@yemi33/minions 0.1.2370 → 0.1.2372

package/dashboard.js

@@ -82,24 +82,6 @@ const IS_DEV_MODE = fs.existsSync(path.join(MINIONS_DIR, '.git'));
 const FAVICON_EMOJI = IS_DEV_MODE ? '🚧' : '👽';
 const TITLE_SUFFIX = IS_DEV_MODE ? ' [DEV]' : '';
 
-// Startup size guard (#1167): fail fast with a clear error when dispatch.json /
-// cooldowns.json have ballooned past ENGINE_DEFAULTS.maxStateFileBytes. Without
-// this, V8 silently OOMs on JSON.parse(~1 GB) and the operator has no hint as to
-// which file is bloated. The thrown error names the file and directs to
-// engine/contexts/ where sidecars live.
-(() => {
-  const stateFiles = [
-    DISPATCH_PATH,
-    path.join(ENGINE_DIR, 'cooldowns.json'),
-  ];
-  for (const fp of stateFiles) {
-    try { shared.assertStateFileSize(fp); } catch (e) {
-      console.error('\n[dashboard] STARTUP ABORTED — ' + e.message + '\n');
-      process.exit(78); // 78 = configuration error; consistent with spawn-agent.js
-    }
-  }
-})();
-
 let CONFIG = queries.getConfig();
 let PROJECTS = _getProjects(CONFIG);
 // PORT resolution chain (W-mq5nwl9l): explicit CLI arg (argv[2]) > env
@@ -469,6 +451,18 @@ function mergeSettingsConfigUpdate(current, candidate, body, patch = {}) {
       // `worktreeMode`. Drop any stale legacy key on every settings save so a
       // migrated project never carries both fields.
       delete currentProject.worktreeMode;
+      // W-mrchrfe100067d3a — mirror the per-project additionalRepoScopes
+      // allowlist the same way: present on candidate → copy; absent → clear so
+      // the endpoint falls back to single-scope matching. Without this branch
+      // the validated update (set/deleted on `candidate` in
+      // handleSettingsUpdate) is silently dropped before reaching disk — the
+      // endpoint would return 200 but persist nothing (issue: fix before
+      // configuring minions-opg to poll the secondary yemi33/minions scope).
+      if (Object.prototype.hasOwnProperty.call(candidateProject, 'additionalRepoScopes')) {
+        currentProject.additionalRepoScopes = candidateProject.additionalRepoScopes;
+      } else {
+        delete currentProject.additionalRepoScopes;
+      }
     }
   }
   shared.pruneDefaultClaudeConfig(current);
@@ -579,6 +573,9 @@ function normalizePrMetadata(metadata) {
     description: typeof metadata.description === 'string' ? metadata.description : '',
     branch: typeof metadata.branch === 'string' ? metadata.branch.trim().replace(/^refs\/heads\//i, '') : '',
     author: typeof metadata.author === 'string' ? metadata.author.trim() : '',
+    // W-mrezh0yb0007f733 — carry the platform's real creation timestamp through
+    // so the manual-link path can seed `created` with it instead of now().
+    created: typeof metadata.created === 'string' ? metadata.created.trim() : '',
   };
 }
 
@@ -1365,7 +1362,12 @@ function linkPullRequestForTracking({ url, title, project: projectName, contextO
     branch: metadata?.branch || '',
     reviewStatus: 'pending',
     status: 'active',
-    created: new Date().toISOString(),
+    // W-mrezh0yb0007f733 — prefer the platform's real creationDate (fetched into
+    // metadata for ADO before linking) over link-time now(). When it isn't
+    // available yet (e.g. GitHub, where enrichment runs async after this insert,
+    // or an ADO metadata-fetch failure), fall back to now() — the next PR poll
+    // corrects it from the platform via shared.shouldAdoptPlatformCreated.
+    created: metadata?.created || new Date().toISOString(),
     url,
     prdItems: linkedWorkItemId ? [linkedWorkItemId] : [],
     contextOnly: resolvedContextOnly,
@@ -1499,161 +1501,10 @@ function _resolveSkillReadPath({ file, dir, source, config, skillFiles } = {}) {
   return null;
 }
 
