Composes the four alpha.11 fix-train slices: A (root --version + write-free --dry-run via DryRunFileSystemAdapter), B (scaffold type-soundness), C (--cache/--cache-backend + interactive init via PromptPort), E (plain GET /health + service-health e2e probe). Init conflict resolved keeping both A+C behaviors. Composed scaffold.runtime e2e 48/0. IMPL-EVAL PASS (OpenHands qwen3.7-max, separate session): no userland leak, no unauthorized casts, minimal lock churn. Integrates #156 #157 #158 #159. Refs #141 #153.

…renderPlugin full-source (breaking)

Unified S4 of the #157 plugin re-architecture. The plugin verb is now `install`
everywhere (zero-compat, no `add` alias) and the full-source `renderPlugin`
fallback is deleted so `netscript plugin install` ALWAYS uses the plugin-owned
thin scaffold path.

- Verb: `FRAMEWORK_VERBS`/`FrameworkVerb`/`isFrameworkVerb` flip `add`→`install`
  (dispatch-plugin-verb.ts, public-api.ts); public + local `plugins-group.ts`
  register `install`; `.name('install')` in both command surfaces.
- Folder rename `features/plugins/add/`→`install/` (public) and
  `local/.../plugins/add/`→`install/`; `plan-plugin-add`→`plan-plugin-install`;
  domain `plugin-add-plan`→`plugin-install-plan`; e2e `plugin-add-gates`→
  `plugin-install-gates`. `render-plugin.ts` filename kept; `renderPlugin` export
  DELETED, `renderPluginSupport` retained.
- Sound fallback: when no resolvable plugin package + process runner, the command
  throws `ScaffoldValidationError` (not a silent full-source render). Config
  wiring + `copyPluginSchemasToRootDb` preserved.
- Skills regenerated via sync-claude-skills.ts (.agents + .claude netscript-cli).
- Other verbs (`service add`, `db add`, `contract add`) intentionally untouched.

Supervisor-verified independently of the generator: scoped `deno check` GREEN
(542 files, 0 errors); `deno publish --dry-run` Success (no `--allow-slow-types`);
repo grep clean of `renderPlugin(`/`addPlugin(`/`plan-plugin-add`/`features/plugins/add`.

Known follow-up (out of this slice): `packages/plugin` skeleton templates still
print `netscript plugin add {{pluginName}}` into generated READMEs/mod headers;
fixing needs a `packages/plugin` template + `embedded.generated.ts` regen slice.

Refs #157 #163

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

…ebt — relocate + migrate KV stores onto @netscript/kv

Open, PLAN-EVAL-gated debt for the final #172 thin-connector convergence step.
Two coupled defects in the sagas/triggers/workers connectors that still ship
runtime stores/adapters under `plugins/<kind>/src/runtime/`:

1. Placement: by the #157→#172 thin-connector law these port→backend adapters
   belong in `@netscript/plugin-<kind>-core` (`stores/`/`adapters/`).
2. Primitive-bypass / engine lock: sagas + triggers KV stores hardwire raw
   `Deno.openKv` + the Deno-native fluent atomic, bypassing the engine-agnostic
   `@netscript/kv` primitive — forfeiting Redis / in-memory / reactive-watch.
   Workers `KvWorkerIdempotencyStore` already does it right (the reference).

Scope = relocate + migrate (not a blind file move): rewrite the sagas/triggers
KV stores onto `@netscript/kv` (`KvStore` + `AtomicCheck/Mutation/Result`,
injected handle), adding `@netscript/kv`(+`@netscript/cron`+`@netscript/watchers`
for triggers) deps to the `-core` packages — which is the ENCOURAGED direction,
not a cost. No "minimize -core deps" rule exists; an earlier "D1" framing of that
was removed. Net-new vs the PASSed scaffold-surface S1–S7 plan → gated separately.

Linked plan: .llm/tmp/run/feat-scaffold-surface-167--adapter-relocation/{plan,research}.md

Refs #157 #172

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

… + plan) for PLAN-EVAL

Adds the adapter-relocation run-dir research.md + plan.md so the PR-branch-checkout
PLAN-EVAL session can read the canonical plan. Scope = relocate sagas/triggers/workers
runtime stores+adapters into their `-core` packages AND migrate the sagas+triggers KV
stores off raw `Deno.openKv` onto `@netscript/kv` (engine-agnostic; mirrors the workers
`KvWorkerIdempotencyStore` reference). Locked decisions D-KV / D2 / D3 / D4. No "minimize
-core deps" rule — depending on `@netscript/*` primitives is the encouraged direction.
PLAN-EVAL hard-gate; no implementation slice before PASS.

Refs #157 #172

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

…n-source copy (#172)

* docs(scaffold-167): corrected research + plan for thin typesafe scaffold surface

Re-architecture spine for #157: plugin add emits ONLY userland glue (wiring
entrypoint + config edits + user-owned sample stubs + dep-sourced prisma) via a
typesafe factory/typed code model. Disease (string-copied plugin TS source) is
deleted. Supersedes chore/plugin-167-harden / PR #170. Grounded in 4 read-only
agent sweeps (hexagon+emit map, plugin-add mutation map, prisma, doctrine+gates).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(scaffold-167): S1 typesafe @netscript/plugin/scaffold core surface

Add the typesafe core scaffold surface under packages/plugin/src/scaffold,
exported as @netscript/plugin/scaffold. Provides ScaffoldArtifact, a typed
manifest spec + byte-identical scaffold.plugin.json renderer, centralized
kebab pluginName parsing, a composition factory (createPluginScaffold) over an
injected FileSystemPort, and the --context-json CLI runner. No abstract base,
no string codegen, no casing module.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(scaffold-167): S2a thin workers scaffolder (userland-only, no plugin-source copy)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(scaffold-167): S2b thin sagas scaffolder (userland-only, no plugin-source copy)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(scaffold-167): S2b thin triggers scaffolder (userland-only, no plugin-source copy)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(scaffold-167): S2b thin streams scaffolder (userland-only, no plugin-source copy)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(scaffold-167): S2c thin auth scaffolder (userland-only, no plugin-source copy)

Re-architect the auth plugin scaffolder onto the shared @netscript/plugin/scaffold
composition surface, replacing the legacy 26-template full plugin-copy with a single
userland barrel. plugin add auth now emits only auth/mod.ts (re-exporting the published
@netscript/plugin-auth-core/contracts/v1 surface); the service, routes, streams, Aspire
wiring, deno.json/config, and auth.prisma all resolve from the @netscript/plugin-auth
dependency (D-NOCOPY, D-CONFIG-KEEP, D-PRISMA: databaseMigrationsAdded:false).

Delete artifacts.ts, files.ts, and all src/scaffold/templates/**. Migrate the auth
manifest spec verbatim into plugins/auth/src/scaffold/spec.ts as authManifestSpec and
retire the central packages/plugin test_fixtures/manifest-specs.ts (each plugin now owns
its byte-identity test in-package). Completes S2 across all five official plugins.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(scaffold-167): lock unified plugin-command-contract architecture (v2)

Re-architect the scaffold surface into FULL UNIFICATION: one core-owned plugin
command contract (Vite-style composition + typed seams, strong single-target
defaults, no cross-package inheritance). research.md + plan.md rewritten;
context-pack added. Decisions also locked into PR #172 body + issue #167.

Mandatory: install/doctor/info/update/remove. Optional: add/generate <resource>.
ONE typesafe ItemScaffolder. Full rename+namespace. Forward-only reconcile of v1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(scaffold-167): add author-side tooling (plugin verify + plugin new) + DoD

Fold the user's two maintainer-facing capabilities into the unified plan:
- S8 `netscript plugin verify` — author-grade plugin doctor (deno doc --lint +
  publish --dry-run + manifest schema + arch:check + adapter-contract
  completeness → one "exactly what is wrong" report; reuses repo/Deno tools).
- S9 `netscript plugin new <name>` — conforming starter-shape generator built on
  the SAME unified item generator (dogfood); skeleton passes verify+dry-run.

Both are the marketplace AUTHOR side of #167 and reinforce "core owns the shape".
Also records an explicit Definition of Done: skill-first+harness, Deno-native
first, JSR-ready, doctrine/fitness as actual merge gates, zero dead/dup code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(scaffold-167): record PLAN-EVAL dispatch prompt (OpenHands minimax-M3)

Hard Plan-Gate trigger on PR #172 for the unified plugin-command-contract
re-architecture (S1-S9). No implementation slice begins before PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(scaffold-167): record re-architecture license for packages/plugin + cli

User grants explicit license to rethink/re-architect the internal design of
packages/plugin and packages/cli (not just graft the contract onto existing
structure). Widens latitude, not the bar — all doctrine/JSR/no-leak/cast/lock
invariants still bind. PLAN-EVAL prompt updated to judge bold restructuring as
legitimate/preferred. Re-dispatching the gate on the updated plan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(openhands): apply agent changes

* chore(openhands): record run trace 28346124073-1

* feat(plugin): S1 core plugin adapter contract

* feat(plugin-workers): connect workers to plugin adapter contract

* fix(plugin-workers): remove casts from adapter connector

* feat(plugin-sagas): S3a sagas connector on @netscript/plugin/adapter

* feat(plugin-triggers): S3a triggers connector on @netscript/plugin/adapter

* feat(plugin-streams): S3b streams connector on @netscript/plugin/adapter (one ItemScaffolder; delete legacy scaffolders)

* feat(plugin-auth): S3b auth connector on @netscript/plugin/adapter (install-only; delete legacy scaffolder)

* refactor(plugin): unify forked local-project-files CLI adapters into @netscript/plugin

#171a-1: replace the three per-plugin local-project-files.ts forks
(workers/sagas/triggers) with one generic LocalProjectFiles + ProjectFiles in
packages/plugin/src/cli/adapters/project-files.ts, re-exported via the existing
@netscript/plugin/cli subpath. Entry widened to the superset {path,relativePath,size};
parameterized over project root only, no per-kind branching. All 12 import sites
repointed; the three forks deleted and empty adapters/ dirs pruned.

