orionfold-relay 0.22.1 → 0.23.0

package/README.md

@@ -104,7 +104,7 @@ The governance is *in* the workflow, not bolted on. A blueprint is a fixed step
 ## Why it stays trustworthy
 
 - **Local-first** — SQLite database, no cloud dependency, `npx orionfold-relay` and go
-- **Never phones home** — no telemetry, no update checks, no license server; the complete outbound-network inventory is documented and code-linked in [docs/trust/data-flow.md](docs/trust/data-flow.md)
+- **Relay never sends your data to Orionfold** — no telemetry, no update checks, no license server; the complete outbound-network inventory is documented and code-linked in [docs/trust/data-flow.md](docs/trust/data-flow.md)
 - **Your rules, enforced** — tool permissions, inbox approvals, and audit trails for every agent action
 - **Your AI team** — 21 specialist profiles ready to deploy, each with instructions, tool policies, and runtime tuning
 - **Know what you spend** — usage metering, budgets, and per-provider/per-model spend visibility on governed runs
@@ -134,8 +134,8 @@ relay license remove <license-id>                            # forget a license
 
 - **Verification is 100% offline** — an Ed25519 signature check against keys embedded in
   this repo ([`src/lib/licensing/verify.ts`](src/lib/licensing/verify.ts)). Relay never
-  phones home: no activation server, no telemetry, no network call of any kind. Works
-  air-gapped.
+  sends your data to Orionfold: no activation server, no telemetry, no network call of
+  any kind. Works air-gapped.
 - **Your packs are yours forever. Renewal gets you the year's new and updated packs +
   priority support.** An expired or removed license never re-locks content you already
   installed — it only gates new premium installs and updates.

