@sigrun/sigrun 0.4.2 → 0.5.0

package/dist/harness/boot.js

@@ -31,15 +31,39 @@ import { MEMORY_SECTION_KEY, noopMemoryExtension } from "./memory-default.js";
 import { createSeamHost, } from "./seam-host.js";
 import { contextFilesExtension } from "./sections/context-files.js";
 import { modelGuidanceExtension } from "./sections/model-guidance.js";
-import { createSkillsExtension } from "../skills/index.js";
+import { createSkillsExtension, scanFsRoot } from "../skills/index.js";
 import { SLASH_COMMANDS } from "../server/commands.js";
 import { packagePromptRootsOf } from "../commands/templates.js";
 import { blocksToolsExtension } from "./blocks/tools.js";
-import { codingToolsExtension, searchToolsExtension } from "./tools.js";
+import { createCodingToolsExtension, searchToolsExtension } from "./tools.js";
 import { collectProviders, createProviderMergeSink, } from "./providers/index.js";
 import { EventHub } from "../server/events/hub.js";
-import { providerAuthStatus } from "../server/helpers.js";
+import { providerAuthStatus, storeAgentChange } from "../server/helpers.js";
 import { bootRefresh, DEFAULT_REFRESH_TIMEOUT_MS, refreshProvider, } from "./providers/refresh.js";
+/**
+ * The default per-request stream deadline (curator-eval hardening): the
+ * OpenAI SDK waits up to 10 minutes for response HEADERS by default, and
+ * a request that never reaches the provider never gets headers — the
+ * generation task wedges in phase=request. Five minutes covers long
+ * first tokens on slow providers (observed 40-60s on the eval models;
+ * reasoning models can run far longer once streaming) because the SDK's
+ * timer clears at headers arrival, not stream end.
+ */
+export const DEFAULT_STREAM_TIMEOUT_MS = 300_000;
+/**
+ * The boot `stream` getter's merge, factored out for the harness-open
+ * test: caller seam over file over the default `timeoutMs`, field-wise.
+ * Returns `undefined` when nothing is set (the honest empty shape).
+ */
+export function mergeStreamSettings(caller, file) {
+    const merged = {
+        ...(caller ?? file),
+        ...(caller === undefined && file?.timeoutMs === undefined
+            ? { timeoutMs: DEFAULT_STREAM_TIMEOUT_MS }
+            : {}),
+    };
+    return Object.keys(merged).length > 0 ? merged : undefined;
+}
 import { startProviderRefresh } from "./providers/scheduler.js";
 import { fileModelsStore } from "./providers/models-store.js";
 import { packagesDirOf, selfPackageRoot } from "./packages.js";
@@ -55,6 +79,14 @@ import { probeOsUsers } from "../sandbox/availability.js";
 import { createAdmissionGuard } from "./identity/users.js";
 import { sweepAccountLinks } from "./identity/link-sweep.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
+import { learnedSkillsDir } from "../curation/paths.js";
+import { SkillStore } from "../curation/store.js";
+import { OverlayStore } from "../curation/overlays.js";
+import { UsageCounters } from "../curation/usage.js";
+import { buildCurationRegistry } from "../curation/targets.js";
+import { createCurationHost } from "../curation/host.js";
+import { createCurationToolFeed, wrapExtensionCurationTools, } from "../curation/wrap.js";
+import { createCurationGateExtension, CURATION_GATE_EXTENSION } from "../curation/gate.js";
 import { probeIsolation, runHelperProbe, selfTestHelper, } from "../sandbox/availability.js";
 import { resolveBuiltins, } from "./builtins.js";
 import { createRegistry } from "./registry.js";
@@ -346,9 +378,106 @@ export async function openHarness(config, options = {}) {
     // ones, which `listSkills` includes by design).
     const skillsOptions = {
         userDir: join(roots.configDir, "skills"),
+        // Curator A9 (P6): the canonical workspace ROOT for overlay keys —
+        // the configured default workspace (a conversation with a
+        // sub-cwd still matches the root-keyed overlay; the accessor
+        // stays live for the config's sake).
