feat(ksp): implement Knowing-State Prosthesis layer — 7 packages, full loop e2e

.agents/memory/working/WORKSPACE.md

@@ -1,37 +1,54 @@
 # Current Workspace
 
 ## Status
-Session ended at 2026-06-03T05:12:55.417Z. Auto-snapshot by WorkspaceSnapshot.hook.ts.
+Session ended at 2026-06-08T22:53:10.542Z. Auto-snapshot by WorkspaceSnapshot.hook.ts.
 
 ## Last update
-2026-06-03T05:12:55.417Z
+2026-06-08T22:53:10.542Z
 
 ## Recent actions (last 4h from AGENT_LEARNINGS.jsonl)
 
-- [05:00:34] Agent: SE augment SPEC-FF-DEVOPS-001 for full lifecycle production/Ops
-- [05:00:34] Bash: grep -rn "ACTIVE_EXECUTION_KEY\|R2.*checkpoint\|checkpoint\|exit 143\|exit143\|143\|SIGTERM\|resume" workers/ff-pipeline
-- [05:00:42] Bash: curl -s -X POST http://localhost:8888/notify -H "Content-Type: application/json" -d '{"message":"Algorithm agent activat
-- [05:00:46] Bash: ls /Users/wes/.claude/skills/PAI/SKILL.md /Users/wes/.claude/skills/skill-index.json 2>&1; echo "---REPO SEARCH---"; fin
-- [05:00:46] Bash: cd /Users/wes/Developer/function-factory; echo "=== ff-pipeline wrangler ==="; grep -n "name\|image\|class_name\|contain
-- [05:00:57] Bash: cd /Users/wes/Developer/function-factory; grep -n "recordActiveExecution\|clearActiveExecution\|infrastructure_error\|fa
-- [05:01:00] Bash: grep -rl "SPEC-FF-DEVOPS" . 2>/dev/null | head; echo "---WRANGLER---"; ls workers/ff-pipeline/wrangler.jsonc 2>/dev/null
-- [05:01:08] Bash: cd /Users/wes/Developer/function-factory
-echo "=== pi-container-version.ts (restart decision) ==="
-grep -n "shouldRestar
-- [05:01:09] Bash: curl -s -X POST http://localhost:8888/notify -H "Content-Type: application/json" -d '{"message":"Augmented the DevOps sp
-- [05:01:16] Bash: cd /Users/wes/Developer/function-factory; sed -n '100,120p' workers/ff-pipeline/wrangler.jsonc
-- [05:02:21] Bash: curl -s -X POST http://localhost:8888/notify \
-  -H "Content-Type: application/json" \
-  -d '{"message": "Running the St
-- [05:04:47] Bash: ls /Users/wes/Developer/function-factory/workers/ && ls /Users/wes/Developer/function-factory/ 2>/dev/null | head -30
-- [05:04:51] Bash: ls /Users/wes/Developer/function-factory/workers/gascity-supervisor/ 2>/dev/null && cat /Users/wes/Developer/function-fa
-- [05:04:52] Bash: ls /Users/wes/Developer/function-factory/.github/workflows/ 2>/dev/null || echo "no .github/workflows found"
-- [05:07:32] Bash: ls /Users/wes/Developer/function-factory/.github/workflows/ 2>/dev/null && cat /Users/wes/Developer/function-factory/.gi
-- [05:11:29] Write: /Users/wes/Developer/function-factory/specs/reference/SPEC-FF-DEVOPS-001-v2.md
-- [05:12:18] Bash: ls /Users/wes/Developer/function-factory/specs/reference/ 2>/dev/null && ls /Users/wes/Developer/function-factory/docs/a
-- [05:12:33] Bash: wc -l /Users/wes/Developer/function-factory/specs/reference/SPEC-FF-DEVOPS-001-v2.md && tail -30 /Users/wes/Developer/fu
-- [05:12:35] Bash: wc -l /Users/wes/Developer/function-factory/docs/adr/ADR-0012-candidatepatch-untracked-file-fix.md 2>/dev/null && head -
-- [05:12:46] Bash: head -30 /Users/wes/Developer/function-factory/specs/reference/ADR-012-candidatepatch-git-diff-fix.md
+- [21:59:51] Bash: git -C /Users/wes/Developer/function-factory log --oneline -- workers/ff-pipeline/pi-container/server.mjs | head -10
+- [21:59:54] Bash: git -C /Users/wes/Developer/function-factory show 2ffbed1 -- workers/ff-pipeline/pi-container/workspace-seed.mjs | grep 
+- [21:59:58] Bash: git -C /Users/wes/Developer/function-factory show ab48d7f -- workers/ff-pipeline/pi-container/server.mjs | grep "^+" | g
+- [22:00:01] Bash: git -C /Users/wes/Developer/function-factory show ab48d7f -- workers/ff-pipeline/pi-container/workspace-seed.mjs | grep 
+- [22:00:05] Bash: # Check when workDir/cwd was introduced - look at older commits
+git -C /Users/wes/Developer/function-factory show 89ba50
+- [22:00:09] Bash: git -C /Users/wes/Developer/function-factory show 89ba50c:workers/ff-pipeline/pi-container/server.mjs | grep -n "cwd\|wo
+- [22:00:47] Edit: /Users/wes/Developer/function-factory/workers/ff-pipeline/pi-container/server.mjs
+- [22:00:56] Edit: /Users/wes/Developer/function-factory/workers/ff-pipeline/pi-container/server.mjs
+- [22:01:04] Bash: git -C /Users/wes/Developer/function-factory add workers/ff-pipeline/pi-container/server.mjs && \
+git -C /Users/wes/Deve
+- [22:47:37] Bash: cd /Users/wes/Developer/function-factory && \
+bash scripts/ops/seed.sh \
+  specs/intent-specifications/IS-GC-DISPATCH-WI
+- [22:49:55] Bash: GC_BEARER="$(cat /tmp/gc_supervisor_token.txt)"
+for i in $(seq 1 80); do
+  RESULT=$(curl -sf -H "Authorization: Bearer $
+- [22:50:05] Bash: GC_BEARER="$(cat /tmp/gc_supervisor_token.txt)"
+curl -sf -H "Authorization: Bearer $GC_BEARER" -H "X-GC-Request: 1" \
+
+- [22:50:16] Bash: GC_BEARER="$(cat /tmp/gc_supervisor_token.txt)"
+curl -sf -H "Authorization: Bearer $GC_BEARER" -H "X-GC-Request: 1" \
+
+- [22:50:45] Bash: GC_BEARER="$(cat /tmp/gc_supervisor_token.txt)"
+curl -sf -H "Authorization: Bearer $GC_BEARER" -H "X-GC-Request: 1" \
+
+- [22:50:50] Bash: # Check the logs from the pi container status for symlink errors
+curl -sf -H "Authorization: Bearer $(cat /tmp/gc_token.
+- [22:51:38] Bash: GC_BEARER="$(cat /tmp/gc_supervisor_token.txt)"
+curl -sf -H "Authorization: Bearer $GC_BEARER" -H "X-GC-Request: 1" \
+
+- [22:51:58] Bash: grep -n "seed_workspace\|seedKey\|putSeed\|SeedWorkspace\|seed.*workspace" \
+  /Users/wes/Developer/function-factory/wor
+- [22:52:14] Bash: git -C ~/Developer/gascity show e7f3469a --stat 2>/dev/null | head -10
+git -C ~/Developer/gascity show e7f3469a 2>/dev/n
+- [22:52:36] Bash: grep -rn "seed_workspace\|SeedWorkspace" \
+  ~/Developer/gascity/cmd/gc/*.go \
+  ~/Developer/gascity/internal/dispatch/*
+- [22:52:40] Bash: grep -rn "gc\.seed_workspace\|seed_workspace" \
+  ~/Developer/gascity/cmd/gc/cmd_sling.go \
+  ~/Developer/gascity/intern
 