-// ── Harness propagation diagnostic (P-c601f9a2) ──────────────────────────────
-// Per-runtime view of where the CLI looks for skills/commands/MCPs, what the
-// engine actually attaches via --add-dir, which assets are explicitly
-// suppressed (e.g. AGENTS.md auto-load, Copilot's bundled github-mcp-server),
-// and the canonical footgun: per-project assets that live as uncommitted files
-// in the operator's main checkout but won't propagate to fresh worktrees.
-//
-// Surfaced via GET /api/harness/diagnostics and rendered on the Tools page so
-// operators can spot a missing or unpropagated harness asset without leaving
-// the dashboard. See docs/harness-propagation.md for the full contract.
-const HARNESS_FOOTGUN_DIRS = [
-  '.claude/skills',
-  '.claude/commands',
-  '.copilot/skills',
-  '.copilot/commands',
-  '.agents/skills',
-  '.agents/commands',
-];
-const HARNESS_FOOTGUN_FILES = [
-  '.claude/.mcp.json',
-  '.copilot/.mcp.json',
-  '.mcp.json',
-];
-
-const _PROJECT_LOCAL_FOOTGUN_WARNING =
-  'These files exist in your main checkout but are uncommitted or untracked in ' +
-  'git. A fresh `git worktree add` for a mutating dispatch will NOT see them, so ' +
-  'the dispatched agent silently underperforms. Fix: commit them, move them to ' +
-  'user scope (~/.claude/skills/..., ~/.copilot/skills/...), or flip the project ' +
-  'to live-checkout mode (checkoutMode: live).';
-
-function _walkUncommittedHarnessAssets(absStart, rootDir, projectName) {
-  const results = [];
-  const stack = [absStart];
-  let count = 0;
-  while (stack.length > 0 && count < 500) {
-    const cur = stack.pop();
-    let entries;
-    try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
-    catch { continue; }
-    for (const ent of entries) {
-      if (ent.name === '.git' || ent.name === 'node_modules') continue;
-      const full = path.join(cur, ent.name);
-      if (ent.isDirectory()) { stack.push(full); continue; }
-      if (!ent.isFile()) continue;
-      const rel = path.relative(rootDir, full);
-      const normalized = rel.replace(/\\/g, '/');
-      let kind = null;
-      if (
-        normalized.startsWith('.claude/skills/') ||
-        normalized.startsWith('.copilot/skills/') ||
-        normalized.startsWith('.agents/skills/')
-      ) kind = 'skill';
-      else if (
-        normalized.startsWith('.claude/commands/') ||
-        normalized.startsWith('.copilot/commands/') ||
-        normalized.startsWith('.agents/commands/')
-      ) kind = 'command';
-      else if (
-        normalized === '.mcp.json' ||
-        normalized === '.claude/.mcp.json' ||
-        normalized === '.copilot/.mcp.json'
-      ) kind = 'mcp';
-      if (!kind) continue;
-      results.push({ file: rel, kind, scope: `project:${projectName}` });
-      count++;
-      if (count >= 500) break;
-    }
-  }
-  return results;
-}
-
-function _scanProjectLocalHarnessFootgun(project) {
-  const out = {
-    project: project && project.name ? project.name : '',
-    localPath: project && project.localPath ? project.localPath : '',
-    uncommittedAssets: [],
-    footgunWarning: _PROJECT_LOCAL_FOOTGUN_WARNING,
-  };
-  if (!project || !project.localPath) return out;
-  // Skip the synchronous `git status` for UNC / WSL-from-Windows paths
-  // (\\wsl.localhost\..., \\wsl$\..., or any \\server\share). git/stat over a
-  // WSL UNC mount can hang for minutes; even capped at the 10s timeout below it
-  // hard-blocks the dashboard event loop on every poll, freezing the whole
-  // dashboard. Such projects can't carry uncommitted project-local harness
-  // assets the engine would propagate anyway, so returning the empty shell here
-  // is correct, not lossy. (Load-reduction audit 2026-06-24.)
-  const _lp = String(project.localPath);
-  if (_lp.startsWith('\\\\') || _lp.startsWith('//')) return out;
-  let raw = '';
-  try {
-    const { execFileSync } = require('child_process');
-    raw = execFileSync('git', ['status', '--porcelain', '-z'], {
-      cwd: project.localPath,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 10000,
-      // W-mqecdoot — MUST set windowsHide. This runs per-project on every
-      // GET /api/harness/diagnostics hit (Tools/Harness page, polled), and a
-      // detached dashboard has no console — so without this each call pops a
-      // visible git.exe console window per project ("infinite git windows").
-      // This was the only git spawn in the codebase missing windowsHide.
-      windowsHide: true,
-    });
-  } catch { return out; }
-  if (!raw) return out;
-  const records = raw.split('\0').filter(Boolean);
-  const seen = new Set();
-  for (const rec of records) {
-    if (rec.length < 4) continue;
-    const filePath = rec.slice(3);
-    const normalized = filePath.replace(/\\/g, '/');
-    const isDirRecord = normalized.endsWith('/');
-    const trimmed = isDirRecord ? normalized.slice(0, -1) : normalized;
-    let overlaps = false;
-    for (const dir of HARNESS_FOOTGUN_DIRS) {
-      if (
-        trimmed === dir ||
-        trimmed.startsWith(dir + '/') ||
-        dir.startsWith(trimmed + '/')
-      ) { overlaps = true; break; }
-    }
-    if (!overlaps) {
-      for (const file of HARNESS_FOOTGUN_FILES) {
-        if (trimmed === file || file.startsWith(trimmed + '/')) { overlaps = true; break; }
-      }
-    }
-    if (!overlaps) continue;
-
-    const absStart = path.join(project.localPath, filePath);
-    let stat;
-    try { stat = fs.statSync(absStart); } catch { continue; }
-    if (stat.isDirectory()) {
-      for (const asset of _walkUncommittedHarnessAssets(absStart, project.localPath, out.project)) {
-        if (seen.has(asset.file)) continue;
-        seen.add(asset.file);
-        out.uncommittedAssets.push(asset);
-      }
-    } else {
-      let kind = 'other';
-      if (normalized.includes('/skills/')) kind = 'skill';
-      else if (normalized.includes('/commands/')) kind = 'command';
-      else if (normalized.endsWith('.mcp.json')) kind = 'mcp';
-      if (seen.has(filePath)) continue;
-      seen.add(filePath);
-      out.uncommittedAssets.push({ file: filePath, kind, scope: `project:${out.project}` });
-    }
-  }
-  return out;
-}
-
-// TTL cache for the harness diagnostic. The build runs a synchronous `git
-// status` + directory walks per project; the Tools page polls it while open,
-// so without a cache it re-runs the whole sweep every 4s and blocks the event
-// loop each time. The diagnostic is rare-change, so a short TTL is ample.
+// ── Runtime harness inventory ─────────────────────────────────────────────────
+// Read-only view of native skill, command, and MCP locations declared by each
+// adapter. It does not influence spawning or attest what a runtime loaded.
+// The inventory is rare-change, so a short TTL is ample.
 // Bypassed whenever explicit opts are supplied (unit tests pass homeDir/
 // projects/engineConfig) so test determinism is unaffected.
 // (Load-reduction audit 2026-06-24.)
@@ -1730,29 +1581,7 @@ function _buildHarnessDiagnosticsUncached(opts = {}) {
     collectMissing(mcpConfigPaths, runtimeName, 'mcp');
   }
 
