Complete ObjectType kernel migration

.dockerignore

@@ -0,0 +1,17 @@
+node_modules
+**/node_modules
+dist
+**/dist
+.git
+.tmp
+.tmp*
+test-results
+coverage
+**/coverage
+apps/bridge/data/*.sqlite*
+apps/bridge/data/**/timeseries
+apps/bridge/data/**/blobs
+apps/bridge/data/**/artifacts
+**/.env
+**/.env.*
+!**/.env.example

.github/workflows/ci.yml

@@ -17,6 +17,21 @@ jobs:
       - run: npm ci
       - run: npm run build:packages
       - run: npm run typecheck
+      - run: npm run audit:kernel
+      - run: npm run test:audit
+      - run: npm test
       - run: npm run build -w @godmode/bridge
       - run: npm run build -w @godmode/web
       - run: node scripts/audit-oss-core.mjs
+      - run: docker build -f deploy/Dockerfile -t godmode-ci .
+      - name: Smoke production image
+        run: |
+          docker run -d --name godmode-ci -p 8080:80 godmode-ci
+          for attempt in {1..30}; do
+            if curl --fail --silent http://127.0.0.1:8080/api/health; then
+              exit 0
+            fi
+            sleep 2
+          done
+          docker logs godmode-ci
+          exit 1

.gitignore

@@ -12,6 +12,7 @@ build/
 *.tsbuildinfo
 coverage/
 **/coverage/
+test-results/
 .cache/
 .apps-cache/
 
@@ -58,6 +59,8 @@ apps/bridge/data/**/artifacts/
 *.log
 *.tmp
 .tmp/
+.tmp*.py
+.last-run-id.txt
 .screenshots/
 *.sse
 .cursor/debug-*.log

CHANGELOG.md

@@ -10,6 +10,22 @@ Post–0.1.0 work on `main` (merged PRs #1–#15). No new version tag yet — se
 
 ### Added
 
+- **Durable ObjectType kernel** — 72 ObjectTypes discovered by strict audit;
+  explicit CRUD and named actions; exact declaration/adapter parity; mandatory
+  operation context, access policy, confirmation, idempotency, concurrency,
+  redaction, structured errors, durable events/consumer receipts, and
+  asynchronous retries, timeouts, cancellation, leases, and replay-safe recovery
+- **Completed consumer cutover** — generic Record/action HTTP routes, 335
+  generated AI-tool candidates, capability discovery, metadata-driven web
+  list/form UI, 75 static tools, and strict zero legacy routes/callers, unmatched
+  mutation callers, direct entry-point writes, or generated-tool collisions;
+  five narrow mutation protocol exceptions remain
+- **Tenant-safe workflows** — shared-resource adapters enforce exact grants and
+  owner-database routing; marketplace clone acquisition and plugin lifecycle use
+  durable idempotent cross-database sagas rather than implied cross-SQLite
+  transactions
+- **Versioned plugin kernel client** — Bridge/web plugin API version 1 with
+  manifest negotiation and unsupported-version rejection
 - **Per-workspace FirstRunWizard** — onboarding (Welcome → LLM → Ready) is tenant-scoped; hub installs never share platform-wide completion flags
 - **`LLAMA_EXTERNAL` attach mode** — Bridge attaches to a host-managed `llama-server` (no spawn/kill inside Docker); hub external LLM compose example
 - **Unified Intelligence model catalog** — picker lists local GGUFs, Cursor subscription models, cloud providers, and shared/remote endpoints
@@ -27,13 +43,25 @@ Post–0.1.0 work on `main` (merged PRs #1–#15). No new version tag yet — se
 - ~5s black screen after production sign-in
 - Embedding-only GGUFs (e.g. EmbeddingGemma) excluded from the Intelligence chat model picker
 - Vault Cursor Connect status (named `cursor_api_key` counts as connected; model-list errors no longer clear Connected)
+- Structure Record listing now returns child plugin nodes when no parent filter is
+  requested; Structure action compatibility calls send the kernel's flat input
+  body
 
