@wrongstack/webui-server 0.302.2 → 0.305.0

package/dist/index.js

@@ -28,7 +28,14 @@ function isRecord(value) {
 var AUTONOMY_VALUES = /* @__PURE__ */ new Set(["off", "suggest", "auto", "eternal", "eternal-parallel"]);
 var CONTEXT_STRATEGY_VALUES = /* @__PURE__ */ new Set(["hybrid", "intelligent", "selective"]);
 var CONTEXT_MODE_VALUES = /* @__PURE__ */ new Set(["balanced", "frugal", "deep"]);
-var TOKEN_SAVING_TIER_VALUES = /* @__PURE__ */ new Set(["off", "minimal", "light", "medium", "aggressive"]);
+var TOKEN_SAVING_TIER_VALUES = /* @__PURE__ */ new Set([
+  "auto",
+  "off",
+  "minimal",
+  "light",
+  "medium",
+  "aggressive"
+]);
 var ENHANCE_LANGUAGE_VALUES = /* @__PURE__ */ new Set(["original", "english"]);
 var LOG_LEVEL_VALUES = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var AUDIT_LEVEL_VALUES = /* @__PURE__ */ new Set(["minimal", "standard", "full"]);
@@ -285,12 +292,8 @@ function validatePreferenceValue(key, value) {
     if (!Array.isArray(value)) return `prefs.update payload.${key} must be an array`;
     for (let i = 0; i < value.length; i++) {
       const item = value[i];
-      if (!isRecord(item))
-        return `prefs.update payload.${key}[${i}] must be an object`;
-      const error2 = arrayValidator(
-        item,
-        `prefs.update payload.${key}[${i}]`
-      );
+      if (!isRecord(item)) return `prefs.update payload.${key}[${i}] must be an object`;
+      const error2 = arrayValidator(item, `prefs.update payload.${key}[${i}]`);
       if (error2) return error2;
     }
     return null;
@@ -1099,11 +1102,11 @@ import { randomBytes } from "node:crypto";
 import { scrubErrorDetail } from "@wrongstack/core/security";
 import { WebSocket } from "ws";
 var WEBUI_WS_MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
-function sendSerialized(ws, data) {
+function sendSerialized(ws, data, frameBytes) {
   if (ws.readyState !== WebSocket.OPEN) return false;
   const buffered = Number.isFinite(ws.bufferedAmount) ? ws.bufferedAmount : 0;
-  const frameBytes = Buffer.byteLength(data, "utf8");
-  if (buffered + frameBytes > WEBUI_WS_MAX_BUFFERED_BYTES) {
+  const bytes = frameBytes ?? Buffer.byteLength(data, "utf8");
+  if (buffered + bytes > WEBUI_WS_MAX_BUFFERED_BYTES) {
     try {
       ws.terminate();
     } catch {
@@ -1126,8 +1129,9 @@ function send(ws, msg) {
 }
 function broadcast(clients, msg) {
   const data = JSON.stringify(msg);
+  const frameBytes = Buffer.byteLength(data, "utf8");
   for (const [ws] of clients) {
-    sendSerialized(ws, data);
+    sendSerialized(ws, data, frameBytes);
   }
 }
 function sendResult2(ws, success, message) {
@@ -1464,7 +1468,13 @@ function indexDbVersion(projectRoot, indexDir) {
   try {
     const dir = resolveIndexDir(projectRoot, indexDir);
     const st = fs.statSync(path.join(dir, DB_FILE));
-    return `${st.mtimeMs}:${st.size}`;
+    let wal = "";
+    try {
+      const walSt = fs.statSync(path.join(dir, `${DB_FILE}-wal`));
+      wal = `:${walSt.mtimeMs}:${walSt.size}`;
+    } catch {
+    }
+    return `${st.mtimeMs}:${st.size}${wal}`;
   } catch {
     return "missing";
   }
@@ -2196,6 +2206,7 @@ var CollaborationWebSocketHandler = class {
         this.broadcast(sessionId, this.stateMessage(sessionId));
       }
     }, 2e3);
+    this.broadcastInterval.unref?.();
   }
   stopBroadcast() {
     if (this.broadcastInterval) {
@@ -7211,13 +7222,18 @@ var GoalWebSocketHandler = class {
           const { execFile: execFile2 } = await import("node:child_process");
           const result = await new Promise((resolve17) => {
             const npxCommand = process.platform === "win32" ? "npx.cmd" : "npx";
-            execFile2(npxCommand, ["tsc", "--noEmit"], { cwd, timeout: 6e4 }, (err, stdout, stderr) => {
-              if (err && err.code === "ENOENT") {
-                resolve17("[verify] tsc not found \u2014 skipping");
-                return;
+            execFile2(
+              npxCommand,
+              ["tsc", "--noEmit"],
+              { cwd, timeout: 6e4 },
+              (err, stdout, stderr) => {
+                if (err && err.code === "ENOENT") {
+                  resolve17("[verify] tsc not found \u2014 skipping");
+                  return;
+                }
+                resolve17(stdout + stderr);
               }
-              resolve17(stdout + stderr);
-            });
+            );
           });
           if (result.includes("[verify]") || result.trim().length === 0) {
             return { ok: true };
@@ -7519,6 +7535,7 @@ ${result_.finalText.slice(0, 2e3)}`
       if (progress) this.broadcast({ type: "goal.progress", payload: progress });
       this.broadcastState();
     }, 2e3);
+    this.broadcastInterval.unref?.();
   }
   stopBroadcast() {
     if (this.broadcastInterval) {
@@ -7643,8 +7660,9 @@ ${result_.finalText.slice(0, 2e3)}`
   }
   broadcast(msg) {
     const data = JSON.stringify(msg);
+    const frameBytes = Buffer.byteLength(data, "utf8");
     for (const client of this.clients) {
-      sendSerialized(client.ws, data);
+      sendSerialized(client.ws, data, frameBytes);
     }
   }
   send(client, msg) {
@@ -7689,12 +7707,34 @@ function handleTodosGet(ctx, ws) {
     payload: sessionPayload(ctx, { todos: [...ctx.context.todos] })
   });
 }
-function handleTodosClear(ctx, ws) {
-  ctx.replaceTodos?.([]);
-  sendResult3(ctx, ws, true, "Todos cleared");
-  ctx.broadcast({ type: "todos.updated", payload: sessionPayload(ctx, { todos: [] }) });
+async function commitTodos(ctx, todos) {
+  if (ctx.mutateTodos) {
+    const result = await ctx.mutateTodos(todos);
+    return { todos: result.todos, warnings: result.warnings ?? [] };
+  }
+  ctx.replaceTodos?.(todos);
+  return { todos: [...todos], warnings: [] };
+}
+function managedProjectionMessage() {
+  return "Kanban-bound todos are task projections. Change or remove the task from Kanban.";
+}
+async function handleTodosClear(ctx, ws) {
+  if (ctx.context.todos.some((todo) => todo.kanbanBoardId && todo.kanbanTaskId)) {
+    sendResult3(ctx, ws, false, managedProjectionMessage());
+    return;
+  }
+  try {
+    const result = await commitTodos(ctx, []);
+    sendResult3(ctx, ws, true, "Todos cleared");
+    ctx.broadcast({
+      type: "todos.updated",
+      payload: sessionPayload(ctx, { todos: result.todos })
+    });
+  } catch (error2) {
+    sendResult3(ctx, ws, false, error2 instanceof Error ? error2.message : String(error2));
+  }
 }
-function handleTodosRemove(ctx, ws, payload) {
+async function handleTodosRemove(ctx, ws, payload) {
   if (!payload) {
     sendResult3(ctx, ws, false, "Missing id or index");
     return;
@@ -7711,12 +7751,27 @@ function handleTodosRemove(ctx, ws, payload) {
     sendResult3(ctx, ws, false, "Todo not found");
     return;
   }
+  if (removed.kanbanBoardId && removed.kanbanTaskId) {
+    sendResult3(ctx, ws, false, managedProjectionMessage());
+    return;
+  }
   const next = [...todos.slice(0, targetIndex), ...todos.slice(targetIndex + 1)];
-  ctx.replaceTodos?.(next);
-  sendResult3(ctx, ws, true, `Removed: ${removed.content}`);
-  ctx.broadcast({ type: "todos.updated", payload: sessionPayload(ctx, { todos: next }) });
+  try {
+    const result = await commitTodos(ctx, next);
+    sendResult3(ctx, ws, true, `Removed: ${removed.content}`);
+    ctx.broadcast({
+      type: "todos.updated",
+      payload: sessionPayload(ctx, { todos: result.todos })
+    });
+  } catch (error2) {
+    sendResult3(ctx, ws, false, error2 instanceof Error ? error2.message : String(error2));
+  }
 }
-function handleTodoUpdate(ctx, ws, payload) {
+async function handleTodoUpdate(ctx, ws, payload) {
+  if (!payload || typeof payload.id !== "string" || payload.status !== void 0 && payload.status !== "pending" && payload.status !== "in_progress" && payload.status !== "completed" || payload.activeForm !== void 0 && typeof payload.activeForm !== "string") {
+    sendResult3(ctx, ws, false, "Invalid todo update payload");
+    return;
+  }
   const index = ctx.context.todos.findIndex((todo) => todo.id === payload.id);
   const existing = ctx.context.todos[index];
   if (index === -1 || !existing) {
@@ -7729,9 +7784,25 @@ function handleTodoUpdate(ctx, ws, payload) {
