feat: add agent learning with shared setup, diagnostics and local status

[humandebri]

Purpose

Make the existing Kinic CLI support the full workflow from agent reference records through retrieval, execution, evaluation, and revision publication. Once a project is configured, routine use no longer requires passing multiple JSON files on every invocation. Configuration, hook installation, and observed behavior are reported separately so users can diagnose problems and inspect learning progress.

This PR includes the continual-learning foundation and portable-learning changes that have not yet landed on main, together with shared configuration, diagnostics, and local status reporting.

Changes

• Add store, runtime, and canister APIs, plus Candid clients, for revision history, atomic publication with dependency validation, evaluation evidence, and rollback.
• Add CLI support for context retrieval, Codex/DSH execution, recording and retries, candidate generation, isolated evaluation, and publication decisions. Support project-specific configuration and evidence, selected shared scopes, and durable jobs.
• Share learning and engine settings through .kinic/config.toml and existing user settings. Preserve explicit argument/JSON precedence, relative-path handling, --cwd, and existing connection behavior. Preserve additional configuration tables during database link/unlink.
• Add agent setup to show configuration differences and prepare DSH launch settings and distribution files. Changes require explicit application; arbitrary wrappers are not launched merely for inspection. Explain Codex hook installation separately from activation in the external application.
• Add agent doctor with individual checks for configuration, executables, authentication, read connectivity, required APIs, hook files, and storage locations. Normal diagnostics do not run inference, write data, retry records, or perform repairs. Unverified checks remain unknown.
• Add read-only agent status for local records, receipts, existing job/evaluation references, and engine-specific queues. It does not create state or directories, or infer healthy, delivered, or accepted states from incomplete evidence.
• Fix cross-project contamination when run IDs match, misleading zero counts for unresolved legacy repositories, and path resolution/repeated reads for --recall-config -, with regression coverage.

Review fixes

• Preserve portable-project scope, identity, and destination validation when a legacy recall file or stdin supplies partial runtime overrides.
• Resolve learning state from the requested --project-root, including when the command runs from another project.
• Add inherited_environment to resolve explicitly named environment variables at runner execution time during isolated evaluation. Store only variable names in configuration; keep credential values out of verifier processes and persisted evaluation artifacts.
• Preserve a subsequently created public URL when replaying a duplicate publication request, including recovery after interrupted finalization.
• Replace setup tests' dependency on a host-installed Codex executable with deterministic fixtures.
• Address required Clippy checks with behavior-preserving conditional/reference cleanup and a narrowly scoped allowance for the resolved-recall helper.

For isolated evaluation, reference required credentials by name, for example "inherited_environment":["OPENAI_API_KEY"] in runner configuration. Authentication that relies only on a login under the original HOME requires a supported environment variable or an explicitly configured credential path. Temporary legacy recall overrides preserve portable policy but do not start automatic jobs; use version 2 configuration for durable jobs.

Verification

• After the five review fixes (0aecf7bb), cargo test --workspace --quiet: 925 passed / 0 failed / 3 intentionally ignored across 43 top-level harnesses. The credential-fixture subprocess test also passed separately.
• After the final lint cleanup (2633c236), 309 related CLI tests passed, plus the credential-fixture subprocess test. cargo clippy --workspace --all-targets --locked -- -D warnings, formatting, and whitespace checks passed.
• All six project setup tests passed with Codex absent from PATH. The locked Wasm canister check passed.
• Independent reviews of the five fixes and the final lint cleanup found no additional actionable issues. No live provider inference was run for these fixes.
• The preceding status implementation passed 50 Python runtime tests and 8 DSH plugin tests using the real SDK. The plugins were unchanged by the final fixes; these suites were not rerun for those fixes.
• Foundation validation included 4 PocketIC tests against actual Wasm, Candid compatibility, real Codex/DSH transport, and eight executions of the same task. These are historical results, not reruns against the final HEAD. Reproduction conditions and limitations are recorded in docs/CONTINUAL_LEARNING_VALIDATION.md, docs/PORTABLE_LEARNING_VALIDATION.md, and docs/superpowers/plans/2026-10-16-agent-status-progress.md.
• GitHub Actions run 38833810278 passed workspace Rust tests, the canister build, the actual Wasm probe, and Linux/macOS CLI builds. Its subsequent Clippy failure was addressed in 2633c236. A new CI run was triggered for that commit; this report does not claim that run has passed. Five dependency-audit jobs failed in the earlier run; the dependency update below addresses those failures.

Impact and remaining scope

• Existing runner/recall JSON files remain supported. Model choices, retrieval behavior, context budgets, and evaluation/publication rules are preserved rather than implicitly expanded by configuration changes.
• Using the new revision/publication APIs requires a canister upgrade. Creating this PR did not deploy the changes, install them into user profiles, or replace the installed CLI.
• Status reporting in this PR uses local evidence. Doctor probes that run inference, remote refresh for status, and new observation indexes remain follow-up work.
• Broad held-out quality evaluation remains incomplete. Transport and workflow validation do not establish improved learning performance.

Branch packaging

GitHub push protection detected an artificial Slack-token fixture in earlier commits. The original branch history was retained, and the complete changes were packaged onto a PR branch based on main. The fixture now constructs the test token with concat!; push protection was not bypassed. Packaging did not change product code relative to the original HEAD. Redaction tests, formatting, and whitespace checks passed after the fixture adjustment. The review fixes and lint cleanup described above were then added as separate commits.

CI dependency audit fix

Commit 69326248 upgrades both web apps to @tanstack/react-start@1.168.60 and its matching @tanstack/react-router@1.170.41, resolving GHSA-qx66-fv34-fjm8 in React Start and start-server-core. The existing seroval override is updated to 1.6.9 to match the updated serialization plugins and keep production builds working. Audit thresholds and the existing unrelated braces exception are unchanged.

Validation with the CI-pinned pnpm 11.0.8: frozen-lockfile installation and moderate-level audit passed; both web apps passed tests, lint, type checking, production builds, and Cloudflare Worker dry runs. WikiBrowser's Vitest suite passed all 226 tests across 33 files, followed by its scripted checks. GitHub Actions is rerunning for this commit.

Commit 6de39d7d fixes the two worker Candid drift checks exposed once dependency audits passed. The learning APIs changed generated result type numbers; the generator and MCP checks now use the current aliases, and MCP reuses the shared edit-result alias. All existing shape/method assertions remain enabled. Both worker type checks and all 674 tests passed locally (generator: 155; MCP: 111 Node, 326 Vitest, and 82 Worker tests). GitHub Actions is rerunning against the updated head.