@zq-silk/yui 0.15.7 → 0.15.9

package/dist/executor/workspacePreflightClassification.js

@@ -20,7 +20,7 @@ function ownerLabel(owner) {
  * This is a read-only check: it never mutates Git state, creates Sessions, or
  * writes recovery records.
  */
-export function classifyWorkspacePreflight(store, task, roleName, activeTurn, inspectPhysical) {
+export function classifyWorkspacePreflight(store, task, roleName, activeRun, inspectPhysical) {
     const main = store.getTaskWorkspace(task.id);
     const bindings = task.projectBindings.map(({ projectId, directory }) => ({ projectId, directory }));
     // 1. Owner validation: the Task main workspace must be a durable,
@@ -41,26 +41,26 @@ export function classifyWorkspacePreflight(store, task, roleName, activeTurn, in
             actual
         };
     }
-    // 2. Turn snapshot validation: when the active Turn carries a workspace
+    // 2. AgentRun snapshot validation: when the active AgentRun carries a workspace
     //    snapshot its launch-stable identity must match the durable
     //    ManagedWorkspace. Audit timestamps may change without changing the
-    //    owner, root, or Project entries authorized for the Turn.
-    if (activeTurn?.workspace !== undefined) {
-        const durableRunWorkspace = store.getManagedWorkspace(activeTurn.workspace.owner);
+    //    owner, root, or Project entries authorized for the AgentRun.
+    if (activeRun?.workspace !== undefined) {
+        const durableRunWorkspace = store.getManagedWorkspace(activeRun.workspace.owner);
         if (durableRunWorkspace === null
-            || !sameManagedWorkspaceIdentity(durableRunWorkspace, activeTurn.workspace)) {
+            || !sameManagedWorkspaceIdentity(durableRunWorkspace, activeRun.workspace)) {
             const diff = [];
             if (durableRunWorkspace === null) {
-                diff.push(`durable ManagedWorkspace for owner ${JSON.stringify(activeTurn.workspace.owner)} is missing`);
+                diff.push(`durable ManagedWorkspace for owner ${JSON.stringify(activeRun.workspace.owner)} is missing`);
             }
             else {
-                if (durableRunWorkspace.root !== activeTurn.workspace.root) {
-                    diff.push(`root: durable=${durableRunWorkspace.root} run=${activeTurn.workspace.root}`);
+                if (durableRunWorkspace.root !== activeRun.workspace.root) {
+                    diff.push(`root: durable=${durableRunWorkspace.root} run=${activeRun.workspace.root}`);
                 }
-                if (durableRunWorkspace.entries.length !== activeTurn.workspace.entries.length) {
-                    diff.push(`entries: durable=${durableRunWorkspace.entries.length} run=${activeTurn.workspace.entries.length}`);
+                if (durableRunWorkspace.entries.length !== activeRun.workspace.entries.length) {
+                    diff.push(`entries: durable=${durableRunWorkspace.entries.length} run=${activeRun.workspace.entries.length}`);
                 }
-                for (const [index, entry] of activeTurn.workspace.entries.entries()) {
+                for (const [index, entry] of activeRun.workspace.entries.entries()) {
                     const durableEntry = durableRunWorkspace.entries[index];
                     if (durableEntry === undefined) {
                         diff.push(`entry[${index}] ${entry.projectId}: missing from durable`);
@@ -76,10 +76,10 @@ export function classifyWorkspacePreflight(store, task, roleName, activeTurn, in
             }
             return {
                 kind: "workspace-stale",
-                reason: `Role Turn workspace is not the durable owner: ${task.id}/${roleName}.`,
+                reason: `Role AgentRun workspace is not the durable owner: ${task.id}/${roleName}.`,
                 taskId: task.id,
                 roleName,
-                turnId: activeTurn.id,
+                runId: activeRun.id,
                 diff
             };
         }
@@ -89,7 +89,7 @@ export function classifyWorkspacePreflight(store, task, roleName, activeTurn, in
     // from that immutable boundary. A reset/repoint outside the lineage is
     // physical drift and must fail before Provider launch.
