Harden workspace-scoped route access

.gitignore

@@ -1,3 +1,6 @@
+# Agent loop logs
+logs/
+
 # Dependencies
 node_modules/
 
@@ -45,3 +48,6 @@ playwright-report/
 # Claude Code context files (root CLAUDE.md is committed for AI agent discovery)
 **/CLAUDE.md
 !/CLAUDE.md
+
+# OpenCode configuration
+opencode.json

BLOCKERS.md

@@ -0,0 +1,35 @@
+# Mission Control Implementation Blockers
+
+## TASK 4: Activate memory-review-weekly cron job
+
+**Date**: 2026-05-02
+
+**Blocker**: The cron system (`src/app/api/cron/route.ts`) reads and writes to
+`~/.openclaw/cron/jobs.json` (the OpenClaw daemon's config file). There is no
+standalone MC-native cron table in the SQLite database.
+
+**Implications**:
+- Creating a cron job via `mc cron create` writes to `~/.openclaw/cron/jobs.json`,
+  which is only processed when the OpenClaw daemon is running.
+- Activating the job silently in test/offline context would create a dangling entry
+  that never fires.
+- `SCHEDULES.md` says: "No schedule activates automatically. Owner or Systems
+  Curator must enable it explicitly." — this is consistent.
+
+**What was implemented instead**:
+- Created `scripts/mc-memory-review.cjs` — a standalone observe-only script
+  that reads the SQLite memory store directly and appends results to
+  `logs/mc/memory-review.jsonl`.
+- `SCHEDULES.md` has **not** been reconciled yet. It still describes the
+  planned Mission Control cron model and should be updated separately once the
+  scheduling/runtime story is unified.
+- The script is idempotent: running twice in the same UTC day is a no-op.
+- Added `"mc:memory-review": "node scripts/mc-memory-review.cjs"` to package.json.
+- To wire into OpenClaw cron once the daemon is running:
+  ```bash
+  mc cron create --name memory-review-weekly --schedule "0 9 * * 1" \
+    --agent systems-curator --task-template memory-review
+  ```
+
+**Tests**: `src/lib/__tests__/mc-memory-review.test.ts` — covers offline path,
+idempotency, and log format.

config/model-routes.yaml

@@ -0,0 +1,24 @@
+routes:
+  chat:
+    provider: ollama
+    model: qwen3.5:9b
+    purpose: general chat
+    fallback: anthropic_sonnet
+
+  fast:
+    provider: ollama
+    model: qwen3.5:9b
+    purpose: quick local tasks
+    fallback: null
+
+  reason:
+    provider: ollama
+    model: deepseek-r1:32b
+    purpose: math and reasoning
+    fallback: anthropic_sonnet
+
+  heavy_agentic:
+    provider: ollama
+    model: qwen3.6:35b-a3b
+    purpose: large autonomous tasks
+    fallback: anthropic_opus