     status: payload.status ?? existing.status,
     activeForm: payload.activeForm !== void 0 ? payload.activeForm : existing.activeForm
   };
-  ctx.replaceTodos?.(next);
-  sendResult3(ctx, ws, true, `Todo "${existing.content}" updated`);
-  ctx.broadcast({ type: "todos.updated", payload: sessionPayload(ctx, { todos: next }) });
+  try {
+    const result = await commitTodos(ctx, next);
+    const projected = result.todos.find((todo) => todo.id === existing.id);
+    const requestedStatus = payload.status ?? existing.status;
+    const projectionRejected = Boolean(existing.kanbanBoardId && existing.kanbanTaskId) && projected?.status !== requestedStatus;
+    const warning = result.warnings[0];
+    sendResult3(
+      ctx,
+      ws,
+      !projectionRejected,
+      projectionRejected ? warning ?? `Kanban kept "${existing.content}" at ${projected?.status ?? "its current state"}.` : warning ? `Todo "${existing.content}" updated. ${warning}` : `Todo "${existing.content}" updated`
+    );
+    ctx.broadcast({
+      type: "todos.updated",
+      payload: sessionPayload(ctx, { todos: result.todos })
+    });
+  } catch (error2) {
+    sendResult3(ctx, ws, false, error2 instanceof Error ? error2.message : String(error2));
+  }
 }
 async function handleTasksGet(ctx, ws) {
   const taskPath = taskPathOf(ctx);
@@ -7759,14 +7830,32 @@ async function handleTaskUpdate(ctx, ws, payload) {
     return;
   }
   try {
-    const file = await mutateTasks(taskPath, currentSessionId(ctx), async (tasks) => {
-      const task = tasks.tasks.find((candidate) => candidate.id === payload.id);
-      if (!task) return tasks;
-      task.status = payload.status;
-      task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      return tasks;
-    });
-    sendResult3(ctx, ws, true, `Task status updated to "${payload.status}".`);
+    let file;
+    if (ctx.mutateTaskStatus) {
+      const result = await ctx.mutateTaskStatus(payload.id, payload.status);
+      if (!result.ok) {
+        sendResult3(ctx, ws, false, result.message);
+        return;
+      }
+      file = await loadTasks(taskPath);
+      if (!file) throw new Error("Task mutation succeeded but its persisted snapshot is missing.");
+      sendResult3(ctx, ws, true, result.message);
+    } else {
+      let matched = false;
+      file = await mutateTasks(taskPath, currentSessionId(ctx), async (tasks) => {
+        const task = tasks.tasks.find((candidate) => candidate.id === payload.id);
+        if (!task) return tasks;
+        matched = true;
+        task.status = payload.status;
+        task.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+        return tasks;
+      });
+      if (!matched) {
+        sendResult3(ctx, ws, false, `Task "${payload.id}" not found.`);
+        return;
+      }
+      sendResult3(ctx, ws, true, `Task status updated to "${payload.status}".`);
+    }
     ctx.broadcast({
       type: "tasks.updated",
       payload: sessionPayload(ctx, { tasks: file.tasks })
@@ -7813,6 +7902,18 @@ async function handlePlanTemplateUse(ctx, ws, template) {
     return;
   }
   try {
+    if (ctx.mutatePlan) {
+      const result = await ctx.mutatePlan({ action: "template_use", template });
+      if (!result.ok) {
+        sendResult3(ctx, ws, false, result.message);
+        return;
+      }
+      const plan2 = await loadPlan(planPath);
+      if (!plan2) throw new Error("Plan mutation succeeded but its persisted snapshot is missing.");
+      sendResult3(ctx, ws, true, result.message);
+      ctx.broadcast({ type: "plan.updated", payload: sessionPayload(ctx, { plan: plan2 }) });
+      return;
+    }
     const templateDefinition = getPlanTemplate(template);
     if (!templateDefinition) {
       sendResult3(ctx, ws, false, `Unknown template "${template}".`);
@@ -7841,6 +7942,22 @@ async function handlePlanItemUpdate(ctx, ws, payload) {
     return;
   }
   try {
+    if (ctx.mutatePlan) {
+      const result = await ctx.mutatePlan({
+        action: "status",
+        target: payload.target,
+        status: payload.status
+      });
+      if (!result.ok) {
+        sendResult3(ctx, ws, false, result.message);
+        return;
+      }
+      const plan2 = await loadPlan(planPath);
+      if (!plan2) throw new Error("Plan mutation succeeded but its persisted snapshot is missing.");
+      sendResult3(ctx, ws, true, result.message);
+      ctx.broadcast({ type: "plan.updated", payload: sessionPayload(ctx, { plan: plan2 }) });
+      return;
+    }
     let changed = false;
     const plan = await mutatePlan(planPath, currentSessionId(ctx), async (currentPlan) => {
       const before = currentPlan.updatedAt;
@@ -7864,13 +7981,17 @@ async function handleWorklistMessage(ctx, ws, message) {
       handleTodosGet(ctx, ws);
       return;
     case "todos.clear":
-      handleTodosClear(ctx, ws);
+      await handleTodosClear(ctx, ws);
       return;
     case "todos.remove":
-      handleTodosRemove(ctx, ws, message.payload);
+      await handleTodosRemove(
+        ctx,
+        ws,
+        message.payload
+      );
       return;
     case "todo.update":
-      handleTodoUpdate(
+      await handleTodoUpdate(
         ctx,
         ws,
         message.payload
@@ -9452,7 +9573,19 @@ function isTrustedLoopbackOrigin(origin, hostHeader) {
     if (!host) return false;
     const hostUrl = new URL(`${url.protocol}//${host}`);
     if (!isLoopbackHostname(hostUrl.hostname)) return false;
-    return effectivePort(url) === effectivePort(hostUrl);
+    return normalizeHostname(url.hostname) === normalizeHostname(hostUrl.hostname) && effectivePort(url) === effectivePort(hostUrl);
+  } catch {
+    return false;
+  }
+}
+function originMatchesHost(origin, hostHeader) {
+  try {
+    const originUrl = new URL(origin);
+    if (originUrl.protocol !== "http:" && originUrl.protocol !== "https:") return false;
+    const host = (hostHeader ?? "").trim();
+    if (!host) return false;
+    const requestUrl = new URL(`${originUrl.protocol}//${host}`);
+    return normalizeHostname(originUrl.hostname) === normalizeHostname(requestUrl.hostname) && effectivePort(originUrl) === effectivePort(requestUrl);
   } catch {
     return false;
   }
@@ -9557,13 +9690,15 @@ function verifyClient(input) {
   try {
     const { hostname: originHostname } = new URL(origin);
     if (isLoopbackHostname(originHostname)) {
-      if (requireToken || !isLoopbackBind(wsHost)) return cookieTokenOk;
+      if (requireToken || !isLoopbackBind(wsHost)) {
+        return cookieTokenOk && (originMatchesHost(origin, hostHeader) || Boolean(allowCrossPortLoopbackCookie));
+      }
       if (!isTrustedLoopbackOrigin(origin, hostHeader)) {
         return Boolean(allowCrossPortLoopbackCookie) && cookieTokenOk;
       }
       return true;
     }
-    return cookieTokenOk || Boolean(allowBrowserUrlToken) && urlTokenOk && allowedHostname(originHostname, allowedHostnames);
+    return cookieTokenOk && originMatchesHost(origin, hostHeader) || Boolean(allowBrowserUrlToken) && urlTokenOk && allowedHostname(originHostname, allowedHostnames);
   } catch {
     return false;
   }
@@ -10528,7 +10663,8 @@ async function handleIntrospectionRoute(ctx, ws, message) {
   switch (message.type) {
     case "diag.get": {
       if (!sessionAllowed(ctx, ws, message)) return true;
-      const tools = ctx.agent.tools.list();
+      const registry = ctx.agent.tools;
+      const tools = registry.listForProvider?.() ?? registry.list();
       ctx.send(ws, {
         type: "diag.get",
         payload: {
@@ -10611,6 +10747,7 @@ async function handleIntrospectionRoute(ctx, ws, message) {
           description: tool.description ?? "",
           params: schema.properties ? Object.keys(schema.properties) : [],
           disabled: registry.isDisabled?.(tool.name) ?? false,
+          direct: registry.isExposedToProvider?.(tool.name) ?? true,
           mutating: !!tool.mutating,
           permission: tool.permission ?? "auto"
         };
@@ -10920,7 +11057,6 @@ async function handleKanbanHostRoute(ws, msg, handlers) {
 import { deserializeTaskGraph, serializeTaskGraph } from "@wrongstack/core/tasking";
 import {
   addCheckToTask,
-  addColumn,
   addGoalMetricToTask,
