@rubytech/create-sitedesk-code 0.1.507 → 0.1.508

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.507",
+  "version": "0.1.508",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"
@@ -13,7 +13,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-risk-class.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-agent-contract.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-brand-fonts.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/config/brand.json

@@ -140,6 +140,18 @@
         {
           "weight": 500,
           "file": "inter-500.woff2"
+        },
+        {
+          "weight": 600,
+          "file": "inter-600.woff2"
+        },
+        {
+          "weight": 700,
+          "file": "inter-700.woff2"
+        },
+        {
+          "weight": 800,
+          "file": "inter-800.woff2"
         }
       ]
     },

package/payload/platform/plugins/admin/PLUGIN.md

@@ -148,11 +148,16 @@ tools:
     adminAllowlist: true
     riskClass: write_local
 hidden:
-  - remote-auth-status
-  - remote-auth-set-password
-  - remote-auth-revoke-password
-  - qr-generate
-  - wifi
+  - name: remote-auth-status
+    riskClass: read
+  - name: remote-auth-set-password
+    riskClass: write_local
+  - name: remote-auth-revoke-password
+    riskClass: write_local
+  - name: qr-generate
+    riskClass: write_local
+  - name: wifi
+    riskClass: exec
 always: true
 embed: false
 mcp:

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:314794449900df77759bdbbc4bbeadb2afb0e8d6479371d935e7030a18d47485
+content-hash: sha256:b15d0e491d957f75523ecf7056f8004bafcdf448767c0c3dd64b40a73926b58b
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -3104,8 +3104,11 @@ not-found|rm-error>`.
 
 ### Agents
 
-The Agents surface (`/agents`) is the admin view of the account's agents, of two
-kinds, each card tagged `Public` or `Specialist`:
+The Agents surface (`/agents`) is the admin view of the account's agents. Each
+card is tagged by **origin**, which says who put the agent there and therefore
+what the operator may do with it. Origin is a different question to `kind`, which
+says what shape the agent is: a shipped specialist and a user-created one are
+both `kind: 'specialist'` and differ only by origin.
 
 - **Public agents** — the per-agent directories under `<accountDir>/agents/<slug>/`,
   each carrying a `config.json` (`displayName`, `status`, `model`,
@@ -3116,19 +3119,63 @@ kinds, each card tagged `Public` or `Specialist`:
   to the public URL (computed client-side: an `admin.` host maps to the `public.`
   host), plus a **delete** behind a confirm that runs the loud-fail `DELETE`
   (graph projection cleanup precedes file removal).
-- **User-created specialists** — the agent files under
+- **User-created specialists** (`origin: 'specialist'`) — the agent files under
   `<accountDir>/plugins/<plugin>/agents/<plugin>--<name>.md` (written by
-  `agent-builder`). `<accountDir>/plugins` is the user-created tree, so only
-  user-created specialists list here; shipped premium and core specialists (whose
-  plugins live under `PLATFORM_ROOT`) do not. The specialist modal shows the
-  model, tools, the owning plugin's skills, and the system-prompt body. Specialists
-  are authored, edited, and deleted through chat (`agent-builder` /
-  `specialist-management`), so the specialist modal offers no delete or open-agent
-  link.
+  `agent-builder`). The specialist modal shows the model, tools, the owning
+  plugin's skills, and the system-prompt body. Specialists are authored, edited,
+  and deleted through chat (`agent-builder` / `specialist-management`), so the
+  specialist modal offers no delete or open-agent link.
+- **Shipped specialists** (`origin: 'shipped'`) — the union of
+  `<accountDir>/specialists/agents/`, `<accountDir>/specialists/agents-disabled/`
+  and `PLATFORM_ROOT/templates/specialists/agents/`, in that precedence order.
+  `sidebar-artefacts.ts` reads the same union minus the quarantine directory, so
+  a disabled agent still appears there through its bundled-template row. The
+  route once walked only the account plugins tree, so the twelve
+  highest-capability agents on the box were the ones the operator could not see.
+  These are the only agents that can be disabled, and the route enforces that
+  rather than relying on the UI to withhold the control.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
 the sole agent surface.
 