 ## Notes
 This file is auto-updated on session end. Manual edits will be overwritten.

.agents/patterns/compile-interface-json-truncation.md

@@ -0,0 +1,31 @@
+# Pattern: compile-interface JSON truncation
+
+**Observed:** 2026-06-08, pipeline runs d409750f and b2e88972
+
+## Symptom
+
+`compile-interface` step fails with:
+```
+Compile pass interface: JSON parse failed after repair.
+Error: Expected ',' or '}' after property value in JSON at position N
+```
+
+All 3 retries fail. Pipeline terminates at this step.
+
+## Trigger
+
+Signals that generate complex interface contracts with deeply nested JSON schemas (e.g. cache invalidation, rate-limiting). The LLM produces output that is truncated mid-JSON, likely due to hitting the output token limit.
+
+## Examples of failing signal domains
+- "Refactor rate-limiter middleware for edge caching"
+- "Refactor distributed cache invalidation layer"
+
+Both generate interface contracts with complex nested object schemas that overflow the model output.
+
+## Mitigation
+
+Use simpler signals for test runs — prefer domains that generate flat/shallow interface contracts (auth, logging, simple CRUD). Avoid cache/performance optimization signals for pipeline E2E tests.
+
+## Permanent fix (not yet implemented)
+
+The compile-interface pass should instruct the LLM to produce minimal interface definitions — no deep nesting, no inline JSON Schema. A simpler output format would reduce token pressure and prevent truncation.