   addNoteToTask,
   addTask,
@@ -10928,14 +11064,17 @@ import {
   claimReadyTask,
   copyTaskToBoard,
   createBoard,
+  createBoardFromText,
   duplicateBoard,
   exportBoardToTaskGraph,
-  createBoardFromText,
   getBoard,
   getKanbanOrchestrationSnapshot,
   getKanbanQueueHealth,
   getTaskChain,
+  hasKanbanQueueAnomalies,
+  kanbanQueueAnomalyCount,
   listBoards as listBoards2,
+  listBoardHistory,
   listReadyTasks,
   mergeTasks,
   moveTask,
@@ -10944,7 +11083,6 @@ import {
   recoverStaleTaskAssignments,
   releaseTaskClaim,
   removeBoard,
-  removeColumn,
   setTaskChain,
   splitTask,
   syncBoardFromTaskGraph,
@@ -10956,14 +11094,16 @@ import {
   updateTask as updateTask2
 } from "@wrongstack/kanban";
 
-// src/server/kanban-decomposition-routes.ts
+// src/server/kanban-contract-routes.ts
 import {
-  listBoards,
-  resolveDecompositionProposal,
-  updateTask,
-  verifyTaskCompletion
+  addContractEdge,
+  configureContractGraph,
+  evaluateTaskContractGraph,
+  getContractGraph,
+  removeContractEdge,
+  removeContractNode,
+  upsertContractNode
 } from "@wrongstack/kanban";
-import { recordKanbanVerificationEvidence as recordKanbanVerificationEvidence2 } from "@wrongstack/tools";
 
 // src/server/kanban-route-helpers.ts
 import { touchKanbanPresence } from "@wrongstack/kanban";
@@ -11015,7 +11155,150 @@ function findTask2(tasks, taskId) {
   return tasks.find((task) => task.id === taskId || task.id.startsWith(taskId));
 }
 
+// src/server/kanban-contract-routes.ts
+async function handleKanbanContractRoute(ws, type, payload, ctx) {
+  switch (type) {
+    case "kanban.contract.get":
+      await handleGet(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.configure":
+      await handleConfigure(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.node.upsert":
+      await handleNodeUpsert(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.node.remove":
+      await handleNodeRemove(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.edge.add":
+      await handleEdgeAdd(ws, type, payload, ctx);
+      return true;
+    case "kanban.contract.edge.remove":
+      await handleEdgeRemove(ws, type, payload, ctx);
+      return true;
+    default:
+      return false;
+  }
+}
+var str = (payload, key) => typeof payload?.[key] === "string" ? payload[key] : void 0;
+async function publishBoard(ctx, board) {
+  await publishKanbanBoard((message) => ctx.broadcast?.(message), board);
+}
+async function handleGet(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  if (!boardId) return fail(ws, type, "boardId required");
+  const found = await getContractGraph(ctx.projectRoot, boardId);
+  if (!found) return fail(ws, type, "Board not found");
+  const taskId = str(payload, "taskId");
+  const evaluated = taskId ? await evaluateTaskContractGraph(ctx.projectRoot, boardId, taskId) : null;
+  if (taskId && !evaluated) return fail(ws, type, "Task not found on this board");
+  ok(ws, type, {
+    boardId,
+    graph: found.graph,
+    ...evaluated ? { evaluation: evaluated.evaluation } : {}
+  });
+}
+async function handleConfigure(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  if (!boardId) return fail(ws, type, "boardId required");
+  const enforcement = str(payload, "enforcement") ?? "advisory";
+  const board = await configureContractGraph(ctx.projectRoot, boardId, enforcement);
+  if (!board) return fail(ws, type, "Board not found");
+  await publishBoard(ctx, board);
+  ok(ws, type, { boardId, graph: board.contractGraph ?? null });
+}
+async function handleNodeUpsert(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const taskId = str(payload, "taskId");
+  const kind = str(payload, "kind");
+  const title = str(payload, "title");
+  if (!boardId || !taskId || !kind || !title) {
+    return fail(ws, type, "boardId, taskId, kind, and title required");
+  }
+  const state = str(payload, "state");
+  const waiverActor = str(payload, "waiverActor");
+  const waiverReason = str(payload, "waiverReason");
+  if (state === "waived" && (!waiverActor?.trim() || !waiverReason?.trim())) {
+    return fail(ws, type, "A waived contract node requires waiverActor and waiverReason");
+  }
+  try {
+    const result = await upsertContractNode(ctx.projectRoot, boardId, {
+      taskId,
+      kind,
+      title,
+      ...str(payload, "nodeId") !== void 0 ? { id: str(payload, "nodeId") } : {},
+      ...str(payload, "description") !== void 0 ? { description: str(payload, "description") } : {},
+      ...state !== void 0 ? { state } : {},
+      ...str(payload, "enforcement") !== void 0 ? { enforcement: str(payload, "enforcement") } : {},
+      ...str(payload, "checkId") !== void 0 ? { checkId: str(payload, "checkId") } : {},
+      ...str(payload, "metricId") !== void 0 ? { metricId: str(payload, "metricId") } : {},
+      ...state === "waived" ? {
+        waiver: {
+          actor: waiverActor,
+          reason: waiverReason,
+          at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      } : {},
+      ...str(payload, "createdBy") !== void 0 ? { createdBy: str(payload, "createdBy") } : { createdBy: "webui" }
+    });
+    if (!result) return fail(ws, type, "Board or task not found");
+    await publishBoard(ctx, result.board);
+    ok(ws, type, { boardId, node: result.node, graph: result.board.contractGraph ?? null });
+  } catch (err) {
+    fail(ws, type, err instanceof Error ? err.message : String(err));
+  }
+}
+async function handleNodeRemove(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const nodeId = str(payload, "nodeId");
+  if (!boardId || !nodeId) return fail(ws, type, "boardId and nodeId required");
+  const board = await removeContractNode(ctx.projectRoot, boardId, nodeId);
+  if (!board) return fail(ws, type, "Contract node not found");
+  await publishBoard(ctx, board);
+  ok(ws, type, { boardId, graph: board.contractGraph ?? null });
+}
+async function handleEdgeAdd(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const from = str(payload, "from");
+  const to = str(payload, "to");
+  const edgeType = str(payload, "edgeType");
+  if (!boardId || !from || !to || !edgeType) {
+    return fail(ws, type, "boardId, from, to, and edgeType required");
+  }
+  try {
+    const result = await addContractEdge(ctx.projectRoot, boardId, {
+      from,
+      to,
+      type: edgeType,
+      ...str(payload, "enforcement") !== void 0 ? { enforcement: str(payload, "enforcement") } : {},
+      ...str(payload, "rationale") !== void 0 ? { rationale: str(payload, "rationale") } : {},
+      createdBy: str(payload, "createdBy") ?? "webui"
+    });
+    if (!result) return fail(ws, type, "Board not found");
+    await publishBoard(ctx, result.board);
+    ok(ws, type, { boardId, edge: result.edge, graph: result.board.contractGraph ?? null });
+  } catch (err) {
+    fail(ws, type, err instanceof Error ? err.message : String(err));
+  }
+}
+async function handleEdgeRemove(ws, type, payload, ctx) {
+  const boardId = str(payload, "boardId");
+  const edgeId = str(payload, "edgeId");
+  if (!boardId || !edgeId) return fail(ws, type, "boardId and edgeId required");
+  const board = await removeContractEdge(ctx.projectRoot, boardId, edgeId);
+  if (!board) return fail(ws, type, "Contract edge not found");
+  await publishBoard(ctx, board);
+  ok(ws, type, { boardId, graph: board.contractGraph ?? null });
+}
+
 // src/server/kanban-decomposition-routes.ts
+import {
+  listBoards,
+  resolveDecompositionProposal,
+  updateTask,
+  verifyTaskCompletion
+} from "@wrongstack/kanban";
+import { recordKanbanVerificationEvidence as recordKanbanVerificationEvidence2 } from "@wrongstack/tools";
 async function handleKanbanDecompositionRoute(ws, type, payload, ctx) {
   switch (type) {
     case "kanban.decomposition.approve":
@@ -11118,8 +11401,35 @@ async function handleTaskVerification(ws, type, payload, ctx) {
   }
 }
 
+// src/server/kanban-route-pagination.ts
+function paginateKanbanBoards(boards, input) {
+  const pageSize = Math.min(100, Math.max(1, Math.floor(input.pageSize)));
+  const activeSessionIds = new Set(input.activeSessionIds ?? []);
+  const isActive = (board) => board.presence?.some((entry) => entry.active) === true || board.tags?.some((tag) => tag.startsWith("session:") && activeSessionIds.has(tag.slice(8))) === true;
