@stravica-ai/digital-operator-pa 0.1.0

package/dist/engineering-pa-core-extensions-atlassian/README.md

@@ -0,0 +1,31 @@
+# @stravica-ai/engineering-pa-core-extensions-atlassian
+
+Identity: `@stravica-ai/engineering-pa-core-extensions-atlassian` — optional Atlassian (Jira/Confluence) core extension.
+
+## Status
+
+**Skeleton — v0.1.0.** Workspace-internal, `"private": true`, not individually published.
+
+Phase 2 promotes the existing operator-side Atlassian extension(s) into core via the extension-promotion mechanism: the upgrade tool detects a local extension matching this namespace, deactivates the local copy, copies operator-specific config across, and enables the core version.
+
+For v0.1.0, this is an empty slot so the manifest-toggleable extension model is established from day one.
+
+## Layout
+
+```
+packages/core-extensions/atlassian/
+  index.mjs            # placeholder export
+  package.json         # name, version, scripts
+  README.md            # this file
+  test/index.test.mjs
+```
+
+## Tests
+
+```bash
+pnpm --filter @stravica-ai/engineering-pa-core-extensions-atlassian test
+```
+
+## Standards
+
+Follows the [tooling standard](../../../CONTRIBUTING.md#standards): JS only, zero npm deps, `node:test`, camelCase JSON.

package/dist/engineering-pa-core-extensions-atlassian/index.mjs

@@ -0,0 +1,9 @@
+// @stravica-ai/engineering-pa-core-extensions-atlassian — optional Atlassian
+// integration (Jira/Confluence tooling + workspace pages).
+//
+// Status: skeleton. Phase 2 promotes the existing operator-side Atlassian
+// extension(s) into core. Until then, this is a placeholder slot so the
+// manifest-toggleable extension model is established from day one.
+
+export const name = './';
+export const status = 'skeleton';

package/dist/engineering-pa-core-extensions-atlassian/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@stravica-ai/engineering-pa-core-extensions-atlassian",
+  "version": "0.1.1",
+  "description": "Atlassian (Jira/Confluence) core extension — optional, manifest-toggleable.",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "private": true,
+  "license": "MIT",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "test": "node --test --test-isolation=none test/*.test.mjs"
+  },
+  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper — see packages/cli/test/secrets. Counts must never lie."
+}

package/dist/engineering-pa-core-extensions-n8n/README.md

@@ -0,0 +1,29 @@
+# @stravica-ai/engineering-pa-core-extensions-n8n
+
+Identity: `@stravica-ai/engineering-pa-core-extensions-n8n` — optional n8n core extension.
+
+## Status
+
+**Skeleton — v0.1.0.** Workspace-internal, `"private": true`, not individually published.
+
+Phase 2 promotes the operator-side n8n extension content (the generic, non-operator-specific parts) into core via the extension-promotion mechanism. v0.1.0 holds the placeholder slot.
+
+## Layout
+
+```
+packages/core-extensions/n8n/
+  index.mjs            # placeholder export
+  package.json         # name, version, scripts
+  README.md            # this file
+  test/index.test.mjs
+```
+
+## Tests
+
+```bash
+pnpm --filter @stravica-ai/engineering-pa-core-extensions-n8n test
+```
+
+## Standards
+
+Follows the [tooling standard](../../../CONTRIBUTING.md#standards): JS only, zero npm deps, `node:test`, camelCase JSON.