data/mission-control/agent-registry.json

@@ -0,0 +1,150 @@
+{
+  "schema_version": "2",
+  "description": "Canonical Mission Control agent registry. Single source of truth for all agent identity, coordination metadata, and runtime eligibility. src/lib/agent-coordination.ts derives its registry from this file. ACTIVE agents with enabled:true are coordinator-orchestrated. ACTIVE agents with enabled:false are gate-enforced via API. PLANNED agents are not executable.",
+  "agents": [
+    {
+      "id": "repo-steward",
+      "name": "Repo Steward",
+      "status": "ACTIVE",
+      "mode": "OBSERVE_ONLY",
+      "owner": "platform",
+      "system_area": "repository",
+      "enabled": true,
+      "observe_only": true,
+      "command": ["node", "scripts/repo-steward.cjs"],
+      "timeout_ms": 30000,
+      "allowed_commands": ["git status", "git log", "git diff"],
+      "blocked_commands": ["git push", "git reset", "git clean"],
+      "dependencies": [],
+      "risk_level": 0,
+      "description": "Observe-only repository health and cleanliness check"
+    },
+    {
+      "id": "skill-intake",
+      "name": "Skill Intake",
+      "status": "ACTIVE",
+      "mode": "APPROVAL_REQUIRED",
+      "owner": "platform",
+      "system_area": "skills",
+      "enabled": true,
+      "observe_only": true,
+      "command": ["node", "scripts/skill-intake.cjs"],
+      "timeout_ms": 15000,
+      "allowed_commands": ["pnpm skills:intake"],
+      "blocked_commands": ["rm", "unlink"],
+      "dependencies": ["repo-steward"],
+      "risk_level": 1,
+      "description": "Observe-only external skill/repo candidate registry reader"
+    },
+    {
+      "id": "systems-curator",
+      "name": "Systems Curator",
+      "status": "ACTIVE",
+      "mode": "OBSERVE_ONLY",
+      "owner": "platform",
+      "system_area": "audit",
+      "enabled": true,
+      "observe_only": true,
+      "command": ["node", "scripts/systems-curator.cjs"],
+      "timeout_ms": 30000,
+      "allowed_commands": ["node scripts/systems-curator.cjs"],
+      "blocked_commands": [],
+      "dependencies": [],
+      "risk_level": 0,
+      "description": "Observe-only implementation-gap auditor for Mission Control runtime wiring"
+    },
+    {
+      "id": "mc-coordinator",
+      "name": "MC Coordinator",
+      "status": "ACTIVE",
+      "mode": "OBSERVE_ONLY",
+      "owner": "platform",
+      "system_area": "coordination",
+      "enabled": false,
+      "observe_only": true,
+      "command": ["node", "scripts/mc-coordinator.cjs"],
+      "timeout_ms": 60000,
+      "allowed_commands": ["node scripts/mc-coordinator.cjs"],
+      "blocked_commands": [],
+      "dependencies": ["repo-steward", "systems-curator"],
+      "risk_level": 1,
+      "description": "Observe-only orchestration spine that runs all enabled observe_only agents"
+    },
+    {
+      "id": "passive-income-bot",
+      "name": "Passive Income Bot",
+      "status": "ACTIVE",
+      "mode": "APPROVAL_REQUIRED",
+      "owner": "products",
+      "system_area": "bots",
+      "enabled": false,
+      "observe_only": false,
+      "command": ["node", "scripts/passive-income-bot.cjs"],
+      "timeout_ms": 30000,
+      "allowed_commands": ["node scripts/passive-income-bot.cjs"],
+      "blocked_commands": ["curl", "fetch", "wget"],
+      "dependencies": [],
+      "risk_level": 2,
+      "description": "Heuristic product opportunity scorer. Invoked via POST /api/bots/passive-income with execution gate enforcement. Not coordinator-orchestrated."
+    },
+    {
+      "id": "pr-reviewer-bot",
+      "name": "PR Reviewer Bot",
+      "status": "ACTIVE",
+      "mode": "OBSERVE_ONLY",
+      "owner": "platform",
+      "system_area": "review",
+      "enabled": false,
+      "observe_only": true,
+      "command": ["node", "scripts/pr-reviewer.cjs"],
+      "timeout_ms": 300000,
+      "allowed_commands": ["gh pr view", "gh pr diff", "gh pr comment", "node scripts/pr-reviewer.cjs"],
+      "blocked_commands": ["gh pr merge", "git push", "git commit", "git reset"],
+      "dependencies": ["repo-steward", "systems-curator"],
+      "risk_level": 1,
+      "description": "Observe-only PR review agent. Classifies file risk, scans diff for red flags, runs local validation, emits structured JSON and Markdown reviewer comment. No merge capability."
+    },
+    {
+      "id": "stocks-research-bot",
+      "name": "Stocks Research Bot",
+      "status": "PLANNED",
+      "enabled": false,
+      "description": "Equity and ETF research, paper trading simulation. Not yet wired."
+    },
+    {
+      "id": "sports-betting-bot",
+      "name": "Sports Betting Bot",
+      "status": "PLANNED",
+      "enabled": false,
+      "description": "Sports odds research, edge detection, paper betting simulation. Not yet wired."
+    },
+    {
+      "id": "appliance-bot",
+      "name": "Appliance Intelligence Bot",
+      "status": "PLANNED",
+      "enabled": false,
+      "description": "Appliance fault diagnosis, repair guidance, parts research. Not yet wired."
+    },
+    {
+      "id": "builder-bot",
+      "name": "Builder Bot",
+      "status": "PLANNED",
+      "enabled": false,
+      "description": "Code generation, CI/CD, dependency management. Not yet wired."
+    },
+    {
+      "id": "research-scout",
+      "name": "Research Scout",
+      "status": "PLANNED",
+      "enabled": false,
+      "description": "Literature review, competitive analysis, web intelligence. Not yet wired."
+    },
+    {
+      "id": "content-bot",
+      "name": "Content Bot",
+      "status": "PLANNED",
+      "enabled": false,
+      "description": "Copywriting, image prompts, social media drafts. Not yet wired."
+    }
+  ]
+}

