Dan/wayfinder durable passive launch

[justsml]

Description

Fixes # (issue)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Performance improvement
• Security fix
• Code refactoring

How Has This Been Tested?

• pnpm typecheck passes
• pnpm test passes
• pnpm build passes
• Manual testing steps:

Checklist

• My code follows the style guidelines of this project (see AGENTS.md)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (README, AGENTS.md, etc.)
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Screenshots / GIFs (if applicable)

Security Considerations

[Copilot]

🟡 Changes recommended

There is at least one likely TypeScript compilation issue (type-only import used with typeof) and a confirmed resumption regression path for legacy research runs missing an execution profile.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds a set of “durable passive launch” foundations for ExploitHunter.app by introducing immutable/pinned run configuration (Research Execution Profile), portable Target Recipe + Campaign admission contracts, Workspace-owned product skill discovery, and deterministic gates/policies for campaign autonomy, impact validation, and device research lanes—backed by new integration/eval tests and updated architecture/context docs.

Changes:

• Add new deterministic admission/policy modules (Target Recipes, Research Campaign admission, Campaign autonomy policy, Device research admission, Impact validation, Ecosystem opportunity ranking, Product skill promotion).
• Introduce Research Execution Profile resolution + persistence in the research turn ledger and pass pinned runtime projection into the chat turn runner.
• Replace filesystem-based product skill registry with a Mastra WorkspaceSkills-backed registry and expand integration tests/docs accordingly.

File summaries

File	Description
tests/integration/target-recipes.test.ts	Adds admission tests for pinned Target Recipe digests, lifecycle path safety, and exposure/permission conflicts.
tests/integration/research-execution-profile.test.ts	Validates execution-profile pinning across continuations and runtime/forensics consistency.
tests/integration/research-campaign-admission.test.ts	Adds campaign admission tests ensuring “freeze without launch” and required gates/threads/harnesses.
tests/integration/product-skill-registry.test.ts	Updates tests for Workspace-backed skill registry (status, revision, provenance, invalidation).
tests/integration/product-skill-promotion.test.ts	Adds promotion-policy tests to enforce contamination boundaries and evidence requirements.
tests/integration/impact-validation.test.ts	Adds deterministic impact-validation promotion boundary tests.
tests/integration/ecosystem-opportunity-ranking.test.ts	Adds ranking tests for gated cohort ranking and explainable score vectors.
tests/integration/discovery-artifact-normalizer.test.ts	Adds tests for passive discovery artifact normalization into URLs/auth candidates/blockers.
tests/integration/device-research-admission.test.ts	Adds device research lane admission tests enforcing lane-specific approval/evidence requirements.
tests/integration/campaign-autonomy-policy.test.ts	Adds tests for autonomy decisions around approvals, budgets, recovery dedupe, and stop conditions.
tests/evals/native-harness-comparison.test.ts	Adds eval-focused tests for native harness admission and cohort-freeze comparison.
src/server/targets/target-recipe.ts	Introduces Target Recipe schema parsing + stable digest/locator admission.
src/server/targets/index.ts	Exports new target-recipe + device-research-admission APIs.
src/server/targets/device-research-admission.ts	Implements deterministic device research lane admission gate.
src/server/skills/promotion-policy.ts	Implements product skill promotion decision policy with contamination/evidence validation.
src/server/skills/product-skill-registry.ts	Replaces filesystem discovery with Mastra WorkspaceSkills-backed registry + revisions/diagnostics.
src/server/research/turn-ledger.ts	Persists execution profile metadata and attempts to pin it across run continuations.
src/server/research/index.ts	Exposes new research campaign admission + autonomy policy exports.
src/server/research/execution-profile.ts	Implements immutable Research Execution Profile resolution, validation, and runtime projection.
src/server/research/campaign-autonomy-policy.ts	Implements campaign autonomy decision policy for approvals/budgets/recovery.
src/server/research/campaign-admission.ts	Implements Research Campaign admission (freeze references, no launch/authority).
src/server/recon/index.ts	Adds recon barrel export for discovery artifact normalization.
src/server/recon/discovery-artifact-normalizer.ts	Implements passive normalization of URLs/auth surfaces/status families/blockers from evidence.
src/server/knowledge/ecosystem-opportunity-ranking.ts	Implements gated, cohort-scoped opportunity ranking with explainable contributions.
src/server/graph/index.ts	Re-exports new impact-validation API from graph module.
src/server/graph/impact-validation.ts	Implements deterministic impact validation/promotion boundary logic.
src/server/chat/securityResearchTurn.ts	Resolves and injects pinned execution profile into turn ledger + agent runtime metadata.
src/mastra/tools/product-skill-registry.ts	Updates Mastra tool to use Workspace-backed registry + capability-based filtering.
evals/native-harness-comparison.ts	Adds native harness manifest admission + cohort-freeze comparison utilities.
docs/research/safe-device-research-method-2026-08-26.md	Adds device-research methodology note and lane gating rationale.
docs/research/council-next-ticket-portfolio-2026-08-26.md	Adds portfolio decision doc framing “durable passive launch” sequencing.
docs/architecture.md	Documents new concepts/policies (recipes, campaigns, ranking, validation, device lanes, skill promotion).
CONTEXT.md	Adds vocabulary definitions for Ecosystem Signals, Target Recipes, device lanes, autonomy policy, promotion, campaigns.

Review details

• Files reviewed: 45/45 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[justsml]

This was generated by AI during triage.

This mega PR has been split into ticket-scoped replacements:

• Wayfinder decisions and research: #124: Wayfinder council synthesis and handoff notes #138, #125: Choose ecosystem intelligence sources and ranking signals #139, #126: Design the native-agent harness comparison contract #140, #127: Extract a safe device-research method #141, #128: Define the ecosystem opportunity ranking contract #142, #129: Define the Target Recipe contract #143, #130: Define campaign autonomy and approval boundaries #144, #131: Define impact-validation methodology #145, #132: Define harness-study admission and attribution #146, #133: Define the product skill promotion pipeline #147, #134: Define device research admission and recovery #148, #135: Define the first OSS research campaign #149
• Product implementation and eval work: #164: Expose an authorization-scoped stored-evidence passive auth tracer #150, #36: Add the canonical zero-cost evaluation smoke #151, #37: Create a unified containment policy module #152, #38: Persist restricted-egress enforcement evidence #153, #39: Require external isolation for high-risk lab workloads #154, #41: Add deterministic forensic-policy scoring #155, #111: Preserve append-only decision history #159, #112: Expose canonical inventory, Evidence, and cockpit queues #160, #114: Bound high-risk dialogs and folder uploads #161
• Intentional dependency stack: #37: Create a unified containment policy module #152 → #89: Make Workspace the product skill registry #156 → #87: Pin immutable Research Execution Profiles #157 → #100: Pin validation-authority provenance #158

#149 is intentionally based on #144. The original branch is preserved as a backup; no history was rewritten.