package/dist/engineering-pa-core-extensions-n8n/index.mjs

@@ -0,0 +1,8 @@
+// @stravica-ai/engineering-pa-core-extensions-n8n — optional n8n integration
+// (workflows + workspace pages).
+//
+// Status: skeleton. Phase 2 promotes operator-side n8n extension content
+// into core. v0.1.0 holds the placeholder slot.
+
+export const name = './';
+export const status = 'skeleton';

package/dist/engineering-pa-core-extensions-n8n/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@stravica-ai/engineering-pa-core-extensions-n8n",
+  "version": "0.1.1",
+  "description": "n8n integration core extension — optional, manifest-toggleable.",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "private": true,
+  "license": "MIT",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "test": "node --test --test-isolation=none test/*.test.mjs"
+  },
+  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper — see packages/cli/test/secrets. Counts must never lie."
+}

package/dist/engineering-pa-librarian/README.md

@@ -0,0 +1,38 @@
+# @stravica-ai/engineering-pa-librarian
+
+Identity: `@stravica-ai/engineering-pa-librarian` — librarian client + deployed distillation service.
+
+## Status
+
+**Skeleton — v0.1.0.** Workspace-internal, `"private": true`, not individually published.
+
+Two distinct surfaces ship here, in different phases:
+
+- **Phase 1 Task 4** — role-as-library librarian: in-session distillation for personal/operator knowledge. Ported from Stravica/dave's predecessor implementation.
+- **Phase 3** — deployed librarian service: runs scheduled (cron-style) on a team-deployment host (smarthome01 for HQ, per-team VM elsewhere), pulls each PA's `intake/{paName}/`, distills into the team library's `canonical/`, commits a PR, auto-merges. The sole writer to `canonical/`.
+
+Both surfaces obey the [knowledge-system standard](https://github.com/Stravica/dave/blob/main/operator/knowledge/engineering/standards/knowledge-system.md): raw/canonical/schema layer separation, KCS Solve/Evolve routing, Wikipedia-NPOV per-claim conflict blocks, Mem0-style hybrid retrieval, LangMem semantic/episodic/procedural memory typing.
+
+## Layout
+
+```
+packages/librarian/
+  index.mjs            # placeholder export; populated in Task 4 / Phase 3
+  package.json         # name, version, scripts
+  README.md            # this file
+  test/index.test.mjs
+```
+
+## Open operator decisions
+
+The knowledge-system standard surfaces eight deferred operator decisions (personal-vs-team routing default, confirmation semantics, cross-PA notification mechanism, schema versioning lifecycle, GraphRAG summaries, personal-vs-team librarian role, talk-page equivalent, multi-tenant write enforcement). None are resolved in this skeleton.
+
+## Tests
+
+```bash
+pnpm --filter @stravica-ai/engineering-pa-librarian test
+```
+
+## Standards
+
+Follows the [tooling standard](../../CONTRIBUTING.md#standards): JS only, zero npm deps, `node:test`, camelCase JSON.

package/dist/engineering-pa-librarian/index.mjs

@@ -0,0 +1,12 @@
+// @stravica-ai/engineering-pa-librarian — team-library client + librarian service.
+//
+// Status: skeleton. Phase 3 lands the deployed librarian service that distills
+// PA intake into canonical team-library content per the knowledge-system
+// methodology (raw/canonical/schema layer separation, KCS Solve/Evolve
+// routing, Wikipedia-NPOV per-claim conflict blocks).
+//
+// Phase 1 Task 4 ports the role-as-library librarian (in-session distillation
+// for personal/operator knowledge) from Stravica/dave's predecessor.
+
+export const name = './';
+export const status = 'skeleton';

package/dist/engineering-pa-librarian/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@stravica-ai/engineering-pa-librarian",
+  "version": "0.1.1",
+  "description": "Librarian — team-library client + deployed distillation service.",
+  "type": "module",
+  "main": "./index.mjs",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "private": true,
+  "license": "MIT",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "test": "node --test --test-isolation=none test/*.test.mjs"
+  },
+  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper — see packages/cli/test/secrets. Counts must never lie."
+}