-  let addDirSnapshot = [];
-  if (preflight && registry) {
-    let fleetRuntime = null;
-    try { fleetRuntime = registry.resolveRuntime(fleetDefaultCli); }
-    catch { fleetRuntime = null; }
-    if (fleetRuntime) {
-      const snapshot = preflight._computeAddDirSnapshot(fleetRuntime, {
-        minionsHome: MINIONS_DIR,
-        homeDir,
-        existsFn,
-      });
-      if (Array.isArray(snapshot)) addDirSnapshot = snapshot.map(slimRow);
-    }
-  }
-
   const suppressed = [];
-  if (engineConfig.copilotSuppressAgentsMd !== false) {
-    suppressed.push({
-      flag: 'copilotSuppressAgentsMd',
-      value: true,
-      effect: 'Copilot --no-custom-instructions: in-tree AGENTS.md is NOT auto-loaded, so Minions playbook prompts are not overridden by repo-local instructions.',
-    });
-  }
   if (engineConfig.copilotDisableBuiltinMcps !== false) {
     suppressed.push({
       flag: 'copilotDisableBuiltinMcps',
@@ -1760,22 +1589,10 @@ function _buildHarnessDiagnosticsUncached(opts = {}) {
       effect: 'Copilot --disable-builtin-mcps: bundled github-mcp-server is stripped so dispatched agents do not open a parallel PR alongside the Minions PR.',
     });
   }
-  if (engineConfig.hermeticHarness === true) {
-    suppressed.push({
-      flag: 'hermeticHarness',
-      value: true,
-      effect: 'Hermetic harness mode: only the engine playbook + system prompt are surfaced; user-scope skills, commands, and MCP configs are NOT propagated to this dispatch.',
-    });
-  }
-
-  const projectLocalOnMain = projects.map(_scanProjectLocalHarnessFootgun);
-
   return {
     fleetDefaultCli,
     runtimes,
-    addDirSnapshot,
     suppressed,
-    projectLocalOnMain,
     missingDirs,
   };
 }
@@ -1841,6 +1658,11 @@ let _plansCacheTs = 0;
 const PLANS_CACHE_TTL_MS = 5000;
 function invalidatePlansCache() { _plansCache = null; _plansCacheTs = 0; }
 
+function statePathExists(filePath) {
+  if (prdStore.parsePrdPath(filePath)) return prdStore.readPrd(filePath) != null;
+  return fs.existsSync(filePath);
+}
+
 // Resolve a plan/PRD file path: .json files live in prd/, .md files in plans/
 // Validates that the file stays within the expected directory to prevent path traversal.
 function resolvePlanPath(file) {
@@ -1848,11 +1670,12 @@ function resolvePlanPath(file) {
     // Validate against both prd/ and prd/archive/
     shared.sanitizePath(file, PRD_DIR);
     const active = path.join(PRD_DIR, file);
-    if (fs.existsSync(active)) return active;
+    if (prdStore.readPrd(active)) return active;
     const archived = path.join(PRD_DIR, 'archive', file);
-    if (fs.existsSync(archived)) return archived;
+    if (prdStore.readPrd(archived)) return archived;
     return active;
   }
+
   // Validate against both plans/ and plans/archive/
   shared.sanitizePath(file, PLANS_DIR);
   const active = path.join(PLANS_DIR, file);
@@ -1881,7 +1704,7 @@ function _archivePrdPostProcess({ planFile, archivePath, planPath, plansDir, _mu
 