package/dist/cli.js

@@ -1186,7 +1186,7 @@ var CURRENT_PLUGIN_API_VERSION, CAPABILITY_VALUES, ORIGIN_VALUES, PrimitivesBund
 var init_types = __esm({
   "src/lib/plugins/sdk/types.ts"() {
     "use strict";
-    CURRENT_PLUGIN_API_VERSION = "0.22";
+    CURRENT_PLUGIN_API_VERSION = "0.23";
     CAPABILITY_VALUES = ["fs", "net", "child_process", "env"];
     ORIGIN_VALUES = ["ainative-internal", "third-party"];
     PrimitivesBundleManifestSchema = z.object({
@@ -3739,9 +3739,25 @@ var init_format = __esm({
       /**
        * Premium display copy (D6). Offline strings rendered on the locked
        * gallery card — the Website still owns actual pricing. Meaningful only
-       * alongside `entitlement`; harmless on a free pack.
+       * alongside `entitlement`; harmless on a free pack. Either a flat string
+       * ("$499/year") or a two-phase offer ({ list, intro?, note? }) so a
+       * founding/introductory price can render alongside the list price.
+       * Render sites consume `packPrice()` — never branch on the raw shape.
        */
-      price: z3.string().min(1).optional(),
+      price: z3.union([
+        z3.string().min(1),
+        z3.object({
+          list: z3.string().min(1),
+          intro: z3.string().min(1).optional(),
+          note: z3.string().min(1).optional()
+        }).strict()
+      ]).optional(),
+      /**
+       * Card identity token — a lucide icon name rendered on the gallery card
+       * (e.g. "briefcase"). Unknown tokens fall back to the default glyph;
+       * never a remote asset.
+       */
+      icon: z3.string().min(1).optional(),
       /** Get-license CTA target on the locked card. */
       purchaseUrl: z3.url().optional(),
       /**
@@ -12929,7 +12945,7 @@ var init_registry6 = __esm({
     init_registry5();
     init_installer();
     init_schedule_spec();
-    SUPPORTED_API_VERSIONS = /* @__PURE__ */ new Set([CURRENT_PLUGIN_API_VERSION, "0.21"]);
+    SUPPORTED_API_VERSIONS = /* @__PURE__ */ new Set([CURRENT_PLUGIN_API_VERSION, "0.22"]);
     pluginCache = null;
     lastLoadedPluginIds = /* @__PURE__ */ new Set();
     PluginTableSchema = z16.object({
@@ -20746,6 +20762,24 @@ async function withAnthropicDirectMcpServers(profileServers, browserServers, ext
     relay: relayServer
   };
 }
+function mcpServersToAnthropicConnectors(mergedServers) {
+  const connectors = [];
+  for (const [name, config] of Object.entries(mergedServers)) {
+    if (name === "relay") continue;
+    const cfg = config;
+    const url = cfg.url ?? cfg.server_url;
+    if (typeof url !== "string" || url.length === 0) {
+      continue;
+    }
+    const connector = { type: "url", url, name };
+    for (const [key, value] of Object.entries(cfg)) {
+      if (["url", "server_url", "command", "args", "env"].includes(key)) continue;
+      if (typeof value === "string") connector[key] = value;
+    }
+    connectors.push(connector);
+  }
+  return connectors;
+}
 async function getAnthropicSDK() {
   if (!_sdk) {
     _sdk = await import("@anthropic-ai/sdk");
@@ -20812,7 +20846,7 @@ async function callAnthropicModel(client, systemPrompt, messages, tools, signal,
       budget_tokens: options.extendedThinking.budgetTokens ?? 1e4
     };
   }
-  if (options.mcpServers && Object.keys(options.mcpServers).length > 0) {
+  if (options.mcpServers && options.mcpServers.length > 0) {
     params.mcp_servers = options.mcpServers;
   }
   const stream = client.messages.stream(params, { signal });
@@ -20917,6 +20951,7 @@ ${outputInstructions}`;
       pluginServers,
       task.projectId
     );
+    const mcpConnectors = mcpServersToAnthropicConnectors(mergedMcpServers);
     let initialMessages;
     if (isResume) {
       const snapshot = await loadSessionSnapshot(taskId);
@@ -20965,7 +21000,7 @@ ${outputInstructions}`;
             enableCaching: true,
             profileInstructions: profile?.skillMd,
             extendedThinking: capOverrides?.extendedThinking,
-            mcpServers: mergedMcpServers
+            mcpServers: mcpConnectors
           }
         );
         await saveSessionSnapshot(taskId, agentProfileId, [
@@ -25740,8 +25775,8 @@ import { execFileSync as execFileSync3 } from "child_process";
 import yaml12 from "js-yaml";
 import semver from "semver";
 function relayCoreVersion() {
-  if (semver.valid("0.22.1")) {
-    return "0.22.1";
+  if (semver.valid("0.23.0")) {
+    return "0.23.0";
   }
   try {
     const root = getAppRoot(import.meta.dirname, 3);
@@ -26984,6 +27019,10 @@ function hasSqliteHeader(path24) {
     return false;
   }
 }
+var MIGRATION_CHAIN = [
+  { fromDir: ".stagent", toDir: ".ainative", fromDb: "stagent.db", toDb: "ainative.db" },
+  { fromDir: ".ainative", toDir: ".relay", fromDb: "ainative.db", toDb: "relay.db" }
+];
 async function migrateLegacyData(options = {}) {
   const home = options.home ?? homedir2();
   const gitDir = options.gitDir ?? join6(process.cwd(), ".git");
@@ -26996,46 +27035,50 @@ async function migrateLegacyData(options = {}) {
     keychainMigrated: false,
     errors: []
   };
-  const oldDir = join6(home, ".stagent");
-  const newDir = join6(home, ".ainative");
-  if (existsSync4(oldDir) && !existsSync4(newDir)) {
-    try {
-      renameSync(oldDir, newDir);
-      report.dirMigrated = true;
-      log(`renamed ${oldDir} -> ${newDir}`);
-    } catch (err2) {
-      const e = err2;
-      if (e.code === "EXDEV") {
-        try {
-          cpSync(oldDir, newDir, { recursive: true });
-          rmSync2(oldDir, { recursive: true, force: true });
-          report.dirMigrated = true;
-          log(`copied ${oldDir} -> ${newDir} (cross-device fallback)`);
-        } catch (copyErr) {
-          report.errors.push(`dir copy failed: ${String(copyErr)}`);
+  const finalDir = join6(home, MIGRATION_CHAIN[MIGRATION_CHAIN.length - 1].toDir);
+  const finalDbName = MIGRATION_CHAIN[MIGRATION_CHAIN.length - 1].toDb;
+  for (const hop of MIGRATION_CHAIN) {
+    const oldDir = join6(home, hop.fromDir);
+    const newDir = join6(home, hop.toDir);
+    if (existsSync4(oldDir) && !existsSync4(newDir)) {
+      try {
+        renameSync(oldDir, newDir);
+        report.dirMigrated = true;
+        log(`renamed ${oldDir} -> ${newDir}`);
+      } catch (err2) {
+        const e = err2;
+        if (e.code === "EXDEV") {
+          try {
+            cpSync(oldDir, newDir, { recursive: true });
+            rmSync2(oldDir, { recursive: true, force: true });
+            report.dirMigrated = true;
+            log(`copied ${oldDir} -> ${newDir} (cross-device fallback)`);
+          } catch (copyErr) {
+            report.errors.push(`dir copy failed: ${String(copyErr)}`);
+            return report;
+          }
+        } else {
+          report.errors.push(`dir rename failed: ${String(err2)}`);
           return report;
         }
-      } else {
-        report.errors.push(`dir rename failed: ${String(err2)}`);
-        return report;
       }
     }
-  }
-  if (existsSync4(newDir)) {
-    for (const suffix of ["", "-shm", "-wal"]) {
-      const oldName = join6(newDir, `stagent.db${suffix}`);
-      const newName = join6(newDir, `ainative.db${suffix}`);
-      if (existsSync4(oldName) && !existsSync4(newName)) {
-        try {
-          renameSync(oldName, newName);
-          report.dbFilesRenamed++;
-        } catch (err2) {
-          report.errors.push(`db file rename failed (${suffix}): ${String(err2)}`);
+    if (existsSync4(newDir)) {
+      for (const suffix of ["", "-shm", "-wal"]) {
+        const oldName = join6(newDir, `${hop.fromDb}${suffix}`);
+        const newName = join6(newDir, `${hop.toDb}${suffix}`);
+        if (existsSync4(oldName) && !existsSync4(newName)) {
+          try {
+            renameSync(oldName, newName);
+            report.dbFilesRenamed++;
+          } catch (err2) {
+            report.errors.push(`db file rename failed (${suffix}): ${String(err2)}`);
+          }
         }
       }
     }
   }
-  const dbPath4 = join6(newDir, "ainative.db");
+  const dbPath4 = join6(finalDir, finalDbName);
   if (existsSync4(dbPath4) && !hasSqliteHeader(dbPath4)) {
     log(`skipping SQL migration \u2014 ${dbPath4} exists but lacks SQLite header`);
   }

package/drizzle.config.ts

@@ -2,13 +2,13 @@ import { defineConfig } from "drizzle-kit";
 import { homedir } from "os";
 import { join } from "path";
 