+        workspaceRoot: () => config.workspace.path,
+        // Curator A3 (P2): the conversation owner's learned root —
+        // `<dataDir>/users/<owner>/skills`, undefined for ownerless
+        // conversations. Discovery resolves the owner per render.
+        learnedRoot: (owner) => owner === undefined
+            ? undefined
+            : learnedSkillsDir(managedPaths.userAreas(owner)),
         packageRoots: () => collectedSkillRoots,
         sectionMaxBytes: () => skillsSettings?.read().skills?.sectionMaxBytes ?? 4096,
     };
+    // Curator A6 (P3/P4): the per-user curation wiring — one skill store,
+    // one overlay store and one usage counter set per EXISTING user,
+    // created lazily on first use and cached. `userExists` is the LIVE
+    // directory read (a removed user's factories stop resolving), and
+    // `nameTakenElsewhere` scans the host-side roots the harness owns
+    // (the user dir and the collected package roots; a conversation's
+    // workspace can only be checked through its env, which the store
+    // cannot see — the create-refusal there is the A4 store's own).
+    const skillStores = new Map();
+    const overlayStores = new Map();
+    const usageCounters = new Map();
+    const curationOf = (user) => {
+        if (user === undefined)
+            return undefined;
+        // Curator A10: cache-FIRST resolution — a store set captured before
+        // a user's deletion stays resolvable, so its own `userExists` gate
+        // fails every later op with "user removed" (the A4/A5 fail-closed
+        // property: an in-flight run's late write never recreates the
+        // roots). A never-seen user still needs the live directory read.
+        if (skillStores.get(user) === undefined &&
+            identity.users.get(user) === undefined) {
+            return undefined;
+        }
+        const userArea = managedPaths.userAreas(user);
+        let store = skillStores.get(user);
+        if (store === undefined) {
+            store = new SkillStore({
+                userArea,
+                user,
+                now: () => clockNow(),
+                nameTakenElsewhere: async (name) => {
+                    for (const skill of scanFsRoot(join(roots.configDir, "skills"), "user dir")) {
+                        if (skill.name === name)
+                            return "user dir";
+                    }
+                    for (const root of collectedSkillRoots) {
+                        if (scanFsRoot(root.dir, "package").some((skill) => skill.name === name))
+                            return root.extension;
+                    }
+                    return undefined;
+                },
+                userExists: () => identity.users.get(user) !== undefined,
+            });
+            skillStores.set(user, store);
+        }
+        let overlays = overlayStores.get(user);
+        if (overlays === undefined) {
+            overlays = new OverlayStore({
+                userArea,
+                user,
+                userExists: () => identity.users.get(user) !== undefined,
+                feed: store,
+            });
+            overlayStores.set(user, overlays);
+        }
+        let usage = usageCounters.get(user);
+        if (usage === undefined) {
+            usage = new UsageCounters({
+                userArea,
+                user,
+                now: () => clockNow(),
+                // The A4 gate, but silent: the cached counters outlive the user
+                // (cache-first resolution), and telemetry is void-and-forget —
+                // a removed user's flush drops instead of recreating the
+                // deleted curation directory (deletion's fail-closed claim).
+                userExists: () => identity.users.get(user) !== undefined,
+            });
+            usageCounters.set(user, usage);
+        }
+        return { store, overlays, usage };
+    };
+    const curationSkillsOptions = {
+        ...skillsOptions,
+        skillStore: (user) => curationOf(user)?.store,
+        overlays: (owner) => curationOf(owner)?.overlays,
+        usage: (owner) => curationOf(owner)?.usage,
+    };
+    // Curator A6 (P4): the read tool counts learned-root reads through the
+    // same per-user wiring (load_skill and /skill: count through the
+    // skills options above).