Scoped check (--unstable-kv) / lint / fmt green across packages/plugin and
plugins/{workers,sagas,triggers}.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* refactor(plugin): extract shared registry-emission machinery into @netscript/plugin

#171a-2: add a generic renderRegistryModule + toRegistryImportSpecifier in
packages/plugin/src/cli/application/registry-emitter.ts (new application/ role
folder; pure code emitter). Thin the three ProjectFiles-based static-registry
generators (workers registry-compiler, sagas registry-generator, triggers
trigger-registry-compiler) and the triggers inline runtime generator to delegate
to it, passing only their specifics (discovery, import-line + entry-block shape,
header/body). The generic owns ordering + import-specifier path math; zero
per-kind branching. Exported via the existing @netscript/plugin/cli subpath.

Byte-identity proven: golden snapshot tests for all three registry shapes ran
green against the original generators (oracle locked) and remained byte-identical
after thinning (3/3 passed). Workers Family-A runtime-registry-generator (manifest/
profile/job-definition engine) deliberately left un-unified — folding it in would
require a leaky abstraction; sharing the renderer skeleton is the correct thinness
outcome.

Scoped check (--unstable-kv) 0 errors / lint 0 / fmt 0 across packages/plugin and
plugins/{workers,sagas,triggers}; publish dry-run + doc --lint clean. Zero new casts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* refactor(plugin): data-driven verifyPlugin + single-source plugin version from deno.json

#171b: replace the five hand-rolled per-plugin verify-plugin.ts files with one
data-driven verifyPlugin(manifest, expectations) + runPluginVerificationCli in
packages/plugin/src/diagnostics/verify-plugin.ts (exported from the root
@netscript/plugin entrypoint alongside inspectPlugin). PluginExpectations is a
pure data description of every contribution axis (services, processors, topics,
schemas, contracts, runtimeConfigTopics, e2e, aspire, deps, telemetry, helpers),
each item carrying its own finding message so wording is reproduced verbatim.
Each plugin's verify-plugin.ts is now a thin verifyPlugin(...) call + one-line CLI
main; named verify<Kind>Plugin() exports preserved. Dynamic helper-key reads use
Reflect.get (unknown, no cast). 18-test generic suite added.

Single-source the version: every plugin manifest now derives its version from its
own deno.json via a JSON import attribute (JSR-safe; deno.json is in publish
include), replacing the stale hardcoded literals/consts (alpha.0 / 0.1.0). A
release:cut deno.json bump now propagates to every manifest automatically. All
five verifiers truthfully return ok:true / findings:[] / exit 0 at the current
0.0.1-alpha.12; version-pinned test assertions repointed to deno.json.

Scoped check (--unstable-kv) 0 errors / lint 0 / fmt 0 across packages/plugin and
all five plugins; per-plugin suites green (workers 20, sagas 42, triggers 14,
streams 11, auth 23) + generic 18; publish dry-run Success; zero new casts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* refactor(plugin): centralize generic E2E gate + probe machinery into core

#171c: lift the convention-bearing E2E primitives that were duplicated (or
sagas-local) across plugin src/e2e into @netscript/plugin (src/diagnostics, the
sanctioned verification-concern folder; e2e is not in the core folder vocabulary).

New core surface (exported from the root @netscript/plugin entry, mirroring
verifyPlugin):
- PluginE2eGate: the single { id, description, command } gate-definition type.
  The per-plugin WorkersE2eGate/SagasE2eGate/StreamsE2eGate are now thin aliases.
- Generic HTTP-probe primitives: ProbeHttpResult, summarizeResponse,
  assertSuccessfulProbe, joinProbeUrl, normalizeProbePath.
- resolveProbeUrl(envVarNames, fallbackUrl, { stripTrailingSlash }) +
  ResolveProbeUrlOptions: one env->URL resolver replacing three hand-rolled forks.

Connectors rewired to thin consumers, kind-specifics preserved verbatim:
- sagas: deleted local probe primitives, resolvers now call the core helpers; saga
  roundtrip payload + env names + defaults unchanged; src/e2e/mod.ts public export
  NAMES unchanged (generic four now source from @netscript/plugin, one definition).
- workers: resolveWorkersProbeUrl keeps its exact no-strip behavior via
  { stripTrailingSlash: false }.
- streams: resolveStreamsProbeUrl strips as before; createProbeStreamPath /
  ignoreExpectedProbeCleanupError / probePayloadSchema untouched.

No gate id/description/command, env var name, default URL/port, or payload changed.
Triggers tests/e2e migration, richer probes, and gate-data convergence are out of
scope (deferred to plugin convergence). src/adapter and the #171a/b surfaces untouched.

Scoped check (--unstable-kv) 320 files 0 errors / lint 0 / fmt 0 across
packages/plugin + workers/sagas/streams; diagnostics + 3-plugin e2e suites 29/0
(table-driven equivalence: 500-char preview, frozen result, exact error wording,
slash-join, env precedence, strip/no-strip per kind); publish dry-run Success (both
new files ship in the tarball); no new casts, no new slow types, no new doc-lint errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* refactor(plugins): #172a-1 contract + barrel structural convergence (auth L6)

Converge all five plugins toward the canonical thin-connector shape (workers = reference):

- Collapse src/plugin/mod.ts -> src/public/mod.ts (sagas/triggers/auth); deno.json
  "./plugin" now points at src/public/mod.ts (exact alias of "./public"/".").
- auth L6: "./contracts" ./contracts.ts -> new thin ./contracts/v1/mod.ts barrel
  (re-exports @netscript/plugin-auth-core/contracts/v1 + AUTH_SESSION_STATES);
  publish.include + check/doc-lint tasks + manifest loader strings + 2 tests repointed.
- Delete orphan loose contracts.ts (workers/sagas/triggers) and orphan services/mod.ts
  (workers/sagas/auth) — zero importers (grep-proven); "./services" already targets
  services/src/main.ts.
- Repoint sagas/triggers reference doc tables to src/public/mod.ts.

Surface preserved: "./plugin" aliasing "./public" gains the *_API_*/*_PLUGIN_* constants
the old curated barrel omitted (already reachable via "."), a surface expansion not a
regression. Sagas contract-definition move DEFERRED: plugin-sagas-core already ships an
evolved/divergent sagasContractV1 the plugin router does not implement; reconcile in the
base-contract seam slice (#175 / 172a-2), not a relocation slice.

Validation: scoped deno check 283 files / 0 diagnostics; 110 passed / 0 failed plugin
tests; deno publish --dry-run (workers/sagas/triggers/auth) Success; deno doc --lint clean;
arch:check EXIT=0. No packages/ source, src/adapter/, or deno.lock changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin): #172a-2a base plugin contract + base service seam (package core)

Add the package-core base seam every feature plugin converges onto, per the USER
base-contract/service design (contracts live in -core by design — anti-cyclic,
core derives seam types; package core owns the base each -core contract extends).

@netscript/plugin/contract-base (new export):
- BASE_PLUGIN_ERRORS — shared oRPC error fragment (NOT_FOUND/VALIDATION_ERROR reuse
  @netscript/contracts schemas; INTERNAL owned here) spread into every plugin
  contract's error map.
- PluginCapabilities + PluginCapabilitiesSchema — marketplace-discoverable
  capability descriptor (pluginName, contractVersions, routeGroups, capabilities).
- BASE_PLUGIN_CONTRACT_ROUTES — spreadable fragment carrying the single mandatory
  typed `describe` (GET /describe) route, pre-wired to the base errors + output.
- BasePluginContract type — each -core contract declares `satisfies
  BasePluginContract`; a missing/mis-typed `describe` is a compile error (the
  negative @ts-expect-error test proves it). oRPC has no .extend(); convergence is
  object-spread + satisfies.

@netscript/plugin/service (new export):
- createPluginService() — base service via COMPOSITION (A5), wrapping
  @netscript/service createService and baking the un-violable builder chain
  (cors->logger->openapi->docs->database->use->context->withRPC->withHealth->
  withServiceInfo) as data; connectors describe the service as data and only
  .serve(). Absorbs the two Hono plugin services without class inheritance.

Health/info stay INFRA (raw Hono handlers registered by withHealth/withServiceInfo),
so the base CONTRACT mandates only the typed `describe`; the factory mandates the
infra. Two non-mirror seams by design.

Casts: 2 `as unknown as` at the oRPC contract boundary (sanctioned centralized-
contract pattern, mirrors @netscript/contracts baseContract); no `any`, no novel
cast category. JSR-safe (explicit return types, @module + symbol JSDoc).

Validation: scoped check 6 files/0 diagnostics; package `check` task EXIT=0; lint 0;
3/3 new tests pass (incl. integration boot of /health + describe oRPC route);
deno publish --dry-run Success (no --allow-slow-types). deno.lock additive only
(@netscript/contracts, @netscript/service, npm:@orpc/server). No other package
source touched; pre-existing src/adapter #174 reds unchanged (zero diff vs HEAD).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin-workers): #172a-2b adopt base contract seam + createPluginService (reference connector)

Workers is the reference connector for the #172 convergence: it adopts the
172a-2a package-core base seam and defines the shape sagas/triggers/auth copy.

Contract (@netscript/plugin-workers-core/contracts/v1):
- Spread BASE_PLUGIN_ERRORS (NOT_FOUND/VALIDATION_ERROR/INTERNAL) over the
  hand-rolled error map, converging on the shared plugin error vocabulary.
- Spread BASE_PLUGIN_CONTRACT_ROUTES so the mandatory typed `describe`
  (GET /describe) route is present; declare the definition
  `satisfies BasePluginContract` (the real compile-time conformance guard).
  All 21 existing routes preserved.

describe handler (plugins/workers/services/src/routers/describe.ts):
- Returns a real PluginCapabilities doc for workers (pluginName
  @netscript/plugin-workers, contractVersions [v1], routeGroups jobs/executions/
  tasks/task-executions/topics/subscribe/admin, capabilities
  background-processor/job-scheduling/task-execution/sse-streaming), every field
  derived from the manifest + contract surface. Served at /api/v1/workers/describe.

