@pellux/goodvibes-tui 1.26.0 → 1.27.1

package/src/renderer/shell-surface.ts

@@ -1,6 +1,7 @@
 import type { Line } from '../types/grid.ts';
-import { renderProcessIndicator } from './process-indicator.ts';
+import { renderProcessIndicator, renderVoiceCaptureIndicator } from './process-indicator.ts';
 import { UIFactory } from './ui-factory.ts';
+import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
 
 export interface ShellFooterBuildOptions {
   readonly width: number;
@@ -84,6 +85,14 @@ export interface ShellFooterBuildOptions {
   readonly webSurfaceUrl?: string;
   /** True while power.keepAwake holds — renders the always-visible "sleep disabled" chip. */
   readonly powerKeepAwake?: boolean;
+  /**
+   * Live microphone state — a push-to-talk recording, or the wake detector for
+   * as long as it runs. Rendered as a persistent row beside the process
+   * indicator, because a capture device held open with nothing on screen saying
+   * so is the one state a voice feature must never be in. Null (or a wake state
+   * with `voice.wake.indicator: off`) renders nothing.
+   */
+  readonly voiceCapture?: VoiceCaptureIndicatorState | null;
 }
 
 export interface ShellFooterBuildResult {
@@ -98,6 +107,8 @@ export interface ShellFooterBuildResult {
 const FOOTER_BASE_ROWS = 5;
 const CONTEXT_PROGRESS_ROWS = 1;
 const PROCESS_INDICATOR_ROWS = 1;
+/** The live-microphone row, when one is showing (see renderVoiceCaptureIndicator). */
+const VOICE_CAPTURE_ROWS = 1;
 // Compact posture drops the context-info line (and never shows the context
 // bar or process indicator), leaving just: prompt-box top border, bottom
 // border, token-usage line, and the help/exit line.
@@ -151,6 +162,7 @@ export function estimateShellFooterHeight(
   promptLineCount: number,
   contextWindow?: number,
   compact = false,
+  voiceCapture: VoiceCaptureIndicatorState | null = null,
 ): number {
   if (lastRenderedFooterHeight !== null && lastRenderedFooterHeight.compact === compact) {
     return lastRenderedFooterHeight.height;
@@ -160,7 +172,11 @@ export function estimateShellFooterHeight(
     return COMPACT_FOOTER_BASE_ROWS + safePromptLines;
   }
   const progressRows = contextWindow && contextWindow > 0 ? CONTEXT_PROGRESS_ROWS : 0;
-  return FOOTER_BASE_ROWS + safePromptLines + progressRows + PROCESS_INDICATOR_ROWS;
+  // Counted on the cold-start path too: a shell launched with the wake detector
+  // already listening renders that row in its very first frame, and a viewport
+  // sized one row too tall would draw the transcript's last line under it.
+  const voiceRows = voiceCaptureRowVisible(voiceCapture) ? VOICE_CAPTURE_ROWS : 0;
+  return FOOTER_BASE_ROWS + safePromptLines + progressRows + PROCESS_INDICATOR_ROWS + voiceRows;
 }
 
 export function buildShellFooter(
@@ -206,7 +222,10 @@ export function buildShellFooter(
       options.runningAgentProgress,
     );
     const inputBoxRows = Math.max(1, options.promptLineCount) + 2;
-    lines.splice(inputBoxRows, 0, ...processIndicator);
+    // The voice row sits directly under the prompt box, ABOVE the process
+    // indicator: an open microphone is a live condition the user is acting inside,
+    // while the process indicator is a background summary.
+    lines.splice(inputBoxRows, 0, ...renderVoiceCaptureIndicator(options.width, options.voiceCapture ?? null), ...processIndicator);
     // Scriptable status line — dim informational line above the prompt. Unshifted
     // before the context hint so the context hint (if any) sits above it.
     if (options.scriptableStatusLine) {