+**Risk class.** Every classified card carries a green/amber/red badge derived
+from the agent's declared `tools:` line: green when every tool is `read`, amber
+when the worst is `write_local`, red on any `exec` or `external`, and red when
+any tool resolves to no class at all. Resolution has two sources, because
+frontmatter names tools in Claude Code's namespace: a plugin tool is a direct
+lookup in `ToolSurface.riskByTool`, which is keyed by the same
+canonical `mcp__plugin_<p>_<p>__<tool>` string frontmatter writes, and the
+eleven built-ins carry their own table in `server/lib/agent-risk.ts`. An empty
+tool list is red: no `tools:` line means the full surface, not none of it.
+
+A public agent carries `risk: null` and shows no badge. Its tool surface
+resolves through `ADMIN_CORE_TOOLS` plus the plugin allowlists rather than a
+`tools:` line, and classifying its empty list would paint every public agent red
+on a premise nothing established.
+
+The detail modal renders one chip per declared tool carrying **that tool's own**
+class, so a `read` tool inside a red agent still reads as harmless; a tool with
+no class is dashed and uncoloured rather than painted as if it were understood.
+Badge colours come from the shared semantic status set: `-solid` with white text
+for the badge, `-tint` with `-textOnTint` for a chip, never white.
+
+**Disable.** `<accountDir>/specialists/agents/` is the live dispatchable set —
+`spawn-context.ts` reads it to build the spawn manifest — so disabling **moves**
+the agent file to `<accountDir>/specialists/agents-disabled/` and records the
+basename in a 0600 `<accountDir>/agents-disabled.json`. A flag alone would leave
+the agent running while the card claimed otherwise.
+
+The file is moved, never deleted: a premium `--` agent and an operator-edited
+override each exist only in the account dir, so deleting one and later restoring
+from the bundled template would hand back a different agent than the operator
+switched off. A disabled agent stays listed, marked `Disabled`, because an agent
+that vanished from the surface that disabled it could never be switched back on.
+
+`provision-account-dir.sh` re-reads the store after its core-specialist recopy
+and removes anything named in it, so an upgrade does not silently re-deliver a
+disabled agent. An unreadable store withholds nothing and says so: a corrupt
+file is not evidence that an agent was disabled.
+
 **Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
 account from device state. The two reads resolve from the caller's admin session
 (`requireAdminSession` + the shared `accountDirForSession` in
@@ -3142,8 +3189,10 @@ explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent) plus its user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, accountId, skipped, specialistsSkipped}` — `accountId` names the account resolved (the client sends it back on a delete); `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. 401 when the session maps to no account. |
-| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, returns that plugin's specialist `{kind, model, tools, systemPrompt, skills}`. Unknown 404s, 401 as above. |
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `worstTool`, `unresolved` and `disabled`. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped}`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, worstTool, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
+| `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Same `accountId` contract as delete. |
+| `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. |
 | `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
 | `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
 
@@ -3170,6 +3219,35 @@ Agents page survived undiagnosed on a multi-account install.
 - `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
   `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
   graph-cleanup throw).
+- `op=classify account=<id8> agent=<name> origin=<shipped|public|specialist>
+  risk=<green|amber|red> worstTool=<tool> tools=<n> unresolved=<comma-list|none>
+  disabled=<bool>` — one line per classified agent per listing, so it fires on
+  every page load. `worstTool` makes a wrong class diagnosable without
+  re-deriving it. **A non-empty `unresolved=` is the one to act on**: the agent
+  is forced red, and the cause is that the built-in table or the registry
+  mapping has drifted, not that the agent changed.
+- `op=risk-surface status=load-failed reason=<msg>` — the plugin registry did
+  not parse, so every row is forced red and the listing returns
+  `riskSurfaceFailed: true`. Without the forced red, every plugin tool would
+  land in `unresolved` and a registry outage would read as agent drift across
+  every card at once; without the response field, a red row would be
+  indistinguishable from a genuinely dangerous agent, because nothing resolved
+  so `unresolved` is empty and the per-tool explanation cannot fire.
+- `op=disabled-store status=parse-failed reason=<msg>` — the listing then treats
+  every agent as enabled, which is what they actually are. A read surface shows
+  the true dispatchable set rather than a comforting one.
+- `op=<disable|enable> accountId=<id8> slug=<…> outcome=<ok|failed>`, with
+  `moved=<bool>` on disable and `reason=nothing-quarantined` on a failed enable.
+
+**Disable is a no-event failure, so it needs a standing check.** If the store
+names an agent whose file is still in `specialists/agents/`, nothing throws, the
+card reads disabled, and the agent keeps being dispatched. The five-minute
+`account-dir-schema-reconcile` pass reports it as
+`[fs-reconcile] op=agent-parity account=<id8> disabled=<n> stillOnDisk=<list>`,
+fired only on disagreement. The per-cycle heartbeat is `agent-drift=0` on that
+pass's summary line, which is what makes the absence of a per-account line
+readable as "clean" rather than "never audited" — grep the summary line, not the
+per-account one, to confirm the check is running.
 