Service migration (plugins/workers/services/src/main.ts):
- Migrated off the raw createService(...) chain onto createPluginService(router,
  config); every option (cors/logger/openapi/docs/database/context/health/
  serviceInfo + the onStartup hook) is now data. The @netscript/kv/redis
  side-effect import and the import.meta.main bootstrap are preserved verbatim.

Base-factory fold-in (discovered-necessary, @netscript/plugin/service):
- createPluginService gained data-only onStartup/onShutdown hook arrays applied
  after withServiceInfo (workers' job-registration + stream mutation hook needs
  onStartup). Documented chain JSDoc updated; an onStartup serve-test added.

Casts: only the sanctioned centralized-contract `as unknown as` category (the
base error map and the seam-typed `describe` cross into the oRPC builders the
same way @netscript/contracts baseContract does); no new `any`, lint-ignore, or
novel cast category. JSR-safe.

No deno.json import additions or deno.lock changes: @netscript/plugin resolves
by Deno workspace member name (same pattern workers-core already uses for
@netscript/plugin-streams-core), and its ./contract-base + ./service exports
exist from 172a-2a.

Validation (supervisor-run, independent of the generator):
- scoped check 191 files/0 diagnostics; scoped lint exit 0/0
- deno test workers-core + workers + plugin/service: 46 passed/0 failed
  (incl. new contract-conformance, GET /describe integration, onStartup tests)
- deno publish --dry-run both packages: Success, no --allow-slow-types
- deno.lock untouched

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(run): track 172a-2a + 172a-2b commits in scaffold-surface run log

* fix(plugin): #172a-2 posix-join workspace artifact paths (closes #174 Windows reds)

The core plugin adapter resolved artifact write targets with the platform-native
@std/path join, which emits backslash keys on Windows
(\workspace\src\jobs\starter.ts) while the command reports POSIX createdFiles
(src/jobs/starter.ts). The two adapter tests that read written artifacts back by
their POSIX key therefore passed on Linux CI but failed on Windows
(install_test / plugin-cli-runner_test) - the pre-existing #174 reds.

Switch resolveWorkspacePath to @std/path/posix join so the resolved key is
byte-deterministic across operating systems and matches the reported POSIX
createdFiles. Deno accepts forward-slash paths for filesystem writes on Windows;
createDenoFileSystem keeps native dirname for the real-disk mkdir.

Verified (supervisor-run): packages/plugin scoped check 139/0, lint 0,
deno test packages/plugin 63 passed/0 failed (both former reds now green).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin-workers): #172a-2-SOUND type-sound base contract seam + workers reference

Closes the two systemic soundness holes in the plugin service stack (Hole A
caused Hole B), making the workers connector the rock-solid reference shape the
remaining connectors copy. No any, no Record<string,unknown> handler maps, no
contract erasure - contract to handler to router is type-enforced end to end.

Base seam (@netscript/plugin/contract-base):
- describe is now a real oc contract route (was a phantom built with the server
  os.errors(...) builder and cast to a hand-rolled __output marker).
- BasePluginContract enforces the typed describe route via the real
  AnyContractRouter constraint; the permissive [route: string]: unknown index
  signature that made satisfies illusory is gone.

Workers contract (@netscript/plugin-workers-core/contracts/v1):
- workers.contract-definition rewritten isolatedDeclarations-clean and precise:
  explicit WorkersContractDefinition, per-route Route<inSchema,outSchema>
  aliases, all 21 routes + describe, no whole-contract
  as-unknown-as Parameters<typeof implement>[0] erasure. implement() stays precise.
- WorkersContract/WorkersContractV1/WorkersRouter DERIVED from the real types
  (no longer hand-maintained, no drift from the Zod schemas).
- ExecutionRecordShape annotated with concrete Zod constructor types
  (ZodString/ZodNullable/ZodDefault/...) instead of z.ZodType<T> upcasts, which
  under Zod v4 erased _output to unknown through .omit().extend() and silently
  widened the published ExecutionRecordResponse fields.

Implementation conformed UP to the (correct) contract - registry/runtime/state
read-boundary types tightened so handlers receive contract-conformant jobs; no
published response field was loosened.

Workers connector (plugins/workers/services):
- router/v1/handler modules assembled through the contract-bound implementer's
  .router() (conformance checked); deleted v1: any, router: any, workersV1 as any,
  and the Record<string,unknown> handler maps + their deno-lint-ignore.

Casts: only the sanctioned centralized-contract as-unknown-as category at the
oRPC boundary (mirrors @netscript/contracts baseContract). New negative type-test
(workers-contract-soundness_test) pins the seam with @ts-expect-error.

deno.json/lock: additive only - workers-core now genuinely imports @orpc/contract
(oc), @orpc/server (implement), and @netscript/plugin (base seam); plugin adds
@orpc/contract. Lock re-resolved additively (no version changes).

Verified (supervisor-run, independent of generator): scoped check 331 files/0
diagnostics; scoped lint 0; deno test workers-core + workers + plugin/service 108
passed/0 failed; deno publish --dry-run @netscript/plugin and
@netscript/plugin-workers-core both Success, no --allow-slow-types.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin-sagas): #172a-2c sagas SOUND convergence (Decision-B fold)

Roll the proven workers SOUND pattern (8a12e48f) onto the sagas connector +
plugin-sagas-core contract, closing both systemic soundness holes (Hole A caused
Hole B) and folding in the paused Decision-B evolved-contract work. No any, no
Record<string,unknown> handler maps, no contract erasure - contract to handler
to router is type-enforced end to end.

Core contract (@netscript/plugin-sagas-core/contracts/v1):
- sagas.contract rewritten isolatedDeclarations-clean: adopts the
  @netscript/plugin base seam (spreads BASE_PLUGIN_ERRORS via the single
  sanctioned oc.errors boundary cast, BASE_PLUGIN_CONTRACT_ROUTES describe route,
  satisfies BasePluginContract); explicit per-route Route<TIn,TOut> alias for all
  7 routes + describe; no whole-contract as-unknown-as Parameters<typeof
  implement>[0] erasure; sagasContract/sagasContractV1 exported precise.
- Every response Zod schema annotated with concrete Zod constructor types
  (ZodString/ZodNullable/ZodDefault/...) instead of z.ZodType<T> upcasts, which
  under Zod v4 erased _output to unknown and silently widened published fields.
- Decision-B fields populated in the published schemas: sagaId/instanceId/
  correlationKey on instance/history/SSE responses, correlationKey/messageId on
  publish response, durabilityTier (default t1) on definition responses.
- Dropped the hand-rolled ContractProcedureLike and the (options: any)
  SagasRouteHandler.

Connector (plugins/sagas):
- Deleted the dead connector-local duplicate contract
  (plugins/sagas/contracts/v1/sagas.contract.ts; its SagasRoute* types were
  unused). contracts/v1/mod.ts reduced to a thin re-export of the core contract,
  so the manifest loader path + deno.json export resolve through the single
  canonical source - exactly like workers binds to workers-core.
- New routers/router-context.ts: contract-bound implementer
  sagasContractV1.$context<SagaServiceContext>() + SagasHandlers<K> mapped type
  (kills router:any).
- router/v1-handlers assembled through the implementer's .router(); deleted
  v1:any, router:any, sagasV1 as any, the Record<string,unknown> handler maps
  (incl. health) and their deno-lint-ignores. describe route returns real
  PluginCapabilities. Only AnyRouter at the top-level router assembly boundary.
- Handlers conform UP to the contract: mapStateToInstance emits the Decision-B
  identifiers and normalizes the legacy 'active' status to the canonical
  'running' (SAGA_INSTANCE_STATUSES); mapSagaToResponse emits durabilityTier. No
  published response field was loosened.
- main.ts migrated from the raw createService(...).withCors()... chain to
  createPluginService(router, {...}).serve(); the durable-runtime lifecycle
  (registerSagas/openSagaRuntimeKv/createDurableSagaRuntime/start/stream mirror)
  moves to onStartup and the deterministic stop-runtime -> dispose order moves to
  a single onShutdown hook (try sagaRuntime.stop / finally durableRuntime.dispose).

Casts: only the two sanctioned categories - the centralized-contract
as-unknown-as at the oRPC error-map boundary (identical to workers) and the
top-level router AnyRouter. Open domain data (saga state, message payload) stays
an explicit open Record<string,unknown>. New negative @ts-expect-error type-test
(sagas-contract-soundness_test) pins the seam.

deno.json/lock: no change - the additive imports (@netscript/plugin-sagas-core/
contracts/v1, @netscript/plugin/contract-base) resolve through existing workspace
members.

Verified (supervisor-run, independent of generator): scoped check 306 files/0
diagnostics; scoped lint 167 files/0; deno test plugin-sagas-core 29 passed/0
failed (incl. new soundness test) and plugins/sagas 42 passed/0 failed; deno
publish --dry-run @netscript/plugin-sagas-core and @netscript/plugin both
Success, no --allow-slow-types.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin-triggers): #172a-2d triggers-core SOUND contract (Hole A)

Roll the proven workers/sagas SOUND pattern (8a12e48f / c1d8bec4) onto the
@netscript/plugin-triggers-core published oRPC contract, closing Hole A
(contract->inference erasure). Contract-package scope ONLY - the triggers
connector (plugins/triggers raw Hono service: 8 unimplemented oRPC routes +
raw-body HMAC webhook ingress incompatible with oRPC Zod input parsing) is a
separate PLAN-EVAL-gated daemon-attached slice, recorded as explicit arch-debt.
No any, no Record<string,unknown> contract export, no contract erasure.