   // (a) Flip the archived FLAG + status + archivedAt. Phase 10 step 4.2b:
   // archived-ness is the flag now (not the directory), so set `archived:true`
-  // explicitly. The mutate dual-writes the change into SQL via the chokepoint.
+  // explicitly. The path-shaped mutator routes PRDs into SQL.
   // When archivePath === planPath (in-place archive) this flags the PRD where it
   // sits; when they differ (.md-cascade / legacy move) it flags the moved copy.
   try {
@@ -3245,7 +3068,8 @@ function serveFreshJson(req, res, opts) {
     return;
   }
   const mtime = _maxInputMtimeMs(inputs);
-  const etag = '"' + tag + '-' + mtime + '"';
+  const eventVersion = _getCurrentEventVersion();
+  const etag = '"' + tag + '-' + mtime + '-' + eventVersion + '"';
   res.setHeader('ETag', etag);
   res.setHeader('Cache-Control', 'private, max-age=0, must-revalidate');
   if (req && req.headers && req.headers['if-none-match'] === etag) {
@@ -6254,11 +6078,11 @@ const server = http.createServer(async (req, res) => {
       const prdDir = path.join(MINIONS_DIR, 'prd');
       let prdPath = path.join(prdDir, body.file);
       let fromArchive = false;
-      if (!fs.existsSync(prdPath)) {
+      if (!statePathExists(prdPath)) {
         prdPath = path.join(prdDir, 'archive', body.file);
         fromArchive = true;
       }
-      if (!fs.existsSync(prdPath)) return jsonReply(res, 404, { error: 'PRD not found' });
+      if (!statePathExists(prdPath)) return jsonReply(res, 404, { error: 'PRD not found' });
 
       // If archived, temporarily restore to active so checkPlanCompletion can find it
       const activePath = path.join(prdDir, body.file);
@@ -7218,14 +7042,9 @@ const server = http.createServer(async (req, res) => {
       const manualPrd = buildManualPrdItemPlan(body);
       if (manualPrd.error) return jsonReply(res, 400, { error: manualPrd.error });
 
-      if (!fs.existsSync(PRD_DIR)) fs.mkdirSync(PRD_DIR, { recursive: true });
-
       const planFile = 'manual-' + shared.uid() + '.json';
       const manualPrdPath = path.join(PRD_DIR, planFile);
       safeWrite(manualPrdPath, manualPrd.plan);
-      // Phase 10 step 2 — this create uses safeWrite (not mutateJsonFileLocked),
-      // so mirror to SQL explicitly. Best-effort.
-      prdStore.mirrorPrdToSql(manualPrdPath, manualPrd.plan);
       invalidatePlansCache();
       return jsonReply(res, 200, { ok: true, id: manualPrd.id, file: planFile });
     } catch (e) { return jsonReply(res, 400, { error: e.message }); }
@@ -7239,7 +7058,7 @@ const server = http.createServer(async (req, res) => {
       // the file with JSON, destroying source plans (see /api/plans/approve trap).
       if (!body.source.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename in `source` (got `' + body.source + '`). Pass prd/<plan>.json, not plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.source);
-      if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
+      if (!statePathExists(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
       // Pre-check: verify item exists before taking the lock
       const preCheck = safeJsonObj(planPath);
       const preItem = (preCheck.missing_features || []).find(f => f.id === body.itemId);
@@ -7296,7 +7115,7 @@ const server = http.createServer(async (req, res) => {
       if (!body.source || !body.itemId) return jsonReply(res, 400, { error: 'source and itemId required' });
       if (!body.source.endsWith('.json')) return jsonReply(res, 400, { error: 'expected a PRD JSON filename in `source` (got `' + body.source + '`). Pass prd/<plan>.json, not plans/<plan>.md.' });
       const planPath = resolvePlanPath(body.source);
-      if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
+      if (!statePathExists(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
       let removed = false;
       mutateJsonFileLocked(planPath, (plan) => {
         if (!plan || Array.isArray(plan) || typeof plan !== 'object') plan = { missing_features: [] };
@@ -8041,9 +7860,9 @@ const server = http.createServer(async (req, res) => {
       { dir: PRD_DIR, archived: false },
       { dir: path.join(PRD_DIR, 'archive'), archived: true },
     ];
-    // Load work items to check for completed plan-to-prd conversions.
-    // safeJsonArr is sync but reads a single small file — leave as is.
-    const centralWi = safeJsonArr(path.join(MINIONS_DIR, 'work-items.json'));
+    // Load central work items from the SQL-backed store to check for completed
+    // plan-to-prd conversions.
+    const centralWi = require('./engine/work-items-store').readWorkItemsForScope('central');
     const completedPrdFiles = new Set(
       centralWi.filter(w => w.type === WORK_TYPE.PLAN_TO_PRD && DONE_STATUSES.has(w.status) && w.planFile)
         .map(w => w.planFile)
@@ -8427,8 +8246,8 @@ const server = http.createServer(async (req, res) => {
       if (!body.file.endsWith('.md')) return jsonReply(res, 400, { error: 'only .md plans can be executed' });
       shared.sanitizePath(body.file, PLANS_DIR);
       const planPath = path.join(MINIONS_DIR, 'plans', body.file);
-      if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
-      const planContent = fs.readFileSync(planPath, 'utf8');
+      if (!statePathExists(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
+      const planContent = safeRead(planPath);
       const declaredProject = shared.extractPlanDeclaredProject(planContent);
 