package/dist/engineering-pa-migrate-inspect/README.md

@@ -0,0 +1,131 @@
+# @stravica-ai/engineering-pa-migrate-inspect
+
+**Status:** v0.1.0 — active
+
+Host-inspection CLI for migration planning. Produces a structured `inspection.json` describing migration-relevant host state: layout version, runtimes, scheduled tasks, mounts, Dave environment variables, and operator extensions.
+
+## Install / Invoke
+
+### As a `pa` verb (recommended)
+
+```
+pa migrate-inspect [options]
+```
+
+### As a standalone binary (after pnpm install)
+
+```
+migrate-inspect [options]
+```
+
+## Commands
+
+| Option | Type | Default | Description |
+|---|---|---|---|
+| `--out <path>` | string | stdout | Write inspection.json to file |
+| `--dave-root <path>` | string | `DAVE_ROOT` or `PA_REPO_ROOT` env | Override Dave root path |
+| `--pretty` | boolean | false | Pretty-print JSON output |
+| `-h, --help` | — | — | Show help |
+
+### Examples
+
+```bash
+# Inspect current host, print to stdout
+pa migrate-inspect
+
+# Inspect with explicit Dave root, write to file
+pa migrate-inspect --dave-root /home/user/dave --out /tmp/inspect.json
+
+# Pretty-print for human review
+pa migrate-inspect --pretty
+```
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| 0 | OK |
+| 1 | Usage error |
+| 2 | Operational failure |
+| 3 | Transport/IO failure |
+
+## Operational discipline
+
+- **Read-only**: this tool never modifies any file except the output file specified by `--out`. It makes no changes to the Dave installation or host configuration.
+- **No writes outside log dir**: the only file written is the one explicitly specified by `--out`.
+- **No external deps**: uses Node stdlib only (`node:child_process`, `node:fs/promises`, `node:os`, `node:util`, `node:path`).
+- **Platform-guarded**: on Linux, `launchdPlists` is always `[]`; `~/Library/LaunchAgents` is never read.
+
+## Output shape
+
+```json
+{
+  "host": {
+    "hostname": "string",
+    "os": "darwin | linux | ...",
+    "osVersion": "string",
+    "arch": "arm64 | x64 | ..."
+  },
+  "runtimes": {
+    "nodeVersion": "24.0.0",
+    "pnpmVersion": "10.0.0",
+    "gitVersion": "2.40.0"
+  },
+  "scheduled": {
+    "crontab": [{ "schedule": "* * * * *", "command": "..." }],
+    "launchdPlists": [{ "label": "...", "program": "...", "args": [], "workingDirectory": "...", "runAtLoad": true, "keepAlive": true }]
+  },
+  "mounts": [{ "source": "//server/share", "target": "/mnt/share", "fsType": "smbfs" }],
+  "daveEnv": {
+    "daveRoot": "/path/to/dave",
+    "daveRelevantEnvVars": { "DAVE_ROOT": "/path/to/dave" },
+    "pathSegments": ["/path/to/dave/node_modules/.bin"]
+  },
+  "paths": {
+    "daveRoot": "/path/to/dave",
+    "coreToolsPath": "/path/to/dave/core/tools",
+    "operatorPath": "/path/to/dave/operator",
+    "layoutVersion": "v1 | v2 | unknown"
+  },
+  "extensions": [{ "name": "my-ext", "path": "/path/to/dave/operator/extensions/tools/my-ext", "hasManifestEntry": true }],
+  "inspectedAt": "2026-05-17T12:00:00.000Z"
+}
+```
+
+## Project layout
+
+```
+packages/cli/migrate-inspect/
+  bin/migrate-inspect          shebang shim
+  package.json
+  src/
+    cli.mjs                    arg parsing + exit-code translation
+    inspector.mjs              orchestrates platform modules
+    platforms/
+      macos.mjs                macOS-specific collectors
+      linux.mjs                Linux-specific collectors
+    runner.mjs                 CHOKEPOINT: all spawns happen here
+  test/
+    fixtures/
+      fake-dave-v1/            minimal v1 fixture tree
+      fake-dave-v2/            minimal v2 fixture tree
+    cli.test.mjs
+    inspector.test.mjs
+    runner.test.mjs
+```
+
+## Tests
+
+```bash
+pnpm --filter @stravica-ai/engineering-pa-migrate-inspect test
+# or
+node --test 'test/**/*.test.mjs'
+```
+
+## Tooling standard reference
+
+- Chokepoint pattern: all subprocess spawning is in `runner.mjs` — never elsewhere.
+- No shell interpolation: `spawnCapture` always receives `cmd` and `args` as separate arguments.
+- No external npm deps: Node stdlib only.
+- `node:test` + `node:assert/strict` for tests.
+- Exit codes follow tooling standard §6.