 ### Graph
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,13 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-25 (0.1.508)
+
+- SiteDesk's screens now use a single, cleaner typeface throughout, and the old olive-green colour is gone.
+- You can now disable an agent from the Agents page, and each one shows its risk level.
+- Dashboard sections appear as soon as each one loads, instead of the whole page waiting on the slowest one.
+- Real Agent's icons and imagery were redrawn to match its colour palette.
+
 ## 2026-07-25 (0.1.507)
 
 - Chat now updates the moment a message or permission prompt arrives, instead of checking every couple of seconds.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -151,8 +151,11 @@ not-found|rm-error>`.
 
 ### Agents
 
-The Agents surface (`/agents`) is the admin view of the account's agents, of two
-kinds, each card tagged `Public` or `Specialist`:
+The Agents surface (`/agents`) is the admin view of the account's agents. Each
+card is tagged by **origin**, which says who put the agent there and therefore
+what the operator may do with it. Origin is a different question to `kind`, which
+says what shape the agent is: a shipped specialist and a user-created one are
+both `kind: 'specialist'` and differ only by origin.
 
 - **Public agents** — the per-agent directories under `<accountDir>/agents/<slug>/`,
   each carrying a `config.json` (`displayName`, `status`, `model`,
@@ -163,19 +166,63 @@ kinds, each card tagged `Public` or `Specialist`:
   to the public URL (computed client-side: an `admin.` host maps to the `public.`
   host), plus a **delete** behind a confirm that runs the loud-fail `DELETE`
   (graph projection cleanup precedes file removal).
-- **User-created specialists** — the agent files under
+- **User-created specialists** (`origin: 'specialist'`) — the agent files under
   `<accountDir>/plugins/<plugin>/agents/<plugin>--<name>.md` (written by
-  `agent-builder`). `<accountDir>/plugins` is the user-created tree, so only
-  user-created specialists list here; shipped premium and core specialists (whose
-  plugins live under `PLATFORM_ROOT`) do not. The specialist modal shows the
-  model, tools, the owning plugin's skills, and the system-prompt body. Specialists
-  are authored, edited, and deleted through chat (`agent-builder` /
-  `specialist-management`), so the specialist modal offers no delete or open-agent
-  link.
+  `agent-builder`). The specialist modal shows the model, tools, the owning
+  plugin's skills, and the system-prompt body. Specialists are authored, edited,
+  and deleted through chat (`agent-builder` / `specialist-management`), so the
+  specialist modal offers no delete or open-agent link.
+- **Shipped specialists** (`origin: 'shipped'`) — the union of
+  `<accountDir>/specialists/agents/`, `<accountDir>/specialists/agents-disabled/`
+  and `PLATFORM_ROOT/templates/specialists/agents/`, in that precedence order.
+  `sidebar-artefacts.ts` reads the same union minus the quarantine directory, so
+  a disabled agent still appears there through its bundled-template row. The
+  route once walked only the account plugins tree, so the twelve
+  highest-capability agents on the box were the ones the operator could not see.
+  These are the only agents that can be disabled, and the route enforces that
+  rather than relying on the UI to withhold the control.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
 the sole agent surface.
 