+  const sorted = [...boards].sort((left, right) => {
+    const activityOrder = Number(isActive(right)) - Number(isActive(left));
+    return activityOrder || right.updatedAt.localeCompare(left.updatedAt);
+  });
+  const activeTotal = sorted.filter(isActive).length;
+  const total = sorted.length;
+  const totalPages = Math.max(1, Math.ceil(total / pageSize));
+  const requestedPage = Number.isFinite(input.page) ? Math.floor(input.page) : 1;
+  const page = Math.min(totalPages, Math.max(1, requestedPage));
+  const start = (page - 1) * pageSize;
+  return {
+    items: sorted.slice(start, start + pageSize),
+    total,
+    page,
+    pageSize,
+    totalPages,
+    activeTotal,
+    orphanedTotal: total - activeTotal
+  };
+}
+
 // src/server/kanban-task-routes.ts
 import {
+  getKanbanWorkbench,
   getTask,
   listTaskActivity,
   recordTaskActivity,
@@ -11127,6 +11437,16 @@ import {
 } from "@wrongstack/kanban";
 async function handleKanbanTaskRoute(ws, type, payload, ctx) {
   switch (type) {
+    case "kanban.workbench":
+      ok(
+        ws,
+        type,
+        await getKanbanWorkbench(ctx.projectRoot, {
+          ...typeof payload?.limitPerLane === "number" ? { limitPerLane: payload.limitPerLane } : {},
+          ...typeof payload?.alertLimit === "number" ? { alertLimit: payload.alertLimit } : {}
+        })
+      );
+      return true;
     case "kanban.task.remove":
       await handleTaskRemove(ws, type, payload, ctx);
       return true;
@@ -11219,45 +11539,20 @@ async function handleTaskActivityAdd(ws, type, payload, ctx) {
       outcome,
       ...typeof payload?.details === "string" && payload.details.trim() ? { details: payload.details.trim() } : {}
     },
-    activityContext(
-      ctx,
-      payload?.actor ?? ctx.context?.agentId ?? "webui"
-    )
+    activityContext(ctx, payload?.actor ?? ctx.context?.agentId ?? "webui")
   );
   board ? ok(ws, type, board) : fail(ws, type, "Board or task not found");
 }
 
-// src/server/kanban-route-pagination.ts
-function paginateKanbanBoards(boards, input) {
-  const pageSize = Math.min(100, Math.max(1, Math.floor(input.pageSize)));
-  const activeSessionIds = new Set(input.activeSessionIds ?? []);
-  const isActive = (board) => board.presence?.some((entry) => entry.active) === true || board.tags?.some((tag) => tag.startsWith("session:") && activeSessionIds.has(tag.slice(8))) === true;
-  const sorted = [...boards].sort((left, right) => {
-    const activityOrder = Number(isActive(right)) - Number(isActive(left));
-    return activityOrder || right.updatedAt.localeCompare(left.updatedAt);
-  });
-  const activeTotal = sorted.filter(isActive).length;
-  const total = sorted.length;
-  const totalPages = Math.max(1, Math.ceil(total / pageSize));
-  const requestedPage = Number.isFinite(input.page) ? Math.floor(input.page) : 1;
-  const page = Math.min(totalPages, Math.max(1, requestedPage));
-  const start = (page - 1) * pageSize;
-  return {
-    items: sorted.slice(start, start + pageSize),
-    total,
-    page,
-    pageSize,
-    totalPages,
-    activeTotal,
-    orphanedTotal: total - activeTotal
-  };
-}
-
 // src/server/kanban-route-protocol.ts
 var KANBAN_CLIENT_MESSAGE_TYPES = [
   "kanban.capabilities",
-  "kanban.column.add",
-  "kanban.column.remove",
+  "kanban.contract.configure",
+  "kanban.contract.edge.add",
+  "kanban.contract.edge.remove",
+  "kanban.contract.get",
+  "kanban.contract.node.remove",
+  "kanban.contract.node.upsert",
   "kanban.create",
   "kanban.decomposition.approve",
   "kanban.decomposition.reject",
@@ -11297,7 +11592,8 @@ var KANBAN_CLIENT_MESSAGE_TYPES = [
   "kanban.task.verify",
   "kanban.taskgraph.export",
   "kanban.taskgraph.sync",
-  "kanban.update"
+  "kanban.update",
+  "kanban.workbench"
 ];
 
 // src/server/kanban-routes.ts
@@ -11307,6 +11603,7 @@ async function handleKanbanRoute(ws, msg, ctx) {
   const type = msg.type;
   try {
     if (await handleKanbanDecompositionRoute(ws, type, payload, ctx)) return true;
+    if (await handleKanbanContractRoute(ws, type, payload, ctx)) return true;
     if (await handleKanbanTaskRoute(ws, type, payload, ctx)) return true;
     switch (type) {
       case "kanban.list": {
@@ -11345,7 +11642,14 @@ async function handleKanbanRoute(ws, msg, ctx) {
           fail(ws, type, "boardId required");
           return true;
         }
-        ok(ws, type, await getKanbanQueueHealth(ctx.projectRoot, { boardId: hBoardId }));
+        ok(
+          ws,
+          type,
+          await getKanbanQueueHealth(ctx.projectRoot, {
+            boardId: hBoardId,
+            includeClassifications: false
+          })
+        );
         return true;
       }
       case "kanban.supervisor.status":
@@ -11375,16 +11679,16 @@ async function handleKanbanRoute(ws, msg, ctx) {
           reason: "On-demand standalone Kanban supervisor audit."
         }) : null;
         if (recovered) health = await getKanbanQueueHealth(ctx.projectRoot, { boardId });
-        const anomalyCount = health.staleAssignments.count + health.dependencyBlocked.count + health.failedRetryable.count + health.counts.failed + health.counts.blocked;
+        const anomalyCount = kanbanQueueAnomalyCount(health);
         ok(ws, type, {
           boardId,
-          status: board.supervisor?.enabled === false ? "disabled" : anomalyCount ? "attention" : "healthy",
+          status: board.supervisor?.enabled === false ? "disabled" : hasKanbanQueueAnomalies(health) ? "attention" : "healthy",
           mode: board.supervisor?.mode ?? "deterministic",
           lastAuditAt: (/* @__PURE__ */ new Date()).toISOString(),
           reconciledTaskIds: reconciled?.tasks.map((task) => task.id) ?? [],
           staleRecoveredTaskIds: recovered?.tasks.map((task) => task.id) ?? [],
           anomalyCount,
-          summary: `${health.counts.running} running \xB7 ${health.counts.ready} ready \xB7 ${health.counts.review} review \xB7 ${health.counts.blocked} blocked \xB7 ${health.counts.failed} failed`
+          summary: `${health.counts.running} running \xB7 ${health.counts.startable} ready \xB7 ${health.counts.review} review \xB7 ${health.counts.blocked} blocked \xB7 ${health.counts.failed} failed`
         });
         return true;
       }
@@ -11401,7 +11705,6 @@ async function handleKanbanRoute(ws, msg, ctx) {
             title,
             ...payload?.description ? { description: payload.description } : {},
             ...payload?.tags ? { tags: payload.tags } : {},
-            ...payload?.columns ? { columns: payload.columns } : {},
             ...has(payload, "lifecycle") ? { lifecycle: payload?.lifecycle } : {},
             ...has(payload, "boundary") ? { boundary: payload?.boundary } : {}
           })
@@ -11418,7 +11721,6 @@ async function handleKanbanRoute(ws, msg, ctx) {
           ...payload?.title ? { title: payload.title } : {},
           ...payload?.description ? { description: payload.description } : {},
           ...payload?.tags ? { tags: payload.tags } : {},
-          ...payload?.columns ? { columns: payload.columns } : {},
           ...has(payload, "lifecycle") ? {
             lifecycle: payload?.lifecycle ?? null
           } : {},
@@ -11465,6 +11767,12 @@ async function handleKanbanRoute(ws, msg, ctx) {
         });
         return true;
       }
+      case "kanban.board.history": {
+        const boardId = payload?.boardId;
+        const history = await listBoardHistory(ctx.projectRoot, boardId);
+        ok(ws, type, history);
+        return true;
+      }
       case "kanban.generate": {
         const description = payload?.description;
         if (!description) {
@@ -11926,8 +12234,14 @@ async function handleKanbanRoute(ws, msg, ctx) {
           taskId,
           {
             description,
+            // The old cast listed `manual | auto | agent | test | review` —
+            // three of which have no verifier plugin, while the six that do
+            // (command, file_exists, file_matches, git_diff, metric, test)
+            // were unreachable. `notes` carries the executable body every
+            // deterministic plugin reads.