-const dataDir = process.env.AINATIVE_DATA_DIR || join(homedir(), ".ainative");
+const dataDir = process.env.RELAY_DATA_DIR || join(homedir(), ".relay");
 
 export default defineConfig({
   schema: "./src/lib/db/schema.ts",
   out: "./src/lib/db/migrations",
   dialect: "sqlite",
   dbCredentials: {
-    url: join(dataDir, "ainative.db"),
+    url: join(dataDir, "relay.db"),
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionfold-relay",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "description": "Orionfold Relay — a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.",
   "keywords": [
     "ai",

package/src/app/api/license/route.ts

@@ -14,7 +14,7 @@ import type { SignedLicense } from "@/lib/licensing/verify";
  * paste/upload activation path for UI-first users: the browser reads the
  * fulfilment file client-side and ships the `{ payload, signature }` envelope
  * as JSON. Verification is offline Ed25519 inside saveLicense; nothing here
- * phones home.
+ * sends user data to Orionfold.
  */
 
 const BodySchema = z.object({

package/src/app/packs/page.tsx

@@ -2,9 +2,20 @@ import Link from "next/link";
 import { PageShell } from "@/components/shared/page-shell";
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent } from "@/components/ui/card";
-import { Boxes, Check, Lock, Package, TriangleAlert } from "lucide-react";
+import {
+  Boxes,
+  Briefcase,
+  Building2,
+  Check,
+  Lock,
+  Package,
+  TriangleAlert,
+  type LucideIcon,
+} from "lucide-react";
+import { cn } from "@/lib/utils";
 import { listApps } from "@/lib/apps/registry";
 import { listPackTemplates, type PackTemplate } from "@/lib/packs/catalog";
+import { packPrice, type PackPrice } from "@/lib/packs/format";
 import { packUpdateAvailability } from "@/lib/packs/update";
 import { changelogWindow } from "@/lib/licensing/recap";
 import { PackInstallButton } from "@/components/packs/pack-install-button";
@@ -16,29 +27,234 @@ export const dynamic = "force-dynamic";
  * Local-first bundled-pack browser (NOT a marketplace — feature-cut fence).
  * Premium packs are visible-but-locked (D6): every user sees what exists,
  * what it materializes, and what it costs; only the content install is gated.
+ * A locked premium pack renders as a full-width feature panel — the sales
+ * copy and the two-phase offer are the conversion surface (#20/#21).
  */
-export default function PacksPage() {
+
+/** Bundled icon names (pack.yaml `icon:`) → lucide glyphs. Never remote. */
+const PACK_ICONS: Record<string, LucideIcon> = {
+  briefcase: Briefcase,
+  "building-2": Building2,
+};
+
+function packIcon(template: PackTemplate): LucideIcon {
+  const iconName = template.meta?.icon;
+  if (iconName && PACK_ICONS[iconName]) return PACK_ICONS[iconName];
+  return template.meta?.entitlement ? Lock : Package;
+}
+
+type PackFilter = "all" | "free" | "premium";
+
+function resolveFilter(raw: string | string[] | undefined): PackFilter {
+  const v = Array.isArray(raw) ? raw[0] : raw;
+  return v === "free" || v === "premium" ? v : "all";
+}
+
+export default async function PacksPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ filter?: string | string[] }>;
+}) {
+  const params = await searchParams;
+  const filter = resolveFilter(params.filter);
   const templates = listPackTemplates();
   const installedIds = new Set(listApps().map((a) => a.id));
 
+  const isPremium = (t: PackTemplate) => Boolean(t.meta?.entitlement);
+  // Corrupt templates ignore the filter — a packaging bug must stay visible.
+  const visible = templates.filter(
+    (t) =>
+      t.error ||
+      filter === "all" ||
+      (filter === "premium" ? isPremium(t) : !isPremium(t))
+  );
+  const featured = visible.filter(
+    (t) => !t.error && isPremium(t) && !installedIds.has(t.id)
+  );
+  const standard = visible.filter((t) => !featured.includes(t));
+  const counts: Record<PackFilter, number> = {
+    all: templates.length,
+    free: templates.filter((t) => !t.error && !isPremium(t)).length,
+    premium: templates.filter((t) => !t.error && isPremium(t)).length,
+  };
+
   return (
     <PageShell
       title="Packs"
       description="Vertical content bundles — an app, profiles, blueprints, tables, and seed data installed in one step."
+      filters={
+        templates.length > 1 ? (
+          <FilterChips active={filter} counts={counts} />
+        ) : undefined
+      }
     >
       {templates.length === 0 ? (
         <EmptyHero />
+      ) : visible.length === 0 ? (
+        <p className="text-sm text-muted-foreground">
+          No {filter} packs in this build.{" "}
+          <Link
+            href="/packs"
+            className="underline underline-offset-2 hover:text-foreground"
+          >
+            Show all packs
+          </Link>
+        </p>
       ) : (
-        <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
-          {templates.map((t) => (
-            <PackCard key={t.id} template={t} installed={installedIds.has(t.id)} />
+        <div className="space-y-4">
+          {featured.map((t) => (
+            <FeaturedPackCard key={t.id} template={t} />
           ))}
+          {standard.length > 0 && (
+            <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
+              {standard.map((t) => (
+                <PackCard
+                  key={t.id}
+                  template={t}
+                  installed={installedIds.has(t.id)}
+                />
+              ))}
+            </div>
+          )}
         </div>
       )}
     </PageShell>
   );
 }
 