Core contract (@netscript/plugin-triggers-core/contracts/v1):
- triggers.contract rewritten isolatedDeclarations-clean: adopts the
  @netscript/plugin base seam (spreads BASE_PLUGIN_ERRORS via the single
  sanctioned oc.errors boundary cast; BASE_PLUGIN_CONTRACT_ROUTES describe
  route; satisfies BasePluginContract). Base error set is a superset of the
  prior local NOT_FOUND/VALIDATION_ERROR map; TRIGGERS_ERROR_CODES are
  TriggersError domain codes, not contract error-map entries, so no merge
  needed - no route-referenced error dropped.
- Explicit interface TriggersContractDefinitionShape extends BasePluginContract
  with per-route Route<TIn,TOut> aliases for all 10 business routes + describe
  (11 total) plus a dedicated SubscribeEventsRoute for the eventIterator SSE
  route; no whole-contract as-unknown-as Readonly<Record<string,unknown>>
  erasure. triggersContract/triggersContractV1 exported precise and DERIVED
  from the real implement(triggersContractDefinition).
- Every response/input Zod schema annotated with concrete Zod constructor types
  (ZodString/ZodNullable/ZodDefault/ZodObject/ZodEnum) instead of z.ZodType<T>
  upcasts, which under Zod v4 erased _output to unknown and silently widened
  published fields. Deleted the erasing TriggerContractSchema<T> indirection
  type and its as-unknown-as casts (grep confirmed no external importers);
  introduced structural ContractSchema/ContractSchemaResult mirroring sagas.
- Open domain data (trigger payload, event metadata, SSE data) stays an
  explicit open z.ZodRecord<z.ZodString, z.ZodUnknown> - allowed open domain,
  not erasure. Domain enums (TRIGGER_DURABILITY_TIERS / TRIGGER_EVENT_STATUSES
  / TRIGGER_KINDS) preserved; no allowed value changed. Wire shape unchanged.
- Added derived TriggersContract/TriggersContractV1/TriggersRouter/
  TriggersCapabilities exports; mod.ts drops the dead TriggerContractSchema
  export and adds the new precise types.

Casts: only the single centralized-contract as-unknown-as at the oRPC error-map
boundary (identical to workers/sagas). New negative @ts-expect-error type-test
(triggers-contract-soundness_test) pins the seam. No deno.json/lock change.

Verified (supervisor-run, independent of generator): scoped check 253 files/0
diagnostics (plugin-triggers-core + plugins/triggers + plugin); scoped lint
0; deno test plugin-triggers-core 14 passed/0 failed (incl. new soundness
test); deno publish --dry-run @netscript/plugin-triggers-core and
@netscript/plugin both Success, no --allow-slow-types. The plugins/triggers
root in the check confirms the connector's contract import did not break.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin-auth): #172a-2d auth SOUND convergence (Hole A + Hole B)

Roll the proven workers/sagas SOUND pattern (8a12e48f / c1d8bec4) onto the auth
plugin end to end: close both systemic soundness holes and adopt the base seam +
createPluginService. No any, no Record<string,unknown> handler maps, no contract
erasure - contract -> handler -> router is type-enforced. Implementation types
conform UP to the (correct) contract; no published contract field loosened.

Core contract (@netscript/plugin-auth-core/contracts/v1):
- auth.contract rewritten isolatedDeclarations-clean: adopts the
  @netscript/plugin base seam (BASE_PLUGIN_ERRORS merged with auth-specific
  UNAUTHORIZED/AUTH_PROVIDER_ERROR/VALIDATION_ERROR via the single sanctioned
  oc.errors boundary cast - no auth error dropped; BASE_PLUGIN_CONTRACT_ROUTES
  describe route; satisfies BasePluginContract). Explicit
  AuthContractDefinitionShape extends BasePluginContract with per-route
  Route<TIn,TOut> aliases for all 5 business routes (signin POST /signin,
  callback POST /callback, signout POST /signout, session GET /session, me
  GET /me) + describe; no whole-contract as-unknown-as Parameters<typeof
  implement>[0] erasure; no permissive Record<string,unknown> index signature.
  authContractV1/AuthContractV1/AuthRouter/AuthContract DERIVED from the real
  implement(...) - no phantom as-unknown-as upcast.
- All 11 z.ZodType<T> annotations replaced with concrete Zod constructor types,
  fixing the Zod v4 _output erasure. Session state enum (AUTH_SESSION_STATES:
  active/expired/revoked) preserved. mod.ts + public/mod.ts add AuthCapabilities
  /AuthContract/AuthContractDefinition and drop dead type exports
  (AuthContractErrorFactory/Errors, AuthRouteHandler(Options)).

Connector (plugins/auth):
- New routers/router-context.ts: authContractV1.$context<AuthServiceContext>()
  implementer + AuthHandlers<K> mapped type (kills router:any). v1-handlers
  typed AuthHandlers<AuthV1RouteKey> (was Record<string,unknown>); added the
  describe handler returning a real PluginCapabilities const. health.ts typed
  via HealthHandlers<K> mapped type. router.ts rebuilt through
  authImplementer.router(authV1) + os.$context<...>().use(mw).prefix('/v1/auth')
  .router(...); deleted every any / as any / deno-lint-ignore. AnyRouter only at
  the top-level router boundary. v1-helpers mappers return mutable arrays/claims
  matching the contract output schema.
- main.ts migrated from the raw createService(...).withCors()... chain to
  createPluginService(router, {...}).serve(): openApi/docs/database/
  middleware:[withAuthRequest]/context/traceContext map 1:1; registry
  resolution + adapter selection (better-auth/workos/kv-oauth via
  backend-registry) unchanged.

Casts: only the two sanctioned categories - centralized-contract as-unknown-as
at the oRPC error-map boundary (identical to workers/sagas) and the top-level
router AnyRouter. Open domain data (token payloads, provider metadata, claims)
stays explicit open Record<string,unknown>. New negative @ts-expect-error
type-test (auth-contract-soundness_test). No deno.json/lock change.

Verified (supervisor-run, independent of generator): scoped check 253 files/0
diagnostics; scoped lint 0; deno test plugin-auth-core 27 passed/0 failed and
plugins/auth 23 passed/0 failed (incl. new soundness test + full
signin->callback->session->me->signout round-trip through the new router +
createPluginService); deno publish --dry-run @netscript/plugin-auth-core and
@netscript/plugin both Success, no --allow-slow-types.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(run): record #172a-2d triggers-core + auth SOUND commits in run log

* chore(debt): record deferred triggers-connector SOUND convergence (triggers-connector-sound-deferred)

* chore(debt): record deferred streams-connector SOUND convergence (streams-connector-sound-deferred)

* chore(run-log): record deb801aa + 74e9e5ce deferred proxy-connector debt entries

* feat(plugin): #180a createPluginService raw-route + serveRpc escape hatch (package-core)

Adds the reusable capability the triggers (raw-body HMAC webhook) and streams
(transparent proxy) connectors need to adopt createPluginService(...).serve().

@netscript/service: new ServiceRouteMethod union adds 'all'; route()/DeferredRoute
retyped; install loop branches 'all' -> app.all(...). @netscript/plugin: new
PluginRawRoute interface + PluginServiceConfig.rawRoutes (forwarded via route())
and serveRpc?:boolean (default true; false skips withRPC for pure passthrough
connectors with no oRPC contract). {} stays a valid ServiceRouter so a no-router
proxy needs no cast. New surface re-exported through both service mods (incl.
ServiceHandler/ServiceRouteMethod from plugin/service/mod for the JSR
private-type-ref rule).

Verified (supervisor-run, independent of generator): scoped check 0 errors,
lint 0 (25 files), deno test 59 passed/0 failed (incl. 2 new raw-route tests:
serveRpc:false catch-all + /health coexist + /api/rpc passthrough; mixed-mode raw
POST webhook unparsed-body alongside withRPC), dry-run @netscript/service +
@netscript/plugin both Success (no --allow-slow-types). No deno.json/lock change.
No new casts. 7 files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(streams): converge connector onto createPluginService proxy surface (#172 S180b)

Migrate the streams service entrypoint from a hand-rolled Hono + Deno.serve
front to the mandated `createPluginService({}, { serveRpc: false, ... }).serve()`
surface, adopting the raw-route + serveRpc escape hatch landed in S180a (c19ebf59).

Streams is the one plugin with no oRPC contract, so it serves with an empty
router (`{}`, a valid ServiceRouter — no cast) and `serveRpc: false` (withRPC
skipped). The transparent proxy to the upstream DurableStreamTestServer moves to
a raw catch-all route (`{ method: 'all', path: '/*' }`); `/health[/live|/ready]`
come from `withHealth`; the upstream-reachability probe is folded into
`healthChecks`. `serve()` now owns the listener and SIGINT/SIGTERM/SIGBREAK
graceful shutdown, so the manual signal listeners and front-server shutdown are
deleted and the upstream `server.stop()` runs as an `onShutdown` hook.

Behavior deltas (both verified benign — no consumer depends on either path):
- `GET /` now returns NetScript service-info (withServiceInfo) instead of
  proxying to the upstream root. E2E probes, Aspire health, and the upstream
  health probe all target `/health` or explicit stream paths, never bare `/`.
- `/health/ready` readiness list is now empty (always ready); createPluginService
  exposes no readiness-predicate knob. Upstream-reachability is still asserted
  via `/health`, which is the path all consumers probe.

Launch contract preserved: aspire/scaffold launch the connector as a direct
`deno run` of services/src/main.ts; it stays a top-level script (no factory —
streams has no DB/registry/context). Version single-sourced from deno.json.

No `any`, no new casts; the only escape is the pre-existing `@ts-ignore` for
Request `duplex` (a Deno lib-types platform gap). Adds a services smoke test
(excluded from the publish tarball). Closes streams-connector-sound-deferred.

Verified (supervisor-run, from the streams package dir):
- `deno task check` (14 entrypoints incl. services/src/main.ts) — 0 errors
- `deno lint services/src` — 0 errors (2 files)
- `deno test services/src/main_test.ts` — 1 passed / 0 failed (graceful
  serve() shutdown + onShutdown hook fired)
- `deno publish --dry-run --allow-dirty` (NO --allow-slow-types) — Success;
  services/src/main.ts in tarball, main_test.ts excluded, no slow types

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(plugin-triggers): #180c converge triggers connector onto createPluginService (oRPC contract + raw HMAC webhook)

Slice A of #180c: migrates the triggers connector from a hand-rolled raw Hono
server to the mandated `createPluginService(...).serve()` surface, binding the
already-SOUND `@netscript/plugin-triggers-core` v1 contract (Hole-A, 74656d71)
for every backed route and fronting the raw-body HMAC webhook ingress through
the #180a `rawRoutes` escape hatch.