+**Risk class.** Every classified card carries a green/amber/red badge derived
+from the agent's declared `tools:` line: green when every tool is `read`, amber
+when the worst is `write_local`, red on any `exec` or `external`, and red when
+any tool resolves to no class at all. Resolution has two sources, because
+frontmatter names tools in Claude Code's namespace: a plugin tool is a direct
+lookup in `ToolSurface.riskByTool`, which is keyed by the same
+canonical `mcp__plugin_<p>_<p>__<tool>` string frontmatter writes, and the
+eleven built-ins carry their own table in `server/lib/agent-risk.ts`. An empty
+tool list is red: no `tools:` line means the full surface, not none of it.
+
+A public agent carries `risk: null` and shows no badge. Its tool surface
+resolves through `ADMIN_CORE_TOOLS` plus the plugin allowlists rather than a
+`tools:` line, and classifying its empty list would paint every public agent red
+on a premise nothing established.
+
+The detail modal renders one chip per declared tool carrying **that tool's own**
+class, so a `read` tool inside a red agent still reads as harmless; a tool with
+no class is dashed and uncoloured rather than painted as if it were understood.
+Badge colours come from the shared semantic status set: `-solid` with white text
+for the badge, `-tint` with `-textOnTint` for a chip, never white.
+
+**Disable.** `<accountDir>/specialists/agents/` is the live dispatchable set —
+`spawn-context.ts` reads it to build the spawn manifest — so disabling **moves**
+the agent file to `<accountDir>/specialists/agents-disabled/` and records the
+basename in a 0600 `<accountDir>/agents-disabled.json`. A flag alone would leave
+the agent running while the card claimed otherwise.
+
+The file is moved, never deleted: a premium `--` agent and an operator-edited
+override each exist only in the account dir, so deleting one and later restoring
+from the bundled template would hand back a different agent than the operator
+switched off. A disabled agent stays listed, marked `Disabled`, because an agent
+that vanished from the surface that disabled it could never be switched back on.
+
+`provision-account-dir.sh` re-reads the store after its core-specialist recopy
+and removes anything named in it, so an upgrade does not silently re-deliver a
+disabled agent. An unreadable store withholds nothing and says so: a corrupt
+file is not evidence that an agent was disabled.
+
 **Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
 account from device state. The two reads resolve from the caller's admin session
 (`requireAdminSession` + the shared `accountDirForSession` in
@@ -189,8 +236,10 @@ explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent) plus its user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, accountId, skipped, specialistsSkipped}` — `accountId` names the account resolved (the client sends it back on a delete); `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. 401 when the session maps to no account. |
-| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, returns that plugin's specialist `{kind, model, tools, systemPrompt, skills}`. Unknown 404s, 401 as above. |
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `worstTool`, `unresolved` and `disabled`. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped}`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, worstTool, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
+| `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Same `accountId` contract as delete. |
+| `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. |
 | `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
 | `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
 
@@ -217,6 +266,35 @@ Agents page survived undiagnosed on a multi-account install.
 - `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
   `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
   graph-cleanup throw).
+- `op=classify account=<id8> agent=<name> origin=<shipped|public|specialist>
+  risk=<green|amber|red> worstTool=<tool> tools=<n> unresolved=<comma-list|none>
+  disabled=<bool>` — one line per classified agent per listing, so it fires on
+  every page load. `worstTool` makes a wrong class diagnosable without
+  re-deriving it. **A non-empty `unresolved=` is the one to act on**: the agent
+  is forced red, and the cause is that the built-in table or the registry
+  mapping has drifted, not that the agent changed.
+- `op=risk-surface status=load-failed reason=<msg>` — the plugin registry did
+  not parse, so every row is forced red and the listing returns
+  `riskSurfaceFailed: true`. Without the forced red, every plugin tool would
+  land in `unresolved` and a registry outage would read as agent drift across
+  every card at once; without the response field, a red row would be
+  indistinguishable from a genuinely dangerous agent, because nothing resolved
+  so `unresolved` is empty and the per-tool explanation cannot fire.
+- `op=disabled-store status=parse-failed reason=<msg>` — the listing then treats
+  every agent as enabled, which is what they actually are. A read surface shows
+  the true dispatchable set rather than a comforting one.
+- `op=<disable|enable> accountId=<id8> slug=<…> outcome=<ok|failed>`, with
+  `moved=<bool>` on disable and `reason=nothing-quarantined` on a failed enable.
+
+**Disable is a no-event failure, so it needs a standing check.** If the store
+names an agent whose file is still in `specialists/agents/`, nothing throws, the
+card reads disabled, and the agent keeps being dispatched. The five-minute
+`account-dir-schema-reconcile` pass reports it as
+`[fs-reconcile] op=agent-parity account=<id8> disabled=<n> stillOnDisk=<list>`,
+fired only on disagreement. The per-cycle heartbeat is `agent-drift=0` on that
+pass's summary line, which is what makes the absence of a per-account line
+readable as "clean" rather than "never audited" — grep the summary line, not the
+per-account one, to confirm the check is running.
 