+    const codingWithUsage = createCodingToolsExtension({
+        countersOf: (owner) => curationOf(owner)?.usage,
+        learnedRootOf: (owner) => owner === undefined
+            ? undefined
+            : learnedSkillsDir(managedPaths.userAreas(owner)),
+    });
     const templateOptions = {
         userDir: join(roots.configDir, "prompts"),
         packageRoots: () => collectedTemplateRoots,
@@ -371,8 +500,22 @@ export async function openHarness(config, options = {}) {
         },
     };
     registry.install(contextFilesExtension);
-    registry.install(createSkillsExtension(skillsOptions));
-    registry.install(codingToolsExtension);
+    // Curator A8 (P9): the wrap feed — the mutable set of curation tool
+    // names, seeded with the core set and grown by the loader as each
+    // extension's curationTargets validate. The skills extension's
+    // install below wraps through it (its OWN tools: `skill_manage`);
+    // the loader wraps every extension-declared target tool at its
+    // install. `isCurationTool` on the built registry (A7) stays the
+    // read-side API — the feed is only the write-side wrap oracle.
+    const curationFeed = createCurationToolFeed();
+    // Curator A6: the skills extension carries the curation wiring
+    // (skill_manage + usage counting), and the coding tools count
+    // learned-root reads — the same extension NAMES as before, so
+    // nothing downstream observes the swap. A8: the install WRAPS the
+    // curation tools (skill_manage's registration carries the hint
+    // interception; load_skill and the section are untouched).
+    registry.install(wrapExtensionCurationTools(createSkillsExtension(curationSkillsOptions), curationFeed));
+    registry.install(codingWithUsage);
     registry.install(searchToolsExtension);
     // The chat-blocks tools (UI-blocks U5 Task 1, spec §8.1): every agent
     // can show and update interactive block surfaces in chat — the same
@@ -466,8 +609,11 @@ export async function openHarness(config, options = {}) {
     const sharedStores = sharedExtensionStores(roots, env, identity.users);
     const seamHosts = new Map();
     const seamKinds = new Map();
-    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
+    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, curationBindings, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
         packagesDir,
+        // Curator A8 (P9): the wrap feed — the loader grows it with each
+        // validated target tool and wraps those tools at their install.
+        curationFeed,
         hostContextFactory: (extensionName, kinds, priorHost) => {
             // Two-phase, revised for the provisional identity (provider
             // plugins Task 9 P1): the loader's PRE-import call passes the
@@ -505,6 +651,11 @@ export async function openHarness(config, options = {}) {
         },
     });
     perUserSlugs.push(...loadedPerUserSlugs);
+    // The curation-target registry (curator P7): the loader's validated,
+    // slug-attributed bindings folded into the ONE registry — the A8
+    // wrapping feed (isCurationTool) and the A9 host.curation surface
+    // read it. An empty fold is the no-declarer deploy.
+    const curation = buildCurationRegistry(curationBindings);
     for (const binding of userServiceBindings) {
         userServices.register(binding.extension, binding.services, binding.packageDir);
     }
@@ -640,6 +791,11 @@ export async function openHarness(config, options = {}) {
         name: "sigrun.jobs",
         tasks: [createScheduleTask(jobRuntimeDeps)],
     });
+    // Curator A8 (P6 gate): the hooks-only curator-run gate — installed
+    // in the registry but NEVER in the host default selection (the
+    // settings getter below filters it like a per-user entry): only A9's
+    // producer selects it, in the internal run conversations it creates.
+    registry.install(createCurationGateExtension());
     // The host event hub (W3 Task 4, spec §7.4): ONE per opened harness.