package/dist/engineering-pa-migrate-inspect/bin/migrate-inspect

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import('../src/cli.mjs').then(m => m.main(process.argv.slice(2)).then(c => process.exit(c)));

package/dist/engineering-pa-migrate-inspect/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@stravica-ai/engineering-pa-migrate-inspect",
+  "version": "0.1.1",
+  "description": "Host-inspection CLI for migration planning — produces a structured inspection.json describing migration-relevant host state.",
+  "type": "module",
+  "main": "./src/cli.mjs",
+  "exports": {
+    ".": "./src/cli.mjs",
+    "./src/*": "./src/*"
+  },
+  "bin": {
+    "migrate-inspect": "bin/migrate-inspect"
+  },
+  "private": true,
+  "license": "MIT",
+  "engines": { "node": ">=24" },
+  "scripts": {
+    "test": "node --test --test-isolation=none 'test/**/*.test.mjs'"
+  },
+  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper — see packages/cli/test/secrets. Counts must never lie."
+}

package/dist/engineering-pa-migrate-inspect/src/age-key-migrate.mjs

@@ -0,0 +1,83 @@
+// age-key-migrate.mjs — perform the v1 -> v2 age-key copy.
+//
+// v1 stored its age private key at ~/.config/dave/age-key.txt; v2 looks
+// at ~/.config/stravica-pa/age-key.txt. Operators who upgraded by
+// reinstalling discovered their vault was unusable because the
+// migrate-to-v2 host work did not move the file (w-2026-05-18-008).
+//
+// This module exposes `migrateAgeKey({ home })` which:
+//   - reads the current key file at the v1 path
+//   - writes it to the v2 path with mode 0600
+//   - LEAVES the v1 file in place so a single-session rollback is possible
+//   - never overwrites an existing v2 key (returns 'v2-already-populated')
+//   - never fabricates a key (returns 'none-present' if v1 is absent)
+//
+// The READ-only inspector lives in inspector.mjs; this module is the only
+// write-bearing path in migrate-inspect, gated by the cli's --apply-age-key
+// flag.
+
+import { copyFile, chmod, mkdir, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+/**
+ * Migrate the v1 age key to the v2 location.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.home]   Override homedir (used by tests).
+ * @returns {Promise<{action: 'migrated'|'v2-already-populated'|'none-present',
+ *                    v1Path: string, v2Path: string, message: string}>}
+ */
+export async function migrateAgeKey(opts = {}) {
+  const home = opts.home ?? homedir();
+  const v1Path = join(home, '.config', 'dave', 'age-key.txt');
+  const v2Path = join(home, '.config', 'stravica-pa', 'age-key.txt');
+
+  const [v1Exists, v2Exists] = await Promise.all([_exists(v1Path), _exists(v2Path)]);
+
+  // Path 1: neither key exists — silent. Host has no key (e.g. smarthome01).
+  if (!v1Exists && !v2Exists) {
+    return {
+      action: 'none-present',
+      v1Path,
+      v2Path,
+      message: 'No age key found at either location. Host has no key.',
+    };
+  }
+
+  // Path 2: v2 already populated — leave alone. Operator either already
+  // migrated, or generated a v2 key directly. Removing v1 (if present) is
+  // a separate cleanup step the operator can take once they're confident
+  // the v2 vault is healthy.
+  if (v2Exists) {
+    return {
+      action: 'v2-already-populated',
+      v1Path,
+      v2Path,
+      message: v1Exists
+        ? `v2 key already present at ${v2Path}. v1 key still at ${v1Path} — remove manually once confirmed healthy.`
+        : `v2 key already present at ${v2Path}. No action taken.`,
+    };
+  }
+
+  // Path 3: only v1 exists — copy to v2 with mode 0600. Keep v1 in place
+  // as a one-session safety net.
+  await mkdir(dirname(v2Path), { recursive: true, mode: 0o700 });
+  await copyFile(v1Path, v2Path);
+  await chmod(v2Path, 0o600);
+  return {
+    action: 'migrated',
+    v1Path,
+    v2Path,
+    message: `Migrated age key: ${v1Path} -> ${v2Path} (mode 600). v1 left in place as a one-session safety net.`,
+  };
+}
+
+async function _exists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/dist/engineering-pa-migrate-inspect/src/cli.mjs