     if (inspectPhysical !== undefined) {
-        const effective = activeTurn?.workspace ?? main;
+        const effective = activeRun?.workspace ?? main;
         for (const entry of effective.entries) {
             const physical = inspectPhysical(entry);
             if (!physical.recordedBaseIsAncestor) {
@@ -121,7 +121,7 @@ export function formatWorkspacePreflightError(classification) {
                 + "` to inspect the binding, ManagedWorkspace, and physical HEAD.");
             break;
         case "workspace-stale":
-            lines.push(`  Turn ${classification.turnId} snapshot differs from the durable ManagedWorkspace:`);
+            lines.push(`  AgentRun ${classification.runId} snapshot differs from the durable ManagedWorkspace:`);
             for (const entry of classification.diff) {
                 lines.push(`    - ${entry}`);
             }

package/dist/grant/capabilityGrant.js

@@ -68,8 +68,8 @@ export function grantUseReservations(grant) {
 }
 /**
  * Record one use against the grant, failing closed once the limit is reached.
- * The reservation key is appended to the grant's durable reservations so a
- * later resume recognizes this exact attempt and avoids a double charge.
+ * Supply a reservation key when a later resume must recognize the attempt.
+ * Non-resumable calls only advance the counter; historical keys stay intact.
  */
 export function recordGrantUse(grant, now, reservationKey) {
     validateCapabilityGrant(grant);
@@ -79,7 +79,10 @@ export function recordGrantUse(grant, now, reservationKey) {
     return validateCapabilityGrant({
         ...grant,
         usesUsed: grant.usesUsed + 1,
-        useReservations: Object.freeze([...grantUseReservations(grant), reservationKey]),
+        useReservations: Object.freeze([
+            ...grantUseReservations(grant),
+            ...(reservationKey === undefined ? [] : [reservationKey])
+        ]),
         updatedAt: now.toISOString()
     });
 }

package/dist/input/inputRequest.js

@@ -89,12 +89,11 @@ export function validateInputRequest(value) {
         updatedAt: requireTimestamp(request.updatedAt, "Input request updatedAt")
     };
     validateTaskRecordReference({ taskId: base.taskId, localId: base.id }, "inputRequest");
-    validateTaskRecordReference({
-        taskId: base.requester.taskId,
-        localId: base.requester.turnId
-    }, "turn");
+    if (base.requester.runId !== undefined) {
+        validateTaskRecordReference({ taskId: base.requester.taskId, localId: base.requester.runId }, "run");
+    }
     for (const reference of base.blockedRefs) {
-        validateTaskRecordReference({ taskId: reference.taskId, localId: reference.id }, reference.type === "turn" ? "turn" : "workItem");
+        validateTaskRecordReference({ taskId: reference.taskId, localId: reference.id }, reference.type === "run" ? "run" : "workItem");
     }
     if (base.requester.taskId !== base.taskId
         || base.blockedRefs.some(({ taskId }) => taskId !== base.taskId)) {
@@ -175,7 +174,7 @@ function normalizeBlockedRefs(value) {
     const references = value.map((reference) => {
         const item = record(reference, "Input blocked reference");
         exact(item, ["type", "taskId", "id"], "Input blocked reference");
-        if (item.type !== "work-item" && item.type !== "turn") {
+        if (item.type !== "work-item" && item.type !== "run") {
             throw new Error("Input blocked reference type must be work-item or turn.");
         }
         return {
@@ -223,16 +222,19 @@ function validateBlockedRefs(value) {
 }
 function normalizeRequester(value) {
     const requester = record(value, "Input requester");
-    exact(requester, requester.nativeSessionId === undefined
-        ? ["taskId", "roleName", "agentId", "turnId"]
-        : ["taskId", "roleName", "agentId", "turnId", "nativeSessionId"], "Input requester");
+    exact(requester, ["taskId", "roleName", "agentId",
+        ...(requester.runId === undefined ? [] : ["runId"]),