     // The event bus's commit-derived events subscribe below (after the bus
     // opens); the provider refresh paths observe readiness here — each
@@ -828,14 +984,26 @@ export async function openHarness(config, options = {}) {
                 return callerSettings?.retry ?? fileSettings.retry;
             },
             get stream() {
-                return callerSettings?.stream ?? fileSettings.stream;
+                // The stream-request default (curator-eval hardening): a
+                // model request with no explicit timeout can wedge forever —
+                // the OpenAI SDK's `timeout` is a headers-arrival deadline and
+                // defaults to 10 minutes, but a request that never reaches the
+                // provider (undici socket-pool class) never gets headers to
+                // time out against, so pi-durable's generation task sits in
+                // phase=request indefinitely. `mergeStreamSettings` bounds
+                // every request with a default `timeoutMs`; the caller seam
+                // and the file each override field-wise.
+                return mergeStreamSettings(callerSettings?.stream, fileSettings.stream);
             },
             get extensions() {
                 // Per-user entries are core-computed from SessionMeta.owner,
                 // never part of a host default — including an operator-supplied
-                // caller list (controller ruling: filter BOTH sources).
+                // caller list (controller ruling: filter BOTH sources). The
+                // curator-run gate (A8) is filtered the same way: it is selected
+                // ONLY in the internal run conversations A9's producer creates.
                 const selected = callerSettings?.extensions ?? registry.snapshot().installed();
-                return selected.filter((entry) => !isUserEntryName(entry.name));
+                return selected.filter((entry) => !isUserEntryName(entry.name) &&
+                    entry.name !== CURATION_GATE_EXTENSION);
             },
             toolExecution: callerSettings?.toolExecution,
             compaction: {
@@ -920,6 +1088,36 @@ export async function openHarness(config, options = {}) {
     // order). The bus's close stops delivery; the unsubscribe is unused.
     const now = clockNow;
     wireActivity(eventBus, harness, now);
+    // Curator A9 (P6): the ONE curation host — the `host.curation`
+    // surface over the per-user stores (curationOf), the curation
+    // registry, the jobs records and the run driver. The server's host
+    // bridge and every seam host expose the SAME instance (the bridge
+    // carries it; the seam hosts delegate). The digest producer's
+    // default agent is the create op's own store-default change (what
+    // every server-created conversation starts from): the structural
+    // `{settings, registry, providerEnv}` subset `storeAgentChange`
+    // reads, closed over the LIVE references so a settings PATCH
+    // reaches later digests without a restart.
+    // SAFETY: the cast — `storeAgentChange` reads exactly these three
+    // members (settings.read, registry.snapshot, providerEnv) and
+    // nothing else of OpenedHarness; the live closure satisfies them.
+    const curationHost = createCurationHost({
+        harness,
+        registry,
+        storage,
+        curation,
+        defaultModel,
+        stores: curationOf,
+        skillsOptions: {
+            userDir: join(roots.configDir, "skills"),
+            packageRoots: () => collectedSkillRoots,
+        },
+        defaultAgent: () => storeAgentChange({
+            settings: { read: () => settingsStore.read() },
+            registry,
+            providerEnv: effectiveEnv,
+        }, defaultModel),
+    });
     const handlersByName = new Map();
     for (const binding of runSettledBindings) {
         handlersByName.set(binding.extension.name, {
@@ -1176,6 +1374,8 @@ export async function openHarness(config, options = {}) {
         channelBindings,
         gatewayEngine,
         skillRoots: extensionSkillRoots,
+        curation,
+        curationHost,
         commandExpansion,
         eventBus,
         events,

package/dist/harness/builtins.js

@@ -1,7 +1,7 @@
 /**
- * Built-in extensions: codemode, MCP, tool search and OAuth ship WITH
- * core — present by default, disableable via settings `builtinExtensions`,
- * replaceable by a same-named configured extension.
+ * Built-in extensions: codemode, MCP, tool search, OAuth and the curator
+ * ship WITH core — present by default, disableable via settings
+ * `builtinExtensions`, replaceable by a same-named configured extension.
  *
  * The first three mirror pi 1.3.0's built-in tool surface; OAuth adds
  * sigrun's standard OIDC/OAuth2 login providers without extra setup.