package/src/runtime/bootstrap-core.ts

@@ -20,11 +20,11 @@ import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './s
 import {
   type MutableRuntimeState, type SessionEvent, bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates, RuntimeEventBus, ForensicsCollector,
   ForensicsRegistry, generateUserSessionId, loadBootstrapSystemPrompt, syncConfiguredServices,
-  registerBootstrapHookBridge, registerBootstrapRuntimeEvents,
+  registerBootstrapHookBridge, registerBootstrapRuntimeEvents, configureRuntimeEventBusDefaults, runtimeEventBusOptionsFrom,
 } from '@/runtime/index.ts';
 import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
-import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { createRuntimeServices, installDevicePosture, type RuntimeServices } from './services.ts';
 import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
 import { runBootMemoryFold } from './memory-fold.ts';
 import { wireCostPricing } from '../export/cost-utils.ts';
@@ -238,7 +238,7 @@ export async function initializeBootstrapCore(
   bindFeatureSettingsBridge(configManager, featureFlags);
 
   const userSessionId = `user-${generateUserSessionId()}`;
-  const runtimeBus = new RuntimeEventBus();
+  configureRuntimeEventBusDefaults(runtimeEventBusOptionsFrom((key) => configManager.get(key))); const runtimeBus = new RuntimeEventBus(); // cap from runtime.eventBus.maxListeners before the first bus exists
   const store = createRuntimeStore();
   const domainDispatch = createDomainDispatch(store);
   let getConversationTitle = (): string | undefined => undefined;
@@ -249,9 +249,9 @@ export async function initializeBootstrapCore(
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
     workingDir, homeDirectory, ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
-    // Embedded topology: the in-process runtime IS the daemon and holds its own OS
-    // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
-    powerSeam: createHostPowerSeam(),
+    // Embedded topology: the in-process runtime IS the daemon, so it holds its own OS inhibitor (fork
+    // default is non-spawning) and owns the wake-model boot retry a standalone daemon would. See services.ts.
+    powerSeam: createHostPowerSeam(), provisionWakeModelsAtBoot: true,
   });
   await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
   const providerRegistry = services.providerRegistry;
@@ -381,7 +381,7 @@ export async function initializeBootstrapCore(
     contextAccountingHolder: services.contextAccountingHolder,
     // First contained (sandboxed) command run announces "commands now run contained" once — recorded and surfaced now.
     onSandboxedRun: createSandboxContainmentNotice({ configManager, notify: (text) => conversation.log(`[Sandbox] ${text}`, { fg: '135' }) }),
-  });
+  }); installDevicePosture(toolRegistry, services.devicePosture); // the `phone` tool is the only path that reaches the device capability service, so without this every `device.*` posture key governs nothing a session can observe; the housekeeping timer starts here (not at composition) so building a runtime in a test sweeps nothing
   // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
     surfaceRoot: services.surface.surfaceRoot,

package/src/runtime/bootstrap.ts

@@ -264,7 +264,7 @@ export async function bootstrapRuntime(
   }, ACP_TASK_SYNC_INTERVAL_MS);
   bootstrapUnsubs.push(() => clearInterval(acpTaskSyncInterval));
   orchestrator.registerDelegateTool(acpManager);
-  const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId);
+  const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId, services.featureFlags); // featureFlags required: without it runtime.unifiedTasks configured nothing (permissive fallback); SDK default matches shipped behaviour, so this is a no-op for existing installs.
   // Operator interventions ride the control-plane gateway capability
   // (controlPlane.gateway, on by default; the old never-registered gate id shipped this dead).
   const opsControlPlane = services.featureFlags.isEnabled('control-plane-gateway')
@@ -482,9 +482,9 @@ export async function bootstrapRuntime(
   };
 
   // Embedded DaemonServer/HttpListener factories (incl. the facade auto-update
-  // suppression) — see embedded-service-factories.ts.
+  // suppression), plus the daemon STATE directory — see embedded-service-factories.ts.
   const createExternalServiceFactories = (token: string): ExternalServiceFactories =>
-    createEmbeddedServiceFactories(token, services.clusterCoordinator, services.clusterGroup.verbs);
+    createEmbeddedServiceFactories(token, services.clusterCoordinator, services.clusterGroup.verbs, join(services.homeDirectory, '.goodvibes', 'daemon'));
 
   let externalServices: ExternalServicesHandle = {
     daemonServer: null, httpListener: null,