+function FilterChips({
+  active,
+  counts,
+}: {
+  active: PackFilter;
+  counts: Record<PackFilter, number>;
+}) {
+  const chips: Array<{ value: PackFilter; label: string; href: string }> = [
+    { value: "all", label: "All", href: "/packs" },
+    { value: "free", label: "Free", href: "/packs?filter=free" },
+    { value: "premium", label: "Premium", href: "/packs?filter=premium" },
+  ];
+  return (
+    <nav aria-label="Filter packs" className="flex items-center gap-2">
+      {chips.map((c) => (
+        <Link
+          key={c.value}
+          href={c.href}
+          aria-current={active === c.value ? "page" : undefined}
+          className={cn(
+            "inline-flex h-7 items-center gap-1.5 rounded-md border px-2.5 text-xs font-medium transition-colors",
+            "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2",
+            active === c.value
+              ? "border-transparent bg-primary text-primary-foreground"
+              : "surface-control text-muted-foreground hover:text-foreground"
+          )}
+        >
+          {c.label}
+          <span
+            className={cn(
+              "tabular-nums",
+              active === c.value
+                ? "text-primary-foreground/70"
+                : "text-muted-foreground/70"
+            )}
+          >
+            {counts[c.value]}
+          </span>
+        </Link>
+      ))}
+    </nav>
+  );
+}
+
+/** Two-phase offer: founding intro leads, list price stays as the anchor. */
+function OfferPrice({ price }: { price: PackPrice }) {
+  return (
+    <div>
+      <div className="flex items-baseline gap-2">
+        <span className="text-2xl font-bold tracking-tight">
+          {price.intro ?? price.list}
+        </span>
+        {price.intro && (
+          <span className="text-sm text-muted-foreground line-through">
+            {price.list}
+          </span>
+        )}
+      </div>
+      {price.note && (
+        <p className="mt-1 text-xs text-muted-foreground">{price.note}</p>
+      )}
+    </div>
+  );
+}
+
+/**
+ * Locked premium pack — the conversion hero. Full sales copy at a readable
+ * measure (never clamped), offer rail with the two-phase price + CTAs.
+ */
+function FeaturedPackCard({ template }: { template: PackTemplate }) {
+  const meta = template.meta!;
+  const Icon = packIcon(template);
+  const price = packPrice(meta);
+
+  return (
+    <Card className="relative hover:border-primary/50 transition-colors">
+      <CardContent className="p-4 sm:p-5">
+        <div className="grid gap-5 lg:grid-cols-[minmax(0,1fr)_260px]">
+          <div className="min-w-0 space-y-3">
+            <div className="flex items-center gap-3">
+              <div className="surface-card-muted flex h-12 w-12 shrink-0 items-center justify-center rounded-lg border">
+                <Icon className="h-6 w-6 text-primary" aria-hidden="true" />
+              </div>
+              <div className="min-w-0">
+                <h2 className="truncate text-base font-semibold">
+                  {meta.name}
+                </h2>
+                <div className="mt-0.5 flex flex-wrap items-center gap-1.5">
+                  <Badge variant="outline" className="gap-1">
+                    <Lock className="h-3 w-3" aria-hidden="true" />
+                    Premium
+                  </Badge>
+                  {template.primitivesSummary && (
+                    <span className="text-[11px] text-muted-foreground/70">
+                      {template.primitivesSummary}
+                    </span>
+                  )}
+                </div>
+              </div>
+            </div>
+            {meta.description && (
+              <p className="max-w-[70ch] text-sm leading-relaxed text-muted-foreground">
+                {meta.description}
+              </p>
+            )}
+          </div>
+
+          <div className="surface-card-muted flex flex-col gap-4 rounded-lg border p-4 lg:self-start">
+            {price && <OfferPrice price={price} />}
+            <div className="space-y-2">
+              <PackInstallButton
+                packId={template.id}
+                packName={meta.name}
+                premium
+              />
+              {meta.purchaseUrl && (
+                <a
+                  href={meta.purchaseUrl}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="block text-xs font-medium text-foreground underline underline-offset-2 hover:text-primary"
+                >
+                  Get license →
+                </a>
+              )}
+            </div>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
+
 function PackCard({
   template,
   installed,
@@ -68,34 +284,31 @@ function PackCard({
 
   const meta = template.meta!;
   const premium = Boolean(meta.entitlement);
+  const Icon = packIcon(template);
+  const price = packPrice(meta);
 
   return (
     <Card className="relative h-full hover:border-primary/50 transition-colors">
-      <CardContent className="p-3 space-y-2">
+      <CardContent className="flex h-full flex-col gap-2 p-3">
         <div className="flex items-center justify-between gap-2">
-          <div className="flex items-center gap-2 min-w-0">
-            {premium ? (
-              <Lock
-                className="h-4 w-4 text-muted-foreground shrink-0"
-                aria-hidden="true"
-              />
-            ) : (
-              <Package
-                className="h-4 w-4 text-muted-foreground shrink-0"
+          <div className="flex min-w-0 items-center gap-2">
+            <div className="surface-card-muted flex h-9 w-9 shrink-0 items-center justify-center rounded-md border">
+              <Icon
+                className="h-5 w-5 text-muted-foreground"
                 aria-hidden="true"
               />
-            )}
+            </div>
             <span className="text-sm font-medium truncate">{meta.name}</span>
           </div>
           {premium && !installed && (
             <Badge variant="outline" className="shrink-0">
-              {meta.price ?? "Premium"}
+              {price?.intro ?? price?.list ?? "Premium"}
             </Badge>
           )}
         </div>
 
         {meta.description && (
-          <p className="text-xs text-muted-foreground line-clamp-2">
+          <p className="text-xs text-muted-foreground line-clamp-3">
             {meta.description}
           </p>
         )}
@@ -105,27 +318,29 @@ function PackCard({
           </p>
         )}
 
-        {installed ? (
-          <InstalledActions template={template} />
-        ) : (
-          <div className="flex items-end justify-between gap-2 pt-1">
-            <PackInstallButton
-              packId={template.id}
-              packName={meta.name}
-              premium={premium}
-            />
-            {premium && meta.purchaseUrl && (
-              <a
-                href={meta.purchaseUrl}
-                target="_blank"
-                rel="noopener noreferrer"
-                className="text-xs font-medium text-foreground underline underline-offset-2 hover:text-primary shrink-0"
-              >
-                Get license →
-              </a>
-            )}
-          </div>
-        )}
+        <div className="mt-auto">
+          {installed ? (
+            <InstalledActions template={template} />
+          ) : (
+            <div className="flex items-end justify-between gap-2 pt-1">
+              <PackInstallButton
+                packId={template.id}
+                packName={meta.name}
+                premium={premium}
+              />
+              {premium && meta.purchaseUrl && (
+                <a
+                  href={meta.purchaseUrl}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="text-xs font-medium text-foreground underline underline-offset-2 hover:text-primary shrink-0"
+                >
+                  Get license →
+                </a>
+              )}
+            </div>
+          )}
+        </div>
       </CardContent>
     </Card>
   );

package/src/components/notifications/inbox-list.tsx

@@ -40,12 +40,52 @@ export function InboxList({
     }
   }, []);
 