+        ...(requester.nativeSessionId === undefined ? [] : ["nativeSessionId"])], "Input requester");
     if (requester.roleName !== "leader")
         throw new Error("Input requester must be the Task Leader.");
+    if (requester.runId === undefined && requester.nativeSessionId === undefined) {
+        throw new Error("Input requester requires an originating Run or native Session.");
+    }
     return {
         taskId: requireIdentity(requester.taskId, "Input requester Task id"),
         roleName: "leader",
         agentId: requireIdentity(requester.agentId, "Input requester Agent id"),
-        turnId: requireIdentity(requester.turnId, "Input requester Turn id"),
+        ...(requester.runId === undefined ? {} : { runId: requireIdentity(requester.runId, "Input requester AgentRun id") }),
         ...(requester.nativeSessionId === undefined
             ? {}
             : { nativeSessionId: requireIdentity(requester.nativeSessionId, "Input requester native session id") })

package/dist/integration/gitIntegrationService.js

@@ -549,8 +549,6 @@ export class GitIntegrationService {
     #runtimePreparation(attempt, workspace) {
         return this.runtimeIsolation.preflight({
             workspace,
-            runtimeGenerationId: integrationRuntimeRuntimeGenerationId(this.home, attempt.id),
-            generationId: "integration-checks",
             allowExactActive: true
         });
     }
@@ -1083,7 +1081,7 @@ function isNodeCode(error, code) {
 function defaultIntegrationRuntimeIsolation(home, homeId) {
     const controlHome = resolve(home);
     return new FileTaskRuntimeIsolation({
-        runtimeRoot: integrationRuntimeRoot(),
+        runtimeRoot: integrationRuntimeRoot(controlHome),
         pathLayout: "compact",
         controlPlane: {
             yuiHome: controlHome,
@@ -1093,15 +1091,10 @@ function defaultIntegrationRuntimeIsolation(home, homeId) {
         }
     });
 }
-function integrationRuntimeRoot() {
+function integrationRuntimeRoot(home) {
     const uid = typeof process.getuid === "function" ? process.getuid() : 0;
-    return join("/tmp", `yi-${uid.toString(36)}`);
-}
-function integrationRuntimeRuntimeGenerationId(home, integrationId) {
-    const homeDigest = createHash("sha256")
-        .update(resolve(home))
-        .digest("hex");
-    return `${integrationId}-${homeDigest}`;
+    const homeDigest = createHash("sha256").update(resolve(home)).digest("hex").slice(0, 16);
+    return join("/tmp", `yi-${uid.toString(36)}-${homeDigest}`);
 }
 /**
  * Reuse is enabled only for an immutable installed release. Development

package/dist/integration/integrationQueueService.js

@@ -3,6 +3,7 @@ import { workspaceProjectEntry } from "../worktree/managedWorkspace.js";
 import { createIntegrationAttempt, recordResolutionDecision, updateIntegrationAttempt } from "./integrationAttempt.js";
 import { createConvergedIntegrationQueueEntry, createIntegrationQueueEntry, markIntegrationQueueBlocked, markIntegrationQueueCommitted, markIntegrationQueueRequeued, markIntegrationQueueRunning, markIntegrationQueueSuperseded, recordIntegrationQueueAffectedPaths, recordIntegrationQueueAttempt } from "./integrationQueueEntry.js";
 import { GitIntegrationService } from "./gitIntegrationService.js";
+import { governingWorkItemCandidate } from "../workItem/workItem.js";
 /**
  * Producer WorkItem statuses that close the WorkItem lifecycle.  A ChangeSet
  * captured from a WorkItem that reached one of these without ever producing a
@@ -11,8 +12,7 @@ import { GitIntegrationService } from "./gitIntegrationService.js";
  * Candidate.
  */
 const TERMINAL_PRODUCER_STATUSES = new Set([
-    "completed",
-    "failed",
+    "accepted",
     "retired"
 ]);
 /**
@@ -59,11 +59,11 @@ function assertCurrentCandidateInStore(store, taskId, changeSet) {
         throw new Error(`ChangeSet producer WorkItem not found: ${changeSet.workItemId}.`);
     }
     // A running WorkItem has no current Candidate: a new one is expected.