package/src/runtime/device-posture-composition.ts

@@ -0,0 +1,110 @@
+/**
+ * device-posture-composition.ts — the paired-phone feature inside THIS daemon.
+ *
+ * A phone pairs with whichever daemon the person runs, and for this owner that
+ * daemon is hosted by the terminal app. Until this module existed the app had no
+ * device posture at all: `device.nodes.maxPaired` was enforced at the pairing
+ * path (SDK-side) and `device.capabilities.mode` was an onboarding toggle, while
+ * the other eleven `device.*` keys were recorded, read back, and governed
+ * nothing — the capability service they describe was never built here, so there
+ * was nothing for them to govern.
+ *
+ * The feature itself is platform-owned (`platform/devices`): the settings→policy
+ * mapping, the grants ledger, the capture store, the housekeeping sweeps, the
+ * confirmation flow, and the `phone` tool. This module supplies the three seams
+ * that are actually ours and nothing else:
+ *
+ *   - the peer transport — the same DistributedRuntimeManager the remote surface
+ *     pairs devices onto, so a phone paired here is a node here,
+ *   - the approval path — the shared approval broker, so the confirmation
+ *     appears wherever the person is looking (terminal, web app, companion),
+ *   - the storage root and the live config manager.
+ *
+ * Constructing this starts nothing. `startHousekeeping()` is called from the
+ * bootstrap tail: grants and captures both outlive a restart, so a grant whose
+ * phone is gone, or a capture torn by a crash, is reaped BEFORE the first
+ * request of this run is served — and the periodic sweep after it is what keeps
+ * a long-running daemon from going days without one. A failed sweep is logged
+ * and the app still runs: housekeeping failing is a reason to say so, not a
+ * reason to refuse to start.
+ */
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { createDevicePostureRuntime, registerDevicePhoneTool } from '@pellux/goodvibes-sdk/platform/devices';
+import type {
+  DeviceApprovalBridge,
+  DevicePeerTransport,
+  DevicePhoneToolRegistry,
+  DevicePostureRuntime,
+} from '@pellux/goodvibes-sdk/platform/devices';
+import { registerDevicesGatewayMethods } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+
+/** Who this surface records in the device audit trail. */
+export const TUI_DEVICE_ACTOR = 'tui:phone-tool';
+
+export interface DevicePostureCompositionOptions {
+  readonly configManager: ConfigManager;
+  /** The runtime devices pair onto; its listPeers/invokePeer are the transport. */
+  readonly distributedRuntime: DevicePeerTransport;
+  readonly approvals: DeviceApprovalBridge;
+  /** Surface-scoped directory the grants ledger, captures and disclosure live in. */
+  readonly stateDirectory: string;
+  /**
+   * Binding the catalog turns devices.nodes.list / devices.grants.* /
+   * devices.housekeeping.run from cataloged-but-unhandled into real handlers,
+   * which is what makes the grants surface work in the web app and the companion
+   * rather than only through this app's own tool.
+   */
+  readonly gatewayMethods?: GatewayMethodCatalog | undefined;
+  readonly getSessionId?: (() => string | undefined) | undefined;
+}
+
+export interface DevicePostureServices {
+  readonly devicePosture: DevicePostureRuntime;
+}
+
+/** Build the device posture runtime and bind the device verbs to it. */
+export function createDevicePostureServices(options: DevicePostureCompositionOptions): DevicePostureServices {
+  const devicePosture = createDevicePostureRuntime({
+    transport: options.distributedRuntime,
+    approvals: options.approvals,
+    config: options.configManager,
+    stateDirectory: options.stateDirectory,
+    actor: TUI_DEVICE_ACTOR,
+    ...(options.getSessionId ? { getSessionId: options.getSessionId } : {}),
+  });
+  if (options.gatewayMethods) registerDevicesGatewayMethods(options.gatewayMethods, devicePosture);
+  return { devicePosture };
+}
+
+/**
+ * Everything a host with a tool registry has to do once it is up: register the
+ * `phone` tool — the only path that reaches the capability service, so without it
+ * the posture keys govern nothing a session can observe — and start housekeeping.
+ *
+ * One call, because these two belong to the same feature and a host that did the
+ * first and forgot the second would serve requests while never reaping a grant
+ * whose phone is gone.
+ */
+export function installDevicePosture(
+  toolRegistry: DevicePhoneToolRegistry,
+  devicePosture: DevicePostureRuntime,
+): void {
+  registerDevicePhoneTool(toolRegistry, devicePosture);
+  startDeviceHousekeeping(devicePosture);
+}
+
+/**
+ * The recovery sweep plus the periodic timer. Separate from construction so
+ * composing a runtime in a test starts no timer and touches no disk, and
+ * separate from the call above so the standalone daemon — which registers no
+ * tools — still sweeps.
+ */
+export function startDeviceHousekeeping(devicePosture: DevicePostureRuntime): void {
+  void devicePosture.startHousekeeping().catch((error: unknown) => {
+    logger.warn('Device housekeeping sweep failed at startup', {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  });
+}