Connector (Archetype-5 presentation seam, specifics only):
- routers/router-context.ts: binds `triggersContractV1.$context<TriggerServiceContext>()`
  and exports the precise `TriggersHandlers<K>` mapped type (per-route
  `ImplementedProcedure`, isolatedDeclarations annotation with no `any`/Record erasure).
- routers/v1.ts: the 11-route contract handler map. Five routes backed by real
  runtime state (describe → static PluginCapabilities; listTriggers/getTrigger via
  the loaded definition registry; listEvents/getEvent via the event store). Six
  mutating/streaming routes (fireTrigger, testWebhook, previewSchedule,
  enableTrigger, disableTrigger, subscribeEvents) have no sound triggers-core
  backing yet and defer honestly (throw → oRPC 500; subscribeEvents is an
  immediately-throwing async generator that never violates the SSE schema).
- routers/v1-types.ts: TriggerServiceContext (definitions/eventStore/ingress).
- router.ts: oRPC router assembly { v1 }.
- main.ts: createTriggersService factory on createPluginService (serveRpc:true,
  openApi/docs, context, rawRoutes for POST /api/v1/webhooks/:triggerId[/*]);
  self-bootstrapping createTriggersServiceContext + startTriggersService +
  import.meta.main. Raw HMAC webhook ingress (x-hub-signature-256) reads c.req.raw.
- Deleted routers/events.ts, health.ts, webhooks.ts (folded into v1 handlers /
  withHealth / the raw webhook route).

Type soundness (rock-solid, zero connector casts):
- The webhook handler resolves the external path parameter against the loaded
  definitions and passes the definition's already-branded `.id` to ingress —
  the same brand-free string-resolution pattern as listEvents/getEvent — so the
  prior `triggerId as TriggerId` brand cast is ELIMINATED, not deferred. Unknown
  id → behavior-equivalent 404 (ingress's known set ⊆ context.definitions).
- toContractKind narrows the open domain TriggerKind to the closed contract kind
  by membership test (no cast); tags spread into a fresh mutable array to match
  the contract output type without weakening the domain type.
- Shipped connector source has ZERO casts and zero `any`. Only sanctioned
  categories remain repo-wide (top-level AnyRouter in router.ts; the centralized
  error-map `as unknown` lives in -core, not here). Test-only casts are confined
  to main_test.ts fixtures (branded-id fixture + in-memory status mutate).

Deferred net-new triggers-core surface (manual/test fire helper, persistent
enabled-state store + TriggerDefinitionBase.enabled/name, cron preview engine,
event-subscription/SSE seam, typed internalError helper) recorded in
.llm/harness/debt/arch-debt.md (TRIGGERS-CONNECTOR-DEFERRED-ROUTES) and queued as
the PLAN-EVAL-gated triggers feature-backing program (task #181). This slice is
strictly additive vs the prior raw-Hono connector, which served none of the
contract routes.

Verified (supervisor-run, independent of the generator), from plugins/triggers:
- deno task check (12 entrypoints incl. services/src/main.ts) — EXIT=0
- deno lint services/src (6 files) — EXIT=0
- deno fmt --check services/src (6 files) — EXIT=0
- deno test --allow-all --unstable-kv services/src/main_test.ts — 1 passed (6 steps), 0 failed
  (incl. unknown-id → 404 and known-id → ingress webhook assertions)
- deno publish --dry-run --allow-dirty (NO --allow-slow-types) — Success
No deno.json/deno.lock change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(run-log): record c19ebf59 + 4f66f645 + 45446f3f (#180a/b/c proxy-connector slices)

* docs(plugins): #176 dual role-README convergence (connector + -core, all 5 kinds)

Converges all ten plugin READMEs to the canonical dual-role shape so the
connector↔core split reads identically across workers/sagas/triggers/streams/auth.
Authored by per-kind Opus agents under the doc-authoring exception; supervisor
independently verified (no source/deno.json/mod.ts touched, fmt-clean, every
claim grounded in deno.json exports + deno doc).

CONNECTORS (plugins/<kind>/README.md): every tagline now uses the canonical
"The deployable <feature> plugin for NetScript. It binds the host plugin system
to <specifics> through a single declarative manifest." form (auth/triggers
reshaped from "official"/"trigger-processing", sagas "durable"→"deployable").
Every connector now closes Key Capabilities with the explicit core cross-link
("The reusable <X> live in @netscript/plugin-<kind>-core; this package binds them
to the host") — newly added to streams + auth, expanded for triggers, already
present for workers/sagas. The `netscript plugin add <kind>` command is verbatim
in every file (no add->install pre-emption).

CORES (packages/plugin-<kind>-core/README.md): every tagline now ends with the
mandated "...the core that the deployable @netscript/plugin-<kind> plugin binds
to the host" clause (auth-core reframed from "contract layer", sagas/triggers
reshaped). Key Capabilities expanded to cover real-but-undocumented subpaths,
each verified via deno doc: workers-core (+./presets/./runtime/./streams/./schemas
/./config/./abstracts), sagas-core (+./transports/./stores/./middleware
/./integration/./agent), triggers-core (+./adapters, ack-then-process two-phase
explanation naming TriggerEventStorePort/TriggerProcessorPort, scheduler/verifier/
clock/file-watcher ports). streams-core was already compliant and is unchanged.

Accuracy fixes (grounded, not invented): triggers connector
inspectTriggers() -> inspectTriggers(triggersPlugin) (real signature), Triggers
API service named triggers-api port 8093, capabilities scoped to the BACKED
surface only (no fire/test/preview/enable/disable/subscribe advertised, matching
the deferred-route reality from #180c); workers connector documents ./contracts.

Surgical convergence only — accurate existing prose, examples, install manifests,
docs links, and licenses preserved. 9 files changed (streams-core untouched),
+74/-43. READMEs only; no framework source. Verified: deno fmt --check on all 9
files EXIT=0; plugin README typescript fences are not doctested (the doctest
fixture is packages/service/tests/_fixtures/readme-examples_test.ts, and the
single fence edit is the corrected inspectTriggers signature).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(run-log): record #176 dual role-README convergence slice

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* refactor(cli)!: #157 S4 — rename plugin verb `add`→`install`, delete renderPlugin full-source (breaking)

Unified S4 of the #157 plugin re-architecture. The plugin verb is now `install`
everywhere (zero-compat, no `add` alias) and the full-source `renderPlugin`
fallback is deleted so `netscript plugin install` ALWAYS uses the plugin-owned
thin scaffold path.

- Verb: `FRAMEWORK_VERBS`/`FrameworkVerb`/`isFrameworkVerb` flip `add`→`install`
  (dispatch-plugin-verb.ts, public-api.ts); public + local `plugins-group.ts`
  register `install`; `.name('install')` in both command surfaces.
- Folder rename `features/plugins/add/`→`install/` (public) and
  `local/.../plugins/add/`→`install/`; `plan-plugin-add`→`plan-plugin-install`;
  domain `plugin-add-plan`→`plugin-install-plan`; e2e `plugin-add-gates`→
  `plugin-install-gates`. `render-plugin.ts` filename kept; `renderPlugin` export
  DELETED, `renderPluginSupport` retained.
- Sound fallback: when no resolvable plugin package + process runner, the command
  throws `ScaffoldValidationError` (not a silent full-source render). Config
  wiring + `copyPluginSchemasToRootDb` preserved.
- Skills regenerated via sync-claude-skills.ts (.agents + .claude netscript-cli).
- Other verbs (`service add`, `db add`, `contract add`) intentionally untouched.

Supervisor-verified independently of the generator: scoped `deno check` GREEN
(542 files, 0 errors); `deno publish --dry-run` Success (no `--allow-slow-types`);
repo grep clean of `renderPlugin(`/`addPlugin(`/`plan-plugin-add`/`features/plugins/add`.

Known follow-up (out of this slice): `packages/plugin` skeleton templates still
print `netscript plugin add {{pluginName}}` into generated READMEs/mod headers;
fixing needs a `packages/plugin` template + `embedded.generated.ts` regen slice.

Refs #157 #163

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): record PLUGIN-RUNTIME-ADAPTER-RELOCATION (#172b/c/d) debt — relocate + migrate KV stores onto @netscript/kv

Open, PLAN-EVAL-gated debt for the final #172 thin-connector convergence step.
Two coupled defects in the sagas/triggers/workers connectors that still ship
runtime stores/adapters under `plugins/<kind>/src/runtime/`:

1. Placement: by the #157→#172 thin-connector law these port→backend adapters
   belong in `@netscript/plugin-<kind>-core` (`stores/`/`adapters/`).
2. Primitive-bypass / engine lock: sagas + triggers KV stores hardwire raw
   `Deno.openKv` + the Deno-native fluent atomic, bypassing the engine-agnostic
   `@netscript/kv` primitive — forfeiting Redis / in-memory / reactive-watch.
   Workers `KvWorkerIdempotencyStore` already does it right (the reference).

Scope = relocate + migrate (not a blind file move): rewrite the sagas/triggers
KV stores onto `@netscript/kv` (`KvStore` + `AtomicCheck/Mutation/Result`,
injected handle), adding `@netscript/kv`(+`@netscript/cron`+`@netscript/watchers`
for triggers) deps to the `-core` packages — which is the ENCOURAGED direction,
not a cost. No "minimize -core deps" rule exists; an earlier "D1" framing of that
was removed. Net-new vs the PASSed scaffold-surface S1–S7 plan → gated separately.

Linked plan: .llm/tmp/run/feat-scaffold-surface-167--adapter-relocation/{plan,research}.md

Refs #157 #172

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): #172b/c/d relocation+migration run artifacts (research + plan) for PLAN-EVAL

Adds the adapter-relocation run-dir research.md + plan.md so the PR-branch-checkout
PLAN-EVAL session can read the canonical plan. Scope = relocate sagas/triggers/workers
runtime stores+adapters into their `-core` packages AND migrate the sagas+triggers KV
stores off raw `Deno.openKv` onto `@netscript/kv` (engine-agnostic; mirrors the workers
`KvWorkerIdempotencyStore` reference). Locked decisions D-KV / D2 / D3 / D4. No "minimize
-core deps" rule — depending on `@netscript/*` primitives is the encouraged direction.
PLAN-EVAL hard-gate; no implementation slice before PASS.

