forkit-connect 0.1.0 → 0.1.1

package/dist/v1/service.js

@@ -50,6 +50,7 @@ const SMART_INBOX_CONFIDENCE_PRIORITY = {
     medium: 1,
     low: 2,
 };
+const SMART_INBOX_FRESH_MAX_AGE_MS = 45 * 1000;
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
@@ -568,6 +569,7 @@ function isGovernorRevokedStatus(status, code) {
 class ConnectV1Service {
     stateStore;
     credentialStore;
+    smartInboxBackgroundRefreshInFlight = false;
     constructor(stateDir, options) {
         this.stateStore = new state_1.LocalStateStore(stateDir);
         this.stateStore.ensureInitialized();
@@ -580,6 +582,68 @@ class ConnectV1Service {
     getStateStore() {
         return this.stateStore;
     }
+    cloneInboxSnapshot(inbox) {
+        return JSON.parse(JSON.stringify(inbox));
+    }
+    withInboxFreshness(inbox, freshness, ageMs) {
+        const next = this.cloneInboxSnapshot(inbox);
+        next.summary = {
+            ...next.summary,
+            freshness_state: freshness,
+            snapshot_age_seconds: Math.max(0, Math.floor(ageMs / 1000)),
+        };
+        return next;
+    }
+    persistSmartInboxSnapshot(inbox) {
+        const state = this.stateStore.readState();
+        state.smart_inbox_snapshot = this.cloneInboxSnapshot(inbox);
+        state.smart_inbox_snapshot_updated_at = nowIso();
+        this.stateStore.writeState(state);
+    }
+    getSmartRegistrationInbox(options) {
+        const preferSnapshot = options?.preferSnapshot !== false;
+        const forceRefresh = options?.forceRefresh === true;
+        const maxSnapshotAgeMs = Math.max(1000, options?.maxSnapshotAgeMs ?? SMART_INBOX_FRESH_MAX_AGE_MS);
+        const refreshInBackground = options?.refreshInBackground !== false;
+        const state = this.stateStore.readState();
+        const snapshot = state.smart_inbox_snapshot;
+        const updatedAtMs = state.smart_inbox_snapshot_updated_at ? Date.parse(state.smart_inbox_snapshot_updated_at) : Number.NaN;
+        const ageMs = Number.isFinite(updatedAtMs) ? Math.max(0, Date.now() - updatedAtMs) : Number.MAX_SAFE_INTEGER;
+        if (!forceRefresh && preferSnapshot && snapshot) {
+            if (this.smartInboxBackgroundRefreshInFlight) {
+                return this.withInboxFreshness(snapshot, 'syncing', ageMs);
+            }
+            if (ageMs <= maxSnapshotAgeMs) {
+                return this.withInboxFreshness(snapshot, 'fresh', ageMs);
+            }
+            if (refreshInBackground) {
+                this.refreshSmartRegistrationInboxInBackground();
+            }
+            return this.withInboxFreshness(snapshot, refreshInBackground ? 'syncing' : 'stale', ageMs);
+        }
+        const liveInbox = this.buildSmartRegistrationInbox();
+        this.persistSmartInboxSnapshot(liveInbox);
+        return this.withInboxFreshness(liveInbox, 'fresh', 0);
+    }
+    refreshSmartRegistrationInboxInBackground() {
+        if (this.smartInboxBackgroundRefreshInFlight) {
+            return;
+        }
+        this.smartInboxBackgroundRefreshInFlight = true;
+        void Promise.resolve().then(() => {
+            try {
+                const liveInbox = this.buildSmartRegistrationInbox();
+                this.persistSmartInboxSnapshot(liveInbox);
+            }
+            finally {
+                this.smartInboxBackgroundRefreshInFlight = false;
+            }
+        });
+    }
+    async prewarmSmartRegistrationInbox() {
+        const liveInbox = this.buildSmartRegistrationInbox();
+        this.persistSmartInboxSnapshot(liveInbox);
+    }
     getStoredSessionRef() {
         return this.credentialStore.getSessionRef();
     }
@@ -1547,6 +1611,9 @@ class ConnectV1Service {
             backendBaseUrl: DEFAULT_BASE_URL,
         };
     }
+    getCredentialStoreStatus() {
+        return this.credentialStore.getStatus();
+    }
     getConfig() {
         return this.stateStore.readState().connect_config;
     }
@@ -1691,6 +1758,16 @@ class ConnectV1Service {
                 // Preserve the current item failure and let the next pass reconcile binding state again.
             }
         }
+        if (input.source === 'runtimeSignal' && input.passportGaid && isCredentialInvalidStatus(input.status, code)) {
+            this.clearRuntimeSignalApiKeyForGaid(input.passportGaid, 'recovery');
+            try {
+                await this.autoProvisionRuntimeSignalKeys({ suppressErrors: true });
+            }
+            catch {
+                // Keep the failure visible in local state. A later cycle or manual key
+                // configuration can recover if provisioning is still blocked.