-  // Poll every 10 seconds (consolidated from 3s inbox + 5s badge)
+  // Poll every 10 seconds (consolidated from 3s inbox + 5s badge). This is the
+  // safety net for non-time-critical notification types (task_completed,
+  // agent_message, …) that the approvals stream below does not carry.
   useEffect(() => {
     const interval = setInterval(refresh, 10_000);
     return () => clearInterval(interval);
   }, [refresh]);
 
+  // Real-time surfacing for workflow-blocking checkpoints
+  // (fix-inbox-checkpoint-realtime). A workflow stuck at a HITL checkpoint
+  // shouldn't wait on the 10s poll — the user must act, and the UI going quiet
+  // for ~15s undercuts the "governed, unattended" promise. We subscribe to the
+  // existing pending-approvals SSE (~750ms server-side tail, already includes
+  // WorkflowCheckpoint rows) and use each snapshot purely as an invalidation
+  // signal: re-pull the authoritative /api/notifications list so a new
+  // checkpoint (and the badge) surfaces within ~1-2s. On SSE failure we fall
+  // back to the 10s poll already running above. Mirrors PendingApprovalHost.
+  useEffect(() => {
+    let cancelled = false;
+    let eventSource: EventSource | null = null;
+
+    try {
+      eventSource = new EventSource("/api/notifications/pending-approvals/stream");
+      eventSource.onmessage = () => {
+        // The snapshot content is not rendered here — its arrival means the
+        // pending-approval set changed, so re-fetch the full list immediately.
+        if (cancelled) return;
+        refresh().catch(() => {
+          // Trigger-driven refresh should fail quietly; the poll will retry.
+        });
+      };
+      eventSource.onerror = () => {
+        // Fall back to the 10s poll (still active) until the stream recovers.
+        eventSource?.close();
+        eventSource = null;
+      };
+    } catch {
+      // EventSource unavailable — the 10s poll remains the delivery path.
+    }
+
+    return () => {
+      cancelled = true;
+      eventSource?.close();
+    };
+  }, [refresh]);
+
   async function markAllRead() {
     await fetch("/api/notifications/mark-all-read", { method: "PATCH" });
     toast.success("All notifications marked as read");

package/src/components/notifications/unread-badge.tsx

@@ -7,12 +7,15 @@ export function UnreadBadge() {
   const [count, setCount] = useState(0);
 
   useEffect(() => {
+    let cancelled = false;
+    let eventSource: EventSource | null = null;
+
     async function fetchCount() {
       try {
         const res = await fetch("/api/notifications?countOnly=true&unread=true");
         if (res.ok) {
           const data = await res.json();
-          setCount(data.count ?? 0);
+          if (!cancelled) setCount(data.count ?? 0);
         }
       } catch {
         // Silently fail
@@ -22,7 +25,30 @@ export function UnreadBadge() {
     fetchCount();
     // Aligned with InboxList polling at 10s to reduce duplicate requests
     const interval = setInterval(fetchCount, 10_000);
-    return () => clearInterval(interval);
+
+    // Real-time badge updates for workflow checkpoints
+    // (fix-inbox-checkpoint-realtime): the badge must jump the instant a
+    // checkpoint is raised, not on the next 10s tick. Re-count immediately
+    // whenever the pending-approvals set changes (SSE trigger). Poll remains
+    // the fallback for other notification types and on SSE failure.
+    try {
+      eventSource = new EventSource("/api/notifications/pending-approvals/stream");
+      eventSource.onmessage = () => {
+        if (!cancelled) void fetchCount();
+      };
+      eventSource.onerror = () => {
+        eventSource?.close();
+        eventSource = null;
+      };
+    } catch {
+      // EventSource unavailable — the 10s poll remains the delivery path.
+    }
+
+    return () => {
+      cancelled = true;
+      clearInterval(interval);
+      eventSource?.close();
+    };
   }, []);
 
   if (count === 0) return null;

package/src/instrumentation-node.ts

@@ -41,7 +41,7 @@ export async function registerNodeInstrumentation() {
     await runPendingMigrations();
 
     // Plugin loader (Kind 5 only). Seeds dogfood examples on first boot,
-    // scans ~/.ainative/plugins/, registers profiles + blueprints + tables + schedules.
+    // scans ~/.relay/plugins/, registers profiles + blueprints + tables + schedules.
     // Failures are isolated per-plugin; boot continues regardless.
     //
     // ORDERING INVARIANTS (do not move this block without re-checking):

package/src/lib/agents/runtime/anthropic-direct.ts

@@ -78,6 +78,62 @@ export async function withAnthropicDirectMcpServers(
   };
 }
 
+/**
+ * Anthropic Messages API `mcp_servers` connector entry.
+ * The API accepts ONLY remote URL connectors (`type: "url"`) — not
+ * in-process server instances or local stdio (`command`) servers.
+ */
+export type AnthropicMcpConnector = {
+  type: "url";
+  url: string;
+  name: string;
+} & Record<string, string>;
+
+/**
+ * Project the five-source MCP merge down to the Anthropic Messages API
+ * `mcp_servers` shape (remote URL connectors only).
+ *
+ * The API's `mcp_servers` field is for REMOTE MCP connectors reached over
+ * HTTP; the SDK JSON-serializes the request body. The in-process `relay`
+ * server (an SDK MCP server object with a circular `root` transport
+ * back-reference) and local stdio (`command`) plugin servers CANNOT go here:
+ *   - `relay` is not serializable → the SDK's `JSON.stringify(body)` throws
+ *     "Converting circular structure to JSON … property 'root' closes the
+ *     circle" and every anthropic-direct task fails before the model call.
+ *   - stdio (`command`) servers are local subprocesses the remote API cannot
+ *     reach; passing them is meaningless.
+ *
+ * Both are already available to the model as local function tools via
+ * `forProvider("anthropic")` + `executeHandler`, so dropping them here loses
+ * no capability. Only genuinely remote (URL-bearing) connectors are emitted;
+ * any remaining scalar config fields (e.g. a per-connector bearer token) are
+ * carried through opaquely. Mirrors openai-direct's `mcpServersToOpenAiTools`
+ * (which likewise skips `relay`).
+ */
+export function mcpServersToAnthropicConnectors(
+  mergedServers: Record<string, unknown>,
+): AnthropicMcpConnector[] {
+  const connectors: AnthropicMcpConnector[] = [];
+  for (const [name, config] of Object.entries(mergedServers)) {
+    if (name === "relay") continue; // in-process tools handled via function-calling, not the remote MCP path
+    const cfg = config as Record<string, unknown>;
+    const url = cfg.url ?? cfg.server_url;
+    if (typeof url !== "string" || url.length === 0) {
+      // stdio/command server or unserializable object — not a remote connector.
+      continue;
+    }
+    const connector = { type: "url", url, name } as AnthropicMcpConnector;
+    // Carry through any remaining scalar config fields opaquely (e.g. the
+    // API's per-connector auth field, if a plugin config supplied one).
+    for (const [key, value] of Object.entries(cfg)) {
+      if (["url", "server_url", "command", "args", "env"].includes(key)) continue;
+      if (typeof value === "string") connector[key] = value;
+    }
+    connectors.push(connector);
+  }
+  return connectors;
+}
+
 // ── SDK lazy import ──────────────────────────────────────────────────
 