 ### Graph
 

package/payload/platform/plugins/memory/PLUGIN.md

@@ -168,9 +168,12 @@ tools:
     adminAllowlist: true
     riskClass: read
 hidden:
-  - session-compact
-  - session-compact-status
-  - image-fetch
+  - name: session-compact
+    riskClass: write_local
+  - name: session-compact-status
+    riskClass: read
+  - name: image-fetch
+    riskClass: read
 skills:
   - skills/conversational-memory/SKILL.md
   - skills/preference-audit/SKILL.md

package/payload/platform/scripts/__tests__/provision-honours-disabled-agents.test.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Task 1996 — an upgrade must not re-deliver an agent the operator switched off.
+#
+# provision_account_dir wipes every core specialist and re-copies it from the
+# bundled templates on every run. Without this, disabling an agent lapses on the
+# next publish: the file reappears in the dispatchable directory, nothing logs,
+# and the card still reads "disabled". That is the no-event failure the task
+# names, so it is pinned here.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLAT_SCRIPTS="$SCRIPT_DIR/.."
+PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
+TEMPLATES_DIR="$PROJECT_DIR/templates"
+PASS=0; FAIL=0; FAILED=()
+assert_absent() { if [ ! -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected absent [$1]"); fi; }
+assert_present() { if [ -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected present [$1]"); fi; }
+assert_eq() { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+. "$PLAT_SCRIPTS/lib/provision-account-dir.sh"
+export TEMPLATES_DIR PROJECT_DIR
+export SCRIPT_DIR="$PLAT_SCRIPTS"
+export USERS_FILE="/nonexistent/users.json"
+
+# A real shipped specialist, so the test exercises the same wipe-and-recopy loop
+# a publish runs rather than a synthetic filename.
+DISABLED_AGENT="coding-assistant.md"
+
+T1=$(mktemp -d); A1="$T1/acct"
+provision_account_dir "$A1" "dddddddd-dddd-dddd-dddd-dddddddddddd" "house" >/dev/null 2>&1
+assert_present "$A1/specialists/agents/$DISABLED_AGENT" "baseline-agent-delivered"
+
+# The operator disables it: the file moves to quarantine and the store names it.
+mkdir -p "$A1/specialists/agents-disabled"
+mv "$A1/specialists/agents/$DISABLED_AGENT" "$A1/specialists/agents-disabled/$DISABLED_AGENT"
+printf '{"disabled":["%s"]}\n' "$DISABLED_AGENT" > "$A1/agents-disabled.json"
+
+# The upgrade runs again.
+OUT="$(provision_account_dir "$A1" "dddddddd-dddd-dddd-dddd-dddddddddddd" "house" 2>&1)"
+
+assert_absent "$A1/specialists/agents/$DISABLED_AGENT" "disabled-agent-not-redelivered"
+assert_present "$A1/specialists/agents-disabled/$DISABLED_AGENT" "quarantined-copy-survives-upgrade"
+# Every other core specialist is still delivered: the guard removes what the
+# operator named, not the whole set.
+assert_present "$A1/specialists/agents/librarian.md" "other-agents-still-delivered"
+# The removal is reported, so an operator reading the publish output can see
+# which agents provisioning deliberately withheld.
+assert_eq "$(printf '%s' "$OUT" | grep -c "agents-withheld=1")" "1" "withheld-count-logged"
+rm -rf "$T1"
+
+# No store, no behaviour change: every core specialist is delivered.
+T2=$(mktemp -d); A2="$T2/acct"
+provision_account_dir "$A2" "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee" "house" >/dev/null 2>&1
+assert_present "$A2/specialists/agents/$DISABLED_AGENT" "no-store-delivers-everything"
+rm -rf "$T2"
+
+# A malformed store withholds nothing rather than withholding everything: an
+# unreadable file is not evidence that the operator disabled an agent.
+T3=$(mktemp -d); A3="$T3/acct"
+provision_account_dir "$A3" "ffffffff-ffff-ffff-ffff-ffffffffffff" "house" >/dev/null 2>&1
+printf '{ not json\n' > "$A3/agents-disabled.json"
+OUT3="$(provision_account_dir "$A3" "ffffffff-ffff-ffff-ffff-ffffffffffff" "house" 2>&1)"
+assert_present "$A3/specialists/agents/$DISABLED_AGENT" "malformed-store-withholds-nothing"
+assert_eq "$(printf '%s' "$OUT3" | grep -c 'agents-disabled-store-unreadable')" "1" "malformed-store-reported"
+rm -rf "$T3"
+
+# Review finding: the withhold used `rm -f` unconditionally. In the drift state
+# the reconcile check exists to catch — store names it, file is live, quarantine
+# empty — that deletes the only copy of a premium `--` agent or an operator-edited
+# override, because the replace loop skips `*--*` and the copy loop only restores
+# templates. Withholding must move, never destroy.
+T4=$(mktemp -d); A4="$T4/acct"
+provision_account_dir "$A4" "aaaa1111-aaaa-1111-aaaa-111111111111" "house" >/dev/null 2>&1
+mkdir -p "$A4/specialists/agents"
+printf -- '---\nname: quoter\n---\n\nOperator edited this premium agent.\n' > "$A4/specialists/agents/sitedesk--quoter.md"
+printf '{"disabled":["sitedesk--quoter.md"]}\n' > "$A4/agents-disabled.json"
+provision_account_dir "$A4" "aaaa1111-aaaa-1111-aaaa-111111111111" "house" >/dev/null 2>&1
+
+assert_absent "$A4/specialists/agents/sitedesk--quoter.md" "premium-withheld-from-dispatch"
+assert_present "$A4/specialists/agents-disabled/sitedesk--quoter.md" "premium-preserved-not-destroyed"
+assert_eq "$(grep -c 'Operator edited this premium agent' "$A4/specialists/agents-disabled/sitedesk--quoter.md" 2>/dev/null || echo 0)" "1" "premium-content-intact"
+rm -rf "$T4"
+
+echo "PASS=$PASS FAIL=$FAIL"
+if [ "$FAIL" -gt 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/check-risk-class.mjs