+            }
+        }
         const observedSession = this.observeBackendCommunicationState(input);
         return {
             observedSession,
@@ -1946,10 +2023,18 @@ class ConnectV1Service {
         if (!sessionRef) {
             return this.getC2SessionSummary();
         }
+        const workspaceId = String(state.workspace_binding.workspaceId || '').trim();
+        const projectId = String(state.project_binding.projectId || '').trim();
+        const scope = workspaceId || projectId
+            ? {
+                ...(workspaceId ? { workspaceId } : {}),
+                ...(projectId ? { projectId } : {}),
+            }
+            : undefined;
         const boundGaids = [...new Set(state.model_bindings.filter((binding) => binding.status !== 'ignored' && typeof binding.gaid === 'string' && binding.gaid?.trim()).map((binding) => binding.gaid))];
         for (const passportGaid of boundGaids) {
             try {
-                const result = await this.getApiClient(state).getDeployments(passportGaid);
+                const result = await this.getApiClient(state).getDeployments(passportGaid, scope);
                 if (!result.ok) {
                     this.observeBackendCommunicationState({
                         passportGaid,
@@ -2104,6 +2189,41 @@ class ConnectV1Service {
         }
         return null;
     }
+    hasExactBoundPassportForModel(state, model) {
+        const modelName = String(model.model || '').trim().toLowerCase();
+        const digest = String(model.digest || '').trim();
+        if (!modelName || !digest) {
+            return false;
+        }
+        return state.model_bindings.some((binding) => {
+            if (binding.status !== 'bound') {
+                return false;
+            }
+            const boundGaid = String(binding.gaid || '').trim();
+            if (!boundGaid) {
+                return false;
+            }
+            const bindingModelName = modelNameFromKey(binding.modelKey).trim().toLowerCase();
+            const bindingDigest = String(modelDigestFromKey(binding.modelKey) || '').trim();
+            return bindingModelName === modelName && bindingDigest === digest;
+        });
+    }
+    runtimeHasExactBoundModelDuplicate(state, runtimePassport) {
+        for (const model of state.detected_models) {
+            if (this.getModelReviewDisposition(model) !== 'active') {
+                continue;
+            }
+            const detectedRuntime = this.findDetectedRuntimeForModel(state, model);
+            const candidateRuntimePassport = detectedRuntime ? this.findRuntimePassportForRuntime(state, detectedRuntime) : null;
+            if (!candidateRuntimePassport || candidateRuntimePassport.runtime_gaid !== runtimePassport.runtime_gaid) {
+                continue;
+            }
+            if (this.hasExactBoundPassportForModel(state, model)) {
+                return true;
+            }
+        }
+        return false;
+    }
     clearModelReviewDeferral(model) {
         if (model.review_state !== 'deferred' && !model.review_deferred_until) {
             return;
@@ -2544,6 +2664,87 @@ class ConnectV1Service {
             return undefined;
         return state.model_bindings.find((binding) => binding.gaid === gaid);
     }
+    findTrainingAnchorBinding(state, input) {
+        const normalizedModelName = input.modelName.trim().toLowerCase();
+        if (!normalizedModelName)
+            return undefined;
+        const normalizedWorkspaceId = String(input.workspaceId || '').trim() || null;
+        const normalizedProjectId = String(input.projectId || '').trim() || null;
+        const candidates = state.model_bindings.filter((binding) => {
+            if (!binding.gaid || binding.status === 'ignored')
+                return false;
+            return modelNameFromKey(binding.modelKey).trim().toLowerCase() === normalizedModelName;
+        });
+        if (candidates.length === 0)
+            return undefined;
+        return [...candidates].sort((left, right) => {
+            const leftProjectMatch = normalizedProjectId && String(left.projectId || '').trim() === normalizedProjectId;
+            const rightProjectMatch = normalizedProjectId && String(right.projectId || '').trim() === normalizedProjectId;
+            if (leftProjectMatch !== rightProjectMatch)
+                return leftProjectMatch ? -1 : 1;
+            const leftWorkspaceMatch = normalizedWorkspaceId && String(left.workspaceId || '').trim() === normalizedWorkspaceId;
+            const rightWorkspaceMatch = normalizedWorkspaceId && String(right.workspaceId || '').trim() === normalizedWorkspaceId;
+            if (leftWorkspaceMatch !== rightWorkspaceMatch)
+                return leftWorkspaceMatch ? -1 : 1;
+            const leftBound = left.status === 'bound';
+            const rightBound = right.status === 'bound';
+            if (leftBound !== rightBound)
+                return leftBound ? -1 : 1;
+            return String(right.updatedAt || '').localeCompare(String(left.updatedAt || ''));
+        })[0];
+    }
+    anchorBuildSessionToBinding(state, session) {
+        if (session.passport_gaid)
+            return session;
+        const binding = this.findTrainingAnchorBinding(state, {
+            modelName: session.model_name,
+            workspaceId: session.workspaceId,
+            projectId: session.projectId,
+        });
+        if (!binding?.gaid)
+            return session;
+        return {
+            ...session,
+            passport_gaid: binding.gaid,
+            workspaceId: session.workspaceId || binding.workspaceId || null,
+            projectId: session.projectId || binding.projectId || null,
+        };
+    }
+    resolveRuntimeRunScope(state, passportGaid) {
+        const trimScope = (value) => String(value || '').trim() || null;
+        const binding = this.findBindingByGaid(state, passportGaid);
+        if (binding) {
+            const primaryBound = this.getPrimaryBoundBinding(state);
+            return {