 ### Documentation
 
 - [LOCAL_LLM.md](docs/LOCAL_LLM.md) — Gemma 4 reference profile, harness table, external attach
 - [CURSOR_SUBSCRIPTION.md](docs/CURSOR_SUBSCRIPTION.md) — Auto vs named Cursor models
 - [AGENT_MEMORY.md](docs/AGENT_MEMORY.md) — memory layers and embeddings
 - Marketplace Docker hub notes; onboarding / verification updates
+- [OBJECTTYPE_KERNEL.md](docs/OBJECTTYPE_KERNEL.md) — canonical architecture,
+  enforced action contract, tenancy, durable recovery, and protocol exceptions
+- [KERNEL_MIGRATION_MATRIX.md](docs/KERNEL_MIGRATION_MATRIX.md) — governed route
+  and AI-tool migration inventory
+- Coordinated ecosystem migrations were completed in:
+  [godmode-plugin-git#1](https://github.com/ReBoticsAI/godmode-plugin-git/pull/1),
+  [godmode-plugin-github#1](https://github.com/ReBoticsAI/godmode-plugin-github/pull/1),
+  [GodMode-Marketplace#2](https://github.com/ReBoticsAI/GodMode-Marketplace/pull/2),
+  and private domain-plugin PRs delivered in their respective repositories
 
 ## [0.1.0] - 2026-06-29
 

CONTRIBUTING.md

@@ -18,14 +18,44 @@ Fresh clone = **personal OS only** (Intelligence, wiki, tasks, structure). Copy
 
 `DEPLOYMENT_MODE=local` (default) is for local development. **Authentication is required by default** (`AUTH_ALLOW_ANONYMOUS=false` in `.env.example`). Set `AUTH_ALLOW_ANONYMOUS=true` only for headless local tooling — never on a network-exposed host.
 
-Run `npm run audit:oss` before release-related PRs.
+Run `npm run audit:oss` before release-related PRs. Changes to authenticated
+mutations, AI tools, ObjectTypes, adapters, or actions must also update the
+kernel coverage baseline and contract tests.
 
 ## Pull requests
 
 - Keep changes focused; match existing code style.
-- Run `npm run typecheck` before submitting.
+- Run `npm run test:gate` before submitting kernel or route changes.
+  `npm run audit:kernel:strict` and `npm run test:objecttypes` are available as
+  focused checks; build affected production workspaces.
 - Do not commit secrets (`.env`, API keys, wallet keys).
 - Domain-specific integrations belong in **external plugin repos**, not the public core tree.
+- Declare ObjectType operations/actions explicitly and keep adapter
+  implementations, schemas, roles, confirmation, idempotency, concurrency,
+  retry/timeout/cancellation/recovery, redaction, and durable event behavior
+  consistent with the metadata. Core tests require exact declaration/handler
+  parity.
+- Preserve the authenticated `OperationContext` and tenant/plugin visibility;
+  custom plugin routes require explicit install checks.
+- Document protocol exceptions rather than disguising transport or control-plane
+  operations as Record CRUD. See
+  [docs/OBJECTTYPE_KERNEL.md](docs/OBJECTTYPE_KERNEL.md).
+- The current strict baseline is 72 ObjectTypes, 75 static tools, 335 generated
+  candidates, 5 protocol exceptions, and zero legacy routes/callers, unmatched
+  callers, direct writes, or tool collisions. Do not reintroduce migration debt.
+- Protocol exceptions are wire-level only: authentication cookies, read-only
+  analytical POST, signed external command transport, ephemeral presence,
+  WebSocket/token streams, and authorized binary transfer. Durable effects must
+  still kernel-dispatch; bytes and streams are not Record CRUD.
+- When mutation routes, callers, tools, or exceptions change, update the audit
+  fixtures/tests and `docs/KERNEL_MIGRATION_MATRIX.md`.
+- The completed plugin ecosystem cutover was coordinated through
+  [godmode-plugin-git#1](https://github.com/ReBoticsAI/godmode-plugin-git/pull/1),
+  [godmode-plugin-github#1](https://github.com/ReBoticsAI/godmode-plugin-github/pull/1),
+  and [GodMode-Marketplace#2](https://github.com/ReBoticsAI/GodMode-Marketplace/pull/2).
+  Private domain-plugin migrations were delivered in their own repositories.
+  Future ecosystem migrations must likewise merge all coordinated external PRs
+  before claiming completion.
 
 ## What we are looking for (roadmap themes)
 

DEPLOY.md

@@ -67,6 +67,28 @@ Open http://localhost:8080. Sign in with email and password. Workspace data stay
 
 Both compose files mount `PLATFORM_DATA_DIR=/data` (SQLite tenants, core DB, tenant sandboxes).
 