package/src/runtime/disposal-wiring.ts

@@ -38,6 +38,14 @@ export { createDisposalScope };
 export interface SurfaceRuntimePollerOwners extends Omit<RuntimePollerOwners, 'stopConfigWatch'> {
   /** Fork-only: the repeating crash-residue sweep (durability-services.ts). */
   readonly stopDurabilityHousekeeping: () => void;
+  /**
+   * Fork-only: the wake-word recovery sweep and a pending boot provision
+   * (voice-setup-services.ts). Started only when an entrypoint opted into boot
+   * provisioning, and a no-op otherwise — but it is on this list unconditionally,
+   * because "the graph did not start it this time" is not a reason for the
+   * teardown path to have no way to stop it.
+   */
+  readonly stopWakeHousekeeping: () => void;
   /**
    * Fork-only: the daemon handler surfaces (daemon-handler-composition.ts).
    *
@@ -47,6 +55,12 @@ export interface SurfaceRuntimePollerOwners extends Omit<RuntimePollerOwners, 's
    * exists, so if this surface does not stop them nothing does.
    */
   readonly daemonHandlers: { readonly unregister: () => void };
+  /**
+   * Fork-only: the paired-phone feature's housekeeping timer
+   * (device-posture-composition.ts). Started by whichever entry point boots the
+   * host, so the stop belongs on this list rather than in one shutdown path.
+   */
+  readonly devicePosture: { readonly stopHousekeeping: () => void };
 }
 
 /**
@@ -72,6 +86,8 @@ export function registerSurfaceRuntimePollers(
 ): void {
   registerRuntimePollers(registry, { ...services, stopConfigWatch: extras.stopConfigWatch });
   registry.add('durability housekeeping', services.stopDurabilityHousekeeping);
+  registry.add('device housekeeping', () => services.devicePosture.stopHousekeeping());
+  registry.add('wake-word housekeeping', services.stopWakeHousekeeping);
   // Registered LAST so it tears down FIRST (the scope unwinds in reverse), which
   // is the order daemon/cli.ts already used by hand: release the handler surfaces
   // — closing the inbox store and stopping its poll timers — before the pollers

package/src/runtime/embedded-service-factories.ts

@@ -27,9 +27,25 @@ export function createEmbeddedServiceFactories(
   sharedDaemonToken: string,
   clusterCoordinator: ClusterCoordinator,
   clusterGroupVerbs: ClusterGroupVerbSurface,
+  daemonStateDirectory: string,
 ): ExternalServiceFactories {
   return {
     sharedDaemonToken,
+    // `daemonRuntimeDir` names the daemon's own STATE directory — the one
+    // holding operator-tokens.json, auth-users.json and daemon-settings.json —
+    // which is `<home>/.goodvibes/daemon`, not the user home above it. Every
+    // reader in this repository resolves it that way (config/goodvibes-home.ts,
+    // cli/service-posture.ts, runtime/bootstrap.ts). Passing it explicitly
+    // through this typed field (rather than appending a duplicate
+    // `--daemon-home` CLI arg via `daemonLaunchArgs` and relying on
+    // last-wins flag parsing) also keeps a detached spawn correct when
+    // `GOODVIBES_HOME` overrides the tree root away from the OS home
+    // directory, which the SDK's own `daemonHomeDir` default does not account
+    // for. The SDK's
+    // fix (sdk commit d1336a2b) that put the state directory behind the FIRST
+    // `--daemon-home` argument shipped in 1.21.0 and made the old
+    // flag-duplication workaround redundant; this is its replacement.
+    daemonRuntimeDir: daemonStateDirectory,
     createDaemonServer: (bus, userAuth, runtimeServices) => {
       // No updateArtifact: the embedded daemon keeps updates host-managed (the
       // TUI client updates itself), so the facade runs no self-update loop.