.agents/tools/skill_loader.ts

@@ -13,7 +13,7 @@
 import { readFileSync, readdirSync, existsSync } from "node:fs"
 import { join } from "node:path"
 
-const SKILLS_DIR = ".agent/skills"
+const SKILLS_DIR = ".agents/skills"
 const MANIFEST = join(SKILLS_DIR, "_manifest.jsonl")
 
 export interface SkillManifestEntry {

.flue/app.ts

@@ -1,25 +1,23 @@
-import { configureProvider } from '@flue/runtime';
 import { flue } from '@flue/runtime/routing';
+// @ts-ignore — bundler resolves this; ff-pipeline is not a workspace package dep
+import ffPipeline from '../workers/ff-pipeline/src/index.js';
+
+interface Env {
+  SANDBOX: unknown;
+}
 
 export default {
-  fetch(req: Request, env: Env, ctx: ExecutionContext) {
-    // Route all model traffic through the WeOps gateway
-    // (reuses ff-linear-bridge's WEOPS_SIGNING_KEY — SPEC-WEOPS-CONSOLE-001)
-    configureProvider('anthropic', {
-      baseUrl: env.WEOPS_GATEWAY_URL,
-      headers: { Authorization: `Bearer ${env.WEOPS_SIGNING_KEY}` },
-      apiKey: 'weops',
-    });
+  async fetch(req: Request, env: Env, ctx: ExecutionContext) {
+    // Flue handles /workflows/* and Flue agent dispatch routes.
+    // Provider config (ofox.ai, kimi CF REST) is set inside atom-execution run()
+    // before init(agent) — not here, because DO/Workflow isolates are separate
+    // from the fetch isolate and don't share module-global state.
+    const flueRes = await (flue() as { fetch(r: Request, e: unknown, c: unknown): Promise<Response> })
+      .fetch(req, env, ctx);
+    if (flueRes.status !== 404) return flueRes;
 
-    return flue().fetch(req, env, ctx);
+    // ff-pipeline handles everything else
+    return (ffPipeline as { fetch(r: Request, e: unknown, c: unknown): Promise<Response> })
+      .fetch(req, env, ctx);
   },
 };
-
-interface Env {
-  WEOPS_GATEWAY_URL: string;
-  WEOPS_SIGNING_KEY: string;
-  ARANGO_ENDPOINT: string;
-  ARANGO_DB: string;
-  FF_CONTEXT_ENDPOINT: string;
-  Sandbox: unknown; // CF Container DO binding
-}

.flue/cloudflare.ts

@@ -0,0 +1,22 @@
+// DO class exports for ff-pipeline worker.
+// Flue's _entry.ts spreads this default export into the final worker export,
+// so scheduled + queue handlers are preserved alongside Flue's fetch wrapper.
+
+export { Sandbox }               from '@cloudflare/sandbox';
+export { CoordinatorDO }         from '@factory/gears';
+export { FactoryArtifactGraphDO, FactoryBeadGraphDO } from '@factory/factory-graph';
+
+// Re-export existing ff-pipeline DO classes so they remain registered
+// @ts-ignore — bundler resolves; not a workspace package dep
+export { SynthesisCoordinator, AtomExecutor, RunCoordinator, PiContainer, FactoryPipeline }
+  from '../workers/ff-pipeline/src/index.js';
+
+// Preserve ff-pipeline's scheduled (governor cron) and queue (synthesis/feedback) handlers.
+// Flue spreads this default into the worker export; fetch is excluded (Flue owns it).
+// @ts-ignore
+import ffPipeline from '../workers/ff-pipeline/src/index.js';
+
+export default {
+  scheduled: (ffPipeline as { scheduled: unknown }).scheduled,
+  queue:     (ffPipeline as { queue:     unknown }).queue,
+};

.flue/flue.config.ts

@@ -0,0 +1,5 @@
+import { defineConfig } from '@flue/cli/config';
+
+export default defineConfig({
+	target: 'cloudflare',
+});