       const feedback = (body.feedback || '').toString().trim();
@@ -8485,7 +8304,7 @@ const server = http.createServer(async (req, res) => {
       const body = await readBody(req);
       if (!body.source) return jsonReply(res, 400, { error: 'source required' });
       const planPath = resolvePlanPath(body.source);
-      if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
+      if (!statePathExists(planPath)) return jsonReply(res, 404, { error: 'plan file not found' });
       const plan = safeJsonObj(planPath);
       const planItems = plan.missing_features || [];
 
@@ -8581,7 +8400,7 @@ const server = http.createServer(async (req, res) => {
       if (!body.file) return jsonReply(res, 400, { error: 'file required' });
       shared.sanitizePath(body.file, body.file.endsWith('.json') ? PRD_DIR : PLANS_DIR);
       const planPath = resolvePlanPath(body.file);
-      if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan not found' });
+      if (!statePathExists(planPath)) return jsonReply(res, 404, { error: 'plan not found' });
       // Read plan content before deleting — needed for worktree cleanup and source_plan
       let planObj = null;
       let prdSourcePlan = null;
@@ -8591,13 +8410,13 @@ const server = http.createServer(async (req, res) => {
       // Clean up worktrees before deleting work items (needs branch info from work items)
       try {
         const { cleanupPlanWorktrees } = require('./engine/lifecycle');
-        cleanupPlanWorktrees(body.file, planObj || {}, PROJECTS, getConfig());
+        cleanupPlanWorktrees(body.file, planObj || {}, PROJECTS, queries.getConfig());
       } catch (e) { console.error('plan worktree cleanup:', e.message); }
       safeUnlink(planPath);
       // Phase 10 step 2 — a deleted PRD must also leave SQL, or the read-flip
       // (step 3) would resurrect it from a stale mirror row. Best-effort; no-op
       // for non-PRD paths (parsePrdPath returns null for plan .md deletes).
-      if (body.file.endsWith('.json')) prdStore.removePrdFromSql(planPath);
+      if (body.file.endsWith('.json')) prdStore.deletePrd(planPath);
       // Neutralize the `.backup` sidecar so `safeJson` auto-restore can't
       // RESURRECT the PRD we just deleted (the live file is gone, but a stray
       // `prd/<plan>.json.backup` would be auto-restored on the next safeJson read
@@ -8667,7 +8486,7 @@ const server = http.createServer(async (req, res) => {
       const isPrd = body.file.endsWith('.json');
       shared.sanitizePath(body.file, isPrd ? PRD_DIR : PLANS_DIR);
       const planPath = resolvePlanPath(body.file);
-      if (!fs.existsSync(planPath)) return jsonReply(res, 404, { error: 'plan not found' });
+      if (!statePathExists(planPath)) return jsonReply(res, 404, { error: 'plan not found' });
 
       // Phase 10 step 4.2b: a PRD is archived IN PLACE (flag flip via
       // _archivePrdPostProcess — the json stays in prd/, no move, so the
@@ -8710,19 +8529,7 @@ const server = http.createServer(async (req, res) => {
         // shipped for the PRD branch in W-mqa13ulk0002def5 (PR #3222) — the
         // helper's source-plan move is a safe no-op here because the outer
         // handler already renamed body.file into plans/archive/.
-        let prdFiles = [];
-        try {
-          prdFiles = fs.readdirSync(PRD_DIR).filter(f => f.endsWith('.json'));
-        } catch (e) {
-          // ENOENT on prd/ is expected for projects without a PRD dir yet —
-          // don't surface as a user-visible warning. Other errors (EACCES,
-          // EIO) get logged + warned.
-          if (e.code !== 'ENOENT') {
-            const warning = `Archive could not enumerate ${PRD_DIR}: ${e.message}`;
-            archiveWarnings.push(warning);
-            console.warn(warning);
-          }
-        }
+        const prdFiles = prdStore.listPrdRows().filter(row => !row.archived).map(row => row.filename);
         for (const prdFile of prdFiles) {
           const prdLivePath = path.join(PRD_DIR, prdFile);
           let prd = null;
@@ -8777,7 +8584,7 @@ const server = http.createServer(async (req, res) => {
 