@@ -0,0 +1,97 @@
+// cli.mjs — arg parsing + exit-code translation for migrate-inspect.
+
+import { parseArgs } from 'node:util';
+import { writeFile } from 'node:fs/promises';
+import { inspect } from './inspector.mjs';
+import { migrateAgeKey } from './age-key-migrate.mjs';
+import * as runner from './runner.mjs';
+
+const USAGE = `pa migrate-inspect — host inspection for migration planning
+
+Usage:
+  pa migrate-inspect [options]
+
+Options:
+  --out <path>            Write inspection.json to <path> (default: stdout)
+  --dave-root <path>      Override Dave root path (default: DAVE_ROOT or PA_REPO_ROOT env)
+  --pretty                Pretty-print JSON output (default: compact)
+  --apply-age-key         Run the v1 -> v2 age-key migration as part of the inspection
+                          (copies ~/.config/dave/age-key.txt to
+                          ~/.config/stravica-pa/age-key.txt, mode 600, keeps v1).
+                          Idempotent: skips if v2 already populated.
+  -h, --help              Show this help
+
+Exit codes:
+  0  OK
+  1  Usage error
+  2  Operational failure
+  3  Transport/IO failure
+`;
+
+export async function main(argv) {
+  let opts;
+  try {
+    const parsed = parseArgs({
+      args: argv,
+      options: {
+        out: { type: 'string' },
+        'dave-root': { type: 'string' },
+        pretty: { type: 'boolean', default: false },
+        'apply-age-key': { type: 'boolean', default: false },
+        help: { type: 'boolean', short: 'h', default: false },
+      },
+      allowPositionals: false,
+    });
+    opts = parsed.values;
+  } catch (err) {
+    process.stderr.write(`[migrate-inspect] Usage error: ${err.message}\n`);
+    process.stderr.write(USAGE);
+    return 1;
+  }
+
+  if (opts.help) {
+    process.stdout.write(USAGE);
+    return 0;
+  }
+
+  let result;
+  try {
+    result = await inspect({ daveRoot: opts['dave-root'] || null }, runner);
+  } catch (err) {
+    process.stderr.write(`[migrate-inspect] Operational failure: ${err.message}\n`);
+    return 2;
+  }
+
+  // Optional in-line age-key migration. Reported as `ageKeyMigration` on
+  // the inspection output so callers can audit what was done.
+  if (opts['apply-age-key']) {
+    try {
+      const migration = await migrateAgeKey();
+      result.ageKeyMigration = migration;
+      // Surface the action on stderr too — operators running this
+      // interactively want to see the outcome at a glance without
+      // having to scroll through inspection.json.
+      process.stderr.write(`[migrate-inspect] age-key: ${migration.action} — ${migration.message}\n`);
+    } catch (err) {
+      process.stderr.write(`[migrate-inspect] age-key migration failed: ${err.message}\n`);
+      return 2;
+    }
+  }
+
+  const json = opts.pretty
+    ? JSON.stringify(result, null, 2)
+    : JSON.stringify(result);
+
+  if (opts.out) {
+    try {
+      await writeFile(opts.out, json + '\n', 'utf8');
+    } catch (err) {
+      process.stderr.write(`[migrate-inspect] IO failure writing ${opts.out}: ${err.message}\n`);
+      return 3;
+    }
+  } else {
+    process.stdout.write(json + '\n');
+  }
+
+  return 0;
+}