             type: payload?.checkType ?? "manual",
-            status: payload?.status ?? "pending"
+            status: payload?.status ?? "pending",
+            ...typeof payload?.notes === "string" ? { notes: payload.notes } : {}
           },
           activityContext(
             ctx,
@@ -11992,30 +12306,6 @@ async function handleKanbanRoute(ws, msg, ctx) {
       case "kanban.capabilities":
         ok(ws, type, { dispatchSupported: Boolean(ctx.dispatchTask) });
         return true;
-      case "kanban.column.add": {
-        const boardId = payload?.boardId;
-        const title = payload?.title;
-        if (!boardId || !title) {
-          fail(ws, type, "boardId and title required");
-          return true;
-        }
-        const result = await addColumn(ctx.projectRoot, boardId, { title });
-        result ? ok(ws, type, result.board.columns) : fail(ws, type, `Board not found: ${boardId}`);
-        return true;
-      }
-      case "kanban.column.remove": {
-        const boardId = payload?.boardId;
-        const columnId = payload?.columnId;
-        if (!boardId || !columnId) {
-          fail(ws, type, "boardId and columnId required");
-          return true;
-        }
-        const board = await removeColumn(ctx.projectRoot, boardId, columnId, {
-          moveTasksToColumnId: payload?.moveTasksToColumnId
-        });
-        board ? ok(ws, type, { removed: true, boardId: board.id, columnId, board }) : fail(ws, type, `Column not found: ${columnId}`);
-        return true;
-      }
       default:
         fail(ws, type, `Unknown kanban message type: ${type}`);
         return true;
@@ -12078,7 +12368,9 @@ function subscribeKanbanDaemonEvents(projectRoot, broadcastMessage) {
     projectRoot,
     async (event) => {
       const family = event.event?.split(".")[0];
-      if (family !== "board" && family !== "task" && family !== "column") return;
+      if (family !== "board" && family !== "task" && family !== "column" && family !== "contract") {
+        return;
+      }
       const evData = event.data;
       const boardId = evData?.boardId;
       if (!boardId) return;
@@ -13283,6 +13575,34 @@ async function handleSageRecover(ws, msg, memoryStore) {
     send(ws, { type: "memory.sage.recover", payload: { error: errMessage(err) } });
   }
 }
+async function handleSageListCandidates(ws, msg, memoryStore) {
+  const Sage = getSageSurface(memoryStore);
+  if (!Sage) {
+    send(ws, {
+      type: "memory.sage.listCandidates",
+      payload: { error: requiresSage("memory.sage.listCandidates") }
+    });
+    return;
+  }
+  try {
+    const payload = msg.payload ?? {};
+    const includeResolved = payload["includeResolved"] === true;
+    if (typeof Sage.listCandidates !== "function") {
+      send(ws, {
+        type: "memory.sage.listCandidates",
+        payload: { error: "listCandidates is not available on this SAGE surface" }
+      });
+      return;
+    }
+    const candidates = await Sage.listCandidates(includeResolved);
+    send(ws, { type: "memory.sage.listCandidates", payload: { candidates } });
+  } catch (err) {
+    send(ws, {
+      type: "memory.sage.listCandidates",
+      payload: { error: errMessage(err) }
+    });
+  }
+}
 async function handleSageCandidateResolve(ws, msg, memoryStore) {
   const Sage = getSageSurface(memoryStore);
   if (!Sage) {
@@ -13395,14 +13715,17 @@ async function handleSageForFile(ws, msg, memoryStore) {
     send(ws, { type: "memory.sage.forFile", payload: { error: "filePath is required" } });
     return;
   }
+  const includeSuperseded = typeof payload["showSuperseded"] === "boolean" ? payload["showSuperseded"] : typeof payload["includeSuperseded"] === "boolean" ? payload["includeSuperseded"] : void 0;
+  const includeDeleted = payload["showDeleted"] === true || payload["includeDeleted"] === true;
   try {
     const response = await Sage.findMemoriesForFile(filePath, {
       ...typeof payload["lineStart"] === "number" ? { lineStart: payload["lineStart"] } : {},
       ...typeof payload["lineEnd"] === "number" ? { lineEnd: payload["lineEnd"] } : {},
       ...typeof payload["limit"] === "number" ? { limit: payload["limit"] } : {},
-      ...payload["includeDeleted"] === true ? { includeDeleted: true } : {}
+      ...includeSuperseded !== void 0 ? { includeSuperseded } : {},
+      ...includeDeleted ? { includeDeleted: true } : {}
     });
-    send(ws, { type: "memory.sage.forFile", payload: response });
+    send(ws, { type: "memory.sage.forFile", payload: { response } });
   } catch (err) {
     send(ws, { type: "memory.sage.forFile", payload: { error: errMessage(err) } });
   }
@@ -13458,6 +13781,9 @@ async function handleMemoryRoute(ctx, ws, message) {
     case "memory.sage.recover":
       await handleSageRecover(ws, message, store);
       return true;
+    case "memory.sage.listCandidates":
+      await handleSageListCandidates(ws, message, store);
+      return true;
     case "memory.sage.candidateResolve":
       await handleSageCandidateResolve(ws, message, store);
       return true;
@@ -15024,6 +15350,7 @@ import {
   finalizeTaskCompletion,
   getBoard as getBoard3,
   getKanbanQueueHealth as getKanbanQueueHealth2,
+  kanbanQueueAnomalyCount as kanbanQueueAnomalyCount2,
   listBoards as listBoards4,
   reconcileKanbanBoard as reconcileKanbanBoard2,
   recoverStaleTaskAssignments as recoverStaleTaskAssignments2,
@@ -15104,8 +15431,9 @@ function createKanbanSupervisor(deps2) {
       mode: config.recoveryMode ?? "auto",
       reason: "Kanban supervisor found an expired worker lease."
     }) : null;
-    if (recovered) health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
-    const anomalyCount = countAnomalies(health);
+    if (recovered)
+      health = await getKanbanQueueHealth2(resolveProjectRoot(deps2), { boardId: board.id });
+    const anomalyCount = kanbanQueueAnomalyCount2(health);
     const snapshot = {
       boardId: board.id,
       status: anomalyCount > 0 ? "attention" : "healthy",
@@ -15199,7 +15527,9 @@ function createKanbanSupervisor(deps2) {
     } else {
       const summaries = await listBoards4(resolveProjectRoot(deps2));
       pruneAbsentBoards(new Set(summaries.map((summary) => summary.id)));
-      boards = (await Promise.all(summaries.map((summary) => getBoard3(resolveProjectRoot(deps2), summary.id)))).filter((board) => Boolean(board));
+      boards = (await Promise.all(
+        summaries.map((summary) => getBoard3(resolveProjectRoot(deps2), summary.id))
+      )).filter((board) => Boolean(board));
     }
     const results = [];
     for (const board of boards) results.push(await auditBoard(board));
@@ -15302,13 +15632,10 @@ function dispatchRoute(routing) {
     ...routing.fallbackModels?.length ? { fallbackModels: routing.fallbackModels } : {}
   };
 }
-function countAnomalies(health) {
-  return health.staleAssignments.count + health.heartbeatDue.count + health.counts.failed + health.counts.blocked;
-}
 function healthSummary(health) {
   return [
     `${health.counts.running} running`,
-    `${health.counts.ready} ready`,
+    `${health.counts.startable} ready`,
     `${health.counts.review} review`,
     `${health.counts.blocked} blocked`,
     `${health.counts.failed} failed`,
@@ -16070,7 +16397,7 @@ import { makeProviderFromConfig } from "@wrongstack/providers";
 import * as fs14 from "node:fs/promises";
 import * as path19 from "node:path";
 import { DefaultSessionStore } from "@wrongstack/core/storage";
-import { resolveWstackPaths as resolveWstackPaths5 } from "@wrongstack/core/utils";
+import { activateProjectStateGuard, resolveWstackPaths as resolveWstackPaths5 } from "@wrongstack/core/utils";
 function createProjectHandlers(ctx) {
   const sendTo = (ws, message) => {
     if (ctx.sendMessage) ctx.sendMessage(ws, message);
@@ -16235,6 +16562,7 @@ function createProjectHandlers(ctx) {
         try {
           await ctx.onSessionSwapped?.(next.id, identityTarget);
           await ctx.onBeforeSessionTodosReplaced?.(next.id, paths.projectSessions);
+          await activateProjectStateGuard(resolved);
         } catch (err) {
           try {
             await ctx.onBeforeSessionTodosReplaced?.(previous.id, previousPaths.projectSessions);
@@ -17252,6 +17580,7 @@ var CLIENT_KNOWLEDGE_MESSAGE_TYPES = [
   "memory.sage.get",
   "memory.sage.graph",
   "memory.sage.list",
+  "memory.sage.listCandidates",
   "memory.sage.listPage",
   "memory.sage.recover",
   "memory.sage.remember",
@@ -17531,6 +17860,7 @@ var SERVER_KNOWLEDGE_MESSAGE_TYPES = [
   "memory.sage.get",
   "memory.sage.graph",
   "memory.sage.list",
+  "memory.sage.listCandidates",
   "memory.sage.listPage",
   "memory.sage.recover",
   "memory.sage.remember",
@@ -18382,6 +18712,7 @@ function createSessionHandlers(ctx) {
         ctx.abortActiveRun?.(current2.id);
       } catch {
       }
+      await ctx.context.flushConversationJournal?.().catch(() => void 0);
       await finalizeSession(current2);
     }
     ctx.setSession(next);
@@ -19071,89 +19402,60 @@ function createEmbeddedProjectRoutes(ctx) {
 
 // src/server/embedded-message-router.ts
 import { makeProviderFromConfig as makeProviderFromConfig2 } from "@wrongstack/providers";
+import { planTool, taskTool, todoTool } from "@wrongstack/tools";
 
 // src/server/agent-roster-handlers.ts
 import {
   applyProjectAgentConfig,
-  buildConsolidationInstruction,
   captureLearnedFromAgentOutputDetailed,
   clearProjectAgentConsolidated,
+  clearProjectSkillAugmentation,
   createProjectAgent,
+  DEFAULT_EAGER_SKILL_LIMIT,
   detectLearnedConflicts,
+  evaluateAutoOptimize,
   FLEET_ROSTER,
   getProjectAgentLearnStats,
   isConsolidated,
   listProjectAgentLearnedEntries,
   listProjectAgentRoles,
+  listProjectSkillAugmentations,
   loadConsolidationMetadata,
   loadProjectAgentConfig,
   loadProjectAgentConsolidated,
   loadProjectAgentIdentity,
   loadProjectAgentLearned,
   loadProjectAgentProfile,
+  loadProjectSkillAugmentation,
+  loadSkillAffinity,
+  optimizeProjectAgentLearning,
+  rankRoleSkills,
+  readQuarantinedDirectives,
+  readRawLearnedEntries,
   resetProjectAgentIdentity,
+  resolveAutoOptimizePolicy,
+  resolveRoleSkillCandidates,
   saveProjectAgentConsolidated,
+  saveProjectSkillAugmentation,
+  scoreSkillAffinity,
+  setSkillPinned,
   slugifyProjectAgentRole,
   updateProjectAgentConfig,
   updateProjectAgentIdentity,
   updateProjectAgentLearned,
   updateProjectAgentLearningPolicy
 } from "@wrongstack/core/coordination";
-import { isTextBlock } from "@wrongstack/core/types";
-var CONSOLIDATION_MAX_TOKENS = 8e3;
-var CONSOLIDATION_TIMEOUT_MS = 12e4;
 var AgentRosterWSHandler = class {
   getProjectRoot;
   getLlm;
   broadcast;
+  getAutoOptimizeSettings;
   constructor(opts) {
     this.getProjectRoot = typeof opts.projectRoot === "function" ? opts.projectRoot : () => opts.projectRoot;
     this.getLlm = opts.getLlm ?? (() => void 0);
     this.broadcast = opts.broadcast ?? (() => {
     });
-  }
-  /**
-   * Run the consolidation LLM synthesis headlessly and return the cleaned
-   * document text. Returns undefined when no LLM is available so the caller
-   * can fall back to the instruction-only path.