 type AnthropicSDK = typeof import("@anthropic-ai/sdk");
@@ -128,13 +184,13 @@ interface AnthropicCallOptions {
   /** Extended thinking config (Anthropic only). */
   extendedThinking?: { enabled: boolean; budgetTokens?: number };
   /**
-   * Five-source merged MCP servers (TDR-035 §1).
-   * Passed as `mcp_servers` in the Anthropic Messages API request body.
-   * The Anthropic SDK mcp_servers field is in beta; typed as unknown to
-   * avoid SDK version skew. The `params` object is already typed as `any`
-   * so no ts-expect-error is needed.
+   * Remote MCP connectors (TDR-035 §1), projected to the Anthropic Messages
+   * API `mcp_servers` shape by `mcpServersToAnthropicConnectors`. ONLY
+   * URL-based remote connectors — the in-process `relay` server and local
+   * stdio plugin servers are excluded upstream (they're served as local
+   * function tools instead), so this is always JSON-serializable.
    */
-  mcpServers?: Record<string, unknown>;
+  mcpServers?: AnthropicMcpConnector[];
 }
 
 /**
@@ -214,10 +270,13 @@ async function callAnthropicModel(
     };
   }
 
-  // Inject five-source merged MCP servers (TDR-035 §1).
+  // Inject remote MCP connectors (TDR-035 §1). Already projected to the
+  // serializable URL-connector shape by mcpServersToAnthropicConnectors —
+  // the in-process `relay` server and local stdio plugins are excluded
+  // upstream, so this can no longer make the request body circular.
   // mcp_servers is a beta Anthropic Messages API field; params is typed as
   // any above so no extra assertion is needed here.
-  if (options.mcpServers && Object.keys(options.mcpServers).length > 0) {
+  if (options.mcpServers && options.mcpServers.length > 0) {
     params.mcp_servers = options.mcpServers;
   }
 
@@ -366,6 +425,10 @@ async function executeAnthropicDirectTask(taskId: string, isResume = false): Pro
       pluginServers,
       task.projectId,
     );
+    // Project to the serializable remote-connector shape BEFORE it reaches the
+    // request body — the raw merge holds the in-process `relay` server (a
+    // circular SDK object) that would crash JSON.stringify (see the helper).
+    const mcpConnectors = mcpServersToAnthropicConnectors(mergedMcpServers);
 
     // Build initial messages or restore from snapshot
     let initialMessages: LoopMessage[];
@@ -429,7 +492,7 @@ async function executeAnthropicDirectTask(taskId: string, isResume = false): Pro
             enableCaching: true,
             profileInstructions: profile?.skillMd,
             extendedThinking: capOverrides?.extendedThinking,
-            mcpServers: mergedMcpServers,
+            mcpServers: mcpConnectors,
           },
         );
 

package/src/lib/apps/registry.ts

@@ -537,7 +537,7 @@ function sweepNamespacedBlueprints(blueprintsDir: string, appId: string): number
  * Cascade-delete an app: removes its DB project (and all FK-dependent rows)
  * via deleteProjectCascade, removes the manifest dir on disk, then sweeps
  * `<appId>--*` profile dirs and `<appId>--*.yaml` blueprint files from the
- * shared `~/.ainative/profiles/` and `~/.ainative/blueprints/` directories.
+ * shared `~/.relay/profiles/` and `~/.relay/blueprints/` directories.
  *
  * All four halves are independent — a missing piece is not an error. The
  * result reports which halves removed something.

package/src/lib/packs/format.ts

@@ -46,9 +46,29 @@ export const PackManifestSchema = z
     /**
      * Premium display copy (D6). Offline strings rendered on the locked
      * gallery card — the Website still owns actual pricing. Meaningful only
-     * alongside `entitlement`; harmless on a free pack.
+     * alongside `entitlement`; harmless on a free pack. Either a flat string
+     * ("$499/year") or a two-phase offer ({ list, intro?, note? }) so a
+     * founding/introductory price can render alongside the list price.
+     * Render sites consume `packPrice()` — never branch on the raw shape.
      */
-    price: z.string().min(1).optional(),
+    price: z
+      .union([
+        z.string().min(1),
+        z
+          .object({
+            list: z.string().min(1),
+            intro: z.string().min(1).optional(),
+            note: z.string().min(1).optional(),
+          })
+          .strict(),
+      ])
+      .optional(),
+    /**
+     * Card identity token — a lucide icon name rendered on the gallery card
+     * (e.g. "briefcase"). Unknown tokens fall back to the default glyph;
+     * never a remote asset.
+     */
+    icon: z.string().min(1).optional(),
     /** Get-license CTA target on the locked card. */
     purchaseUrl: z.url().optional(),
     /**
@@ -65,6 +85,22 @@ export const PackManifestSchema = z
 
 export type PackMeta = z.infer<typeof PackManifestSchema>;
 