Refs #157 #172

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(openhands): apply agent changes

* chore(openhands): record run trace 28412780609-1

* feat(harness)!: #164 S5a — extend arch:check over packages/plugin + 5 plugins; fix A4 detector

Unified S5 part 1 (gates-as-gates): bring the doctrine fitness checker to bear on
the full #172 thin-connector surface, not just the auth packages.

arch:check task (deno.json): appends 5 roots — packages/plugin, plugins/workers,
plugins/sagas, plugins/triggers, plugins/streams (plugins/auth already covered).
All 10 roots now gate FAIL=0 (warnings/infos only: README fence counts, export
default in scaffold-emitted stubs, missing docs/architecture.md — none gate-failing).

check-doctrine.ts A4 detector fix (the enabling tooling change): the A4
"base classes are stub-only contracts" detector only matched abstract METHODS,
so it false-flagged 13 conformant classes when run over the new roots. Two
doctrine-grounded gaps closed (doctrine file 03):
  1. Abstract field/accessor declarations now count as abstract members.
     Doctrine §"The stub-only rule" (line 34) explicitly lists `abstract readonly
     id/kind/version` identity fields as the contract a spine base imposes. The
     detector now recognizes `abstract get/set foo()` and `abstract [readonly]
     name:` alongside abstract methods. Clears the 11 `Plugin*Contribution`
     spine bases in packages/plugin/src/abstracts/ (each declares `abstract
     readonly axis`/`name`/`entrypoint`).
  2. A `protected constructor` marks a deliberate layer-2 / non-instantiable
     base (doctrine §"Spine versus layer-2 abstracts" / R-BASE-L2) — such bases
     may carry concrete shared behavior and need not declare abstract members.
     The stub-only rule applies to the spine, not to layer-2 abstracts. Clears
     WorkersCliCommand + TriggersCliCommand (CliCommand sub-axis, protected ctor,
     multiple concretes, delegate to an injected backend not to spine lifecycle
     methods).

The existing "public mutable field on a base" WARN is unchanged and still guards
state leakage. No source change to any packages/ or plugins/ file — only harness
tooling (.llm/tools/fitness/check-doctrine.ts) + the arch:check task wiring.

Verified (supervisor-run): deno check --unstable-kv on the checker GREEN; all 5
new roots FAIL=0; the 5 existing auth roots stay FAIL=0; full `deno task
arch:check` EXIT=0 end-to-end (deps:check + all 10 doctrine roots). No deno.lock
change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): record S4 (63268439) + S5a (e55a8afa) in commits.md

Append-only run-log bookkeeping for the feat/scaffold-surface-167 program.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(harness): #164 S5a-2 — add 3 -core packages to arch:check (PLAN-EVAL #182 fix #4)

Extends the arch:check task to also enumerate packages/plugin-sagas-core,
packages/plugin-triggers-core, and packages/plugin-workers-core. The #182
PLAN-EVAL flagged that the arch:check denominator did not include the -core
packages the #172b/c/d relocation moves stores INTO, so post-relocation layering
leakage (connector->core, or a -core taking a forbidden dep) would go unflagged.

With S5a (connectors + packages/plugin) this makes arch:check cover the full
#172 surface: 13 roots (5 auth + packages/plugin + 4 connectors + 3 non-auth
-core). All 13 gate FAIL=0; full `deno task arch:check` EXIT=0 end-to-end.

Resolves PLAN-EVAL fix #4 (arch:check denominator) by amending the deno.json
task rather than substituting arch:check:repo in slice gates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): #182 #172b/c/d PLAN-EVAL cycle-1 fixes — plan.md + research.md

Applies the 4 required fixes from the FAIL_PLAN verdict (cycle 1):

1. D2 doc-fence — research.md "Pre-flight verification" pastes the full connector-path
   grep: the SOLE first-party importer of a relocated symbol is
   docs/site/capabilities/durable-sagas.md:331 (resolveSagaStoreBackend). Every other
   @netscript/plugin-<kind>/runtime reference imports symbols that STAY
   (createDurableSagaRuntime/createSagaPublisher) or is prose/manifest; reference-page
   store mentions are PORT interfaces (already in -core/ports), not relocated concrete
   stores. plan.md S-b.5 splits that one fence's import (no shim) + re-greps to zero.

2. S-c KvTriggerEventStore deconflict — research.md records the collision (testing
   fixture at packages/plugin-triggers-core/src/testing/kv-trigger-event-store.ts:5 vs
   relocated production store) and the repo's own taxonomy fix
   (extension-axes.md:18: Kv* = real store, Memory*/Recording* = test doubles).
   plan.md S-c.5 renames the fixture to MemoryTriggerEventStore (mandatory, gated by a
   zero-ref grep).

3. ## Risks block added to plan.md (R1 D2 break, R2 name collision, R3 KV-migration
   semantic drift + FAIL stop condition, R4 arch:check denominator, R5 lock churn).

4. arch:check denominator — plan.md Gates now reflect that the task enumerates the 3
   destination -core packages (deno.json amended in e999a9ea); all 13 roots FAIL=0.

Plan + research only — no deno.lock, no source, no packages/ or plugins/ file touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): record e999a9ea (S5a-2) + e0d85440 (PLAN-EVAL cycle-1 fixes) in commits.md

Append-only commit-log bookkeeping for the two #182 PLAN-EVAL cycle-1 commits:
the arch:check -core extension (fix #4) and the plan.md/research.md fixes
(#1 D2 doc-fence, #2 KvTriggerEventStore deconflict, #3 ## Risks block).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): #182 record PLAN-EVAL cycle-2 dispatch + applied-fix summary

Appends a Cycle-2 dispatch section to the adapter-relocation plan-eval.md:
the four cycle-1 required fixes (D2 doc-fence e0d85440, S-c KvTriggerEventStore
deconflict e0d85440, ## Risks block e0d85440, arch:check denominator e999a9ea)
and the OpenHands minimax-M3 re-dispatch (PR #172 comment 4839015840). Plan-Gate
hard stop remains: no S-b/S-c/S-d slice before cycle-2 PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): #182 record PLAN-EVAL cycle-2 verdict PASS — gate cleared

Cycle-2 OpenHands minimax-M3 returned PASS (PR #172 run 28413720834): all 4
cycle-1 FAIL_PLAN findings RESOLVED; 8 Plan-Gate boxes + 4 decisions PASS. One
non-blocking S-c.5 advisory carried to IMPL (rename target MemoryTriggerEventStore
also taken in testing/ barrel — implementer picks a distinct name). S-b/S-c/S-d
implementation is unblocked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(sagas): relocate runtime stores to core

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(triggers): relocate runtime stores to core

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(workers): relocate idempotency store to core

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): record adapter relocation slices

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* fix(harness): unblock auth arch fitness gate

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(openhands): apply agent changes

* chore(openhands): record run trace 28416306379-1

* fix(plugin): restore scaffold cli bridge

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* fix(cli): reconcile plugin install list contract

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* docs(harness): runtime-launch-contract research + plan (PLAN-EVAL input)

Final #173 chapter: thin-dep plugin runtime-launch contract closing
PLUGIN-RUNTIME-DEPENDENCY-ENTRYPOINT-EXPORTS. Hybrid contract (services
by package-spec ./services; background via install-generated userland
glue importing new public ./runtime export). Grounded slices 0-6.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(openhands): record run trace 28419815466-1

* docs(harness): fold PLAN-EVAL PASS refinements into runtime-launch plan

PLAN-EVAL PASS (OpenHands minimax-M3, run 28419815466). Folded 4
non-blocking clarifications: Slice0 sagas option-a is a deno.json
re-export; Slice2 standardize via additive shim not rename; Slice4
glue folder = resources/glue/; R5 WithEnvironment env is process-scope
and survives jsr:-launch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Add sagas runtime launch export

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Expose workers runtime launch API

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Expose triggers runtime launch shim

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Expose streams service launch export

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Emit plugin runtime launch glue

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Launch plugins through runtime contract

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Honor plugin npm catalog dependencies

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Resolve plugin launch specifiers in generated workspaces

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Stabilize runtime launch generated workspaces

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Resolve plugin service bootstrap through import maps

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Keep workers health alive without streams

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Defer plugin runtime dependencies until after listen

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Return empty sagas read model before startup

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Start triggers API before runtime hydration

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Retry transient Prisma database readiness failures

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Resolve trigger webhook runtime paths

* Clean trigger webhook path regression

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Align trigger starter webhook identity

* Expose trigger registry to package-launched services

* Launch local plugin services from source checkouts

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* Stabilize runtime launch E2E gate

* Cover local plugin service appsettings launch

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* feat(cli): follow .netscript-source-root marker for local plugin source discovery

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* fix(triggers): expose registry to package-launched service

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(harness): finalize scaffold runtime evidence

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* test(cli): derive trigger service fixture specifier

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* fix(cli): keep official plugin services package-launched

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* fix(sagas): honor runtime kv path in supervisor tests

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* chore(harness): record check-test finalization

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

* style(plugins): deno fmt convergence contract + router drift

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_014gW4zfhMMQU6txC828ijct

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: OpenHands Bot <openhands@all-hands.dev>

…n-dir currency)

Worklog: full-surface gate defect fix (6ff46c8), WSL daemon repair, Amendment A2
record, and the S9 audit classification (85 tools: KEEP 33 / HARDEN 24 /
DEPRECATE-DELETE 1 / AMBIGUOUS 27; 3 #307 debt items confirmed). Classification
posted to PR #390 (issuecomment-4881590662); 2 decisions escalated to coordinator
(confirm root release.ts delete; verdict on 27 fitness/ #157 CLI gates). Audit-only
— no destructive action.