+                workspaceId: trimScope(binding.workspaceId) ?? (primaryBound?.gaid === binding.gaid ? trimScope(state.workspace_binding.workspaceId) : null),
+                projectId: trimScope(binding.projectId) ?? (primaryBound?.gaid === binding.gaid ? trimScope(state.project_binding.projectId) : null),
+            };
+        }
+        const latestSession = [...state.c2_sessions]
+            .filter((session) => session.passport_gaid === passportGaid)
+            .sort((left, right) => String(right.last_seen_at || right.last_control_seen_at || '').localeCompare(String(left.last_seen_at || left.last_control_seen_at || '')))
+            .at(0);
+        if (latestSession) {
+            return {
+                workspaceId: trimScope(latestSession.workspaceId),
+                projectId: trimScope(latestSession.projectId),
+            };
+        }
+        const runtimeGaid = state.agent_links.find((link) => link.passport_gaid === passportGaid)?.runtime_gaid ?? null;
+        if (runtimeGaid) {
+            const runtimePassport = state.runtime_passports.find((runtime) => runtime.runtime_gaid === runtimeGaid);
+            if (runtimePassport) {
+                return {
+                    workspaceId: trimScope(runtimePassport.workspaceId),
+                    projectId: trimScope(runtimePassport.projectId),
+                };
+            }
+        }
+        return {
+            workspaceId: null,
+            projectId: null,
+        };
+    }
     getPrimaryBoundBinding(state) {
         return state.model_bindings.find((binding) => binding.status === 'bound' && typeof binding.gaid === 'string' && binding.gaid.trim());
     }
@@ -2562,6 +2763,28 @@ class ConnectV1Service {
             updatedAt: nowIso(),
         });
     }
+    clearRuntimeSignalApiKeyForGaid(gaid, source = 'reset') {
+        if (!gaid)
+            return;
+        const state = this.stateStore.readState();
+        const binding = this.findBindingByGaid(state, gaid);
+        this.credentialStore.clearRuntimeSignalApiKey(gaid);
+        if (!binding)
+            return;
+        this.stateStore.upsertModelBinding({
+            ...binding,
+            runtimeSignalKeyPresent: false,
+            runtimeSignalKeyRef: null,
+            updatedAt: nowIso(),
+        });
+        this.stateStore.addEvidenceEvent({
+            type: 'credential_invalid_observed',
+            details: {
+                source,
+                gaid,
+            },
+        });
+    }
     resolveRuntimeSignalApiKeyForEvent(state, passportGaid) {
         const binding = this.findBindingByGaid(state, passportGaid);
         return String(this.credentialStore.getRuntimeSignalApiKey(passportGaid)
@@ -2834,6 +3057,65 @@ class ConnectV1Service {
             boundGaid: boundBinding?.gaid ?? null,
         };
     }
+    async emitRuntimeRunLog(input) {
+        const state = this.stateStore.readState();
+        const gaid = String(input.gaid || '').trim();
+        const apiKey = String(input.apiKey || this.resolveRuntimeSignalApiKeyForEvent(state, gaid) || '').trim();
+        if (!gaid || !apiKey) {
+            return {
+                ok: false,
+                status: 0,
+                body: {
+                    error: 'Runtime signal API key required. Run `forkit-connect c2 set-key --heartbeat-gaid <gaid> --heartbeat-key <key>` or pass --api-key from a secure environment.',
+                    code: 'MISSING_RUNTIME_SIGNAL_API_KEY',
+                },
+                contract: null,
+            };
+        }
+        const startedAt = input.startedAt || nowIso();
+        const endedAt = input.endedAt || (input.status && input.status !== 'running' ? startedAt : undefined);
+        const runId = String(input.runId || `forkit-connect-${(0, node_crypto_1.randomUUID)()}`).trim();
+        const promptTokens = Math.max(0, Math.trunc(input.promptTokens ?? 0));
+        const completionTokens = Math.max(0, Math.trunc(input.completionTokens ?? 0));
+        const totalTokens = promptTokens + completionTokens;
+        const { workspaceId, projectId } = this.resolveRuntimeRunScope(state, gaid);
+        return this.getApiClient(state).pushRuntimeRunLog({
+            gaid,
+            apiKey,
+            schemaVersion: 'runtime.run.v1',
+            run: {
+                runId,
+                passportGaid: gaid,
+                provider: String(input.provider || 'custom').trim() || 'custom',
+                model: String(input.model || 'unknown').trim() || 'unknown',
+                serviceName: String(input.serviceName || 'Forkit Connect CLI').trim() || 'Forkit Connect CLI',
+                serviceKind: String(input.serviceKind || 'custom').trim() || 'custom',
+                ...(input.externalRunId ? { externalRunId: String(input.externalRunId).trim() } : {}),
+                workspaceId,
+                projectId,
+                status: String(input.status || 'completed').trim() || 'completed',
+                startedAt,
+                ...(endedAt ? { endedAt } : {}),
+                usage: {
+                    promptTokens,
+                    completionTokens,
+                    ...(input.cachedPromptTokens !== undefined ? { cachedPromptTokens: Math.max(0, Math.trunc(input.cachedPromptTokens)) } : {}),
+                    ...(input.reasoningTokens !== undefined ? { reasoningTokens: Math.max(0, Math.trunc(input.reasoningTokens)) } : {}),
+                    totalTokens,
+                    ...(input.latencyMs !== undefined ? { latencyMs: Math.max(0, Math.trunc(input.latencyMs)) } : {}),
+                    ...(input.estimatedCostCents !== undefined ? { estimatedCostCents: Math.max(0, Number(input.estimatedCostCents)) } : {}),
+                    currency: String(input.currency || 'USD').trim().toUpperCase().slice(0, 3) || 'USD',
+                },
+                ...(input.summary ? { summary: String(input.summary).trim().slice(0, 4000) } : {}),
+                metadata: {
+                    source: 'forkit-connect-cli',
+                    safe_metadata_only: true,
+                    connect_device_id: state.connect_identity.connect_device_id,