package/src/runtime/legacy-daemon-migration.ts

@@ -135,7 +135,18 @@ export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServi
     description: MANAGED_SERVICE_DESCRIPTION,
     workingDirectory,
     command: params.binaryPath,
-    args: ['--daemon-home', params.homeDir],
+    // `--daemon-home` names the daemon's own STATE directory — the one holding
+    // operator-tokens.json, auth-users.json and daemon-settings.json — which is
+    // `<home>/.goodvibes/daemon`. This baked the USER HOME, so a serviced
+    // daemon filed its identity a level above where every reader in this
+    // repository looks: config/goodvibes-home.ts resolves the flag AS the state
+    // directory, cli/service-posture.ts already writes the state directory into
+    // GOODVIBES_DAEMON_HOME for the unit it installs, and runtime/bootstrap.ts
+    // reads the companion token from the state directory. On a normal machine
+    // the mismatch is invisible from the outside — the daemon simply mints a
+    // second operator-tokens.json in the home directory and the client keeps
+    // reading the empty one under .goodvibes/daemon.
+    args: ['--daemon-home', join(params.homeDir, '.goodvibes', 'daemon')],
     env: {},
     restartOnFailure: true,
   };

package/src/runtime/runtime-services-types.ts

@@ -38,6 +38,7 @@ import type { createDurabilityServices } from './durability-services.ts';
 import type { MemorySpineClient } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { DomainDispatch, RuntimeStore } from './store/index.ts';
+import type { DevicePostureRuntime } from '@pellux/goodvibes-sdk/platform/devices';
 import type { RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, ShellPathService, FeatureFlagManager, PolicyRuntimeState, SessionSurface } from '@/runtime/index.ts';
 import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
 import type { CacheRegistry, PauseController, MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
@@ -91,6 +92,13 @@ export interface RuntimeServicesOptions {
   readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
   /** Live session id, read per crash-residue sweep so the running session is exempt — see durability-services.ts. */
   readonly currentSessionId?: (() => string | null) | undefined;
+  /**
+   * Wake-word boot provisioning opt-in. Same shape as `powerSeam`: the real
+   * entrypoints (daemon/cli.ts, bootstrap-core.ts) ask for it, the one-shot CLI
+   * commands do not, and a test composing this graph gets neither a network fetch
+   * nor an hourly sweep it did not ask for. See voice-setup-services.ts.
+   */
+  readonly provisionWakeModelsAtBoot?: boolean | undefined;
 }
 
 export interface RuntimeServices {
@@ -176,6 +184,13 @@ export interface RuntimeServices {
   readonly providerRegistry: ProviderRegistry;
   readonly toolLLM: ToolLLM;
   readonly distributedRuntime: DistributedRuntimeManager;
+  /**
+   * The paired-phone feature for this host: the grants ledger, the capture
+   * store, the housekeeping sweeps, and the capability service every `device.*`
+   * setting governs. Bound to the `devices.*` verbs at composition; the `phone`
+   * tool is registered on it in the bootstrap tail.
+   */
+  readonly devicePosture: DevicePostureRuntime;
   readonly daemonHandlers: DaemonHandlerSurfaces;
   /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
   readonly clusterCoordinator: ClusterCoordinator;
@@ -211,6 +226,8 @@ export interface RuntimeServices {
   readonly appendOnlyRetentionScheduler: ReturnType<typeof createDurabilityServices>['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
   /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
   readonly stopDurabilityHousekeeping: () => void;
+  /** Stops the wake-word recovery sweep and a pending boot provision; a no-op unless `provisionWakeModelsAtBoot` was set. */
+  readonly stopWakeHousekeeping: () => void;
   readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
   readonly powerManager: PowerManager;
   /** The daemon's memory governor (default ON). Backs ops.memory.get and defends the daemon's footprint by tier. */