Refs #306 #307

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

…ols + reconcile gate docs

Owner-confirmed deletion (both S9 audit decisions). Every file removed had ZERO live
callers — re-verified before rm: no deno.json task, no .github workflow, no surviving
tool imports any of them. `deno task arch:check` runs check-doctrine.ts per-root (NOT
the deleted check-architecture-gates.ts), and release:publish targets
release/github-release.ts (NOT the deleted root release.ts).

Deleted (28):
- 27 unwired fitness/ gates: the 19 CLI-doctrine gates (check-cli-*, check-*-shape,
  check-*-edges, check-template-*, check-abstract-coloc, check-folder-cardinality,
  check-no-i-prefix, check-cliffy-containment) + their shared lib cli-fitness-shared.ts,
  the check-architecture-gates.ts aggregator, 4 readiness orchestrators
  (audit-all-packages, release-readiness, generate-package-plans,
  check-netscript-standards), and 2 fresh-ui drift gates (check-token-drift,
  check-manifest-integrity). None were wired to any task/workflow/skill; the doctrine
  they reference lives in the doctrine docs, and #157 can build fresh gates later.
- root release.ts: superseded gh-release wrapper (no callers; stale rickylabs default).

Surviving fitness surface: check-doctrine.ts (mechanical AP-1..AP-30 authority, the
script arch:check runs), audit-jsr-package.ts (per-package JSR+doctrine, F-1..F-7),
check-ds-no-raw-hex.ts + check-ds-color-utilities.ts (design-system token gates),
check-ds-gates_test.ts.

Doc reconciliation (in-surface):
- .llm/harness/gates/fitness-gates.md: rewritten to name ONLY the surviving surface;
  fixed the factual error (arch:check runs check-doctrine.ts, not
  check-architecture-gates.ts); PENDING_SCRIPT elevated to the common case now the
  per-domain family is gone. Removed families named in the negative to document the
  reduction.
- .llm/harness/gates/archetype-gate-matrix.md: Phase A example list updated to the
  surviving scripts.

Out-of-surface refs FLAGGED for owner/#305 (NOT edited): doctrine
09-anti-patterns-and-fitness-functions.md (names check-folder-cardinality.ts /
check-abstract-coloc.ts; #305 lane; already stale pre-deletion) and
docs/architecture/DOCS-STRUCTURE.md (names release-readiness.ts; docs/** outside this
run's surface).

Validation: run-deno-check --root .llm/tools/fitness = 5 files, 0 errors, exit 0;
check-doctrine.ts --root packages/plugin smoke exit 0 (no missing-import crash);
grep-zero for all 28 <name>.ts across in-surface paths (only docs/** flagged files +
.llm/runs history remain). A1 slice-review by Tier-A supervisor before commit.

Refs #157

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

…oard design (Stage D+/E)

Opus-A integrated the manage-through-UI corpus (Appwrite/Directus/Strapi) into
design/A-dashboard/: IA shift from a flat "Plugin Control list" to cross-cutting
panels + per-capability create->configure->monitor sections; new DDX-17
DashboardPanelContribution seam (.withDashboardPanel, thinness-correct contract in
plugin-dashboard-core, Aspire-style discovery, @netscript/plugin stays
dashboard-agnostic), DDX-18a-d per-capability sections (workers/sagas/triggers/
streams, thin, beta.6), DDX-19 codegen-from-UI "Add resource" (stable, #157-safe,
#238 AI handshake). D-NSONE sharpened via the Directus panel-contribution precedent.

Reconciled into plan.md: dashboard slices DDX-0..19; DAG IA-shift note; new owner
forks OF-10..OF-13 (=OQ-11..14) added to the open-decision sweep (per-capability-vs-flat,
sugar-vs-core-axis, codegen milestone/#238, schema-driven db tab) — none FAIL_PLAN.
DDX-0..16 unchanged, so plan.md's DDX-8 flagship co-land references remain valid.
pr-body.md status refreshed to current reality (A-E done) + owner-expanded-source-set note.

Planning-only: no GitHub mutation, no framework code. PR #397 stays draft.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

…atures → Road-to-0.0.1-stable) (#397)

* plan(roadmap): seed roadmap-expansion harness run — per-topic specs + Fable delegation charter

Structured steering input for the Fable 5 roadmap supervisor to fold the 5
backlog features (dev-dashboard, telemetry revamp, tutorial rewrites,
positioning docs, deno-desktop+single-process deploy) into Road-to-0.0.1-stable.

- specs/00 authoritative: mission + A-to-G delegation flow (Fable -> Sonnet-5
  workflow -> Opus-4.8 deep-dives -> WSL Codex adversarial -> OpenHands PLAN-EVAL)
  + B1-B4 output contract + overnight/memory directive + hard boundaries
- specs/01 ratified decisions: milestone train, D1-D4, R1/R4, positioning lock,
  delegated calls (D-NSONE, telemetry flow)
- specs/02 eis-chat reference: per-topic reading map
- specs/topic-A..E: each preserves the owner's original bullets verbatim
- matrix/ analysis/ research/ context/: B-output folder contracts
- FABLE-PROMPT.md: thin launch prompt + PR discipline mandate
- harness artifact skeletons for Fable to fill

Planning only — no GitHub mutation, no framework code until the owner ratifies.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): add PR #397 ref + env-split push recipe to Fable launch prompt

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage A complete — worklog + A→G phase registry; stage B (Sonnet 5 deep-search x5) launched

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage B corpus — Sonnet-5 deep-search across all 5 topics (75 files, B1-B4)

Five concurrent Sonnet-5 agents (one per topic) filled the B1-B4 output contract:
matrix/ (resource matrices), analysis/ (exhaustive codebase surface), research/
(distilled external sources), context/ (diagrams, candidate flows, open questions).
Every topic sub-folder carries an INDEX.md. Facts-over-verdicts preserved on all
delegated decisions (D-NSONE, telemetry grouped-trace flow, E sequencing).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage B drift log + bookkeeping — 9 spec-vs-reality drift candidates

Records the load-bearing divergences the B corpus surfaced (E1 172a-2 misattribution,
E2 #327 WATCH placement, A1 D-NSONE reframe, A2 no TS interaction-service, B1 thin
cross-language boundary, B2 telemetry-worse-than-leveling + triggers bug, CD1 #232
disjoint scope, C1 5-tracks + missing milestones, D1 two-IA blocker). Worklog +
phase-registry advanced to stage C.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage C — Fable synthesis + provisional resolution of both delegated decisions

D-NSONE: promote the missing L3 blocks layer into fresh-ui (L0-L2 already byte-identical
copy-source); leave MCP-specific components out unless dashboard IA needs them. Telemetry
grouped-trace flow: two-tier — beta.6 flagship = Flow B framework-native multi-process
pipeline (workers->oRPC callback->streams fan-in with span-links); stable = Flow A
cross-language duckdb.exe subprocess hop (needs net-new span + env-carrier + language shim).
Records telemetry-revamp true scope (package restructure + triggers bugfix + streams/ai
from zero) and E scope correction (172a-2 misattribution; ClientLinkPort is the real precursor).
Owner-facing forks flagged (missing milestones, #232 rescope, #327 rescope).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage D launched — 4 Opus 4.8 deep-dive design agents; stage C marked done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): draft research.md — consolidated corpus + delegated-decision resolutions + jsr-audit surface scan

Written to the Plan-Gate checklist: re-baseline vs main@eeaff336, 14 verifiable load-bearing
findings, planned public-surface deltas (fresh-ui L3 blocks, telemetry OTEL-adapter subpath,
sdk ClientLinkPort, new plugin-dashboard-core) with slow-type risks, delegated decisions +
owner forks. Independent of the in-flight Opus deep-dives.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage D complete — 4 Opus deep-dive design proposals (16 files)

dev-dashboard (DDX-0..16): thin plugins/dashboard + packages/plugin-dashboard-core; Aspire
command-kind seam HARD beta.6; 7-panel IA; D-NSONE promote 7 L3 blocks (drop data-grid
collision, MCP out); DDX-8 flagship trace co-land gate on telemetry.
telemetry-revamp (T1..T9): TC-1..14 convention + ports/adapters restructure; thin-default
+ opt-in-SDK-on-fan-in; triggers W3C bugfix + oRPC span-creation + streams/ai from zero;
@netscript/telemetry/query surface; real Flow-B e2e; Flow-A duckdb + AI adapter at stable.
docs-cut (S0 + C1..C6 + D1..D9 + V): IA-reconciliation precursor; 5 tutorial rewrites +
minimal on-ramp; per-pillar positioning; #232 Option-2 (new child epic) recommended.
#327 rescope (E1..E8): ClientLinkPort in-process adapter precursor; tursodb single-writer
relocation; option b->c ladder; #375 folded; #349 kept WATCH-sibling (not merged).

Cross-topic edges reconciled (query contract, flagship co-land gate). Planning only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): stage B addendum — owner-expanded Topic-A source set (BaaS admin consoles)

Owner steered the dashboard research to add the manage-through-UI category the first
dev-console teardown missed: Appwrite Console (north-star — per-capability create/configure/
monitor loop for every backend primitive), Directus (extension taxonomy: plugin-contributes-a-
panel SDK contract; schema-driven UI generation), Strapi (codegen-from-UI mirroring the CLI +
in-dashboard AI-on-codegen). New research/A-dashboard/04-baas-admin-console-teardown.md +
matrix/_draft-competitor-rows-baas.md (17 rows, kinds manage/extensibility/codegen-ui/ai-iterate).
Opus-A resumed to fold these into the panel IA, a .withDashboardPanel extensibility axis, and
the D-NSONE call. Planning only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): lock integrated cross-epic plan.md + worklog ## Design (Stage E)

Integrated program plan folding owner topics A-E into Road-to-0.0.1-stable (#301):
12 locked decisions (Spine-1 co-land, D-NSONE=fresh-ui L3, two-tier trace flow,
telemetry restructure, dashboard thin-plugin+core, Aspire command-kind seam,
E ClientLinkPort precursor, docs-only wave). 9-fork open-decision sweep (only OF-5
must-resolve-now, resolved technically by LD-4). Cross-epic DAG + beta.5->stable
milestone train + risk register + per-epic gate matrix + deferred scope.
Commit-slice framing satisfies <30 at both run and per-epic levels.