+/** Normalized two-phase offer; `list` is always present. */
+export interface PackPrice {
+  list: string;
+  intro?: string;
+  note?: string;
+}
+
+/**
+ * The single price shape every render site consumes (card, any future recap
+ * surface). Flat-string packs normalize to `{ list }`; free packs → null.
+ */
+export function packPrice(meta: PackMeta): PackPrice | null {
+  if (!meta.price) return null;
+  return typeof meta.price === "string" ? { list: meta.price } : meta.price;
+}
+
 // ── Pack + resolved-layer types ──────────────────────────────────────
 
 export interface Pack {

package/src/lib/packs/templates/relay-agency/pack.yaml

@@ -4,6 +4,7 @@ name: Relay Agency
 author: Orionfold
 description: Agency operating layer — CRE + nonprofit verticals.
 relayCore: ">=0.15.0"
+icon: building-2
 # Declarative metadata. The installer seeds customers from base/seed/customers.yaml
 # (objects), not from this list — these slugs mirror that seed for at-a-glance review.
 customers:

package/src/lib/packs/templates/relay-agency-pro/pack.yaml

@@ -17,11 +17,20 @@ description: >
   included update) — a grant pipeline that takes every opportunity from
   fit-scored go/no-go through LOI, full application, and post-award
   restricted-funds compliance with a reporting calendar. Everything installs
-  offline; your license never phones home.
+  offline; Relay never sends your data to Orionfold.
 relayCore: ">=0.18.0"
 entitlement: product:orionfold-relay
-price: "$499/year"
+# Two-phase offer, hand-maintained to match orionfold.com/relay/ in this
+# release. Reading the canonical Orionfold source to stay current is fine
+# (the promise forbids SENDING user data, not reading public data — operator
+# ruling 2026-07-02); until such a read ships, when the founding window
+# closes on the Website, delete `intro` + `note` here in a normal release.
+price:
+  intro: "$349/year"
+  list: "$499/year"
+  note: "Founding price for early buyers — locks in before it returns to list."
 purchaseUrl: https://orionfold.com/relay/
+icon: briefcase
 # Per-version customer-voice recap — the single source every renewal surface
 # reads (license status, the update refusal, the /packs card, the renewal
 # email). Add a line here with EVERY version bump; the template test suite

package/src/lib/plugins/examples/echo-server/plugin.yaml

@@ -1,6 +1,6 @@
 id: echo-server
 version: 0.1.0
-apiVersion: "0.22"
+apiVersion: "0.23"
 kind: chat-tools
 name: Echo Server
 description: |

package/src/lib/plugins/examples/finance-pack/plugin.yaml

@@ -1,6 +1,6 @@
 id: finance-pack
 version: 0.1.0
-apiVersion: "0.22"
+apiVersion: "0.23"
 kind: primitives-bundle
 name: Finance Pack
 description: |

package/src/lib/plugins/examples/reading-radar/plugin.yaml

@@ -1,6 +1,6 @@
 id: reading-radar
 version: 0.1.0
-apiVersion: "0.22"
+apiVersion: "0.23"
 kind: primitives-bundle
 name: Reading Radar
 description: |

package/src/lib/plugins/registry.ts

@@ -53,7 +53,7 @@ import type { ScheduleSpec } from "@/lib/validators/schedule-spec";
 // unfixed from 0.15.0 through 0.16.0 — treat the window test's failure as
 // a release blocker, not noise). The 0.13→0.14 three-MINOR bridge is over;
 // this is the standard 2-MINOR window now.
-const SUPPORTED_API_VERSIONS = new Set([CURRENT_PLUGIN_API_VERSION, "0.21"]);
+const SUPPORTED_API_VERSIONS = new Set([CURRENT_PLUGIN_API_VERSION, "0.22"]);
 
 /** Test-helper export so the window-enforcement test can read state. */
 export function isSupportedApiVersion(apiVersion: string): boolean {

package/src/lib/plugins/sdk/types.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 // (a hardcoded copy there once drifted to "0.14" — scaffolded plugins would
 // have been disabled on load the moment the window tightened). Bump on every
 // MINOR release; api-version-window.test.ts fails if this goes stale.
-export const CURRENT_PLUGIN_API_VERSION = "0.22";
+export const CURRENT_PLUGIN_API_VERSION = "0.23";
 
 // Shared capability tuple — single source of truth used by Zod schema and
 // capability-check.ts hash derivation. Exported so consumers don't need a

package/src/lib/utils/migrate-to-ainative.ts

@@ -37,7 +37,36 @@ function hasSqliteHeader(path: string): boolean {
 }
 
 /**
- * Idempotent migration from ~/.stagent/ to ~/.ainative/. Safe to call on every boot.
+ * A single directory-rename hop in the brand-migration chain (`from` -> `to`),
+ * together with the db-file basename rename that lives inside that dir.
+ * `stagent` -> `ainative` -> `relay`.
+ */
+interface MigrationHop {
+  /** Legacy home-relative dir name, e.g. ".stagent". */
+  fromDir: string;
+  /** Next-brand home-relative dir name, e.g. ".ainative". */
+  toDir: string;
+  /** Legacy db basename (no suffix), e.g. "stagent.db". */
+  fromDb: string;
+  /** Next-brand db basename (no suffix), e.g. "ainative.db". */
+  toDb: string;
+}
+
+// Ordered chain: an install may sit at ANY legacy brand. Running the hops in
+// order converges `~/.stagent` (two behind) OR `~/.ainative` (one behind) onto
+// the live `~/.relay` / relay.db that @/lib/config/env resolves. The SQL
+// mcp__stagent__ -> mcp__ainative__ rewrite happens here (Step 3); the
+// subsequent mcp__ainative__ -> mcp__relay__ rewrite runs against the live DB
+// in instrumentation-node.ts via migrate-mcp-namespace.ts.
+const MIGRATION_CHAIN: MigrationHop[] = [
+  { fromDir: ".stagent", toDir: ".ainative", fromDb: "stagent.db", toDb: "ainative.db" },
+  { fromDir: ".ainative", toDir: ".relay", fromDb: "ainative.db", toDb: "relay.db" },
+];
+
+/**
+ * Idempotent migration of legacy data dirs onto the live `~/.relay`. Walks the
+ * `~/.stagent` -> `~/.ainative` -> `~/.relay` chain so an install at any prior
+ * brand converges on the current one. Safe to call on every boot.
  * Never throws — errors are collected in report.errors.
  */
 export async function migrateLegacyData(
@@ -55,57 +84,69 @@ export async function migrateLegacyData(
     errors: [],
   };
 