@@ -38,13 +38,15 @@ import { basename, dirname, isAbsolute, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parsePackageSpecifier, readPackageName } from "./packages.js";
 /**
- * The five built-ins, in load order (codemode before tool-search: both
+ * The six built-ins, in load order (codemode before tool-search: both
  * wrap pi-durable's own extensions and neither depends on the other, but
- * the order pins the tool-collision story should names ever overlap).
- * Specifiers are the published package names (Task 3) — npm keys a file:
- * dependency by the target's own manifest name, so the key must be the
- * name the packages publish under (the dev shape carries `file:` values
- * under these same keys until Task 8 publishes exact `0.1.0`s).
+ * the order pins the tool-collision story should names ever overlap;
+ * curator loads LAST — its loops observe every earlier built-in's
+ * contributions). Specifiers are the published package names (Task 3)
+ * — npm keys a file: dependency by the target's own manifest name, so
+ * the key must be the name the packages publish under (the dev shape
+ * carries `file:` values under these same keys until Task 8 publishes
+ * exact `0.1.0`s).
  */
 export const BUILTIN_EXTENSIONS = [
     { key: "codemode", specifier: "@sigrun/ext-codemode", slug: "codemode" },
@@ -52,6 +54,7 @@ export const BUILTIN_EXTENSIONS = [
     { key: "toolSearch", specifier: "@sigrun/ext-tool-search", slug: "tool-search" },
     { key: "gateway", specifier: "@sigrun/ext-gateway", slug: "gateway" },
     { key: "oauth", specifier: "@sigrun/oauth", slug: "oauth" },
+    { key: "curator", specifier: "@sigrun/ext-curator", slug: "curator" },
 ];
 /** The core-anchored require (built-ins resolve from core's own node_modules). */
 const coreRequire = createRequire(import.meta.url);

package/dist/harness/event-bus.js

@@ -103,6 +103,22 @@ export class EventBus {
     }
     #unsubscribe;
     #harness;
+    /**
+     * Internal-run detection (curator P5): the SessionMeta `internal` flag,
+     * resolved SYNCHRONOUSLY from the commit stream — every SessionMeta
+     * document change warms the cache (see the pre-pass in `observe`), so
+     * the arms there always find the flag of the conversation the
+     * publication belongs to. The marker is written in the conversation's
+     * CREATING commit and never changes (`markInternal`), so a cached
+     * value never goes stale; `false` is cached too, keeping ordinary
+     * traffic at zero extra reads (the bus's no-blocking-work contract
+     * forbids a snapshot here).
+     */
+    #internal = new Map();
+    /** Whether `conversationId` is internal per the commit-warmed cache. */
+    #isInternal(conversationId) {
+        return this.#internal.get(conversationId) === true;
+    }
     #queueMax;
     #hookDeadlineMs;
     #idleThresholdMs;
@@ -663,10 +679,37 @@ export class EventBus {
         try {
             const lifecycle = [];
             const forkParents = new Map();
+            // Curator P5, PRE-PASS: warm the internal-flag cache off every
+            // SessionMeta document change BEFORE any arm below can fire —
+            // change order within a publication is unspecified, so the
+            // conversation/submission arms must never depend on the SessionMeta
+            // change having been seen first (an internal conversation created in
+            // THIS commit emits nothing, its `conversation.created` host event
+            // included). The plain `document` arm alone: a fork's
+            // `document.copy` carries no value to read (and `internal` is never
+            // inherited — the child's own first SessionMeta commit re-warms it).
+            // The marker is written in the creating commit and never changes
+            // (`markInternal`), so a cached value never goes stale; `false` is
+            // cached too, keeping ordinary traffic at zero extra reads (the
+            // bus's no-blocking-work contract forbids a snapshot here).
+            for (const change of publication.changes) {
+                if (change.type !== "document")
+                    continue;
+                if (change.record.kind !== SessionMetaDoc.definition.kind)
+                    continue;
+                if (change.conversationId === undefined)
+                    continue;
+                this.#internal.set(change.conversationId, change.value?.internal === true);
+            }
             for (const change of publication.changes) {
                 if (change.type !== "conversation")
                     continue;
                 const record = change.value;
+                // Curator P5: an internal conversation emits nothing — not the
+                // lifecycle events, not the host event (every owner-keyed path
+                // skips internal; the SSE stream's filtering is belt-and-braces).