-   */
-  async synthesizeConsolidation(instruction) {
-    const llm = this.getLlm();
-    if (!llm) return void 0;
-    const req = {
-      model: llm.model,
-      system: [
-        {
-          type: "text",
-          text: "You are a precise technical editor. You consolidate an AI agent role's captured learning entries into a single, durable, role-scoped instruction document. Output ONLY the consolidated markdown document \u2014 no preamble, no code fences, no commentary about the consolidation process."
-        }
-      ],
-      messages: [{ role: "user", content: instruction }],
-      maxTokens: CONSOLIDATION_MAX_TOKENS
-    };
-    const timer = new AbortController();
-    let timedOut = false;
-    const to = setTimeout(() => {
-      timedOut = true;
-      timer.abort(new Error("consolidation timeout"));
-    }, CONSOLIDATION_TIMEOUT_MS);
-    to.unref();
-    try {
-      const res = await llm.provider.complete(req, { signal: timer.signal });
-      const text2 = res.content.filter(isTextBlock).map((block) => block.text).join("\n").trim();
-      const wholeDocFence = /^```(?:markdown|md)?[^\n]*\n([\s\S]*?)\n?```\s*$/i;
-      const wrapped = wholeDocFence.exec(text2);
-      const inner = wrapped?.[1];
-      const unfenced = inner !== void 0 ? inner.trim() : text2;
-      return { content: unfenced, model: llm.model };
-    } catch (err) {
-      if (timedOut) {
-        throw new Error(`consolidation timed out after ${CONSOLIDATION_TIMEOUT_MS}ms`);
-      }
-      throw err;
-    } finally {
-      clearTimeout(to);
-    }
+    this.getAutoOptimizeSettings = opts.getAutoOptimizeSettings;
   }
   /** Handle an incoming client message. Returns a response payload. */
   async handleMessage(_ws, type, payload) {
@@ -19358,70 +19660,47 @@ ${String(p.content ?? "")}`;
         const conflicts = detectLearnedConflicts(projectRoot);
         return { type, payload: { conflicts } };
       }
-      // ── Consolidate learned entries (headless LLM synthesis) ──────────
-      // Runs the whole optimization on the server: read raw entries →
-      // synthesize with the active model → write consolidated.md +
-      // consolidation.json. No chat round-trip. When no LLM is available the
-      // handler degrades to returning the instruction so a caller (e.g. the
-      // chat agent) can still perform the consolidation manually.
-      case "agent-roster.consolidate": {
+      // ── Optimize: distil captures into skill addenda + a consolidated doc,
+      // then archive and reset the raw buffer. Shared implementation with the
+      // CLI (`optimizeProjectAgentLearning`) so both surfaces persist the same
+      // artifacts instead of the CLI producing markdown nobody saved.
+      case "agent-roster.consolidate":
+      case "agent-roster.optimize": {
         if (!role) return { type, payload: { error: "role required" } };
-        const { instruction, rawEntries, hasExistingConsolidation } = buildConsolidationInstruction(role, projectRoot);
-        if (rawEntries.length === 0) {
+        const hasExistingConsolidation = isConsolidated(role, projectRoot);
+        const pending = readRawLearnedEntries(role, projectRoot);
+        if (pending.length === 0) {
           return {
             type: "agent-roster.consolidate",
             payload: {
               role,
               consolidated: false,
               rawEntryCount: 0,
+              skills: [],
               hasExistingConsolidation,
               currentStats: getProjectAgentLearnStats(role, projectRoot)
             }
           };
         }
-        let synth;
-        try {
-          synth = await this.synthesizeConsolidation(instruction);
-        } catch (err) {
-          return {
-            type: "agent-roster.consolidate",
-            payload: {
-              role,
-              consolidated: false,
-              rawEntryCount: rawEntries.length,
-              hasExistingConsolidation,
-              currentStats: getProjectAgentLearnStats(role, projectRoot),
-              error: err instanceof Error ? err.message : "consolidation failed"
-            }
-          };
-        }
-        if (synth && synth.content.length > 0) {
-          let stats;
-          let metadata;
-          try {
-            saveProjectAgentConsolidated(role, synth.content, projectRoot, {
-              trigger: "manual",
-              model: synth.model
-            });
-            stats = getProjectAgentLearnStats(role, projectRoot);
-            metadata = loadConsolidationMetadata(role, projectRoot);
-          } catch (err) {
-            return {
-              type: "agent-roster.consolidate",
-              payload: {
-                role,
-                consolidated: false,
-                rawEntryCount: rawEntries.length,
-                hasExistingConsolidation,
-                currentStats: getProjectAgentLearnStats(role, projectRoot),
-                error: err instanceof Error ? err.message : "failed to persist consolidation"
-              }
-            };
-          }
+        const llm = this.getLlm();
+        const result = await optimizeProjectAgentLearning(role, projectRoot, {
+          ...llm ? { llm } : {},
+          trigger: "manual"
+        });
+        const currentStats = getProjectAgentLearnStats(role, projectRoot);
+        const metadata = loadConsolidationMetadata(role, projectRoot);
+        const basePayload = {
+          role,
+          rawEntryCount: result.rawEntryCount,
+          skills: result.skills,
+          hasExistingConsolidation,
+          currentStats
+        };
+        if (result.status === "optimized") {
           try {
             this.broadcast({
               type: "agent-roster.updated",
-              payload: { role, reason: "consolidated", currentStats: stats, metadata }
+              payload: { role, reason: "consolidated", currentStats, metadata }
             });
           } catch (e) {
             console.warn(
@@ -19437,44 +19716,111 @@ ${String(p.content ?? "")}`;
           return {
             type: "agent-roster.consolidate",
             payload: {
-              role,
+              ...basePayload,
               consolidated: true,
-              rawEntryCount: rawEntries.length,
-              content: synth.content,
-              model: synth.model,
-              currentStats: stats,
+              content: result.content,
+              model: result.model,
+              pruned: result.pruned,
               metadata
             }
           };
         }
-        if (synth) {
-          return {
-            type: "agent-roster.consolidate",
-            payload: {
-              role,
-              consolidated: false,
-              emptySynthesis: true,
-              model: synth.model,
-              rawEntryCount: rawEntries.length,
-              hasExistingConsolidation,
-              currentStats: getProjectAgentLearnStats(role, projectRoot)
-            }
-          };
-        }
         return {
           type: "agent-roster.consolidate",
           payload: {
-            role,
+            ...basePayload,
             consolidated: false,
-            instruction,
-            rawEntryCount: rawEntries.length,
-            hasExistingConsolidation,
-            currentStats: getProjectAgentLearnStats(role, projectRoot),
-            // Instruction for the leader agent to execute the consolidation
-            leaderInstruction: `Optimize what the "${role}" agent has learned. Read its raw learned entries, synthesize them into a single narrowly-scoped document preserving every fact, and save the result. The instruction text contains the full details and raw entries.`
+            ...result.status === "empty-synthesis" ? { emptySynthesis: true, model: result.model } : {},
+            ...result.status === "failed" ? { error: result.error } : {},
+            ...result.status === "no-llm" ? {
+              instruction: result.instruction,
+              leaderInstruction: `Optimize what the "${role}" agent has learned. Read its raw learned entries, synthesize them into a single narrowly-scoped document preserving every fact, and save the result. The instruction text contains the full details and raw entries.`
+            } : {}
+          }
+        };
+      }
+      // ── Automatic-optimization status ─────────────────────────────────
+      // Read-only: says whether the background scheduler considers each role
+      // eligible right now, and why not when it does not. Surfacing the reason
+      // is what keeps "nothing happened" from looking like a broken feature.