+                },
+            },
+            steps: [],
+        });
+    }
     findAgentByIdOrName(state, selector) {
         const normalized = selector.trim().toLowerCase();
         const exactId = state.detected_agents.find((agent) => agent.agent_id === selector || agent.agent_id.startsWith(selector));
@@ -4083,10 +4365,12 @@ class ConnectV1Service {
                 continue;
             }
             const connectableModel = this.findConnectableModelForRuntime(finalState, runtimePassport);
-            const runtimeIsOnlyDuplicatingModelRegistration = Boolean(connectableModel
+            const runtimeHasExactDuplicateBoundModel = this.runtimeHasExactBoundModelDuplicate(finalState, runtimePassport);
+            const runtimeIsOnlyDuplicatingModelRegistration = Boolean(!connectableModel
                 && runtimePassport.status !== 'unavailable'
                 && runtimePassport.linked_model_gaids.length === 0
-                && runtimePassport.linked_agent_ids.length === 0);
+                && runtimePassport.linked_agent_ids.length === 0
+                && runtimeHasExactDuplicateBoundModel);
             if (runtimeIsOnlyDuplicatingModelRegistration) {
                 continue;
             }
@@ -4240,13 +4524,16 @@ class ConnectV1Service {
             website_is_governance_authority: true,
         };
     }
-    getConnectStatusOverview() {
+    getConnectStatusOverview(options) {
         const state = this.stateStore.readState();
-        const inbox = this.buildSmartRegistrationInbox();
+        const includeInbox = options?.includeInbox !== false;
+        const inbox = includeInbox ? this.buildSmartRegistrationInbox() : null;
         const sessionSummary = this.getC2SessionSummary();
         const binding = this.getEffectiveBindingState(state);
         const bindingReconnectRequired = this.bindingRequiresReconnect(state);
         const eventSummary = this.getC2EventSyncSummary(state);
+        const discoveredModels = state.detected_models.filter((item) => item.status !== 'ignored').length;
+        const connectedCount = state.model_bindings.filter((bindingItem) => bindingItem.status === 'bound').length;
         return {
             device_paired: state.connect_identity.connect_identity_status === 'paired',
             workspace_id: state.workspace_binding.workspaceId,
@@ -4254,18 +4541,18 @@ class ConnectV1Service {
             binding_state: binding?.binding.state ?? null,
             lifecycle_note: this.getBindingLifecycleNotice(state),
             daemon_status: this.getDaemonStatus().daemon_running ? 'running' : 'stopped',
-            models_discovered: state.detected_models.filter((item) => item.status !== 'ignored').length,
+            models_discovered: discoveredModels,
             agents_discovered: state.detected_agents.length,
             runtimes_discovered: state.runtime_passports.length,
             paused_session_count: sessionSummary.paused_session_count,
             revoked_session_count: sessionSummary.revoked_session_count,
             credential_reconnect_needed: bindingReconnectRequired || sessionSummary.credential_reconnect_needed,
-            ready_to_connect_count: inbox.summary.ready_to_connect_count,
-            needs_confirmation_count: inbox.summary.needs_confirmation_count,
-            connected_count: inbox.summary.connected_count,
+            ready_to_connect_count: inbox?.summary.ready_to_connect_count ?? discoveredModels,
+            needs_confirmation_count: inbox?.summary.needs_confirmation_count ?? 0,
+            connected_count: inbox?.summary.connected_count ?? connectedCount,
             c2_sync_pending: eventSummary.pendingSyncable,
             privacy_mode: 'metadata only',
-            next_recommended_action: inbox.summary.next_recommended_action,
+            next_recommended_action: inbox?.summary.next_recommended_action ?? null,
         };
     }
     resolveRecommendedNextAction(state) {
@@ -4529,6 +4816,11 @@ class ConnectV1Service {
         const inbox = this.buildSmartRegistrationInbox();
         const state = this.stateStore.readState();
         const candidates = [];
+        const inboxActionableCounts = {
+            inbox_ready_to_connect_count: inbox.summary.ready_to_connect_count,
+            inbox_needs_confirmation_count: inbox.summary.needs_confirmation_count,
+            inbox_actionable_count: inbox.summary.ready_to_connect_count + inbox.summary.needs_confirmation_count,
+        };
         const pulseSummary = state.last_pulse_summary;
         const sessionSummary = this.getC2SessionSummary();
         const pendingDraftEvent = [...state.evidence_events]
@@ -4583,6 +4875,7 @@ class ConnectV1Service {
                 suggested_action: 'connect_model',
                 severity: scopeMismatchDetected ? 'red' : 'amber',
                 metadata: {
+                    ...inboxActionableCounts,
                     item_id: entry.item_id,
                     model_name: entry.display_name,
                     runtime_gaid: entry.runtime_gaid,
@@ -4641,6 +4934,7 @@ class ConnectV1Service {
                 suggested_action: 'review_agent',
                 severity: scopeMismatchDetected ? 'red' : 'amber',
                 metadata: {
+                    ...inboxActionableCounts,
                     item_id: entry.item_id,
                     agent_id: entry.agent_id,
                     display_name: entry.display_name,
@@ -4675,6 +4969,7 @@ class ConnectV1Service {
                 suggested_action: 'open_inbox',
                 severity: 'green',
                 metadata: {
+                    ...inboxActionableCounts,
                     item_id: entry.item_id,
                     matched_passport_gaid: entry.matched_passport_gaid,
                     match_reason: entry.match_reason,
@@ -4705,6 +5000,7 @@ class ConnectV1Service {
                 suggested_action: 'open_inbox',
                 severity: 'amber',
                 metadata: {
+                    ...inboxActionableCounts,