+                if (this.#isInternal(record.id))
+                    continue;
                 lifecycle.push({
                     type: "conversationCreated",
                     conversationId: record.id,
@@ -690,6 +733,17 @@ export class EventBus {
                 if (change.type !== "document" && change.type !== "document.copy") {
                     continue;
                 }
+                // Curator P5: an internal conversation emits nothing on ANY
+                // document arm — not the SessionMeta summary diffs, and not the
+                // interaction/ambient seam events either (every conversation.*
+                // host event and every derived lifecycle is withheld; the flag
+                // was warmed by the pre-pass above).
+                if (change.conversationId !== undefined &&
+                    this.#isInternal(change.conversationId)) {
+                    this.#archivedBasis.delete(change.conversationId);
+                    this.#metaBasis.delete(change.conversationId);
+                    continue;
+                }
                 const kind = change.record.kind;
                 if (kind !== SessionMetaDoc.definition.kind) {
                     // W3 Task 4: the interaction + ambient seam doc families feed
@@ -958,6 +1012,16 @@ export class EventBus {
                 const value = change.value;
                 if (value.type !== "input")
                     continue;
+                // Curator P5: an internal conversation's submissions are invisible
+                // on every surface the bus feeds — no idle bookkeeping (the run
+                // never arms the idle clock), no run.admitted/run.settled host
+                // events (the SSE stream and the notifications surface see
+                // nothing), and no settle-group enqueueing (no extension
+                // runSettled delivery — the brief's three bus gates in one skip).
+                // The flag was warmed by the pre-pass; `markInternal` runs in the
+                // creating commit, which always precedes any submission.
+                if (this.#isInternal(value.conversationId))
+                    continue;
                 // Idle bookkeeping (Task 4): a PLACED input both stamps the
                 // admission clock and marks the run live; a terminal input marks
                 // the run end. Write-type submissions never touch either — a

package/dist/harness/loader.js

@@ -93,6 +93,7 @@ import { satisfies, validRange } from "semver";
 import { HOST_RUNTIME_MODULES, hostModuleVersion, readPackageAssetsDir, readPackageName, readPackageVersion, resolveExtensionEntry, } from "./packages.js";
 import { RESERVED_CORE_SECTION_KEYS, RESERVED_EXTENSION_SLUGS, } from "./reserved-sections.js";
 import { slugifyName } from "./stores.js";
+import { wrapExtensionCurationTools } from "../curation/wrap.js";
 /** Every lifecycle field name, in validation order (mirrors the contract doc). */
 const LIFECYCLE_FIELDS = [
     "conversationCreated",
@@ -217,6 +218,52 @@ function validateWorkers(value) {
  * (the §8.2 grammar), and duplicate names within one extension are
  * rejected (they would collide on the `ext:<slug>:<name>` id).
  */
+/**
+ * Validate a factory result's `curationTargets` declaration (curator
+ * P7). Absent → undefined (no targets). Present but malformed →
+ * throw; the loader quarantines the extension with the thrown message
+ * (fail-loud: an extension that THINKS it declared a curation target
+ * must not silently lose it). Per target, validation order: name,
+ * duplicate qualified name (checked at collection — the slug is
+ * unknown here), tools list, guidance, undo (REQUIRED — no undo, no
+ * magic), maintain.
+ *
+ * The REGISTERED-TOOL check (a target listing a tool its extension
+ * does not register) and the cross-extension duplicate qualified id
+ * live in the load loop, where the registry and the slug are known.