@@ -92,13 +92,18 @@ function collectPluginDirs() {
 }
 
 /** Independent of tool-surface.ts on purpose: a gate that shares the parser it
- *  is checking cannot detect that parser drifting. */
+ *  is checking cannot detect that parser drifting.
+ *
+ *  Task 1998 — `hidden:` entries carry the same name+riskClass shape as
+ *  `tools:` entries and are served by the same MCP server, so a hidden tool
+ *  can contradict its own name exactly as a visible one can. Scanning only
+ *  `tools:` would leave eight declarations outside the gate. */
 function declaredTools(manifestPath) {
   const out = []
   let current = null
   let inTools = false
   for (const line of readFileSync(manifestPath, 'utf8').split(/\r?\n/)) {
-    if (/^tools:\s*$/.test(line)) { inTools = true; continue }
+    if (/^(tools|hidden):\s*$/.test(line)) { inTools = true; current = null; continue }
     if (inTools && /^[A-Za-z_]/.test(line)) inTools = false
     if (!inTools) continue
     const name = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)

package/payload/platform/scripts/check-specialist-tool-surface.mjs

@@ -88,8 +88,11 @@ function parsePluginManifest(rawManifest) {
       if (nameLine) { tools.push(nameLine[1]); continue; }
     }
     if (mode === 'hidden') {
-      const item = line.match(/^\s+-\s+(.+?)\s*$/);
-      if (item) hidden.push(item[1]);
+      // Task 1998 — hidden entries carry the same `- name:` + `riskClass:`
+      // shape as tools entries. Names only here; the gate checks membership
+      // of the `all` surface, not consequence.
+      const nameLine = line.match(/^\s+-\s+name:\s*(.+?)\s*$/);
+      if (nameLine) hidden.push(nameLine[1]);
     }
   }
   return { tools, hidden, hasTools };

package/payload/platform/scripts/lib/canonical-tool-names.mjs

@@ -36,9 +36,12 @@ function extractFrontmatter(md) {
   return md.slice(3, end)
 }
 