       try {
         const { cleanupPlanWorktrees } = require('./engine/lifecycle');
-        cleanupPlanWorktrees(body.file, plan, PROJECTS, getConfig());
+        cleanupPlanWorktrees(body.file, plan, PROJECTS, queries.getConfig());
       } catch (e) { console.error('plan worktree cleanup:', e.message); }
 
       invalidateStatusCache();
@@ -8804,12 +8611,23 @@ const server = http.createServer(async (req, res) => {
       // (physically in <dir>/archive/) or in-place (in <dir>/ with the archived
       // flag set). Restore from whichever it is.
       let liveDest;
-      if (fs.existsSync(archivePath)) {
+      // Existence probes only — NEVER used as the write payload. The actual
+      // restore below (prdStore.restorePrdFromArchive) re-reads the archived
+      // row fresh inside its own transaction immediately before writing, so a
+      // concurrent engine write to that row between this probe and the write
+      // can't be clobbered by a stale in-memory snapshot (W-mrenu075000a94c9).
+      const archivedPrdExists = isJson ? prdStore.readPrd(archivePath) != null : false;
+      const activePrdData = isJson ? prdStore.readPrd(livePath) : null;
+      if (isJson && archivedPrdExists) {
+        const restored = prdStore.restorePrdFromArchive(body.file);
+        if (!restored) return jsonReply(res, 404, { error: 'File not found in archive' });
+        liveDest = livePath;
+      } else if (fs.existsSync(archivePath)) {
         // DATA-LOSS GUARD: restoring must not clobber a LIVE plan/PRD of the same
         // basename (renameSync overwrites). moveFileNoClobber bumps the restored
         // name instead so the existing live file survives.
         liveDest = shared.moveFileNoClobber(archivePath, targetDir, body.file);
-      } else if (isJson && fs.existsSync(livePath) && shared.isPrdArchived(safeJsonNoRestore(livePath))) {
+      } else if (isJson && activePrdData && shared.isPrdArchived(activePrdData)) {
         liveDest = livePath; // in-place flag-archived — already in prd/, just clear the flag below
       } else {
         return jsonReply(res, 404, { error: 'File not found in archive' });
@@ -13610,10 +13428,10 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         },
       });
     }},
-    { method: 'GET', path: '/api/schedules', desc: 'Schedule definitions merged with schedule-runs.json overlay (_lastRun/_lastResult/_lastCompletedAt)', handler: (req, res) => {
+    { method: 'GET', path: '/api/schedules', desc: 'Schedule definitions merged with SQL schedule-run state (_lastRun/_lastResult/_lastCompletedAt)', handler: (req, res) => {
       return serveFreshJson(req, res, {
         tag: 'schedules',
-        inputs: [CONFIG_PATH, path.join(ENGINE_DIR, 'schedule-runs.json')],
+        inputs: [CONFIG_PATH],
         builder: () => {
           // Read config.json directly via queries.getConfig() rather than
           // calling reloadConfig() — the latter cascades into
@@ -13625,7 +13443,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
           // (Round-2 review finding #3.)
           const cfg = queries.getConfig() || {};
           const scheds = cfg.schedules || [];
-          const runs = shared.safeJsonObj(path.join(ENGINE_DIR, 'schedule-runs.json'));
+          const runs = require('./engine/small-state-store').readScheduleRuns();
           return scheds.map(s => {
             const runEntry = runs[s.id];
             const _lastRun = typeof runEntry === 'string' ? runEntry : (runEntry?.lastRun || runEntry?.lastCompletedAt || null);
@@ -13642,12 +13460,11 @@ What would you like to discuss or change? When you're happy, say "approve" and I
         },
       });
     }},
-    { method: 'GET', path: '/api/pipelines', desc: 'Pipeline definitions merged with last-5 runs each from pipeline-runs.json', handler: (req, res) => {
+    { method: 'GET', path: '/api/pipelines', desc: 'Pipeline definitions merged with last-5 SQL-backed runs', handler: (req, res) => {
       return serveFreshJson(req, res, {
         tag: 'pipelines',
         inputs: [
           path.join(MINIONS_DIR, 'pipelines'),
-          path.join(ENGINE_DIR, 'pipeline-runs.json'),
         ],
         builder: () => {
           try {
@@ -13662,14 +13479,14 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     { method: 'GET', path: '/api/qa-runs-summary', desc: 'Sidebar-counter summary {total, sig} for QA runs (sidebar activity-dot signal)', handler: (req, res) => {
       return serveFreshJson(req, res, {
         tag: 'qa-runs-summary',
-        inputs: [path.join(ENGINE_DIR, 'qa-runs.json')],
+        inputs: [],
         builder: () => qaRunsMod.summarizeRunsForStatus(),
       });
     }},
     { method: 'GET', path: '/api/qa-sessions-summary', desc: 'Sidebar-counter summary {active, sig} for non-terminal QA sessions (drives the QA nav badge — issue #717)', handler: (req, res) => {
       return serveFreshJson(req, res, {
         tag: 'qa-sessions-summary',
-        inputs: [qaSessionsMod.qaSessionsPath()],
+        inputs: [],
         builder: () => qaSessionsMod.summarizeActiveSessionsForStatus(),
       });
     }},
@@ -13956,7 +13773,7 @@ What would you like to discuss or change? When you're happy, say "approve" and I
             if (token) ghOpts.env = { ...process.env, GH_TOKEN: token };
             const result = await shared.shellSafeGh(['api', `repos/${shared.validateGhSlug(slug)}/pulls/${String(prNum)}`], ghOpts);
             const d = JSON.parse(result);
-            prData = { title: d.title, description: d.body, branch: d.head?.ref, author: d.user?.login };
+            prData = { title: d.title, description: d.body, branch: d.head?.ref, author: d.user?.login, created: d.created_at };
           } else if (adoTarget && !initialPrData) {
             try {
               prData = await ado.fetchAdoPrMetadata(adoTarget.prNum, adoTarget.adoOrg, adoTarget.adoProj, adoTarget.adoRepo);
@@ -13983,6 +13800,12 @@ What would you like to discuss or change? When you're happy, say "approve" and I
               }
             }
             if (pr.agent === 'human' && prData.author) pr.agent = prData.author;
+            // W-mrezh0yb0007f733 — for GitHub (and ADO metadata-fetch-retry)
+            // links, `created` was seeded with link-time now(); adopt the
+            // platform's real creation timestamp now that enrichment fetched it.
+            if (prData.created && shared.shouldAdoptPlatformCreated(pr.created, prData.created)) {
+              pr.created = prData.created;
+            }
             return prs;
           }, { defaultValue: [] });
           invalidateStatusCache();
@@ -14663,8 +14486,8 @@ What would you like to discuss or change? When you're happy, say "approve" and I
     // Skills
     { method: 'GET', path: '/api/skill', desc: 'Read a skill file', params: 'file, source?, dir?', handler: handleSkillRead },
 