+That volume also contains native ObjectType tables, durable operation/audit
+state (including leases, retries, cancellation, idempotency, and recovery),
+event-consumer receipts, cross-database acquisition saga/outbox rows, and
+Intelligence-authored plugins. Back up the entire platform data directory before
+image upgrades, plugin lifecycle changes, or ObjectType schema changes. A safe
+backup captures `core.sqlite`, every tenant SQLite database (using SQLite's
+backup mechanism or while writers are stopped), and tenant plugin workspaces.
+
+Native ObjectType evolution is additive only. Plugin uninstall removes runtime
+visibility but retains native tables and Records, so uninstall is not an erasure
+or space-reclamation operation. Verify `/api/health`, ObjectType discovery,
+plugin navigation, a representative Record action, async recovery, and the
+strict zero-debt audit after deployment; see
+[docs/VERIFICATION.md](docs/VERIFICATION.md).
+
+Startup reconciles installed-plugin ObjectTypes and seeds before serving tenant
+traffic, recovers replay-safe leased operations, and starts tenant durable-event
+relays. Include `/api/kernel/capabilities` in the post-deploy smoke check. On the
+Z440, also record the exact 40-character source revision and prove the running
+container's immutable image ID equals the image built from it using the commands
+in [docs/VERIFICATION.md](docs/VERIFICATION.md#z440-revision-and-image-identity).
+
 ## Intelligence on hub
 
 New tenants get Intelligence with `backend=provider` (OpenAI-compatible). Users add API keys in **Vault → Secrets** and configure the provider in **Agents → Pipeline**.