-// Collect `- name: <x>` entries under a bare `tools:` block and `- <x>` entries
-// under a bare `hidden:` block. Both contribute names a specialist may list in
-// its `tools:` frontmatter, so both belong to the live set.
+// Collect `- name: <x>` entries under a bare `tools:` block and under a bare
+// `hidden:` block. Both contribute names a specialist may list in its `tools:`
+// frontmatter, so both belong to the live set. Task 1998 gave the hidden block
+// the same name+riskClass shape as tools, so the two branches now read alike;
+// this parser stays separate from tool-surface.ts on purpose, so a drift in one
+// shows up as a diff rather than as agreement between a parser and itself.
 function parseToolNames(frontmatter) {
   const lines = frontmatter.split('\n')
   const names = []
@@ -57,7 +60,7 @@ function parseToolNames(frontmatter) {
       const m = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
       if (m) names.push(m[1])
     } else if (mode === 'hidden') {
-      const m = line.match(/^\s+-\s+(.+?)\s*$/)
+      const m = line.match(/^\s+-\s+name:\s*(.+?)\s*$/)
       if (m) names.push(m[1])
     }
   }

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -251,6 +251,49 @@ SETTINGS_EOF
     [ -f "$specialist" ] && cp "$specialist" "$ACCOUNT_DIR/specialists/agents/$(basename "$specialist")"
   done
 
+  # Task 1996 — the copy loop above re-delivers every core specialist, which
+  # would silently undo a disable on the next publish. specialists/agents/ is
+  # the dispatchable set (spawn-context.ts reads it), so an agent the operator
+  # switched off is removed again here. The quarantined copy under
+  # specialists/agents-disabled/ is never touched: it is the operator's own
+  # file, and for a premium or edited agent it is the only copy.
+  #
+  # An unreadable store withholds NOTHING. A corrupt file is not evidence that
+  # an agent was disabled, and withholding the whole set on a parse error would
+  # turn a bad byte into a fleet-wide loss of specialists.
+  if [ -f "$ACCOUNT_DIR/agents-disabled.json" ]; then
+    local _disabled_names _withheld=0
+    if _disabled_names="$(python3 -c '
+import json, sys
+with open(sys.argv[1]) as fh:
+    names = json.load(fh)["disabled"]
+if not isinstance(names, list):
+    raise SystemExit(1)
+for n in names:
+    if isinstance(n, str) and n.endswith(".md") and "/" not in n and ".." not in n:
+        print(n)
+' "$ACCOUNT_DIR/agents-disabled.json" 2>/dev/null)"; then
+      local _name
+      while IFS= read -r _name; do
+        [ -n "$_name" ] || continue
+        if [ -e "$ACCOUNT_DIR/specialists/agents/$_name" ]; then
+          # MOVE, never delete. In the drift state the standing parity check
+          # exists to catch (store names it, file is live, quarantine empty) a
+          # delete would destroy the only copy of a premium `--` agent or an
+          # operator-edited override: the replace loop above skips `*--*` and
+          # the copy loop only restores templates, so nothing re-delivers it.
+          mkdir -p "$ACCOUNT_DIR/specialists/agents-disabled"
+          mv -f "$ACCOUNT_DIR/specialists/agents/$_name" \
+                "$ACCOUNT_DIR/specialists/agents-disabled/$_name"
+          _withheld=$((_withheld + 1))
+        fi
+      done <<< "$_disabled_names"
+      echo "  specialists agents-withheld=$_withheld (disabled by operator)"
+    else
+      echo "  specialists agents-disabled-store-unreadable — withholding nothing"
+    fi
+  fi
+
   rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
 
   # SOUL.md — user-controlled. Only create if missing. Never overwrite.

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts

@@ -15,7 +15,7 @@ export interface ReconcileResult extends ReconcileCounts {
 /** The single per-run summary line body. A non-zero count is the standing signal
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
-export declare function formatReconcileLine(c: ReconcileCounts, homeMissing?: number, homeUnaudited?: number): string;
+export declare function formatReconcileLine(c: ReconcileCounts, homeMissing?: number, homeUnaudited?: number, agentDrift?: number): string;
 /** Parse the fenced ```allowed-top-level block from an account's SCHEMA.md —
  *  the same structured set fs-schema-guard.sh parses with awk. Returns the
  *  entry names (blank lines dropped). An absent block yields an empty set. */

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AAsFA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,SAAI,EAAE,aAAa,SAAI,GAAG,MAAM,CAGlG;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AAyBD;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA+CtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}
+{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AA2FA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,eAAe,EAClB,WAAW,SAAI,EACf,aAAa,SAAI,EACjB,UAAU,SAAI,GACb,MAAM,CAGR;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AA0DD;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CA8DtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}