // TUI client updates itself), so the facade runs no self-update loop.
+      const daemonServer = new DaemonServer({
+        runtimeBus: bus,
+        userAuth,
+        runtimeServices,
+        serveFactory: createSafeHostServeFactory('Embedded daemon'),
+      });
+      return daemonServer;
+    },
+    createHttpListener: (dispatcher, userAuth, configManager) => new HttpListener({
+      hookDispatcher: dispatcher,
+      userAuth,
+      configManager,
+      serveFactory: createSafeHostServeFactory('Embedded HTTP listener'),
+    }),
+  };
+}

package/src/runtime/feature-settings.ts

@@ -0,0 +1,147 @@
+/**
+ * feature-settings — TUI-side helpers over the SDK's FEATURE_SETTINGS surface.
+ *
+ * Every platform capability is configured through a first-class settings key
+ * in its natural domain (behavior.compactionStrategy, sandbox.enabled,
+ * surfaces.slack.enabled, ...). There is no separate enablement namespace.
+ * These helpers answer the recurring TUI questions:
+ *   - which feature a given id names, and whether a stock config has it on,
+ *   - whether a raw config value means the feature is currently on,
+ *   - which single settings write turns a feature on or off.
+ *
+ * Enablement kinds (from the SDK binding layer):
+ *   - boolean : the key's boolean value is the enablement.
+ *   - enum    : active while the key's value is in enabledValues (several
+ *               features can share one key, e.g. behavior.compactionStrategy).
+ *   - constant: the capability has no separate off switch. When its key is a
+ *               boolean (the surface enabled keys) that value is the honest
+ *               user-facing switch; a non-boolean constant key (e.g.
+ *               fetch.sanitizeMode) has no off position at all.
+ */
+
+import { CONFIG_SCHEMA, type ConfigKey, type ConfigManager, type ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import {
+  FEATURE_SETTINGS,
+  deriveFeatureState,
+  type FeatureSetting,
+} from '@pellux/goodvibes-sdk/platform/runtime/state';
+
+export type { FeatureSetting } from '@pellux/goodvibes-sdk/platform/runtime/state';
+
+// ---------------------------------------------------------------------------
+// Lookups
+// ---------------------------------------------------------------------------
+
+/** Every capability by id, in SDK declaration order. */
+export const FEATURE_SETTINGS_BY_ID: ReadonlyMap<string, FeatureSetting> = new Map(
+  FEATURE_SETTINGS.map((feature) => [feature.id, feature]),
+);
+
+const SCHEMA_BY_KEY: ReadonlyMap<string, ConfigSetting> = new Map(
+  CONFIG_SCHEMA.map((setting) => [setting.key, setting]),
+);
+
+export function getFeatureSetting(featureId: string): FeatureSetting | null {
+  return FEATURE_SETTINGS_BY_ID.get(featureId) ?? null;
+}
+
+/** The CONFIG_SCHEMA descriptor for a settings key, or null for TUI-local synthetics. */
+export function getConfigSchemaSetting(key: string): ConfigSetting | null {
+  return SCHEMA_BY_KEY.get(key) ?? null;
+}
+
+/** Whether a stock configuration has the feature active. */
+export function isFeatureDefaultEnabled(featureId: string): boolean {
+  return getFeatureSetting(featureId)?.defaultEnabled === true;
+}
+
+/** All features whose enablement key is `key` (several features can share one). */
+export function featuresForEnablementKey(key: string): readonly FeatureSetting[] {
+  return FEATURE_SETTINGS.filter((feature) => feature.enablement.key === key);
+}
+
+// ---------------------------------------------------------------------------
+// Enablement derivation
+// ---------------------------------------------------------------------------
+
+/**
+ * Whether a raw config value means the feature is on, as a settings surface
+ * should display it. Boolean/enum kinds derive exactly as the runtime gate
+ * does; constant kinds fall back to the boolean key value when there is one
+ * (the honest user-facing switch for the surface adapters) and read as always
+ * on otherwise.
+ */
+export function isFeatureValueEnabled(feature: FeatureSetting, value: unknown): boolean {
+  const { key, kind, enabledValues } = feature.enablement;
+  if (kind === 'constant') {
+    const schema = getConfigSchemaSetting(key);
+    if (schema?.type === 'boolean') return value === true;
+    return true;
+  }
+  return deriveFeatureState(
+    {
+      featureId: feature.id,
+      key,
+      kind,
+      ...(enabledValues !== undefined ? { enabledValues } : {}),
+    },
+    value,
+  ) === 'enabled';
+}
+
+/** Whether the live config currently has the feature on (see isFeatureValueEnabled). */
+export function isFeatureConfigEnabled(
+  configManager: Pick<ConfigManager, 'get'>,
+  featureId: string,
+): boolean {
+  const feature = getFeatureSetting(featureId);
+  if (!feature) return false;
+  return isFeatureValueEnabled(feature, configManager.get(feature.enablement.key));
+}
+
+// ---------------------------------------------------------------------------
+// Enablement writes
+// ---------------------------------------------------------------------------
+
+export interface FeatureEnablementWrite {
+  readonly key: ConfigKey;
+  readonly value: boolean | string;
+}
+
+/**
+ * The single settings write that turns a feature on or off, or null when the
+ * feature has no off position (a constant-kind capability on a non-boolean
+ * key). For enum kinds the schema default is preferred whenever it sits on
+ * the requested side, so "enable" lands on the feature's stock mode and
+ * "disable" lands on the stock off mode rather than an arbitrary value.
+ */
+export function featureEnablementWrite(
+  featureId: string,
+  enabled: boolean,
+): FeatureEnablementWrite | null {
+  const feature = getFeatureSetting(featureId);
+  if (!feature) return null;
+  const { key, kind, enabledValues } = feature.enablement;
+
+  if (kind === 'boolean') return { key, value: enabled };
+
+  const schema = getConfigSchemaSetting(key);
+  if (kind === 'constant') {
+    return schema?.type === 'boolean' ? { key, value: enabled } : null;
+  }
+
+  // enum
+  const active = enabledValues ?? [];
+  const allValues = schema?.enumValues ?? [];
+  const schemaDefault = typeof schema?.default === 'string' ? schema.default : undefined;
+  if (enabled) {
+    const target = schemaDefault !== undefined && active.includes(schemaDefault)
+      ? schemaDefault
+      : active[0];
+    return target !== undefined ? { key, value: target } : null;
+  }
+  const offTarget = schemaDefault !== undefined && !active.includes(schemaDefault)
+    ? schemaDefault
+    : allValues.find((value) => !active.includes(value));
+  return offTarget !== undefined ? { key, value: offTarget } : null;
+}