README.md

@@ -60,11 +60,15 @@ flowchart TB
   subgraph client [Your machine]
     Web[Web Dashboard React]
     Bridge[Bridge API Node.js]
+    Kernel[ObjectType kernel]
+    Services[Authoritative services and adapters]
     CoreDb[(core.sqlite users and tenants)]
     TenantDb[(tenant.sqlite per workspace)]
     Web -->|REST and WebSocket| Bridge
-    Bridge --> CoreDb
-    Bridge --> TenantDb
+    Bridge --> Kernel
+    Kernel --> Services
+    Services --> CoreDb
+    Services --> TenantDb
   end
   subgraph intelligence [Intelligence loop]
     User[You] --> Chat[Chat panel]
@@ -116,10 +120,26 @@ flowchart LR
   Plugin[Domain plugin repo]
   Core --> PluginHost
   PluginHost -->|discover at runtime| Plugin
-  Plugin -->|registers routes tools UI| Core
+  Plugin -->|registers ObjectTypes actions routes tools UI| Core
 ```
 
-Core ships as a complete personal OS. Plugins add domain packs without forking the platform. See [docs/PLUGIN_AUTHORING.md](docs/PLUGIN_AUTHORING.md).
+Core ships as a complete personal OS. Plugins add domain packs without forking
+the platform. Plugin ObjectTypes are discoverable only for tenants where the
+plugin is installed. See
+[docs/PLUGIN_AUTHORING.md](docs/PLUGIN_AUTHORING.md).
+
+Authenticated data consumers discover explicit CRUD operations and named actions
+through the ObjectType kernel. The strict audit currently discovers 72
+ObjectTypes and reports zero legacy routes/callers, unmatched mutation callers,
+or direct entry-point writes. Existing domain services remain authoritative
+behind exact-parity adapters, so all durable mutations share one enforced
+dispatch boundary without duplicating business logic.
+
+Durable asynchronous actions enforce leases, retries, timeouts, cancellation,
+idempotency, and restart recovery. Declared events use per-consumer durable
+receipts. Live WebSocket/token streams and authorized binary transfer remain
+intentional specialized transports; the stream or bytes are not Record CRUD.
+See [docs/OBJECTTYPE_KERNEL.md](docs/OBJECTTYPE_KERNEL.md).
 
 ## Quick start
 
@@ -225,6 +245,7 @@ LLM and integration keys belong in **Vault** inside the app, not in `.env`, unle
 |-----------|------|------|
 | Web dashboard | `apps/web` | React UI  -  Chat panel, structure, productivity |
 | Bridge | `apps/bridge` | REST/WebSocket API, auth, multi-tenant SQLite |
+| ObjectType kernel | `packages/kernel`, `apps/bridge/src/kernel` | Enforced durable dispatch, policies, Record CRUD/actions, async recovery, events, native storage, generated tools |
 | Connector | `apps/connector` | Local runtime for hardware-bound marketplace plugins |
 | Plugin API | `packages/plugin-api` | Plugin manifest and register contracts |
 | Plugin host | `packages/plugin-host` | Runtime facades for plugins |
@@ -244,7 +265,7 @@ Full documentation index: **[docs/README.md](docs/README.md)**
 |---|---|
 | **Get started** | [GETTING_STARTED](docs/GETTING_STARTED.md) · [ONBOARDING](docs/ONBOARDING.md) · [FEATURES](docs/FEATURES.md) · [LOCAL_LLM](docs/LOCAL_LLM.md) · [CURSOR](docs/CURSOR_SUBSCRIPTION.md) |
 | **Use GodMode** | [AGENT_MEMORY](docs/AGENT_MEMORY.md) · [MARKETPLACE](docs/MARKETPLACE.md) · [SHARED_FEDERATION](docs/SHARED_FEDERATION.md) · [CONFIGURATION](docs/CONFIGURATION.md) · [SECURITY](docs/SECURITY.md) |
-| **Deploy & extend** | [DEPLOY](DEPLOY.md) · [architecture](docs/architecture.md) · [PLUGIN_AUTHORING](docs/PLUGIN_AUTHORING.md) (contributors) |
+| **Deploy & extend** | [DEPLOY](DEPLOY.md) · [architecture](docs/architecture.md) · [ObjectType kernel](docs/OBJECTTYPE_KERNEL.md) · [PLUGIN_AUTHORING](docs/PLUGIN_AUTHORING.md) (contributors) |
 | **Project** | [CHANGELOG](CHANGELOG.md) · [CONTRIBUTING](CONTRIBUTING.md) (includes roadmap themes) |
 
 ## License

SECURITY.md

@@ -29,6 +29,8 @@ Minimum before exposing Bridge to a network:
 4. `AUTH_ALLOW_SIGNUP=false` or `AUTH_INVITE_CODES` on public hubs
 5. CORS locked to your `WEB_ORIGIN`
 6. Install plugins only from sources you trust
+7. Run `npm run audit:kernel:strict`; production durable mutations must have
+   zero legacy routes/callers, unmatched callers, and direct entry-point writes
 
 ## Related
 

apps/bridge/data/ai/rules-bootstrap/platform-actions.mdc

@@ -3,7 +3,16 @@ description: Prefer platform tools over manual UI instructions
 alwaysApply: true
 priority: 20
 ---
-Use platform tools to create and update workspace content from chat: create_department, create_page, create_agent, create_wiki_page, todo_write, create_project_card, etc.
+Discover ObjectTypes and declared actions first. Prefer generic Record CRUD and
+`run_record_action` for durable domain work. The strict migration is complete:
+do not search for or introduce legacy mutation routes, callers, compatibility
+wrappers, or direct durable writes. Use specialized tools only for reviewed
+operational or wire protocols; WebSocket/token streams and binary transfer are
+not Record CRUD, although their durable effects must kernel-dispatch.
+
+For async actions, honor declared idempotency, retry, timeout, cancellation, and
+concurrency requirements. Inspect the returned `OperationRun` rather than