-    // Harness propagation diagnostic (P-c601f9a2)
-    { method: 'GET', path: '/api/harness/diagnostics', desc: 'Per-runtime harness diagnostic (add-dirs, suppressed flags, project-local-on-main footgun, missing dirs)', handler: handleHarnessDiagnostics },
+    // Runtime harness inventory
+    { method: 'GET', path: '/api/harness/diagnostics', desc: 'Read-only inventory of runtime-declared harness locations and explicit orchestration policies', handler: handleHarnessDiagnostics },
 
     // Projects
     { method: 'POST', path: '/api/projects/browse', desc: 'Open folder picker dialog, return selected path', handler: handleProjectsBrowse },

package/docs/README.md

@@ -43,8 +43,8 @@ Architecture, design proposals, and lifecycle references for people working on t
 - [deprecated-process.md](deprecated-process.md) — Schema for `docs/deprecated.json` and the weekly `cleanup-deprecated` audit walk that retires entries past their removal signal.
 - [design-state-storage.md](design-state-storage.md) — Design proposal evaluating five database options for replacing Minions' file-based JSON state; recommends `node:sqlite` (accepted; implementation tracked in CHANGELOG.md Phases 0–10).
 - [harness-mode.md](harness-mode.md) — Tri-Agent Harness Mode (`harness_mode: "tri_agent"` on scheduled tasks): Planner → Generator → Evaluator loop that iterates a shared on-disk artifact until a rubric passes or the iteration cap fires.
-- [harness-propagation.md](harness-propagation.md) — How user-level and project-local harness assets (skills, slash-commands, MCP config, `CLAUDE.md` / `AGENTS.md`) propagate into an agent's worktree via `--add-dir`, the `harnessPropagateProjectLocal` flag, and the project-local-on-main worktree-visibility footgun.
-- [harness-transparency.md](harness-transparency.md) — The `harnessUsed` self-report contract: capture (agent reports the skills / MCPs / commands / docs it used) → ground (engine cross-checks against `_harnessPropagated` and annotates `grounded:true\|false`, never dropping) → surface (PR comment, final agent note, work-item modal).
+- [harness-propagation.md](harness-propagation.md) — The native runtime
+  contract for repository instructions, skills, commands, and MCPs.
 - [kb-dedup-duplicate-pair-investigation.md](kb-dedup-duplicate-pair-investigation.md) — Investigation-only pass diffing suspected duplicate KB filename groups (content-hash dedup for agent-authored reviews/build-reports) to confirm true full-body duplication before any fix is proposed.
 - [kb-pr3223-cascade-archiving.md](kb-pr3223-cascade-archiving.md) — Findings from PR #3223: cascade-archiving PRDs when their linked markdown plan is archived, including the per-concern try/catch pattern and `source_plan` basename-matching invariant in `handlePlansArchive` (`dashboard.js`).
 - [kb-pr696-merge-conflict-docs.md](kb-pr696-merge-conflict-docs.md) — Findings from PR #696: resolving a merge conflict in `docs/kb-sweep.md` with stale line-number citations to `engine/kb-sweep.js`.
@@ -57,7 +57,6 @@ Architecture, design proposals, and lifecycle references for people working on t
 - [pr-auto-fix-dispatch.md](pr-auto-fix-dispatch.md) — Short reference table mapping each PR auto-fix / review dispatch site in `engine.js#discoverFromPrs` to its gate flag, plus the `pollingPaused` / `autoFixPaused` master kill-switches and the per-provider polling gates.
 - [pr-comment-followup.md](pr-comment-followup.md) — PR-comment follow-up dispatch contract: fix/review agents may spin off a new WI via `POST /api/work-items` with `meta.pr_followup` instead of broadening the current PR or rebutting the comment.