package/src/runtime/index.ts

@@ -13,10 +13,6 @@ import {
   shell,
   transport,
 } from '@pellux/goodvibes-sdk/platform/runtime';
-import {
-  createFeatureFlagManager as createSdkFeatureFlagManager,
-  FEATURE_FLAG_MAP,
-} from '@pellux/goodvibes-sdk/platform/runtime/state';
 import { existsSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import type {
@@ -26,7 +22,6 @@ import type {
   shell as Shell,
   transport as Transport,
 } from '@pellux/goodvibes-sdk/platform/runtime';
-import type { FeatureFlagManager, FlagConfig } from '@pellux/goodvibes-sdk/platform/runtime/state';
 
 // Local runtime entry points.
 export { bootstrapRuntime } from './bootstrap.ts';
@@ -35,22 +30,10 @@ export type { BootstrapContext } from './bootstrap.ts';
 export { createUiRuntimeServices } from './ui-services.ts';
 export type { UiRuntimeServices } from './ui-services.ts';
 
-export function createFeatureFlagManager(): FeatureFlagManager {
-  const manager = createSdkFeatureFlagManager();
-  const originalLoadFromConfig = manager.loadFromConfig.bind(manager);
-
-  manager.loadFromConfig = (config: FlagConfig): void => {
-    originalLoadFromConfig({
-      flags: Object.fromEntries(
-        Object.entries(config.flags).filter(([id]) => FEATURE_FLAG_MAP.has(id)),
-      ) as FlagConfig['flags'],
-    });
-  };
-
-  return manager;
-}
-
-// Public SDK runtime seams.
+// Public SDK runtime seams. createFeatureFlagManager comes straight from the
+// SDK state seam below: gate states derive from domain settings keys
+// (deriveFeatureStates), so the old TUI wrapper that filtered unknown ids out
+// of persisted `featureFlags` overrides has nothing left to filter.
 export * from '@pellux/goodvibes-sdk/platform/runtime/state';
 export * from '@pellux/goodvibes-sdk/platform/runtime/store';
 export * from '@pellux/goodvibes-sdk/platform/runtime/ui';