-  const oldDir = join(home, ".stagent");
-  const newDir = join(home, ".ainative");
+  // The terminus of the chain — where the live app reads from.
+  const finalDir = join(home, MIGRATION_CHAIN[MIGRATION_CHAIN.length - 1].toDir);
+  const finalDbName = MIGRATION_CHAIN[MIGRATION_CHAIN.length - 1].toDb;
 
-  // Step 1: rename directory if needed
-  if (existsSync(oldDir) && !existsSync(newDir)) {
-    try {
-      renameSync(oldDir, newDir);
-      report.dirMigrated = true;
-      log(`renamed ${oldDir} -> ${newDir}`);
-    } catch (err) {
-      const e = err as NodeJS.ErrnoException;
-      if (e.code === "EXDEV") {
-        try {
-          cpSync(oldDir, newDir, { recursive: true });
-          rmSync(oldDir, { recursive: true, force: true });
-          report.dirMigrated = true;
-          log(`copied ${oldDir} -> ${newDir} (cross-device fallback)`);
-        } catch (copyErr) {
-          report.errors.push(`dir copy failed: ${String(copyErr)}`);
+  // Steps 1+2: walk each hop's dir rename + db-file rename. A `return` here on
+  // an unrecoverable dir error aborts the whole chain (matches prior behavior:
+  // the data is in an unknown state, so downstream steps must not run).
+  for (const hop of MIGRATION_CHAIN) {
+    const oldDir = join(home, hop.fromDir);
+    const newDir = join(home, hop.toDir);
+
+    // Step 1: rename directory if needed
+    if (existsSync(oldDir) && !existsSync(newDir)) {
+      try {
+        renameSync(oldDir, newDir);
+        report.dirMigrated = true;
+        log(`renamed ${oldDir} -> ${newDir}`);
+      } catch (err) {
+        const e = err as NodeJS.ErrnoException;
+        if (e.code === "EXDEV") {
+          try {
+            cpSync(oldDir, newDir, { recursive: true });
+            rmSync(oldDir, { recursive: true, force: true });
+            report.dirMigrated = true;
+            log(`copied ${oldDir} -> ${newDir} (cross-device fallback)`);
+          } catch (copyErr) {
+            report.errors.push(`dir copy failed: ${String(copyErr)}`);
+            return report;
+          }
+        } else {
+          report.errors.push(`dir rename failed: ${String(err)}`);
           return report;
         }
-      } else {
-        report.errors.push(`dir rename failed: ${String(err)}`);
-        return report;
       }
     }
-  }
 
-  // Step 2: rename DB files inside the new dir. If newDir exists from a
-  // partial prior run (e.g., failed cpSync cross-device), iteration here is
-  // safe — neither old nor new DB files may exist and the step becomes a no-op.
-  if (existsSync(newDir)) {
-    for (const suffix of ["", "-shm", "-wal"]) {
-      const oldName = join(newDir, `stagent.db${suffix}`);
-      const newName = join(newDir, `ainative.db${suffix}`);
-      if (existsSync(oldName) && !existsSync(newName)) {
-        try {
-          renameSync(oldName, newName);
-          report.dbFilesRenamed++;
-        } catch (err) {
-          report.errors.push(`db file rename failed (${suffix}): ${String(err)}`);
+    // Step 2: rename DB files inside the (now-current) dir. If newDir exists
+    // from a partial prior run (e.g., failed cpSync cross-device), iteration
+    // here is safe — neither old nor new DB files may exist and the step
+    // becomes a no-op.
+    if (existsSync(newDir)) {
+      for (const suffix of ["", "-shm", "-wal"]) {
+        const oldName = join(newDir, `${hop.fromDb}${suffix}`);
+        const newName = join(newDir, `${hop.toDb}${suffix}`);
+        if (existsSync(oldName) && !existsSync(newName)) {
+          try {
+            renameSync(oldName, newName);
+            report.dbFilesRenamed++;
+          } catch (err) {
+            report.errors.push(`db file rename failed (${suffix}): ${String(err)}`);
+          }
         }
       }
     }
   }
 
-  // Step 3: SQL row migration. Only open the DB if it begins with the
-  // SQLite magic header. Opening a non-SQLite file (e.g., a test fixture
-  // placeholder) would succeed initially, then fail on the first prepare(),
-  // and the close() in finally would silently delete co-located -shm/-wal.
-  const dbPath = join(newDir, "ainative.db");
+  // Step 3: SQL row migration on the FINAL db. Only open the DB if it begins
+  // with the SQLite magic header. Opening a non-SQLite file (e.g., a test
+  // fixture placeholder) would succeed initially, then fail on the first
+  // prepare(), and the close() in finally would silently delete co-located
+  // -shm/-wal. This rewrites the stagent-era mcp prefix / sourceFormat; the
+  // ainative->relay mcp rewrite runs later against the live DB.
+  const dbPath = join(finalDir, finalDbName);
   if (existsSync(dbPath) && !hasSqliteHeader(dbPath)) {
     log(`skipping SQL migration — ${dbPath} exists but lacks SQLite header`);
   }