package/src/runtime/services.ts

@@ -55,6 +55,10 @@ import { createWorkstreamServices } from './workstream-services.ts';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, createStoreRerooter, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import { createDaemonHandlerComposition } from './daemon-handler-composition.ts';
+import { createDevicePostureServices } from './device-posture-composition.ts';
+// Re-exported so the shell's bootstrap reaches the install through the same
+// module it already imports the runtime graph from.
+export { installDevicePosture } from './device-posture-composition.ts';
 import { createClusterServices, startClusterServices } from './cluster-group-composition.ts';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
 import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
@@ -159,8 +163,24 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     join(surface.sessionsDir, 'task-graph.json'),
   );
   const hookActivityTracker = new HookActivityTracker();
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design — a
+  // narrow embed with no manager wired gets the capability rather than a
+  // silent off — so omitting it did not disable the watcher framework when
+  // watchers.enabled is turned off; it made the setting configure nothing.
+  // Threading it preserves current effective behaviour rather than changing
+  // it: watchers.enabled defaults true, the watcher-framework flag's own
+  // defaultState is 'enabled', and the flag declares no notOperable record —
+  // so with nothing configured the gate reads exactly as before, and the
+  // difference is only that turning it OFF now turns it off. This composes
+  // with bootstrap-core.ts's own `if (configManager.get('watchers.enabled'))`
+  // check around the built-in polling watcher registration: that check reads
+  // the same key, so the two never disagree, and this fix only reaches the
+  // watcher registry's OTHER entry points (registerWatcher/startWatcher/etc.)
+  // that bootstrap-core.ts's narrower check does not cover.
   const watcherRegistry = new WatcherRegistry({
     storePath: shellPaths.resolveProjectPath('tui', 'watchers.json'),
+    featureFlags,
   });
   watcherRegistry.attachRuntime({
     runtimeStore: options.runtimeStore,
@@ -223,6 +243,15 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // modal): bootstrap.ts activates the wire transport when a compatible
   // external daemon is adopted, same signal as the session spine.
   const memorySpine = new MemorySpineClient({ local: createLocalMemoryAccess(memoryRegistry) });
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
+  // omitting it did not disable delivery tracking when
+  // integrations.deliveryTracking is turned off — it made the setting
+  // configure nothing: deliverText/deliverJobRun kept running either way.
+  // Threading it preserves current effective behaviour rather than changing
+  // it: the config default is true, the delivery-engine flag's own
+  // defaultState is 'enabled', and the flag declares no notOperable record —
+  // so with nothing configured the gate reads exactly as before.
   const deliveryManager = new AutomationDeliveryManager({
     configManager,
     // This manager builds the delivery router the daemon actually replies
@@ -236,7 +265,20 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     routeBindings,
     artifactStore,
+    featureFlags,
   });
+  // Same shape as deliveryManager above: automation.enabled defaults true,
+  // the automation-domain flag's own defaultState is 'enabled', so threading
+  // featureFlags here does not change what a default install does — it only
+  // makes turning automation.enabled off actually turn AutomationManager's own
+  // create/update/run/list surface off. This composes with bootstrap.ts's own
+  // `if (configManager.get('automation.enabled'))` gate around scheduling
+  // automationManager.start(): that check reads the same key, and
+  // AutomationManager.start() re-checks the same gate internally (it no-ops
+  // and stops rather than starting when disabled), so the two can never
+  // disagree — this fix only reaches the manager's OTHER entry points
+  // (createJob/updateJob/runNow/etc.) that the bootstrap.ts gate does not
+  // cover, the same way watchers.enabled and the watcher registry above do.
   const automationManager = new AutomationManager({
     configManager,
     defaultSurfaceKind: 'tui',
@@ -248,6 +290,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     // Same live registry: a bare model id on an automation job resolves through
     // the shared resolver instead of a format-only rejection.
     providerRegistry,
+    featureFlags,
     spawnTask: (input) => {
       const record = agentManager.spawn({
         mode: 'spawn',
@@ -309,6 +352,16 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     approvalBridge: approvalBroker,
     automationBridge: automationManager,
   });
+  // The paired-phone feature for this host, on the SAME runtime phones pair onto
+  // and the SAME approval broker every other confirmation rides. Every `device.*`
+  // setting is read live through this; see device-posture-composition.ts.
+  const { devicePosture } = createDevicePostureServices({
+    configManager,
+    distributedRuntime,
+    approvals: approvalBroker,
+    stateDirectory: shellPaths.resolveProjectPath('tui', 'devices'),
+    gatewayMethods,
+  });
 