+ */
+function validateCurationTargets(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value)) {
+        throw new Error("extension factory returned a curationTargets field that is not an array");
+    }
+    const targets = [];
+    for (const entry of value) {
+        const target = entry;
+        const name = target?.name;
+        if (typeof name !== "string" || name.length === 0) {
+            throw new Error("extension factory returned a curation target without a name");
+        }
+        const tools = target?.tools;
+        if (!Array.isArray(tools) ||
+            tools.some((tool) => typeof tool !== "string" || tool.length === 0)) {
+            throw new Error(`extension factory returned a curation target "${name}" whose tools is not an array of non-empty strings`);
+        }
+        if (typeof target?.guidance !== "function") {
+            throw new Error(`extension factory returned a curation target "${name}" whose guidance is not a function`);
+        }
+        if (typeof target?.undo !== "function") {
+            throw new Error(`curation target "${name}" has no undo`);
+        }
+        if (target?.maintain !== undefined &&
+            typeof target.maintain !== "function") {
+            throw new Error(`extension factory returned a curation target "${name}" whose maintain is not a function`);
+        }
+        targets.push(entry);
+    }
+    return targets;
+}
 function validateUserServices(value) {
     if (value === undefined)
         return undefined;
@@ -1204,6 +1251,10 @@ async function resolvedFromFactory(factory, hostContext) {
     }
     // `workers` is a contract key — the candidate read needs no cast.
     const workers = validateWorkers(candidate.workers);
+    // Curation targets (curator P7): validated without the slug (the
+    // qualified-id duplicate check runs in the load loop where the slug
+    // and the already-claimed ids are known).
+    const curationTargets = validateCurationTargets(candidate.curationTargets);
     return {
         ...(candidate.perUserTools === undefined
             ? {}
@@ -1244,6 +1295,7 @@ async function resolvedFromFactory(factory, hostContext) {
             ? {}
             : { ambientKinds: candidate.ambientKinds }),
         ...(workers === undefined ? {} : { workers }),
+        ...(curationTargets === undefined ? {} : { curationTargets }),
         ...(providers === undefined ? {} : { providers }),
         ...(loginProviders === undefined ? {} : { loginProviders }),
         ...(webuiBundles === undefined ? {} : { webuiBundles }),
@@ -1438,6 +1490,10 @@ export async function loadExtensions(specifiers, registry, options = {}) {
     const settingsChangedBindings = [];
     const lifecycleBindings = [];
     const workerBindings = [];
+    // Curation targets (curator P7): slug-attributed declarations, one
+    // entry per loaded extension whose result carried them — boot folds
+    // these into the ONE CurationRegistry (src/curation/targets.ts).
+    const curationBindings = [];
     const userServiceBindings = [];
     // Jobs Task 3: declared jobs, attributed to the extension slug (the
     // `ext:<slug>:<name>` id's namespace).
@@ -1475,6 +1531,11 @@ export async function loadExtensions(specifiers, registry, options = {}) {
     // Slug → declared name, for collision rejection at load (this boot's
     // loaded set only — quarantined extensions never claim a slug).
     const slugs = new Map();
+    // Qualified curation-target ids ("<slug>:<name>", curator P7): the same
+    // claimed-only-by-LOADED pattern as `slugs` — a target id names ONE
+    // target, so a duplicate quarantines the later declarer instead of
+    // shadowing (never last-wins).
+    const curationIds = new Set();
     // Channel id → slug (gateway C1): the same claimed-only-by-LOADED pattern
     // as `slugs`. Chat bindings are keyed by channel id, so a shadowing
     // adapter would inherit another adapter's chats — the collision
@@ -1695,6 +1756,32 @@ export async function loadExtensions(specifiers, registry, options = {}) {
             // install, exactly like the channel-id collision — a second engine
             // leaves no registry entry, no slug claim, and no binding. First
             // loaded wins.
+            // Curation targets (curator P7): the two slug-dependent rules
+            // check HERE — after the slug is final, BEFORE the registry
+            // install (a violation leaves no entry, no slug claim, no
+            // binding — the same point as the one-engine rule below).