 - [pr-review-fix-loop.md](pr-review-fix-loop.md) — How the engine moves a PR from creation through review, fix dispatch, and re-review, including stale-status guards.
-- [project-skills.md](project-skills.md) — Project-local skill discovery (`.claude/skills/`, `.claude/commands/`, `CLAUDE.md` / `.github/copilot-instructions.md` slash-command mentions): how dispatched agents see and steer toward purpose-built tooling the project ships, plus the intent-vocabulary contract.
 - [proposals/repo-pool-for-live-checkout.md](proposals/repo-pool-for-live-checkout.md) — Review-only artifact reproducing the approved plan + PRD for a repo pool covering live-checkout projects (multi-enlistment dispatch), so the design has a git-tracked surface for human comment before the dependent implementation work items land as code PRs.
 - [qa-runbook-lifecycle.md](qa-runbook-lifecycle.md) — End-to-end QA runbook lifecycle (W-mpeiwz6k0005bf34): runbook + run-record storage, `POST /api/qa/runbooks/run` dispatch into the `qa-validate` playbook, artifact contract, and how the `/qa` page mirrors managed-spawn observability.
 - [qa-runbooks.md](qa-runbooks.md) — Per-project QA runbook schema, storage layout (`projects/<name>/runbooks/<id>.json`), CRUD endpoints, run-record lifecycle, and the `qa-validate` agent sidecar contract.

package/docs/architecture.excalidraw

@@ -1551,11 +1551,11 @@
       "versionNonce": 1820013027,
       "fontSize": 12,
       "fontFamily": 3,
-      "text": "copilot adapter\n--autopilot --allow-all\n--disable-builtin-mcps\n--no-custom-instructions",
+      "text": "copilot adapter\n--autopilot --allow-all\n--disable-builtin-mcps",
       "textAlign": "center",
       "verticalAlign": "middle",
       "containerId": "NSvcvc9cT4YYzxMebEDz",
-      "originalText": "copilot adapter\n--autopilot --allow-all\n--disable-builtin-mcps\n--no-custom-instructions",
+      "originalText": "copilot adapter\n--autopilot --allow-all\n--disable-builtin-mcps",
       "lineHeight": 1.25,
       "autoResize": false
     },

package/docs/auto-discovery.md

@@ -105,9 +105,9 @@ Flip via Dashboard → Settings → Polling → "Granular work-discovery control
 
 ### Source 2: PRD Gap Analysis (via `materializePlansAsWorkItems`)
 
-PRD items flow through `materializePlansAsWorkItems()`, which scans `~/.minions/prd/*.json` for PRD files with `missing` / `updated` / `planned` items and creates work items in the target project's queue.
+PRD items flow through `materializePlansAsWorkItems()`, which queries SQL PRDs for `missing` / `updated` / `planned` items and creates work items in the target project's queue.
 
-**Reads:** `~/.minions/prd/*.json` — the central PRD directory. (Legacy `<project>/docs/prd-gaps.json` paths are no longer scanned.)
+**Reads:** SQL `prds` and `prd_items`.
 
 | Item State | Action | Dispatch Type |
 |------------|--------|---------------|
@@ -182,7 +182,7 @@ priority: high
 ...
 ```
 
-**Plans** (`materializePlansAsWorkItems`): Scans `~/.minions/prd/*.json` for PRD files with `missing`/`planned` items. Creates work items in the target project's queue with `createdBy: 'engine:plan-discovery'`. Work item ID = PRD item ID (e.g. `P-43e5ac28`). Deduped by `id`.
+**Plans** (`materializePlansAsWorkItems`): Queries SQL PRDs for `missing`/`planned` items. Creates work items in the target project's queue with `createdBy: 'engine:plan-discovery'`. Work item ID = PRD item ID (e.g. `P-43e5ac28`). Deduped by `id`.
 
 Both write to `work-items.json` and are picked up by Source 3 on the same or next tick.