                     item_id: entry.item_id,
                     display_name: entry.display_name,
                     relationship_summary: 'Existing Passport metadata changed',
@@ -4810,6 +5106,7 @@ class ConnectV1Service {
                 suggested_action: 'open_inbox',
                 severity: 'amber',
                 metadata: {
+                    ...inboxActionableCounts,
                     process_name: finding.process_name,
                     reason: finding.reason,
                     relationship_summary: 'System-detected runtime candidate',
@@ -4837,9 +5134,14 @@ class ConnectV1Service {
                 suggested_action: 'view_pulse_history',
                 severity: 'red',
                 metadata: {
+                    runtime_gaid: entry.runtime_gaid ?? null,
                     runtime_name: entry.runtime_name,
                     model_name: entry.model_name,
                     pulse_status: entry.pulse_status,
+                    bound_passport_gaid: entry.bound_passport_gaid ?? null,
+                    binding_status: entry.binding_status ?? null,
+                    registration_state: entry.registration_state ?? null,
+                    connection_classification: entry.connection_classification ?? null,
                     relationship_summary: 'Existing runtime availability changed',
                     source_summary: sourceSummary,
                     scope_summary: null,
@@ -4900,8 +5202,203 @@ class ConnectV1Service {
         }
         return candidates;
     }
+    getNotificationMetadataNumber(candidate, key) {
+        const value = candidate.metadata[key];
+        return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+    }
+    getMaxNotificationMetadataNumber(candidates, key) {
+        return candidates.reduce((max, candidate) => Math.max(max, this.getNotificationMetadataNumber(candidate, key)), 0);
+    }
+    pluralizeNotificationNoun(count, singular, plural = `${singular}s`) {
+        return `${count} ${count === 1 ? singular : plural}`;
+    }
+    buildConnectInboxReviewNotification(candidates) {
+        const reviewCandidates = candidates.filter((candidate) => (candidate.type === 'model_detected'
+            || candidate.type === 'agent_detected'
+            || candidate.type === 'passport_match_suggested'
+            || candidate.type === 'version_candidate_ready'
+            || candidate.type === 'shadow_candidate'));
+        if (reviewCandidates.length === 0)
+            return null;
+        const modelCount = reviewCandidates.filter((candidate) => candidate.type === 'model_detected').length;
+        const agentCount = reviewCandidates.filter((candidate) => candidate.type === 'agent_detected').length;
+        const runtimeCount = reviewCandidates.filter((candidate) => candidate.type === 'shadow_candidate').length;
+        const confirmationCount = reviewCandidates.filter((candidate) => (candidate.type === 'passport_match_suggested'
+            || candidate.type === 'version_candidate_ready')).length;
+        const totalReadyCount = this.getMaxNotificationMetadataNumber(reviewCandidates, 'inbox_ready_to_connect_count');
+        const totalConfirmationCount = this.getMaxNotificationMetadataNumber(reviewCandidates, 'inbox_needs_confirmation_count');
+        const totalActionableCount = this.getMaxNotificationMetadataNumber(reviewCandidates, 'inbox_actionable_count');
+        const hasHiddenInboxItems = totalActionableCount > reviewCandidates.length;
+        const redCount = reviewCandidates.filter((candidate) => candidate.severity === 'red').length;
+        const parts = [
+            modelCount > 0 ? this.pluralizeNotificationNoun(modelCount, 'model') : null,
+            agentCount > 0 ? this.pluralizeNotificationNoun(agentCount, 'agent') : null,
+            runtimeCount > 0 ? this.pluralizeNotificationNoun(runtimeCount, 'runtime') : null,
+            confirmationCount > 0 ? this.pluralizeNotificationNoun(confirmationCount, 'confirmation') : null,
+        ].filter((item) => Boolean(item));
+        const previewSummary = parts.length > 0 ? parts.join(', ') : this.pluralizeNotificationNoun(reviewCandidates.length, 'item');
+        const inboxSummary = [
+            totalReadyCount > 0 ? `${this.pluralizeNotificationNoun(totalReadyCount, 'item')} ready to connect` : null,
+            totalConfirmationCount > 0 ? `${this.pluralizeNotificationNoun(totalConfirmationCount, 'item')} needing confirmation` : null,
+        ].filter((item) => Boolean(item)).join(', ');
+        const itemSummary = hasHiddenInboxItems && inboxSummary
+            ? inboxSummary
+            : previewSummary;
+        const reviewSentence = hasHiddenInboxItems && inboxSummary
+            ? `${this.pluralizeNotificationNoun(totalActionableCount, 'inbox item')} ${totalActionableCount === 1 ? 'needs' : 'need'} approval or confirmation before registration: ${itemSummary}`
+            : `${itemSummary} ${reviewCandidates.length === 1 ? 'needs' : 'need'} approval or confirmation before registration`;
+        return {
+            id: 'connect-inbox-review',
+            type: modelCount > 0 ? 'model_detected' : agentCount > 0 ? 'agent_detected' : 'shadow_candidate',
+            title: 'Forkit Connect needs your review',
+            message: joinNotificationSentences([
+                reviewSentence,
+                'Nothing has been registered automatically',
+            ]),
+            suggested_action: 'open_inbox',
+            severity: redCount > 0 ? 'red' : 'amber',
+            metadata: {
+                notification_group: 'connect_inbox_review',
+                grouped_count: reviewCandidates.length,
+                model_count: modelCount,
+                agent_count: agentCount,
+                runtime_count: runtimeCount,
+                confirmation_count: confirmationCount,
+                inbox_ready_to_connect_count: totalReadyCount,
+                inbox_needs_confirmation_count: totalConfirmationCount,
+                inbox_actionable_count: totalActionableCount,
+                red_count: redCount,