-    if (workItem.status === "running") {
+    if (workItem.status === "open" && workItem.currentCandidateId === undefined) {
         throw new Error(`ChangeSet ${changeSet.id} has no current Candidate: `
             + `WorkItem ${workItem.id} is running.`);
     }
-    const latestCandidate = workItem.candidates.at(-1);
+    const latestCandidate = governingWorkItemCandidate(workItem);
     if (latestCandidate !== undefined) {
         const snapshotHead = candidateHeadCommit(latestCandidate, changeSet.projectId);
         if (snapshotHead !== undefined && snapshotHead !== changeSet.headCommit) {

package/dist/interaction/operatorPresentation.js

@@ -34,7 +34,7 @@ function eventLabel(event) {
         case "task.completed": return "Task completed";
         case "task.retired": return "Task retired";
         case "leader.attention-required": return "Task Leader needs attention";
-        case "turn.stalled": return "Task Leader stalled";
+        case "run.stalled": return "Task Leader stalled";
         default: return `Task event ${event.type}`;
     }
 }

package/dist/kernel/builtinCapabilities.js

@@ -1,21 +1,119 @@
-import { updateTaskMetadataCommand } from "../commands/taskCommands.js";
+import { updateTaskMetadataCommand, sendTaskMessageCommand } from "../commands/taskCommands.js";
 import { runConfigCommand } from "../commands/configCommands.js";
+import { readTaskContext, readTaskContextDelta, inspectTaskContext, withContextObservations } from "../context/taskContext.js";
 import { CONFIG_DOMAINS } from "../config/configCatalog.js";
 import { createJobCallAuthority, parseDurableJobStartParams } from "../controller/jobControl.js";
 import { inspectJobOperation } from "./kernelPorts.js";
 import { CapabilityRegistry, } from "./capabilityRegistry.js";
+import { createProjectResources } from "../resources/projectResourceService.js";
+import { saveArtifactCapability, readArtifactCapability, listArtifactsCapability } from "../artifacts/artifactCapability.js";
+import { createPluginService } from "../plugins/pluginService.js";
 const text = { type: "string", minLength: 1 };
 const strings = { type: "object", additionalProperties: { type: "string" } };
 const object = (properties, required = Object.keys(properties)) => ({
     type: "object", properties, required, additionalProperties: false
 });
 const taskInput = object({ taskId: text });
+const recordOutput = { type: "object" };
 const taskOutput = { type: "object", required: ["id", "status", "title"], properties: {
         id: text, status: text, title: text
     } };
 const provider = Object.freeze({ id: "yui:builtin-capabilities", generation: "1" });
 /** Source locators identify the existing semantic owner, not a new Store. */
 const definitions = [
+    {
+        name: "message.send", summary: "Save collaboration for Leader or continue the same dispatched work owner.",
+        effect: "local-mutation", requiredPermissions: ["task:read"], source: "sendTaskMessageCommand",
+        inputSchema: object({ taskId: text, body: text,
+            intent: { enum: ["record", "discuss", "develop"] },
+            wakePolicy: { enum: ["leader", "none"] },
+            recipient: object({ roleName: text, workItemId: text, reviewRoundId: text }, ["roleName"])
+        }, ["taskId", "body"]), outputSchema: recordOutput
+    },
+    {
+        name: "context.read", summary: "Read a bounded authorized Task working set and atomic core cursor.",
+        effect: "query", requiredPermissions: ["task:read"], source: "readTaskContext",
+        inputSchema: taskInput, outputSchema: { type: "object", required: ["records", "coreCursor", "omitted"] }
+    },
+    {
+        name: "context.delta", summary: "Read immutable Task events with a fixed pagination upper bound.",
+        effect: "query", requiredPermissions: ["task:read"], source: "readTaskContextDelta",
+        inputSchema: object({ taskId: text, after: text, continuation: text, limit: { type: "integer" } }, ["taskId", "after"]),
+        outputSchema: { type: "object", required: ["events", "throughCursor"] }
+    },
+    {
+        name: "context.inspect", summary: "Expand an authorized current record; optionally require its exact digest.",
+        effect: "query", requiredPermissions: ["task:read"], source: "inspectTaskContext",
+        inputSchema: object({ taskId: text, store: text, refId: text, digest: text }, ["taskId", "store", "refId"]),
+        outputSchema: { type: "object", required: ["ref", "value", "coreCursor"] }
+    },
+    {