+assuming immediate completion.
 
 For multi-step work, plan with todo_write (parent Task + nested subtasks) before execution tools.
 

apps/bridge/data/ai/rules-bootstrap/platform-builder-tiers.mdc

@@ -5,22 +5,27 @@ priority: 30
 ---
 ## Tier 1 — Native workspace (default)
 
-Wiki, structure shells, pages, agents, tasks, calendar hooks, marketplace catalog installs.
+Wiki, StructureNode shells, pages, agents, tasks, calendar hooks, marketplace catalog installs.
 
-- Call `use_skill('platform-workspace')` first.
-- Tools only: create_*, wiki_*, todo_write, install_catalog_entry.
+- Call `use_skill('platform-workspace')` first; for metadata use `use_skill('object-types')`.
+- Tools: list/create_record, create_*, wiki_*, todo_write, install_catalog_entry.
 - Never edit `apps/bridge` for Tier 1 workspace setup.
 - **Do not** use bare `create_department` when the user implies an API, integration, hardware, or compiled extension — that is Tier 2.
 
 ## Tier 2 — Plugin extension (durable surface)
 
-New routes, web UI areas, Bridge tools, department types, external APIs, integrations.
-
-- Call `use_skill('platform-extension')` + `use_skill('plugin-authoring')`.
-- **`scaffold_plugin` first** — never only `create_department` for functional domains.
-- Seed org structure in the plugin's `tenant:install` hook, then `build_plugin` → `install_plugin`.
-- **Implement the code yourself** with read_file, grep, edit_file, run_terminal.
-
+New ObjectTypes, routes, web UI areas, Bridge tools, department types, external APIs, integrations.
+
+- Call `use_skill('platform-extension')` + `use_skill('plugin-authoring')` + `use_skill('object-types')`.
+- **`scaffold_plugin` first** — ship metadata-native `objectTypes` / `records`
+  for straightforward CRUD; add executable adapters/actions when service logic
+  is required. Never only `create_department` for functional domains.
+- Seed org structure as StructureNode Records, then `build_plugin` → `install_plugin`.
+- Prefer generated ObjectType CRUD/action tools before adding static mutation
+  tools.
+- **Implement the code yourself** with read_file, grep, edit_file, run_terminal when metadata is not enough.
+- Verify action schemas/policies, implementation parity, tenant isolation, and
+  custom-route authentication before claiming completion.
 ## Native coding (codeAccess)
 
 Intelligence is the coding agent for multi-file refactors, plugin implementation, and repository engineering.

apps/bridge/data/ai/rules-bootstrap/platform-plugins.mdc

@@ -6,11 +6,18 @@ priority: 25
 When the user needs **durable platform surface** OR **integration/API/hardware behavior**:
 
 1. **Plugin first:** `use_skill('platform-extension')` then `scaffold_plugin` — do not only mutate tenant DB with `create_department`.
-2. **Structure via install hook:** seed departments/divisions/pages in the plugin's `tenant:install` handler; run `install_plugin` so structure appears after install.
-3. Install private plugins via Marketplace, `GODMODE_PLUGIN_PATH`, or a local catalog — see `docs/MARKETPLACE.md`.
-4. After scaffold: `build_plugin`, set `GODMODE_PLUGIN_PATH`, restart Bridge, `install_plugin`.
-5. Kanban/hook operational loops use `platform-self-loop` inside existing surface.
+2. **ObjectTypes first:** use manifest-native definitions for straightforward
+   CRUD; register executable adapters and declared actions for service-backed
+   behavior. Implement every declared capability. Structure shells =
+   `StructureNode` Records. Vocabulary: ObjectType / Field / Record (not
+   DocType).
+3. **Structure via install:** seed StructureNode Records in `records` or `tenant:install`; run `install_plugin`.
+4. Install private plugins via Marketplace, `GODMODE_PLUGIN_PATH`, or a local catalog — see `docs/MARKETPLACE.md`.
+5. After scaffold: `build_plugin` → `install_plugin` (no restart for tools / ObjectTypes / tenant:install).
+6. Kanban/hook operational loops use `platform-self-loop` inside existing surface.
+7. Plugin ObjectTypes are tenant-visible only when installed. Custom routes must
+   enforce authentication, tenancy, and installation checks explicitly.
 
-**Examples:** YouTube division with API → plugin with tenant:install; wiki-only notes → Tier 1 wiki tools; compiled domain extension → Tier 2 plugin + native coding tools.
+**Examples:** Accounting domain → plugin with ObjectTypes + optional bridge tools; wiki-only notes → Tier 1 wiki tools.
 
-See `docs/PLUGIN_AUTHORING.md` and skill `plugin-authoring`.
+See `docs/PLUGIN_AUTHORING.md`, `@godmode/kernel`, and skills `plugin-authoring` / `object-types`.

apps/bridge/data/ai/rules-bootstrap/platform-structure-scope.mdc

@@ -4,6 +4,9 @@ alwaysApply: true
 priority: 12
 ---
 GodMode organizes work in a department → division → page tree (Structure sidebar).
+These labels are roles of `StructureNode` Records.
+`StructureNode.object_type` selects generic Record rendering; `segment` is only
+the URL component.
 
 When the user is on a page, treat platform context and live API data as ground truth for what they are viewing.
 Department-scoped rules apply when chatting from that department's pages.