package/src/runtime/legacy-daemon-migration.ts

@@ -1,9 +1,17 @@
 /**
- * The legacy `goodvibes-daemon.service` detect/migrate engine, shared
+ * The `goodvibes-daemon.service` detect/migrate engine, shared
  * by the daemon CLI (`src/daemon/service-commands.ts`, the `migrate-service`
  * subcommand) and the interactive TUI's onboarding guided UX
  * (`src/input/handler-onboarding-daemon-adopt.ts`).
  *
+ * NAMING, load-bearing: this module's identifiers say "legacy" because the
+ * engine migrates AWAY from the `goodvibes-daemon.service` unit name toward
+ * the runtime-managed unit — but that same name is what scripts/install.sh
+ * actively creates for curl-installed hosts TODAY. It is a parallel,
+ * first-class install path, not an obsolete one. User-facing copy therefore
+ * describes it as "the install-script unit" and never labels it legacy or
+ * implies it should be removed unless the user is explicitly migrating.
+ *
  * This lives under `src/runtime/` — not `src/daemon/` — specifically so the
  * `input` layer can consume it directly: the architecture gate's
  * `input-no-entrypoints` rule forbids `src/input/**` from importing
@@ -250,13 +258,15 @@ export function resolveManagedUnitName(status: ManagedServiceStatus): string {
   return basename(status.path).replace(/\.(service|plist)$/, '');
 }
 
-/** Honest one-line disclosure of the legacy unit's presence/state plus a manual migration hint — never auto-acted-on. */
+/** Honest one-line disclosure of the install-script unit's presence/state plus a manual migration hint — never auto-acted-on. */
 export function legacyUnitNote(legacy: LegacyUnitInfo, trackedServiceName: string): string {
   const stateWord = legacy.active ? 'installed and RUNNING' : 'installed (not currently active)';
   return (
-    `note: a service under the legacy name ${LEGACY_SERVICE_UNIT_NAME}.service is ${stateWord} at ${legacy.path} — ` +
-    `this tool manages a different unit name (${trackedServiceName}.service) and will not touch the legacy one automatically. ` +
-    `Remove it yourself when ready: systemctl --user disable --now ${LEGACY_SERVICE_UNIT_NAME}.service && rm ${legacy.path} && systemctl --user daemon-reload`
+    `note: a separate service named ${LEGACY_SERVICE_UNIT_NAME}.service is ${stateWord} at ${legacy.path} — ` +
+    `that unit name is managed by the goodvibes install script (older installs used it too), while this tool manages ` +
+    `${trackedServiceName}.service and will not touch the other unit automatically. Keep whichever one you use; running ` +
+    `both would start two daemons competing for the same port. To retire the install-script unit in favor of this ` +
+    `tool's: systemctl --user disable --now ${LEGACY_SERVICE_UNIT_NAME}.service && rm ${legacy.path} && systemctl --user daemon-reload`
   );
 }
 