+                relationship_summary: 'Connect inbox items need operator review',
+                source_summary: 'Source: Forkit Connect local discovery',
+                scope_summary: null,
+            },
+        };
+    }
+    buildRuntimeAttentionNotification(candidates) {
+        const runtimeCandidates = candidates.filter((candidate) => (candidate.type === 'runtime_unavailable'
+            && candidate.severity === 'red'
+            && (normalizeDisplayText(candidate.metadata.bound_passport_gaid) !== null
+                || candidate.metadata.binding_status === 'bound'
+                || candidate.metadata.registration_state === 'registered'
+                || candidate.metadata.connection_classification === 'registered_runtime')));
+        if (runtimeCandidates.length === 0)
+            return null;
+        const modelCount = runtimeCandidates
+            .filter((candidate) => normalizeDisplayText(candidate.metadata.model_name))
+            .length;
+        return {
+            id: 'runtime-attention',
+            type: 'runtime_unavailable',
+            title: 'Forkit Connect needs runtime attention',
+            message: joinNotificationSentences([
+                `${this.pluralizeNotificationNoun(runtimeCandidates.length, 'runtime')} reported an unavailable state`,
+                modelCount > 0 ? `${this.pluralizeNotificationNoun(modelCount, 'model')} may be affected` : null,
+            ]),
+            suggested_action: 'view_pulse_history',
+            severity: 'red',
+            metadata: {
+                notification_group: 'runtime_attention',
+                grouped_count: runtimeCandidates.length,
+                affected_model_count: modelCount,
+                relationship_summary: 'Existing runtime availability changed',
+                source_summary: 'Source: Connect runtime pulse',
+                scope_summary: null,
+            },
+        };
+    }
+    buildGovernanceControlNotification(candidates) {
+        const controlCandidates = candidates.filter((candidate) => (candidate.type === 'session_revoked'
+            || candidate.type === 'session_paused'));
+        if (controlCandidates.length === 0)
+            return null;
+        const revokedCount = controlCandidates.filter((candidate) => candidate.type === 'session_revoked').length;
+        const pausedCount = controlCandidates.filter((candidate) => candidate.type === 'session_paused').length;
+        const severity = revokedCount > 0 ? 'red' : 'amber';
+        return {
+            id: 'governance-control',
+            type: revokedCount > 0 ? 'session_revoked' : 'session_paused',
+            title: revokedCount > 0 ? 'Forkit governance revoked access' : 'Forkit governance paused communication',
+            message: joinNotificationSentences([
+                revokedCount > 0 ? `${this.pluralizeNotificationNoun(revokedCount, 'session')} revoked` : null,
+                pausedCount > 0 ? `${this.pluralizeNotificationNoun(pausedCount, 'session')} paused` : null,
+                'Review the Connect inbox before continuing governed communication',
+            ]),
+            suggested_action: 'open_inbox',
+            severity,
+            metadata: {
+                notification_group: 'governance_control',
+                grouped_count: controlCandidates.length,
+                revoked_count: revokedCount,
+                paused_count: pausedCount,
+                relationship_summary: 'Existing governed sessions need operator attention',
+                source_summary: 'Source: Forkit governance control',
+                scope_summary: null,
+            },
+        };
+    }
+    buildSyncAttentionNotification(candidates) {
+        const syncCandidate = candidates.find((candidate) => (candidate.type === 'c2_sync_pending'
+            && candidate.severity !== 'grey'));
+        if (!syncCandidate)
+            return null;
+        const pendingEvents = this.getNotificationMetadataNumber(syncCandidate, 'pending_events');
+        return {
+            ...syncCandidate,
+            id: 'c2-sync-attention',
+            title: 'Forkit Connect sync needs attention',
+            message: joinNotificationSentences([
+                pendingEvents > 0
+                    ? `${this.pluralizeNotificationNoun(pendingEvents, 'metadata update')} could not sync cleanly`
+                    : 'A governed metadata sync needs attention',
+                'Open Connect to review the local queue',
+            ]),
+            metadata: {
+                ...syncCandidate.metadata,
+                notification_group: 'c2_sync_attention',
+                relationship_summary: 'Existing local metadata queue needs sync attention',
+            },
+        };
+    }
+    getNotificationDeliveryCandidates(candidates) {
+        const reconnectCandidate = candidates.find((candidate) => candidate.type === 'credential_reconnect_needed');
+        if (reconnectCandidate) {
+            return [{
+                    ...reconnectCandidate,
+                    id: 'account-reconnect',
+                    title: 'Forkit Connect needs account approval',
+                    message: joinNotificationSentences([
+                        'Reconnect this device before governed metadata sync can continue',
+                        String(reconnectCandidate.metadata.source_summary || ''),
+                    ]),
+                    metadata: {
+                        ...reconnectCandidate.metadata,
+                        notification_group: 'account_reconnect',
+                    },
+                }];
+        }
+        const grouped = [];
+        const governanceNotification = this.buildGovernanceControlNotification(candidates);
+        if (governanceNotification)
+            grouped.push(governanceNotification);
+        const runtimeNotification = this.buildRuntimeAttentionNotification(candidates);
+        if (runtimeNotification)
+            grouped.push(runtimeNotification);
+        const inboxReviewNotification = this.buildConnectInboxReviewNotification(candidates);