+        name: "artifact.save", summary: "Save a file artifact by relativePath into the Task's local Git repository; returns a commit-pinned reference.",
+        effect: "local-mutation", requiredPermissions: ["task:read"], source: "artifacts.saveArtifactCapability",
+        inputSchema: object({ taskId: text, relativePath: text, content: { type: "string" }, message: text, expectedHead: text }, ["taskId", "relativePath", "content"]),
+        outputSchema: { type: "object", required: ["taskId", "commit", "relativePath"] }
+    },
+    {
+        name: "artifact.read", summary: "Read a file artifact at HEAD, or at a pinned commit for frozen evidence, without starting a Runtime or plugin.",
+        effect: "query", requiredPermissions: ["task:read"], source: "artifacts.readArtifactCapability",
+        inputSchema: object({ taskId: text, relativePath: text, commit: text }, ["taskId", "relativePath"]),
+        outputSchema: { type: "object", required: ["taskId", "relativePath", "commit", "content"] }
+    },
+    {
+        name: "artifact.list", summary: "List this Task's tracked file artifacts at HEAD.",
+        effect: "query", requiredPermissions: ["task:read"], source: "artifacts.listArtifactsCapability",
+        inputSchema: taskInput, outputSchema: { type: "array", items: recordOutput }
+    },
+    {
+        name: "environment.prepare", summary: "Prepare empty, Task-owned scratch, or explicitly granted trusted-local directory; does not adopt it or create a sandbox.",
+        effect: "local-mutation", requiredPermissions: ["task:manage"], source: "ProjectResources.prepare",
+        inputSchema: object({ taskId: text, plan: { anyOf: [
+                    object({ kind: { const: "empty" } }), object({ kind: { const: "scratch" } }),
+                    object({ kind: { const: "local" }, resourceId: text, access: { enum: ["read", "write"] } })
+                ] } }), outputSchema: recordOutput
+    },
+    {
+        name: "environment.adopt", summary: "Recheck current resource intent, grants and conflicts, then record Task ownership.",
+        effect: "local-mutation", requiredPermissions: ["task:manage"], source: "ProjectResources.adopt",
+        inputSchema: object({ taskId: text, preparationId: text }), outputSchema: recordOutput
+    },
+    {
+        name: "environment.bind", summary: "Select an adopted environment for a Role's next native Session; null restores managed workspace. Active Sessions keep their environment.",
+        effect: "local-mutation", requiredPermissions: ["task:manage"], source: "ProjectResources.bindEnvironment",
+        inputSchema: object({ taskId: text, roleName: text, preparationId: { anyOf: [text, { const: null }] } }),
+        outputSchema: recordOutput
+    },
+    {
+        name: "environment.release", summary: "Release exact preparation; adopted resources need actual quiescence evidence. Never deletes user directories.",
+        effect: "local-mutation", requiredPermissions: ["task:manage"], source: "ProjectResources.release",
+        inputSchema: object({ taskId: text, preparationId: text, quiescence: text }, ["taskId", "preparationId"]), outputSchema: recordOutput
+    },
+    {
+        name: "environment.list", summary: "Read preparation/adoption facts, not inferred process state.",
+        effect: "query", requiredPermissions: ["task:read"], source: "TaskStore.listEnvironmentPreparations",
+        inputSchema: taskInput, outputSchema: { type: "array", items: recordOutput }
+    },
+    {
+        name: "resource.local.register", summary: "Register a user-owned local directory by canonical identity (Operator); registration does not grant use.",
+        effect: "local-mutation", requiredPermissions: ["resource:register"], source: "ProjectResources.registerLocalDirectory",
+        inputSchema: object({ displayName: text, path: text }), outputSchema: recordOutput
+    },
+    {
+        name: "resource.local.read", summary: "Read an explicitly granted local resource.",
+        effect: "query", requiredPermissions: ["task:read"], source: "ProjectResources.readLocalResource",
+        inputSchema: object({ taskId: text, resourceId: text }), outputSchema: recordOutput
+    },
+    {
+        name: "project.context", summary: "Read Project Knowledge, resource references and default Provider references; no credential grant.",
+        effect: "query", requiredPermissions: ["task:read"], source: "TaskStore.getProject",
+        inputSchema: object({ taskId: text, projectId: text }), outputSchema: recordOutput
+    },
+    {