+            // A target's tools list must name tools THIS extension
+            // registers (A8's wrapping rewrites registrations — an
+            // unregistered name would wrap nothing); a qualified id
+            // ("<slug>:<name>") names ONE target.
+            if (resolved.curationTargets !== undefined) {
+                const registered = new Set((extension?.tools ?? []).map((tool) => tool.name));
+                // Claim each id AS it validates: an intra-list duplicate
+                // (the same name twice in one result) hits the check on
+                // its SECOND arrival, quarantining before any install.
+                const claimed = new Set();
+                for (const target of resolved.curationTargets) {
+                    const id = `${slug}:${target.name}`;
+                    if (curationIds.has(id) || claimed.has(id)) {
+                        throw new Error(`duplicate curation target id "${id}" — a qualified id names one curation target`);
+                    }
+                    claimed.add(id);
+                    const unregistered = target.tools.find((tool) => !registered.has(tool));
+                    if (unregistered !== undefined) {
+                        throw new Error(`extension "${slug}" declares curation target "${target.name}" listing tool "${unregistered}" it does not register`);
+                    }
+                }
+            }
             if (resolved.gateway !== undefined) {
                 if (gatewayEngine !== undefined) {
                     throw new Error(`gateway engine already declared by "${gatewayEngine.extension}"`);
@@ -1702,7 +1789,23 @@ export async function loadExtensions(specifiers, registry, options = {}) {
                 gatewayEngine = { extension: slug, engine: resolved.gateway };
             }
             if (extension !== undefined) {
-                registry.install(extension);
+                // Curator A8 (P9): grow the wrap feed with this extension's
+                // just-validated target tools, then WRAP every curation-tool
+                // registration at the install — its own target tools, plus any
+                // feed name it registers (a non-core `skill_manage`). Growth
+                // lives HERE, after every quarantining check, so the feed
+                // never learns a tool whose extension failed the load. The
+                // bindings below keep pairing with the UNWRAPPED object: they
+                // carry identity, never tools, and the wrap changes only
+                // `execute`.
+                if (options.curationFeed !== undefined &&
+                    resolved.curationTargets !== undefined) {
+                    for (const target of resolved.curationTargets) {
+                        for (const tool of target.tools)
+                            options.curationFeed.add(tool);
+                    }
+                }
+                registry.install(wrapExtensionCurationTools(extension, options.curationFeed));
             }
             if (resolved.perUserTools === true)
                 perUserSlugs.push(slug);
@@ -1773,6 +1876,15 @@ export async function loadExtensions(specifiers, registry, options = {}) {
                     workers: resolved.workers,
                 });
             }
+            if (resolved.curationTargets !== undefined) {
+                curationBindings.push({
+                    extension: slug,
+                    targets: resolved.curationTargets,
+                });
+                for (const target of resolved.curationTargets) {
+                    curationIds.add(`${slug}:${target.name}`);
+                }
+            }
             if (resolved.jobs !== undefined) {
                 jobBindings.push({ extension: slug, jobs: resolved.jobs });
             }
@@ -1890,6 +2002,7 @@ export async function loadExtensions(specifiers, registry, options = {}) {
         settingsChangedBindings,
         lifecycleBindings,
         workerBindings,
+        curationBindings,
         jobBindings,
         routeBindings,
         commandBindings,

package/dist/harness/naming.js

@@ -104,6 +104,12 @@ export function createAutoNamer(deps) {
             // skip sits next to the isTaskOwned check per the plan.
             if (meta?.source === "cron")
                 return;
+            // Internal conversations (curator P5) are never named: they are
+            // invisible on every owner-keyed surface, and a name would exist
+            // only to be hidden. The bus already withholds the settle event;
+            // this is the belt-and-braces read-side gate.
+            if (meta?.internal === true)
+                return;
             // An absent doc (never written — reads serve nothing, defaults are
             // free) is an unnamed conversation with zero attempts: name it.
             if (meta?.name !== undefined || meta?.autoName !== undefined)