+        if (inboxReviewNotification)
+            grouped.push(inboxReviewNotification);
+        const syncNotification = this.buildSyncAttentionNotification(candidates);
+        if (syncNotification)
+            grouped.push(syncNotification);
+        return grouped.slice(0, 3);
+    }
+    getNotificationDeliveryPreview(candidates = this.getNotificationCandidates()) {
+        return this.getNotificationDeliveryCandidates(candidates);
+    }
     getNotificationTargetId(candidate) {
         const metadata = candidate.metadata;
+        if (metadata.notification_group) {
+            return String(metadata.notification_group);
+        }
         switch (candidate.type) {
             case 'model_detected':
                 return String(metadata.discovery_hash || candidate.id);
@@ -4955,10 +5452,13 @@ class ConnectV1Service {
         const deliveredAt = options?.deliveredAt ?? nowIso();
         let state = this.stateStore.readState();
         const candidates = options?.candidates ?? this.getNotificationCandidates();
+        const deliveryCandidates = options?.force && options?.candidates
+            ? candidates
+            : this.getNotificationDeliveryCandidates(candidates);
         if (!state.connect_config.notifications_enabled && !options?.force) {
             return {
                 delivered: 0,
-                suppressed: candidates.length,
+                suppressed: deliveryCandidates.length,
                 fallback: false,
                 disabled: true,
                 notifications: [],
@@ -4969,7 +5469,7 @@ class ConnectV1Service {
         let delivered = 0;
         let suppressed = 0;
         let fallback = false;
-        for (const candidate of candidates) {
+        for (const candidate of deliveryCandidates) {
             if (!options?.force && this.wasNotificationRecentlyDelivered(state, candidate, deliveredAt)) {
                 suppressed += 1;
                 continue;
@@ -5784,29 +6284,30 @@ class ConnectV1Service {
         };
     }
     buildBuildSessionSummary(state, session) {
+        const anchoredSession = this.anchorBuildSessionToBinding(state, session);
         const queuedDraft = state.sync_queue.some((item) => item.type === 'passport-draft'
-            && String(item.payload?.metadata?.build_session_id || '') === session.build_session_id);
-        const draftStatus = session.passport_gaid
+            && String(item.payload?.metadata?.build_session_id || '') === anchoredSession.build_session_id);
+        const draftStatus = anchoredSession.passport_gaid
             ? 'bound'
-            : session.draft_id
+            : anchoredSession.draft_id
                 ? 'draft_created'
                 : queuedDraft
                     ? 'draft_queued'
                     : 'local_only';
-        const latestLifecycleEvent = session.lifecycle_events.at(-1)?.event_type ?? null;
-        const c2Status = this.countC2ForBuildSession(state, session.build_session_id);
+        const latestLifecycleEvent = anchoredSession.lifecycle_events.at(-1)?.event_type ?? null;
+        const c2Status = this.countC2ForBuildSession(state, anchoredSession.build_session_id);
         return {
-            build_session_id: session.build_session_id,
-            model_name: session.model_name,
-            framework: session.framework,
-            task: session.task,
-            build_status: session.status,
+            build_session_id: anchoredSession.build_session_id,
+            model_name: anchoredSession.model_name,
+            framework: anchoredSession.framework,
+            task: anchoredSession.task,
+            build_status: anchoredSession.status,
             draft_status: draftStatus,
-            draft_id: session.draft_id,
-            passport_gaid: session.passport_gaid,
-            dataset_refs_count: session.dataset_refs.length,
-            versions_count: session.versions.length,
-            metrics_count: session.metrics.length,
+            draft_id: anchoredSession.draft_id,
+            passport_gaid: anchoredSession.passport_gaid,
+            dataset_refs_count: anchoredSession.dataset_refs.length,
+            versions_count: anchoredSession.versions.length,
+            metrics_count: anchoredSession.metrics.length,
             latest_lifecycle_event: latestLifecycleEvent,
             c2_sync_status: c2Status.pending > 0 || c2Status.synced > 0 || c2Status.lastError
                 ? {
@@ -5815,14 +6316,16 @@ class ConnectV1Service {
                     last_error: c2Status.lastError,
                 }
                 : null,
-            updated_at: session.updated_at,
+            updated_at: anchoredSession.updated_at,
         };
     }
     saveBuildSession(session) {
-        this.stateStore.upsertBuildSession({
+        const state = this.stateStore.readState();
+        const anchored = this.anchorBuildSessionToBinding(state, {
             ...session,
             updated_at: session.updated_at || nowIso(),
         });
+        this.stateStore.upsertBuildSession(anchored);
         return this.requireBuildSession(this.stateStore.readState(), session.build_session_id);
     }
     shouldFallbackToQueuedTrainingDraft(status) {
@@ -5862,7 +6365,7 @@ class ConnectV1Service {
             ],
             artifact_refs: [],
         };
-        this.saveBuildSession(session);
+        session = this.saveBuildSession(session);
         this.stateStore.addEvidenceEvent({
             type: 'training_session_initialized',
             details: {
@@ -5875,19 +6378,30 @@ class ConnectV1Service {
         this.queueTrainingC2Event(session, 'connect_training_initialized', {
             dataset_refs_count: datasetRefs.length,
         }, now);
-        this.recordC2LifecycleEvent({
-            eventType: 'connect_passport_draft_requested',
-            modelName: session.model_name,
-            passportGaid: null,
-            workspaceId: session.workspaceId,
-            projectId: session.projectId,
-            metadata: {