+        name: "project.resources.configure", summary: "Configure existing Project resource and Provider references (Operator).",
+        effect: "local-mutation", requiredPermissions: ["resource:register"], source: "ProjectResources.configureProject",
+        inputSchema: object({ projectId: text, resourceRefs: { type: "array", items: text }, defaultCapabilityProviders: strings }),
+        outputSchema: recordOutput
+    },
     {
         name: "task.read", summary: "Read the current Task record.", effect: "query",
         inputSchema: taskInput, outputSchema: taskOutput, requiredPermissions: ["task:read"],
@@ -41,6 +139,11 @@ const definitions = [
         inputSchema: object({ domain: { enum: CONFIG_DOMAINS } }),
         outputSchema: { type: "object" }
     },
+    {
+        name: "resource.git.result", summary: "Read an original fixed Git ChangeSet and its external-version reference.",
+        effect: "query", requiredPermissions: ["task:read"], source: "TaskStore.getChangeSet",
+        inputSchema: object({ taskId: text, changeSetId: text }), outputSchema: recordOutput
+    },
     {
         name: "resource.workspaces", summary: "Read the Task's managed workspace resources.",
         effect: "query", requiredPermissions: ["task:read"],
@@ -73,23 +176,58 @@ const definitions = [
         }, ["taskId", "projectId", "head", "workspace", "owner", "env", "steps"]),
         outputSchema: { type: "object", required: ["job", "created", "operation"], properties: { created: { type: "boolean" } } }
     },
-    ...["create", "validate", "activate", "disable"].map((action) => ({
-        name: `plugin.${action}`, summary: "Plugin SDK management is not implemented.",
+    ...[
+        { action: "create", summary: "Create an independent data or trusted-local package in an adopted environment; executes no author code.",
+            inputSchema: object({ preparationId: text, id: text, kind: { enum: ["declarative", "trusted-local"] } }) },
+        { action: "validate", summary: "Validate captured package bytes in an explicit environment; author build/test code needs a separate execution grant.",
+            inputSchema: object({ preparationId: text, directory: text }) },
+        { action: "activate", summary: "Recheck validated bytes, current authority and dependencies; publish one complete Task-local provider.",
+            inputSchema: object({ validationId: text }) },
+        { action: "disable", summary: "Stop new plugin calls and drain the exact Host instance before disposal.",
+            inputSchema: object({ id: text }) }
+    ].map(({ action, summary, inputSchema }) => ({
+        name: `plugin.${action}`, summary, inputSchema,
         effect: "local-mutation", requiredPermissions: ["plugin:manage"],
-        source: "T09 (not implemented)", inputSchema: object({}), outputSchema: object({}),
-        unavailable: "The executable plugin SDK is not implemented. Existing Agent Drivers and Project Skills retain their typed management interfaces."
-    }))
+        source: "PluginService", outputSchema: recordOutput
+    })),
+    {
+        name: "plugin.scan", summary: "Data-only package digest and manifest inspection; never executes author code.",
+        effect: "query", requiredPermissions: ["plugin:manage"], source: "PluginService.scan",
+        inputSchema: object({ preparationId: text, directory: text }), outputSchema: recordOutput
+    },
+    {
+        name: "plugin.validation", summary: "Read immutable validation evidence without starting the plugin.",
+        effect: "query", requiredPermissions: ["task:read"], source: "PluginService.inspect",
+        inputSchema: object({ validationId: text }), outputSchema: recordOutput
+    },
+    {
+        name: "plugin.inspect", summary: "Read durable desired selection, actual Host selection/references and latest intent failure; never activates code.",
+        effect: "query", requiredPermissions: ["task:read"], source: "PluginService.current",
+        inputSchema: object({ id: text }), outputSchema: recordOutput
+    },
+    {
+        name: "plugin.list", summary: "List this Task's explicit plugin choices and current Host observations without executing code.",
+        effect: "query", requiredPermissions: ["task:read"], source: "PluginService.list",
+        inputSchema: object({}), outputSchema: { type: "array", items: recordOutput }
+    }
 ];
 export const BUILTIN_CAPABILITIES = definitions.map((entry) => ({
     ...entry, contractVersion: "1", provider, scope: { kind: "global" }
 }));
-/** Authenticated managed bridge. Socket possession/scope JSON is not a grant.