   // Which machines on this network are "us", and which of them reads the
   // shared inbox. Both inert until startCluster() — no socket, no key material
@@ -334,7 +387,18 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     = createRemoteExecutionServices({
       agentManager, workingDirectory, hookDispatcher, configManager, runtimeBus: options.runtimeBus,
     });
-  const tokenAuditor = new ApiTokenAuditor({ managed: false });
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
+  // omitting it did not disable managed blocking when
+  // security.tokenAudit.enabled is turned off. Threading it preserves current
+  // effective behaviour rather than changing it: managed is hardcoded false
+  // here (advisory reporting only; excess-scope/overdue tokens are reported,
+  // never blocked, regardless of this flag — see isBlocked()'s
+  // `this._config.managed && this._managedBlockingEnabled()` guard), the
+  // config default for security.tokenAudit.enabled is true, and the
+  // token-scope-rotation-audit flag's own defaultState is 'enabled' — so with
+  // nothing configured the gate reads exactly as before either way.
+  const tokenAuditor = new ApiTokenAuditor({ managed: false, featureFlags });
   const componentHealthMonitor = new ComponentHealthMonitor();
   const worktreeRegistry = new WorktreeRegistry(workingDirectory);
   const webhookNotifier = new WebhookNotifier();
@@ -386,7 +450,15 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeBus: options.runtimeBus,
     observeExternalAgents: options.observeExternalAgents, providerRegistry, // observeExternalAgents is daemon-side only
   });
-  const modeManager = new ModeManager(); const fileUndoManager = new FileUndoManager();
+  // featureFlags is REQUIRED here in practice, even though the SDK types it
+  // optional. isFeatureGateEnabled(null, ...) is permissive by design, so
+  // omitting it did not disable the HITL UX mode system when
+  // behavior.hitlMode is set to 'off' — setHITLMode/setDomainVerbosity kept
+  // accepting writes either way. Threading it preserves current effective
+  // behaviour rather than changing it: behavior.hitlMode defaults to
+  // 'balanced' (not 'off'), and the hitl-ux-modes flag's own defaultState is
+  // 'enabled' — so with nothing configured the gate reads exactly as before.
+  const modeManager = new ModeManager({ featureFlags }); const fileUndoManager = new FileUndoManager();
   const workspaceCheckpointManager = createWorkspaceCheckpointing({ workspaceRoot: workingDirectory, surface, runtimeBus: options.runtimeBus, configManager });
   // memory-consolidation honors governor backpressure: it ticks only when idle
   // AND the 'memory-consolidation' job is not paused AND expensive work is
@@ -414,7 +486,11 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
 
   // Managed local-voice provisioning (voice.local.status/install) — single-flight
   // one-act install + no-network status; see voice-setup-services.ts.
-  const { voiceSetup } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork });
+  const { voiceSetup, stopWakeHousekeeping } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork,
+    // Boot provisioning of the wake-word model + its recovery sweep, opted into
+    // by the real entrypoints only (same treatment as powerSeam) so a one-shot
+    // CLI command and a test composing this graph fetch nothing and start no timer.
+    provisionWakeModelsAtBoot: options.provisionWakeModelsAtBoot === true });
 
   // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
   // calendar.*/email.* are platform-served; these two let it register (mail-composition.ts).
@@ -552,6 +628,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     providerRegistry,
     toolLLM,
     distributedRuntime,
+    devicePosture,
     daemonHandlers,
     clusterCoordinator,
     clusterGroup,
@@ -577,7 +654,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workstreamCommands,
     codeIndexStore,
     codeIndexReindexScheduler,
-    storeSnapshotScheduler, appendOnlyRetentionScheduler, stopDurabilityHousekeeping,
+    storeSnapshotScheduler, appendOnlyRetentionScheduler, stopDurabilityHousekeeping, stopWakeHousekeeping,
     memoryConsolidationScheduler,
     powerManager,
     memoryGovernor,

package/src/runtime/voice-setup-services.ts

@@ -23,30 +23,76 @@ import {
   createVoiceSetupService,
   type VoiceSetupService,
 } from '@pellux/goodvibes-sdk/platform/runtime/voice-setup';
-import type { VoiceProviderRegistry } from '@pellux/goodvibes-sdk/platform/voice';
+import {
+  startWakeBootProvisioning,
+  type VoiceProviderRegistry,
+} from '@pellux/goodvibes-sdk/platform/voice';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import type { ShellPathService } from '@/runtime/index.ts';
 
 export type { VoiceSetupService };
 