Planning-only: no GitHub mutation, no framework code. PR #397 stays draft.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): fold owner-expanded Topic-A BaaS source set into dashboard design (Stage D+/E)

Opus-A integrated the manage-through-UI corpus (Appwrite/Directus/Strapi) into
design/A-dashboard/: IA shift from a flat "Plugin Control list" to cross-cutting
panels + per-capability create->configure->monitor sections; new DDX-17
DashboardPanelContribution seam (.withDashboardPanel, thinness-correct contract in
plugin-dashboard-core, Aspire-style discovery, @netscript/plugin stays
dashboard-agnostic), DDX-18a-d per-capability sections (workers/sagas/triggers/
streams, thin, beta.6), DDX-19 codegen-from-UI "Add resource" (stable, #157-safe,
#238 AI handshake). D-NSONE sharpened via the Directus panel-contribution precedent.

Reconciled into plan.md: dashboard slices DDX-0..19; DAG IA-shift note; new owner
forks OF-10..OF-13 (=OQ-11..14) added to the open-decision sweep (per-capability-vs-flat,
sugar-vs-core-axis, codegen milestone/#238, schema-driven db tab) — none FAIL_PLAN.
DDX-0..16 unchanged, so plan.md's DDX-8 flagship co-land references remain valid.
pr-body.md status refreshed to current reality (A-E done) + owner-expanded-source-set note.

Planning-only: no GitHub mutation, no framework code. PR #397 stays draft.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(roadmap): F1 WSL-Codex adversarial review of locked design

Co-Authored-By: Codex <codex@openai.com>

* docs(plan): F2 adversarial-review fixes (F1-01..F1-10)

Resolve all 10 WSL-Codex F1 findings in the roadmap-expansion planning
artifacts (planning-only; no framework code, no GitHub mutation):

- F1-01 BLOCKER: LD-2 + research#1 no longer overstate fresh-ui evidence
  (5/37 pairs sampled-identical; remaining 32 = DDX-0 full-tree-diff gate).
- F1-02 BLOCKER: OF-10 reclassified must-resolve-now (drafted issue graph
  already assumes per-capability); closing note corrected to OF-5 + OF-10.
- F1-03 BLOCKER: DDX-8 + DDX-16 hard-depend telemetry T4/T5/T6/T7 by ID;
  acceptance fails if the oRPC callback span is mock-only.
- F1-04 MAJOR: DDX-16 given an explicit full beta.6 dependency list.
- F1-05 MAJOR: wave:* label-sync folded into OF-1; DDX-19 wave:v2->wave:defer.
- F1-06 MAJOR: gate:jsr + publish acceptance on DDX-0/2/4/17 and #E1.
- F1-07 MAJOR: dashboard slice count corrected 20 -> 23 (< 30 holds).
- F1-08 MAJOR: DDX-2/proposal folder vocab fixed (telemetry/->middleware/;
  public/ reframed as harness-observed #305/#306 divergence).
- F1-09 MINOR: #E2 Closes #375 moved from issue body to resolving-PR body.
- F1-10 NIT: research#14 extended to beta.5/beta.8 milestones.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* docs(harness): land PLAN-EVAL verdict-of-record (PASS) + owner-ratified forks

Restore the OpenHands run-28716441078-1 (minimax M3) filled plan-eval.md that
the CI commit-back steps failed to push (branch previously held the empty
template). Content recovered verbatim from the run log; provenance noted in-file.
Record owner ratification (2026-07-04): OF-5 opt-in OTel-SDK on fan-in; OF-10
per-capability sections; OF-11 DashboardPanelContribution contract owned by
plugin-dashboard-core (not a core axis).

Planning-only; PR #397 stays draft.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* docs(harness): F-ai Stage B corpus + Stage C synthesis (AI suite topic)

Topic F-ai (6th roadmap topic) folded in post-ratification. Stage B: 4 Sonnet-5
deep-search agents, 14 files across research/context/analysis/matrix/F-ai.
Verdict: F-ai is evaluate-and-harden, not rebuild — the five-home #238 split is
correctly shaped; eis-chat is the proof-of-pattern reference. 5 flagship gaps +
contract-bypass + missing doctrine backstop identified. Stage C: Fable synthesis
with working positions + 5 owner forks; Stage-D fan-out = one Opus-F deep-dive.

Planning-only; PR #397 stays draft.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(f-ai): Stage D+E — lock the AI-suite topic into the roadmap (planning only)

Folds the 6th topic (F-ai / NetScript AI suite) into the Road-to-0.0.1-stable
program after the A–E Plan-Gate PASS + owner ratification. Design of record
(Opus-F, 18-slice FAI-0…17 DAG) committed; plan.md carries a self-contained
Topic-F-ai section (LD-F1…F6, ai-stack epic row, DAG lane, OF-F1…F8 forks,
DRAFT supersession map, risks) that leaves the ratified A–E LD/OF numbering
untouched. Verdict: evaluate-and-harden, not rebuild.

No framework code, no GitHub mutation. F-ai has its own Plan-Gate pass pending
(F1 adversarial → F2 fixes → G OpenHands PLAN-EVAL). PR #397 stays draft.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(f-ai): F1-ai adversarial review of the AI-suite design

* plan(F-ai): resolve F1-ai adversarial findings + V3 commits.md cleanup

Stage F2 of the Topic F-ai leg. Resolves all 8 findings from the WSL-Codex
adversarial review (F1-ai-adversarial-review.md, verdict FAIL_PLAN):

- F1AI-01 (BLOCKER): remove invented beta.6 Topic-A "dashboard AI panel";
  reframe FAI-0..3 as a parity FLOOR for the OF-6 telemetry seam + stable
  DDX-19 handshake, not a Topic-A beta.6 hard-dep (proposal, plan DAG/OF-F3,
  OQ-3). No ratified Topic-A artifact edited.
- F1AI-02 (BLOCKER): FAI-17 cross-topic deps corrected T1+T6 -> T3+T6
  (T1 transitive via T3), matching Topic-B T9's declared deps.
- F1AI-03 (BLOCKER): single authoritative supersession headline
  "15 KEEP - 1 FOLD (#257->#379) - 0 close - 3 NEW (FAI-4/10/11)";
  #272 = KEEP-stable, not a fold.
- F1AI-04 (MAJOR): epic-header label-sync owner action (epic:/wave: into
  .github/labels.yml, folded into OF-F4); FAI-10/11/14 wave:defer -> wave:v1.
- F1AI-05 (MAJOR): add Archetype gate matrix (surface->archetype->gates)
  + plan epic-entry gate note.
- F1AI-06 (MAJOR): OF-F3 reclassified safe-to-defer.
- F1AI-07 (MINOR): FAI-9 renamed "beta.6 capability merge gate" + per-milestone gates.
- F1AI-08 (NIT): tighten FAI-0/FAI-6 file:line refs.

V3 harness cleanup: delete run-root commits.md; correct "append commits.md"
wording in A/B/E agent-briefs.md to the V3 commit trail.

Divergences recorded in drift.md (FAI-1, FAI-2, V3); worklog n6 rows added.
Planning artifacts only: no framework code, no GitHub mutation. PR #397 stays DRAFT.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* docs(harness): land F-ai PLAN-EVAL verdict-of-record (PASS)

Stage G of the Topic F-ai leg. Transcribes the independent OpenHands PLAN-EVAL
verdict (run-28722662042-1, minimax M3, separate session) into
plan-eval-F-ai.md with a provenance header. Verdict: PASS.

- Plan-Gate 8/8 satisfied; all 8 F1-ai findings (F1AI-01..08) verified FIXED
  at F2 (1d3ca08) with file:line evidence; independent 11-candidate
  open-decision sweep found 0 rework-forcing deferrals.
- The runner committed the file as a1e66534 but the CI "commit back to PR
  branch" step failed to push it (known caveat); content recovered verbatim
  from run artifact openhands-agent-28722662042-1 and landed here.
- A-E plan-eval.md (run-28716441078-1) unchanged. Plan now fully ratified
  (A-E PASS + F-ai PASS).

Planning artifact only; no framework code, no GitHub mutation. PR #397 stays
DRAFT and Phase-2 filing remains HARD-STOPPED pending owner authorization.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

* plan(morning): pre-stage reversible one-shot filing package (no GH mutation)

Five reversible planning artifacts so the owner's own OF-5/OF-10 go-message
can drive the whole Phase-2 batch in one shot. ZERO GitHub mutation, PR #397
stays DRAFT, no undraft/merge/filing/closes/impl-launch this session.

- OWNER-DECISION-BRIEF.md: 4 primary unblock inputs (OF-5 opt-in SDK, OF-10
  per-capability, milestones=create beta.6/7/8, labels=3 new epic labels) each
  one-line-answerable + rework cost of each alternative; + secondary forks.
- SUPERSESSION-MAP.md: audit of 47 open issues -> 41 KEEP / 2 FOLD
  (#257->#379, #375->#E2, both via downstream PR closing-keyword) / 0
  filing-time closes; live-read corrections captured.
- filing-manifest.md: per-epic create/update index (telemetry T1-9, dashboard
  DDX-0..19, docs, desktop #E1-8, F-ai re-sequence + FAI-4/10/11) with
  taxonomy+milestone+closing-keyword+DAG per issue; empty close-list.
- proposed-labels-patch.md: unified diff for .github/labels.yml (NOT applied to
  the live file); repo create = only 3 new epic labels.
- beta5-launch-brief.md: telemetry supervisor brief (T1->T2 wave, crit path to
  beta.6, WSL Codex draft-PR-per-slice, separate-session eval).

Live-read corrections: 0.0.1-beta.5 already exists (create beta.6/7/8 only);
wave:* + epic:ai-stack/deployment already live on the repo (labels.yml file is
stale). Both contradict stale design-doc assumptions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012wKHquACkXnWPDgJYhhFjN

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Codex <codex@openai.com>