- * A future user/Web ingress must provide its own verified identity adapter;
- * this one deliberately accepts only the existing managed credentials. */
-export function createBuiltinCapabilities(host, store, jobs, signal = () => undefined) {
+/** One registry with separate managed credentials and in-process Web query
+ * issuance. Socket possession or caller-scope JSON never issues a Web context. */
+export function createBuiltinCapabilities(host, store, jobs, signal = () => undefined, contextProviders = []) {
     const authority = createJobCallAuthority(store);
+    const resources = createProjectResources(store);
     const callers = new WeakMap();
+    // Issued only by the Controller's in-process, token-authenticated Web root.
+    // This is not accepted by the managed RPC credential adapter.
+    const webQueries = new WeakSet();
     const current = (context) => {
+        if (webQueries.has(context)) {
+            requireTask(store, context.targetId);
+            return { scope: "user" };
+        }
         authority.authorize(context, context.targetId);
         const caller = callers.get(context);
         if (!caller)
@@ -104,10 +242,92 @@ export function createBuiltinCapabilities(host, store, jobs, signal = () => unde
                 throw new Error("Capability target is outside the authenticated Task.");
             }
             const taskId = invocation.context.targetId;
+            if (name === "message.send") {
+                // A managed Task Session resolves to Leader/role authority and never
+                // gains develop from an intent argument; only a global Operator Session
+                // (user-authority) may carry one. sendTaskMessageCommand enforces this,
+                // so the capability just forwards the optional intent unchanged.
+                const result = sendTaskMessageCommand(store, taskId, params.body, params.wakePolicy, { environment: callerEnvironment(caller) }, params.recipient, params.intent);
+                signal(taskId);
+                return result.message;
+            }
+            if (name === "plugin.create")
+                return plugins.create(taskId, params.preparationId, params.id, params.kind);
+            if (name === "plugin.scan")
+                return plugins.scan(taskId, params.preparationId, params.directory);
+            if (name === "plugin.validate")
+                return plugins.validate(invocation.context, params.preparationId, params.directory);
+            if (name === "plugin.validation")
+                return plugins.inspect(taskId, params.validationId);
+            if (name === "plugin.inspect")
+                return plugins.current(taskId, params.id);
+            if (name === "plugin.list")
+                return plugins.list(taskId);
+            if (name === "plugin.activate")
+                return plugins.activate(invocation.context, params.validationId);
+            if (name === "plugin.disable")
+                return plugins.disable(taskId, params.id);
+            if (name === "context.read") {
+                const core = readTaskContext(store, taskId, callerEnvironment(caller));
+                return withContextObservations(core, contextProviders);
+            }
+            if (name === "context.delta")
+                return readTaskContextDelta(store, taskId, {
+                    after: params.after, continuation: params.continuation,
+                    limit: params.limit
+                }, callerEnvironment(caller));
+            if (name === "context.inspect")
+                return inspectTaskContext(store, taskId, {
+                    store: params.store, refId: params.refId, digest: params.digest
+                }, callerEnvironment(caller));
+            // File/directory artifacts live in the Task's local Git repository, not
+            // the DB. Save commits exactly one path and returns a self-certifying
+            // commit-pinned reference; read/list are ordinary current reads. These
+            // are the async Git path (the capability layer awaits invoke()).