+/**
+ * The recovery act this surface names when a boot provision degrades. The SDK
+ * would otherwise name the control-plane verb, which is correct everywhere and
+ * useless to someone sitting in a terminal.
+ */
+export const WAKE_RECOVERY_COMMAND = '/voice wake setup';
+
 export interface VoiceSetupServicesDeps {
   readonly configManager: ConfigManager;
   readonly shellPaths: Pick<ShellPathService, 'resolveUserPath'>;
   readonly voiceProviders: VoiceProviderRegistry;
   /** Critical-tier admission gate — a provision run allocates archive + model buffers. */
   readonly admitExpensiveWork: (label: string) => { allowed: boolean; reason?: string | undefined };
+  /**
+   * Opt into boot-time wake-model provisioning and the recovery sweeper.
+   *
+   * Off unless a real entrypoint asks for it, matching how this graph treats the
+   * host power seam: `daemon/cli.ts` and `runtime/bootstrap-core.ts` opt in, the
+   * one-shot CLI commands do not, and a test composing the graph gets neither a
+   * network fetch nor a repeating timer it did not ask for.
+   */
+  readonly provisionWakeModelsAtBoot?: boolean | undefined;
+  /** Injected in tests: the boot starter, so no sweeper and no fetch are real. */
+  readonly startBootProvisioning?: typeof startWakeBootProvisioning | undefined;
+}
+
+export interface VoiceSetupServices {
+  readonly voiceSetup: VoiceSetupService;
+  /**
+   * Stop the wake-word recovery sweeper and cancel a pending boot provision.
+   * A no-op when boot provisioning was not opted into. Registered on the
+   * disposal scope (disposal-wiring.ts) — an hourly timer nothing stops is a
+   * poller this surface leaked, which is exactly what that scope exists for.
+   */
+  readonly stopWakeHousekeeping: () => void;
 }
 
 /** Compose the managed-voice single-flight install + no-network status read. */
-export function wireVoiceSetup(deps: VoiceSetupServicesDeps): { voiceSetup: VoiceSetupService } {
+export function wireVoiceSetup(deps: VoiceSetupServicesDeps): VoiceSetupServices {
   const { configManager, voiceProviders } = deps;
+  const managedVoiceRoot = deps.shellPaths.resolveUserPath('voice');
   const voiceSetup = createVoiceSetupService({
-    managedVoiceRoot: deps.shellPaths.resolveUserPath('voice'),
+    managedVoiceRoot,
     getConfig: (key) => String(configManager.get(key as Parameters<typeof configManager.get>[0]) ?? ''),
     setConfig: (key, value) => configManager.setDynamic(key as Parameters<typeof configManager.setDynamic>[0], value),
     // A successful (re-)install clears any tripped local-engine breaker.
     resetLocalEngineFailureState: () => voiceProviders.get('local')?.resetEngineFailureState?.(),
     admitExpensiveWork: deps.admitExpensiveWork,
   });
-  return { voiceSetup };
+  if (deps.provisionWakeModelsAtBoot !== true) {
+    return { voiceSetup, stopWakeHousekeeping: () => {} };
+  }
+  // Sweep the wake tree, then fetch whatever the install could not. The SDK owns
+  // the policy — never throws, one plain message, reaps before it retries — and
+  // routes the attempt through the setup service's single flight so a boot
+  // attempt and a user typing /voice wake setup are one download.
+  const boot = (deps.startBootProvisioning ?? startWakeBootProvisioning)({
+    managedRoot: managedVoiceRoot,
+    ensureProvisioned: () => voiceSetup.wakeEnsureProvisioned({ recoveryHint: WAKE_RECOVERY_COMMAND }),
+    announce: (message) => { logger.info(message); },
+  });
+  return { voiceSetup, stopWakeHousekeeping: () => boot.stop() };
 }