+      case "agent-roster.auto-optimize-status": {
+        const policy = resolveAutoOptimizePolicy(this.getAutoOptimizeSettings?.() ?? void 0);
+        const roles = role ? [role] : listProjectAgentRoles(projectRoot);
+        return {
+          type,
+          payload: {
+            policy,
+            roles: roles.map((current2) => {
+              try {
+                const decision = evaluateAutoOptimize(current2, projectRoot, policy);
+                return { role: current2, ...decision };
+              } catch {
+                return { role: current2, eligible: false, reason: "disabled" };
+              }
+            })
+          }
+        };
+      }
+      // ── Skill layer: what this project has developed for each role skill ──
+      case "agent-roster.skills": {
+        if (!role) return { type, payload: { error: "role required" } };
+        const candidates = resolveRoleSkillCandidates(role, projectRoot);
+        const developed = listProjectSkillAugmentations(role, projectRoot);
+        const affinity = loadSkillAffinity(role, projectRoot);
+        const eager = new Set(rankRoleSkills(role, candidates, projectRoot));
+        return {
+          type,
+          payload: {
+            role,
+            eagerLimit: DEFAULT_EAGER_SKILL_LIMIT,
+            skills: candidates.map((skill) => ({
+              skill,
+              developed: developed.includes(skill),
+              affinity: affinity.entries[skill] ?? null,
+              score: scoreSkillAffinity(affinity.entries[skill]) + (developed.includes(skill) ? 1 : 0),
+              eager: eager.has(skill)
+            }))
           }
         };
       }
+      // ── Directives the loop stopped believing ─────────────────────────────
+      case "agent-roster.quarantine": {
+        if (!role) return { type, payload: { error: "role required" } };
+        return {
+          type,
+          payload: { role, retired: readQuarantinedDirectives(role, projectRoot) }
+        };
+      }
+      case "agent-roster.read-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role || !skill) return { type, payload: { error: "role and skill required" } };
+        return {
+          type,
+          payload: { role, skill, content: loadProjectSkillAugmentation(role, skill, projectRoot) }
+        };
+      }
+      case "agent-roster.save-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role || !skill || typeof p.content !== "string") {
+          return { type, payload: { error: "role, skill and content required" } };
+        }
+        const savedPath = saveProjectSkillAugmentation(role, skill, p.content, projectRoot);
+        return { type, payload: { role, skill, path: savedPath, success: true } };
+      }
+      case "agent-roster.clear-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role) return { type, payload: { error: "role required" } };
+        clearProjectSkillAugmentation(role, skill || void 0, projectRoot);
+        return { type, payload: { role, skill: skill || null, success: true } };
+      }
+      case "agent-roster.pin-skill": {
+        const skill = typeof p.skill === "string" ? p.skill : "";
+        if (!role || !skill || typeof p.pinned !== "boolean") {
+          return { type, payload: { error: "role, skill and boolean pinned required" } };
+        }
+        const affinity = setSkillPinned(role, skill, p.pinned, projectRoot);
+        return { type, payload: { role, skill, pinned: p.pinned, affinity, success: true } };
+      }
       // ── Save consolidated document ────────────────────────────────────
       case "agent-roster.save-consolidated": {
         if (!role || typeof p.content !== "string") {
@@ -20447,7 +20793,20 @@ function createEmbeddedMessageRouter(deps2) {
       },
       send: send2,
       broadcast: deps2.providerCtx.broadcast,
-      replaceTodos: (todos) => opts.agent.ctx.state.replaceTodos(todos)
+      replaceTodos: (todos) => opts.agent.ctx.state.replaceTodos(todos),
+      mutateTodos: async (todos) => {
+        const result = await todoTool.execute({ todos }, opts.agent.ctx, {
+          signal: AbortSignal.timeout(3e4)
+        });
+        return {
+          todos: [...opts.agent.ctx.todos],
+          ...result.kanban_warnings ? { warnings: result.kanban_warnings } : {}
+        };
+      },
+      mutateTaskStatus: async (id, status) => taskTool.execute({ action: "status", id, status }, opts.agent.ctx, {
+        signal: AbortSignal.timeout(3e4)
+      }),
+      mutatePlan: async (operation) => planTool.execute(operation, opts.agent.ctx, { signal: AbortSignal.timeout(3e4) })
     })
   });
   const processRoutes = {
@@ -20531,6 +20890,7 @@ function createEmbeddedMessageRouter(deps2) {
       agentRoster: {
         rosterHandler: new AgentRosterWSHandler({
           projectRoot,
+          getAutoOptimizeSettings: () => deps2.agentConfigCtx.getConfig?.()?.fleet?.learning?.autoOptimize,
           getLlm: () => {
             const ctx = opts.agent.ctx;
             return ctx.provider && ctx.model ? { provider: ctx.provider, model: ctx.model } : void 0;
@@ -21836,6 +22196,7 @@ function registerSetupEventsStatusWatcher(deps2) {
   const logWatcherMetricsEnabled = shouldLogWatcherStats();
   const logWatcherMetrics = () => logFileWatcherMetrics(watcherMetrics);
   const metricsInterval = logWatcherMetricsEnabled ? setInterval(logWatcherMetrics, 6e4) : void 0;
+  metricsInterval?.unref?.();
   const broadcastStatus = (_projectHash, statusData, actualDelayMs) => {
     broadcast2(clients, { type: "client.status_update", payload: statusData });
     if (watcherMetrics) {
@@ -23055,14 +23416,7 @@ import {
   toErrorMessage as toErrorMessage10
 } from "@wrongstack/core/utils";
 import { makeLightSubagentFactory } from "@wrongstack/runtime";
-import {
-  createSageContextMonitorMiddleware,
-  createSageToolCallMiddleware,
-  createSageTurnMiddleware,
-  getSageRetrieval,
-  getSageService,
-  InjectionTracker
-} from "@wrongstack/sage";
+import { getSageService, setupSage } from "@wrongstack/sage";
 
 // src/server/discover-mailbox-bridge.ts
 import { spawn as spawn4 } from "node:child_process";
@@ -23865,6 +24219,7 @@ var WorktreeWebSocketHandler = class {
     this.broadcast(this.stateMessage());
     if (this.broadcastInterval) return;
     this.broadcastInterval = setInterval(() => this.broadcast(this.stateMessage()), 2e3);
+    this.broadcastInterval.unref?.();
   }
   stopBroadcast() {
     this.broadcast(this.stateMessage());
@@ -23916,62 +24271,15 @@ async function createAgentServices(input) {
   const collabPause = collabPauseMiddleware(collabBus, { logger });
   pipelines.toolCall.prepend(collabPause);
   installDesignStudioMiddleware({ pipelines, ctx: context });
-  const memoryRetrieval = getSageRetrieval(memoryStore);
-  if (config.features.memory !== false && config.Sage?.enabled !== false && memoryRetrieval) {
-    const sageInjectionTracker = new InjectionTracker();
-    const getSageSessionId = () => input.sessionGetter().id;
-    if (config.Sage?.inject?.toolResults !== false) {
-      pipelines.toolCall.use(
-        createSageToolCallMiddleware({
-          memory: memoryRetrieval,
-          maxHintsPerTool: config.Sage?.inject?.maxHintsPerTool,
-          maxCharsPerTool: config.Sage?.inject?.maxCharsPerTool,
-          taskAware: config.Sage?.inject?.taskAware,
-          minScore: config.Sage?.inject?.minScore,
-          minImportance: config.Sage?.inject?.minImportance,
-          // Forward the explicit relation floor so an operator-configured
-          // `Sage.inject.relationFloor` is honored in WebUI sessions. Without
-          // this we silently fall back to MIN_RELATION_STRENGTH (0.85), which
-          // is the CLI default but masks operator overrides.
-          relationFloor: config.Sage?.inject?.relationFloor,
-          repeatCooldownMs: config.Sage?.inject?.repeatCooldownMs,
-          verifyOnMutation: config.Sage?.hygiene?.autoOnFileChange,
-          triggers: config.Sage?.inject?.triggers,
-          // Resolve the live session so retrieval and cooldown are session-scoped
-          // (matching the CLI wiring in wiring/sage.ts). Without this, the
-          // middleware falls back to ctx.session.id for cooldown but passes
-          // undefined to retrieval, causing owned session-scoped memories to be
-          // silently excluded from tool-call injection.