.flue/tsconfig.json

@@ -3,16 +3,24 @@
   "compilerOptions": {
     "outDir": "dist",
     "composite": false,
-    "typeRoots": ["./types", "../node_modules/@types"],
+    "typeRoots": [
+      "./types",
+      "../node_modules/@types",
+      "../packages/gears/node_modules/@cloudflare"
+    ],
+    "types": ["workers-types/experimental", "node"],
     "paths": {
-      "@flue/runtime": ["./types/flue-runtime.d.ts"],
-      "@flue/runtime/routing": ["./types/flue-runtime.d.ts"],
       "just-bash": ["./types/flue-runtime.d.ts"],
       "valibot": ["./types/flue-runtime.d.ts"],
       "@factory/ff-context": ["../packages/ff-context/src/index.ts"],
       "@factory/ff-context/patch": ["../packages/ff-context/src/patch.ts"],
       "@factory/ff-context/inject": ["../packages/ff-context/src/inject.ts"],
-      "@factory/ff-arango": ["../packages/ff-arango/src/index.ts"]
+      "@factory/ff-arango": ["../packages/ff-arango/src/index.ts"],
+      "@factory/schemas": ["../packages/schemas/src/index.ts"],
+      "@factory/gears": ["../packages/gears/src/index.ts"],
+      "@factory/gears/flue": ["../packages/gears/src/flue/index.ts"],
+      "@factory/gears/beads": ["../packages/gears/src/beads/index.ts"],
+      "@cloudflare/sandbox": ["../packages/gears/node_modules/@cloudflare/sandbox/dist/index.d.ts"]
     }
   },
   "include": ["./*.ts", "./workflows/*.ts", "./types/*.d.ts"],

.flue/types/flue-runtime.d.ts

@@ -21,36 +21,65 @@ declare module '@flue/runtime' {
     next: () => Promise<unknown>,
   ) => Promise<unknown>;
 
-  export interface FlueContext<TPayload = unknown> {
-    init: (agent: ReturnType<typeof createAgent>) => Promise<HarnessLike>;
-    payload: TPayload;
-    env: Record<string, string> & { Sandbox?: unknown };
+  // AgentProfile — returned by defineAgentProfile, passed to createAgent()
+  export interface AgentProfile {
+    name:         string;
+    model:        string;
+    instructions: string;
   }
 
-  export interface HarnessLike {
+  export function defineAgentProfile(opts: {
+    name:         string;
+    model:        string;
+    instructions: string;
+    skills?:      unknown[];
+    tools?:       unknown[];
+    subagents?:   unknown[];
+    thinkingLevel?: string;
+    compaction?:  unknown;
+    durability?:  unknown;
+  }): AgentProfile;
+
+  // FlueHarness — returned by ctx.init(agent)
+  export interface FlueHarness {
     fs: {
       writeFile(path: string, content: string): Promise<void>;
       readFile(path: string): Promise<string>;
     };
     shell(cmd: string): Promise<{ stdout: string; stderr: string; exitCode: number }>;
-    session(): Promise<SessionLike>;
+    session(name?: string): Promise<FlueSession>;
   }
 
-  export interface SessionLike {
+  // FlueSession — returned by harness.session()
+  export interface FlueSession {
     skill(
       name: string,
-      opts: { args: Record<string, unknown>; result: unknown },
-    ): Promise<{ data: Record<string, unknown> }>;
+      opts: { args?: Record<string, unknown>; result?: unknown },
+    ): Promise<{ data: Record<string, unknown>; text?: string }>;
     task(
       prompt: string,
       opts: { cwd: string; result: unknown },
     ): Promise<{ data: Record<string, unknown> }>;
   }
 
-  export function createAgent(
-    factory: (opts?: unknown) => {
-      model: string;
-      sandbox: unknown;
+  // Legacy aliases kept for other workflows that use HarnessLike/SessionLike
+  export type HarnessLike = FlueHarness;
+  export type SessionLike = FlueSession;
+
+  // FlueContext<TPayload, TEnv> — available inside a Flue workflow run()
+  export interface FlueContext<TPayload = unknown, TEnv = Record<string, string>> {
+    id:      string;
+    init: (agent: ReturnType<typeof createAgent>) => Promise<FlueHarness>;
+    payload: TPayload;
+    env:     TEnv;
+  }
+
+  export function createAgent<TPayload = unknown, TEnv = unknown>(
+    factory: (opts?: { id: string; env: TEnv }) => {
+      profile?: AgentProfile;
+      model?:   string;
+      sandbox?: unknown;
+      cwd?:     string;
       [key: string]: unknown;
     },
   ): unknown;

.flue/workflows/atom-execution.ts

@@ -0,0 +1,12 @@
+/**
+ * atom-execution.ts — shim for local Flue dev (.flue/ path).
+ *
+ * The authoritative implementation lives in @factory/gears.
+ * This shim keeps `flue dev --root .flue` working for local iteration.
+ * Production deployment uses wrangler deploy --config workers/ff-pipeline/wrangler.jsonc
+ * which pulls FlueAtomExecutionWorkflow directly from @factory/gears.
+ *
+ * SPEC-FF-JUSTBASH-004
+ */
+
+export { run, route, extractWorkspaceDelta } from '@factory/gears'