-                build_session_id: session.build_session_id,
-                source_mode: 'connect_training',
-                connection_status: 'building',
-            },
-        });
+        if (!session.passport_gaid) {
+            this.recordC2LifecycleEvent({
+                eventType: 'connect_passport_draft_requested',
+                modelName: session.model_name,
+                passportGaid: null,
+                workspaceId: session.workspaceId,
+                projectId: session.projectId,
+                metadata: {
+                    build_session_id: session.build_session_id,
+                    source_mode: 'connect_training',
+                    connection_status: 'building',
+                },
+            });
+        }
         const payload = this.buildTrainingDraftPayload(session);
+        if (session.passport_gaid) {
+            return {
+                buildSession: session,
+                draftAction: 'bound',
+                draftId: null,
+                gaid: session.passport_gaid,
+                payload,
+            };
+        }
         if (this.hasSessionRef()) {
             const result = await this.getApiClient(state).createPassportDraft(payload);
             if (!result.ok) {
@@ -6123,13 +6637,21 @@ class ConnectV1Service {
     }
     getTrainingStatus(buildSessionId) {
         const state = this.stateStore.readState();
+        const maybePersistAnchoredSession = (session) => {
+            const anchored = this.anchorBuildSessionToBinding(state, session);
+            if (anchored !== session) {
+                this.stateStore.upsertBuildSession(anchored);
+                return anchored;
+            }
+            return session;
+        };
         if (buildSessionId) {
-            const session = this.requireBuildSession(state, buildSessionId);
+            const session = maybePersistAnchoredSession(this.requireBuildSession(state, buildSessionId));
             return this.buildBuildSessionSummary(state, session);
         }
         return [...state.build_sessions]
             .sort((left, right) => right.updated_at.localeCompare(left.updated_at))
-            .map((session) => this.buildBuildSessionSummary(state, session));
+            .map((session) => this.buildBuildSessionSummary(state, maybePersistAnchoredSession(session)));
     }
     markBuildSessionDraftPublished(draftId, passportGaid, workspaceId, projectId) {
         const state = this.stateStore.readState();
@@ -7782,6 +8304,7 @@ class ConnectV1Service {
         const result = options?.processScoutResults
             ? await this.scanRuntime({ processScoutResults: options.processScoutResults })
             : await this.scanRuntime();
+        this.syncEvolutionCandidates();
         const queue = result.discoveryMode === 'auto_draft'
             ? this.queueModelDraftsFromDetected()
             : emptyQueueSummary();
@@ -8129,7 +8652,7 @@ class ConnectV1Service {
         const secureStorage = this.credentialStore.getStatus();
         checks.push({
             name: 'secure_storage',
-            status: secureStorage.available ? 'PASS' : 'FAIL',
+            status: !secureStorage.available ? 'FAIL' : secureStorage.plaintextFallbackActive ? 'WARN' : 'PASS',
             details: secureStorage.legacyPlaintextFilePresent
                 ? `${secureStorage.detail} Legacy plaintext credential file still detected at ${this.credentialStore.getCredentialFilePath()}.`
                 : secureStorage.detail,
@@ -8165,6 +8688,11 @@ class ConnectV1Service {
                 status: 'WARN',
                 details: 'No session reference stored. Set FORKIT_CONNECT_SESSION_REF or run connect with session binding.',
             });
+            checks.push({
+                name: 'backend_session_truth',
+                status: 'WARN',
+                details: 'session_state=missing. Local scope (if present) is cached-only until login verifies account truth.',
+            });
             return checks;
         }
         checks.push({
@@ -8174,11 +8702,39 @@ class ConnectV1Service {
                 ? 'Using session reference from FORKIT_CONNECT_SESSION_REF. Headless mode can run without local credential persistence.'
                 : 'Secure session reference is present in local credential storage.',
         });
+        const api = new api_1.ConnectApiClient({
+            baseUrl: DEFAULT_BASE_URL,
+            sessionRef: this.readSessionRef(),
+        });
+        let sessionTruth = 'unavailable';
+        let profileStatus = null;
+        try {
+            const profileAccess = await api.getProfileAccess();
+            profileStatus = profileAccess.status;
+            if (profileAccess.ok) {
+                sessionTruth = 'authorized';
+            }
+            else if (profileAccess.status === 401 || profileAccess.status === 403) {
+                sessionTruth = 'expired';
+            }
+        }
+        catch {
+            sessionTruth = 'unavailable';
+            profileStatus = null;
+        }
+        checks.push({
+            name: 'backend_session_truth',
+            status: sessionTruth === 'authorized' ? 'PASS' : 'WARN',
+            details: sessionTruth === 'authorized'
+                ? `session_state=authorized via GET /api/profiles/access (${profileStatus ?? 'ok'})`
+                : sessionTruth === 'expired'
+                    ? `session_state=expired via GET /api/profiles/access (${profileStatus ?? 'unknown'}). Renew login before governed actions.`
+                    : `session_state=unavailable via GET /api/profiles/access (${profileStatus ?? 'timeout_or_network_error'}). Account truth is temporarily offline.`,
+        });
+        if (sessionTruth !== 'authorized') {
+            return checks;
+        }
         try {
-            const api = new api_1.ConnectApiClient({
-                baseUrl: DEFAULT_BASE_URL,
-                sessionRef: this.readSessionRef(),
-            });
             const mine = await api.getPassportsMine();
             checks.push({
                 name: 'backend_passports_mine',