@@ -317,7 +327,7 @@ function assertUnitIsNotLegacy(status: ManagedServiceStatus, legacy: LegacyUnitI
   if (status.path === legacy.path || resolveManagedUnitName(status) === LEGACY_SERVICE_UNIT_NAME) {
     throw new Error(
       `refusing to ${action}: the resolved managed unit (${resolveManagedUnitName(status)} at ${status.path}) is the ` +
-        `legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit — this should already have been caught by the pre-flight ` +
+        `install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit — this should already have been caught by the pre-flight ` +
         'collision check in runLegacyDaemonMigration',
     );
   }
@@ -356,7 +366,7 @@ export async function runLegacyDaemonMigration(
         ok: false,
         exitCode: 1,
         lines: [
-          `migrate-service: no legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was found, but something is already ` +
+          `migrate-service: no install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was found, but something is already ` +
             `listening on ${params.host}:${params.port}.`,
           "That looks like a process this tool doesn't manage (for example, a manually-started `nohup` daemon) rather " +
             'than a systemd unit — there is nothing here to stop or disable, and this tool will not attempt to kill an ' +
@@ -371,7 +381,7 @@ export async function runLegacyDaemonMigration(
       ok: true,
       exitCode: 0,
       lines: [
-        `migrate-service: no legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was found and ${params.host}:${params.port} ` +
+        `migrate-service: no install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was found and ${params.host}:${params.port} ` +
           'is free — there is nothing to migrate.',
         `Run install-service to set up the managed ${resolvedUnitName}.service directly.`,
       ],
@@ -385,8 +395,8 @@ export async function runLegacyDaemonMigration(
       exitCode: 1,
       lines: [
         `migrate-service: this host's detected service platform is '${currentStatus.platform}', not systemd, but a ` +
-          `legacy unit file exists at ${legacy.path}.`,
-        'The legacy unit is systemd-specific and this tool only knows how to migrate a systemd legacy unit today — ' +
+          `unit file with the install-script name exists at ${legacy.path}.`,
+        'That unit is systemd-specific and this tool only knows how to migrate a systemd unit today — ' +
           'nothing was changed.',
       ],
       status: currentStatus,
@@ -409,9 +419,9 @@ export async function runLegacyDaemonMigration(
       exitCode: 1,
       lines: [
         `migrate-service aborted: this host's 'service.serviceName' config key resolves to '${resolvedUnitName}', which ` +
-          `is the exact legacy unit name (${LEGACY_SERVICE_UNIT_NAME}.service at ${legacy.path}) this migration is ` +
+          `is the exact install-script unit name (${LEGACY_SERVICE_UNIT_NAME}.service at ${legacy.path}) this migration is ` +
           'supposed to retire.',
-        'Installing or rolling back a unit under that name would overwrite or delete the legacy unit instead of ' +
+        'Installing or rolling back a unit under that name would overwrite or delete the install-script unit instead of ' +
           'managing a separate one, so nothing has been changed.',
         `Fix: set the 'service.serviceName' config key to something other than '${LEGACY_SERVICE_UNIT_NAME}' (for ` +
           `example, the default '${trackedServiceName}') and re-run migrate-service.`,
@@ -429,7 +439,7 @@ export async function runLegacyDaemonMigration(
         'migrate-service (dry run — re-run with confirmation to execute): this would',
         `  1. install and start the new ${resolvedUnitName}.service unit`,
         '  2. verify it comes up healthy (a fresh, honest systemd is-active check)',
-        `  3. only if that succeeds, stop, disable, and remove the legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit ` +
+        `  3. only if that succeeds, stop, disable, and remove the install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit ` +
           'and run `systemctl --user daemon-reload`',
         'Nothing has been changed. Nothing is migrated automatically — re-run with explicit confirmation ' +
           "(the CLI's -y/--yes flag) to execute this plan.",
@@ -452,7 +462,7 @@ export async function runLegacyDaemonMigration(
       exitCode: 1,
       lines: [
         `migrate-service aborted: could not write the new ${resolvedUnitName}.service unit (${installed.actionError}).`,
-        `The legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched.`,
+        `The install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched.`,
       ],
       status: installed,
     };
@@ -473,7 +483,7 @@ export async function runLegacyDaemonMigration(
         `migrate-service aborted: the new ${resolvedUnitName}.service unit did not come up healthy` +
           (started.actionError ? ` (${started.actionError}).` : '.'),
         rollbackNote,
-        `The legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched and should still be running as before.`,
+        `The install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched and should still be running as before.`,
       ],
       status: healthCheck,
     };
@@ -496,20 +506,20 @@ export async function runLegacyDaemonMigration(
   const lines = [`migrated: the new ${resolvedUnitName}.service unit is installed, enabled, and running.`];
   if ((stopResult.status ?? 1) !== 0) {
     lines.push(
-      `note: stopping the legacy unit reported a non-zero exit (${stopResult.stderr ?? stopResult.stdout ?? 'no output'}); ` +
+      `note: stopping the install-script unit reported a non-zero exit (${stopResult.stderr ?? stopResult.stdout ?? 'no output'}); ` +
         'it may already have been stopped.',
     );
   }
   if ((disableResult.status ?? 1) !== 0) {
     lines.push(
-      `note: disabling the legacy unit reported a non-zero exit (${disableResult.stderr ?? disableResult.stdout ?? 'no output'}); ` +
+      `note: disabling the install-script unit reported a non-zero exit (${disableResult.stderr ?? disableResult.stdout ?? 'no output'}); ` +
         'it may already have been disabled.',
     );
   }
   if (removeError) {
-    lines.push(`note: could not remove the legacy unit file at ${legacy.path}: ${removeError} — remove it by hand.`);
+    lines.push(`note: could not remove the install-script unit file at ${legacy.path}: ${removeError} — remove it by hand.`);
   } else {
-    lines.push(`the legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit has been stopped, disabled, and removed.`);
+    lines.push(`the install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit has been stopped, disabled, and removed.`);
   }
   lines.push('ran `systemctl --user daemon-reload`.');
   return { ok: true, exitCode: 0, lines, status: healthCheck };