data/mission-control/skill-intake.json

@@ -0,0 +1,72 @@
+{
+  "schema_version": "1",
+  "description": "Observe-only registry of external repos and skills under consideration for future study or integration.",
+  "entries": [
+    {
+      "name": "TradingAgents",
+      "repo_url": "https://github.com/TauricResearch/TradingAgents",
+      "category": "trading-agents",
+      "proposed_use": "Study multi-agent trading strategy patterns and debate-style agent architecture for use in Stephen the stocks bot and future Polymarket work",
+      "integration_status": "candidate",
+      "risk_level": 1,
+      "allowed_actions": ["read", "study", "reference", "cite-patterns"],
+      "forbidden_actions": ["clone", "install", "execute", "vendor", "modify-dependencies", "import-directly"],
+      "notes": "Multi-agent LLM framework for financial trading research by TauricResearch. High relevance to mission-control agent orchestration patterns."
+    },
+    {
+      "name": "jcode",
+      "repo_url": "https://github.com/1jehuang/jcode",
+      "category": "coding-tools",
+      "proposed_use": "Study lightweight coding agent or task-routing patterns that may complement mission-control CLI agent design",
+      "integration_status": "candidate",
+      "risk_level": 0,
+      "allowed_actions": ["read", "study", "reference"],
+      "forbidden_actions": ["clone", "install", "execute", "vendor", "modify-dependencies", "import-directly"],
+      "notes": "Small coding tool repo. Low risk. Observe and assess for CLI agent patterns."
+    },
+    {
+      "name": "mattpocock-skills",
+      "repo_url": "https://github.com/mattpocock/skills",
+      "category": "skills-framework",
+      "proposed_use": "Study skill registration and dispatch patterns for use in mission-control skills subsystem",
+      "integration_status": "candidate",
+      "risk_level": 0,
+      "allowed_actions": ["read", "study", "reference", "adapt-patterns"],
+      "forbidden_actions": ["clone", "install", "execute", "vendor", "modify-dependencies", "import-directly"],
+      "notes": "Matt Pocock's skills repo. Useful reference for structured skill dispatch and type-safe skill registration."
+    },
+    {
+      "name": "browserbase-skills",
+      "repo_url": "https://github.com/browserbase/skills",
+      "category": "browser-automation",
+      "proposed_use": "Study browser automation skill patterns for potential future agent browser-use integration in mission-control",
+      "integration_status": "candidate",
+      "risk_level": 1,
+      "allowed_actions": ["read", "study", "reference"],
+      "forbidden_actions": ["clone", "install", "execute", "vendor", "modify-dependencies", "import-directly"],
+      "notes": "Browserbase skills repo. Relevant if mission-control agents need browser-use capabilities in future phases."
+    },
+    {
+      "name": "sim",
+      "repo_url": "https://github.com/simstudioai/sim",
+      "category": "agent-simulation",
+      "proposed_use": "Study simulation studio architecture for multi-agent workflow design patterns applicable to mission-control orchestration layer",
+      "integration_status": "candidate",
+      "risk_level": 1,
+      "allowed_actions": ["read", "study", "reference", "cite-patterns"],
+      "forbidden_actions": ["clone", "install", "execute", "vendor", "modify-dependencies", "import-directly"],
+      "notes": "SimStudio AI visual agent workflow tool. Observe for orchestration and simulation patterns."
+    },
+    {
+      "name": "superpowers",
+      "repo_url": "https://github.com/obra/superpowers",
+      "category": "agent-augmentation",
+      "proposed_use": "Study developer superpower augmentation patterns for possible integration into mission-control agent capability layer",
+      "integration_status": "candidate",
+      "risk_level": 0,
+      "allowed_actions": ["read", "study", "reference"],
+      "forbidden_actions": ["clone", "install", "execute", "vendor", "modify-dependencies", "import-directly"],
+      "notes": "obra/superpowers developer augmentation toolkit. Low risk. Review for agent capability extension ideas."
+    }
+  ]
+}

docs/CLI-QUICKREF.md

@@ -0,0 +1,22 @@
+Mission Control CLI
+
+Usage:
+  mc memory status                      Show memory status
+  mc memory sync --dry-run             Scan memory sources (no changes)
+  mc memory sync --apply                Sync memory to MC DB
+  mc memory query "<term>"              Search memory
+
+  mc agents run hermes --task <id> "p"  Execute with task guard
+  mc task create "title"               Create task
+  mc task list                         List tasks
+  mc task status <id>                  Get task
+
+Examples:
+  mc memory status
+  mc memory sync --dry-run
+  mc memory sync --apply
+  mc memory query "hermes"
+
+  mc task create "Cleanup logs"
+  mc task list
+  mc agents run hermes --task 1 "analyze"