-          getSessionId: getSageSessionId,
-          tracker: sageInjectionTracker,
-          events
-        })
-      );
-    }
-    if (config.Sage?.inject?.turnContext === true) {
-      pipelines.request.use(
-        createSageTurnMiddleware({
-          memory: memoryRetrieval,
-          maxMemories: config.Sage?.inject?.maxTurnMemories,
-          maxChars: config.Sage?.inject?.maxCharsPerTurn,
-          minScore: config.Sage?.inject?.minScore,
-          // CLI parity: honor `Sage.retrieval.metadataWeight` so the same config
-          // value drives both runtimes instead of silently falling back to the
-          // 0.3 default. The undefined case keeps the middleware's own default.
-          metadataWeight: config.Sage?.retrieval?.metadataWeight,
-          getSessionId: getSageSessionId,
-          tracker: sageInjectionTracker
-        })
-      );
-    }
-    pipelines.request.use(
-      createSageContextMonitorMiddleware({
-        tracker: sageInjectionTracker,
-        events,
-        getSessionId: getSageSessionId
-      })
-    );
-  }
+  const runSageSessionHygiene = setupSage({
+    config,
+    pipelines,
+    memoryStore,
+    logger,
+    events,
+    getSessionId: () => input.sessionGetter().id,
+    projectRoot
+  });
   const codebaseIndexing = setupWebUICodebaseIndexing({
     config,
     context,
@@ -24083,7 +24391,12 @@ async function createAgentServices(input) {
     confirmAwaiter: void 0,
     iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
     perIterationOutputCapBytes: config.tools?.perIterationOutputCapBytes ?? DEFAULT_TOOLS_CONFIG.perIterationOutputCapBytes,
-    tracer: void 0
+    tracer: void 0,
+    // Off unless the operator opts in. The WebUI drives the same agent as the
+    // CLI, so it must resolve this identically — a surface-dependent gate
+    // would mean the same repo governs under `wstack` and not in the browser.
+    // See packages/cli/src/wiring/pipeline.ts.
+    requireKanbanGovernance: config.tools?.kanbanGovernance ?? DEFAULT_TOOLS_CONFIG.kanbanGovernance
   });
   input.installToolBoundary?.(pipelines);
   const webuiLogger = container.resolve(TOKENS2.Logger);
@@ -24103,6 +24416,7 @@ async function createAgentServices(input) {
     providers: providerRegistry,
     events,
     pipelines,
+    refreshSystemPrompt: true,
     context,
     maxIterations: config.tools?.maxIterations ?? DEFAULT_TOOLS_CONFIG.maxIterations,
     iterationTimeoutMs: config.tools?.iterationTimeoutMs ?? DEFAULT_TOOLS_CONFIG.iterationTimeoutMs,
@@ -24370,6 +24684,7 @@ async function createAgentServices(input) {
     terminalHandler,
     collabHandler,
     disposeRealtimeHandlers,
+    runSageSessionHygiene,
     updateAutoCompactionMaxContext
   };
 }
@@ -24526,6 +24841,7 @@ async function setupWebUiGovernance(input, dependencies = DEFAULT_DEPENDENCIES)
 
 // src/server/message-dispatcher.ts
 import path28 from "node:path";
+import { planTool as planTool2, taskTool as taskTool2, todoTool as todoTool2 } from "@wrongstack/tools";
 function createMessageDispatcher(opts) {
   const { state, deps: deps2, routes, promptsCtx, codebaseIndexing, runLock, pendingConfirms } = opts;
   function makeWorklistContext() {
@@ -24537,7 +24853,20 @@ function createMessageDispatcher(opts) {
       },
       send: (w, m) => send(w, m),
       broadcast: (m) => broadcast(state.getClients(), m),
-      replaceTodos: (todos) => deps2.context.state.replaceTodos(todos)
+      replaceTodos: (todos) => deps2.context.state.replaceTodos(todos),
+      mutateTodos: async (todos) => {
+        const result = await todoTool2.execute({ todos }, deps2.context, {
+          signal: AbortSignal.timeout(3e4)
+        });
+        return {
+          todos: [...deps2.context.todos],
+          ...result.kanban_warnings ? { warnings: result.kanban_warnings } : {}
+        };
+      },
+      mutateTaskStatus: async (id, status) => taskTool2.execute({ action: "status", id, status }, deps2.context, {
+        signal: AbortSignal.timeout(3e4)
+      }),
+      mutatePlan: async (operation) => planTool2.execute(operation, deps2.context, { signal: AbortSignal.timeout(3e4) })
     };
   }
   function makeSkillsContext() {
@@ -24749,6 +25078,7 @@ function createMessageDispatcher(opts) {
       agentRoster: {
         rosterHandler: new AgentRosterWSHandler({
           projectRoot: state.getProjectRoot,
+          getAutoOptimizeSettings: () => state.getConfig().fleet?.learning?.autoOptimize,
           getLlm: () => {
             const ctx = deps2.agent.ctx;
             return ctx.provider && ctx.model ? { provider: ctx.provider, model: ctx.model } : void 0;
@@ -24834,15 +25164,9 @@ import {
   makeMailInboxTool,
   makeMailSendTool
 } from "@wrongstack/core/coordination";
-import {
-  DefaultPromptLoader,
-  DefaultSkillLoader
-} from "@wrongstack/core/execution";
-import {
-  EventBus,
-  TOKENS as TOKENS3
-} from "@wrongstack/core/kernel";
+import { DefaultPromptLoader, DefaultSkillLoader } from "@wrongstack/core/execution";
 import { DefaultTokenCounter } from "@wrongstack/core/infrastructure";
+import { EventBus, TOKENS as TOKENS3 } from "@wrongstack/core/kernel";
 import { DefaultModelsRegistry, DefaultModeStore } from "@wrongstack/core/models";
 import { ProviderRegistry, ToolRegistry } from "@wrongstack/core/registry";
 import { SkillInstaller } from "@wrongstack/core/skills";
@@ -25500,6 +25824,7 @@ async function createPreContextServices(input) {
     modeId,
     modePrompt,
     modelCapabilities: () => modelCapabilitiesRef.current,
+    tokenSavingMode: config.features.tokenSavingMode,
     instructionPaths: {
       globalDir: wpaths.globalInstructions,
       projectDir: wpaths.inProjectInstructions,
@@ -25520,7 +25845,8 @@ async function createPreContextServices(input) {
   const systemPrompt = await systemPromptBuilder.build({
     cwd: projectRoot,
     projectRoot,
-    tools: toolRegistry.list(),
+    tools: toolRegistry.listForProvider(),
+    catalogTools: toolRegistry.list(),
     provider: config.provider,
     model: config.model,
     onlineAgents
@@ -25538,6 +25864,7 @@ async function createPreContextServices(input) {
     projectRoot,
     model: config.model
   });
+  context.meta["promptOnlineAgents"] = onlineAgents;
   const initialContextPolicy = resolveContextWindowPolicy3(config.context);
   context.meta["contextWindowMode"] = initialContextPolicy.id;
   context.meta["contextWindowPolicy"] = initialContextPolicy;
@@ -25610,6 +25937,7 @@ function createModeHandlers(context) {
         modeId: id,
         modePrompt,
         modelCapabilities: context.modelCapabilities,
+        tokenSavingMode: config.features?.tokenSavingMode,
         instructionPaths: {
           globalDir: paths.globalInstructions,
           projectDir: paths.inProjectInstructions,
@@ -25619,7 +25947,8 @@ function createModeHandlers(context) {
       context.context.systemPrompt = await builder.build({
         cwd: context.projectRoot,
         projectRoot: context.projectRoot,
-        tools: context.toolRegistry.list(),
+        tools: context.toolRegistry.listForProvider(),
+        catalogTools: context.toolRegistry.list(),
         provider: config.provider,
         model: config.model
       });
@@ -25959,11 +26288,11 @@ function buildRoutes(state, deps2, cb) {
 }
 
 // src/server/server-runtime.ts
-import * as path33 from "node:path";
 import { createRequire as createRequire4 } from "node:module";
+import * as path33 from "node:path";
 import { fileURLToPath } from "node:url";
-import { WebSocketServer } from "ws";
 import { toErrorMessage as toErrorMessage13 } from "@wrongstack/core/utils";
+import { WebSocketServer } from "ws";
 async function resolvePorts(opts) {
   const surface = opts.surface ?? "webui";
   const surfaceDefaults = surface === "simpleui" ? { http: 3466 } : { http: 3456 };
@@ -26894,15 +27223,7 @@ projectRoot: ${ev.projectRoot ?? "?"}`,
         eternalSubscription = null;
       }
       codebaseIndexing.dispose();
-      if (config.Sage?.enabled !== false && config.Sage?.hygiene?.autoAfterSession !== false) {
-        const candidate = memoryStore;
-        await candidate.hygiene?.({
-          retentionDays: config.Sage?.hygiene?.retentionDays,
-          archiveLowConfidenceAfterDays: config.Sage?.hygiene?.archiveLowConfidenceAfterDays
-        }).catch(
-          (err) => logger.warn(`sage session hygiene failed: ${toErrorMessage14(err)}`)
-        );
-      }
+      await agentServices.runSageSessionHygiene().catch((err) => logger.warn(`sage session hygiene failed: ${toErrorMessage14(err)}`));
       await memoryStore.dispose().catch(
         (err) => logger.warn(`sage connection disposal failed: ${toErrorMessage14(err)}`)
       );