package/src/runtime/memory-fold.ts

@@ -21,7 +21,7 @@ export async function foldTuiLegacyMemory(
 ): Promise<MemoryFoldReport> {
   const legacyTuiProject = join(workingDirectory, '.goodvibes', 'tui', 'memory.sqlite');
   const sources: LegacyMemorySource[] = [
-    { label: `tui:${workingDirectory} (pre-E6)`, dbPath: legacyTuiProject },
+    { label: `tui:${workingDirectory} (legacy per-project store)`, dbPath: legacyTuiProject },
   ];
   return foldMemoryStores(memoryStore, sources, { embeddingRegistry: memoryEmbeddingRegistry });
 }

package/src/runtime/notification-dispatch.ts

@@ -0,0 +1,110 @@
+/**
+ * Notification dispatch — the production wiring that finally gives the
+ * panel_only notification target a live producer.
+ *
+ * The SDK's NotificationRouter decides where each domain notification goes
+ * (conversation / status_bar / panel_only) and collapses bursts and batches.
+ * Nothing in the running app routed real notifications before this: the
+ * panel_only feed (panels/notifications-feed.ts) and its panel existed with no
+ * upstream. This module builds the router, records every panel_only decision
+ * (including burst-collapsed ones) into the shared feed, and bridges the
+ * runtime event bus so real domain events become notifications.
+ */
+
+import { createNotificationRouter, type NotificationRouter } from '@pellux/goodvibes-sdk/platform/runtime/ui';
+import type { Notification, RoutingDecision, RuntimeEventBus, RuntimeEventDomain } from '@/runtime/index.ts';
+import type { ConfigManager } from '../config/index.ts';
+import { getSharedNotificationFeed, type PanelNotificationFeed } from '../panels/notifications-feed.ts';
+
+export interface NotificationDispatcher {
+  /** Route a notification; a panel_only (or burst-collapsed) decision lands in the feed. Returns the decision. */
+  dispatch(notification: Notification): RoutingDecision;
+  /** Surface batch-held notifications (call on a timer / when quiet-typing ends). */
+  flush(): void;
+  readonly router: NotificationRouter;
+}
+
+/**
+ * The runtime event domains whose events surface as operational notifications.
+ * Deliberately a curated set of user-relevant, completion/attention-shaped
+ * domains — not every domain — so the panel reflects meaningful operational
+ * activity rather than raw event churn. The router's per-domain verbosity and
+ * burst/batch policies still collapse floods within these.
+ */
+export const NOTIFICATION_BRIDGE_DOMAINS: readonly RuntimeEventDomain[] = [
+  'agents',
+  'tasks',
+  'workflows',
+  'automation',
+  'deliveries',
+  'security',
+];
+
+/** Turn an UPPER_SNAKE event type into a short human title ("AGENT_COMPLETED" → "Agent completed"). */
+export function humanizeEventType(type: string): string {
+  const words = type.toLowerCase().split(/[_\s]+/).filter(Boolean);
+  if (words.length === 0) return type;
+  return words.map((word, index) => (index === 0 ? word[0]!.toUpperCase() + word.slice(1) : word)).join(' ');
+}
+
+/** Derive a notification severity from an event type — errors/failures warn, the rest are informational. */
+export function levelForEventType(type: string): Notification['level'] {
+  const upper = type.toUpperCase();
+  if (/(FAILED|ERROR|CRASH|DENIED|BLOCKED)/.test(upper)) return 'warning';
+  if (/(CRITICAL|FATAL|BREACH)/.test(upper)) return 'critical';
+  return 'info';
+}
+
+export function createNotificationDispatcher(
+  configManager: Pick<ConfigManager, 'get'>,
+  feed: PanelNotificationFeed = getSharedNotificationFeed(),
+): NotificationDispatcher {
+  const router = createNotificationRouter(undefined, undefined, configManager);
+  const recordIfPanel = (notification: Notification, decision: RoutingDecision): void => {
+    if (decision.suppressed) return;
+    if (decision.target === 'panel_only') feed.record(notification, decision);
+  };
+  return {
+    router,
+    dispatch(notification) {
+      const decision = router.route(notification);
+      recordIfPanel(notification, decision);
+      return decision;
+    },
+    flush() {
+      for (const { notification } of router.flush()) {
+        // A flushed batch head surfaces as a batch-collapsed panel entry; the
+        // feed folds all sharing this batch key into one running-count row.
+        feed.record(notification, {
+          target: 'panel_only',
+          reasonCode: 'batch_window_collapsed',
+          batchKey: `${notification.domain}:${notification.level}`,
+        });
+      }
+    },
+  };
+}
+
+/**
+ * Bridge the runtime event bus to the dispatcher: each event in a curated
+ * domain becomes a notification and is routed. Returns an unsubscribe function
+ * that detaches every domain listener.
+ */
+export function wireRuntimeNotificationBridge(
+  runtimeBus: RuntimeEventBus,
+  dispatcher: Pick<NotificationDispatcher, 'dispatch'>,
+  domains: readonly RuntimeEventDomain[] = NOTIFICATION_BRIDGE_DOMAINS,
+): () => void {
+  const unsubscribes = domains.map((domain) =>
+    runtimeBus.onDomain(domain, (envelope) => {
+      dispatcher.dispatch({
+        id: envelope.traceId ?? `${domain}-${envelope.type}-${envelope.ts}`,
+        domain,
+        level: levelForEventType(envelope.type),
+        title: humanizeEventType(envelope.type),
+        timestamp: envelope.ts,
+      });
+    }),
+  );
+  return () => { for (const unsubscribe of unsubscribes) unsubscribe(); };
+}