+            if (name === "artifact.save")
+                return saveArtifactCapability(store.rootDirectory(), taskId, {
+                    relativePath: params.relativePath, content: params.content,
+                    ...(params.message === undefined ? {} : { message: params.message }),
+                    ...(params.expectedHead === undefined ? {} : { expectedHead: params.expectedHead })
+                });
+            if (name === "artifact.read")
+                return readArtifactCapability(store.rootDirectory(), taskId, {
+                    relativePath: params.relativePath,
+                    ...(params.commit === undefined ? {} : { commit: params.commit })
+                });
+            if (name === "artifact.list")
+                return listArtifactsCapability(store.rootDirectory(), taskId);
+            if (name === "environment.prepare")
+                return resources.prepare(taskId, params.plan);
+            if (name === "environment.adopt")
+                return resources.adopt(taskId, params.preparationId);
+            if (name === "environment.bind") {
+                const role = resources.bindEnvironment(taskId, params.roleName, params.preparationId, {
+                    source: name, actorId: invocation.context.actorId, requestId: invocation.requestId
+                });
+                signal(taskId);
+                return role;
+            }
+            if (name === "environment.release") {
+                plugins.assertEnvironmentUnused(taskId, params.preparationId);
+                return resources.release(taskId, params.preparationId, params.quiescence === undefined ? undefined : { quiescence: params.quiescence });
+            }
+            if (name === "environment.list")
+                return store.listEnvironmentPreparations(taskId);
+            if (name === "resource.local.register")
+                return resources.registerLocalDirectory(params.displayName, params.path);
+            if (name === "resource.local.read")
+                return resources.readLocalResource(taskId, params.resourceId);
+            if (name === "project.context")
+                return resources.projectContext(taskId, params.projectId);
+            if (name === "project.resources.configure")
+                return resources.configureProject(params.projectId, params.resourceRefs, params.defaultCapabilityProviders);
             if (name === "task.read")
                 return requireTask(store, taskId);
             if (name === "resource.workspaces")
                 return store.listManagedWorkspaces(taskId);
+            if (name === "resource.git.result")
+                return resources.gitResult(taskId, params.changeSetId);
             if (name === "config.read")
                 return runConfigCommand(params.domain, ["show"], store).data;
             if (name === "task.update") {
@@ -147,24 +367,45 @@ export function createBuiltinCapabilities(host, store, jobs, signal = () => unde
     const registry = new CapabilityRegistry(host, (context, descriptor, input) => {
         const caller = current(context);
         const task = requireTask(store, context.targetId);
+        if (caller.scope === "user" && descriptor !== undefined && descriptor.effect !== "query") {
+            throw new Error("Web panels may only query capabilities.");
+        }
         if (typeof input === "object" && input !== null && "taskId" in input && input.taskId !== task.id) {
             throw new Error("Capability target is outside the authenticated Task.");
         }
         for (const permission of descriptor?.requiredPermissions ?? []) {
+            if (permission === "job:start" && caller.scope === "task") {
+                const sessions = store.getTaskRoleSessionSet(task.id, caller.role);
+                if (sessions?.sessions[sessions.activeAgentId]?.effective.executionAuthority !== "delivery") {
+                    throw new Error("Planning Sessions cannot start delivery Jobs.");
+                }
+            }
             if (permission === "task:read" || permission === "job:start")
                 continue;
             if (permission === "task:manage" && ((caller.scope === "task" && caller.role === "leader")
                 || (caller.scope === "global" && caller.role === "operator")))
                 continue;
-            if ((permission === "config:read" || permission === "plugin:manage")
+            // PluginService binds every management target to this authenticated
+            // Task. This admits package management, not author-code execution:
+            // adopted environments and exact plugin.execute grants remain separate.
+            if (permission === "plugin:manage" && caller.scope === "task" && caller.role === "leader")
+                continue;
+            if ((permission === "config:read" || permission === "plugin:manage" || permission === "resource:register")
                 && caller.scope === "global" && caller.role === "operator")
                 continue;
             throw new Error(`Permission unavailable: ${permission}.`);
         }
         return { taskIds: [task.id], projectIds: task.projectBindings.map((binding) => binding.projectId) };
     }, BUILTIN_CAPABILITIES);
+    const plugins = createPluginService(store, host, registry);
     return {
         registry,
+        authenticateWebQuery(taskId) {
+            requireTask(store, taskId);
+            const context = Object.freeze({ actorId: "local-web-user", targetId: taskId });
+            webQueries.add(context);
+            return context;
+        },
         authenticate(caller, taskId) {
             const credential = Object.freeze({ ...caller });
             const context = authority.authenticate(credential, taskId);
@@ -180,9 +421,11 @@ function requireTask(store, taskId) {
     return task;
 }
 function callerEnvironment(caller) {
+    if (caller.scope === "user")
+        return {};
     return {
         YUI_SESSION_SCOPE: caller.scope, YUI_TASK_ID: caller.taskId,
         YUI_ROLE: caller.role, YUI_AGENT_ID: caller.agentId,
-        YUI_ADAPTER_ID: caller.adapterId, YUI_JOB_CALLER_KEY: caller.callerKey
+        YUI_ADAPTER_ID: caller.adapterId, YUI_NATIVE_SESSION_ID: caller.nativeSessionId
     };
 }