package/src/runtime/onboarding/apply.ts

@@ -2,7 +2,6 @@ import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { atomicWriteFileSync } from '../../config/atomic-write.ts';
 import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config';
 import { CONFIG_SCHEMA, DEFAULT_CONFIG } from '../../config/index.ts';
-import type { FeatureFlagConfigKey } from '../surface-feature-flags.ts';
 import {
   getOnboardingRuntimeStatePath,
   readOnboardingRuntimeState,
@@ -133,39 +132,14 @@ function isMalformedGoodVibesSecretReferenceValue(value: string): boolean {
   return normalized.startsWith('goodvibes://') && !isGoodVibesSecretReferenceValue(normalized);
 }
 
-function isFeatureFlagConfigKey(key: string): key is FeatureFlagConfigKey {
-  return key === 'featureFlags' || key.startsWith('featureFlags.');
-}
-
-function validateFeatureFlagConfigValue(operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>): boolean {
-  if (!isFeatureFlagConfigKey(operation.key)) return false;
-
-  if (operation.key === 'featureFlags') {
-    if (!isPlainObject(operation.value)) throw new Error('featureFlags expects an object value.');
-    for (const [flagId, state] of Object.entries(operation.value)) {
-      if (flagId.trim().length === 0) throw new Error('featureFlags cannot contain an empty feature id.');
-      if (state !== 'enabled' && state !== 'disabled') {
-        throw new Error(`featureFlags.${flagId} expects enabled or disabled.`);
-      }
-    }
-    return true;
-  }
-
-  const flagId = operation.key.slice('featureFlags.'.length);
-  if (flagId.trim().length === 0) throw new Error('featureFlags requires a feature id.');
-  if (operation.value !== 'enabled' && operation.value !== 'disabled') {
-    throw new Error(`Config key ${operation.key} expects enabled or disabled.`);
-  }
-  return true;
-}
-
 function validateConfigValue(operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>): void {
   if (typeof operation.value === 'string' && isMalformedGoodVibesSecretReferenceValue(operation.value)) {
     throw new Error(`Config key ${operation.key} only accepts goodvibes://secrets/... secret references.`);
   }
 
-  if (validateFeatureFlagConfigValue(operation)) return;
-
+  // Feature enablement arrives as plain domain settings writes (e.g.
+  // sandbox.enabled, controlPlane.gateway), validated by the schema path below
+  // like any other key — there is no separate enablement namespace.
   const schema = CONFIG_SCHEMA.find((entry) => entry.key === operation.key);
   if (!schema) {
     const defaultValue = operation.key.split('.').reduce<unknown>((cursor, part) => (