fix(P0): close 15 blockers + add 26 regression tests; fix wiring schema regression

Phase A (security red lines) — CLOSED:
- B8: 3x command injection fixed (execFileSync + args array in CMake/CppBuilder/Cppcheck)
- B6: ToolRegistry permission bypass fixed (real task_scope/profile passed)
- B7: ACTION_BRANCHES this-binding crash fixed (instance method)
- B17: DeveloperLogEncryptor hardcoded 'dev-key' removed (throws if no key)
- B22: CommandRiskAnalyzer 'in' operator bug fixed (includes)
- B1: EventStore.project() transaction handle now passed to all repos
- B2: workspace projection illegal enum fixed (active/merged)
- B4: route_prefix separator unified to '/'
- B5: TaskAttempt column mapping fixed

Other blockers fixed:
- B3: project-level DB schema aligned to db-schema §20 (.air/local, learned_memories)
- B9: cpp.* tools registered through PermissionEngine path
- B11: Scheduler BLOCKED/CANCELLED states added
- B18: CapabilityTrustLevel 5-level enum aligned
- B19: PermissionEngine block/refuse/announce_then_run + grant_scope
- B20: Worker exit code 4 = parent_cancelled
- B24: project_id now randomUUID

Regression fix (introduced by B3 schema refactor):
- wiring.ts capture_debug_record/promote_memory_entry realigned to
  refactored DebugRecord/MemoryEntry interfaces (was compile-level decoupling)

Tests: 128 regression/unit tests pass (22 regression + 3 unit + 3 e2e suites)

Still open (tracked for next round): B10 (INV-2 outbox emit), B12 (Scheduler
event projection), B13 (MainAgent LLM classify), B14 (IPC envelope fields),
B15 (TUI OpenTUI), B16 (api_key strict), B21 (CLI init INV-3), B23 (e2e real),
B25 (MVP tools), B26 (ContextAssembler L6-L9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/test/regression/knowledge-store-schema.test.ts

@@ -0,0 +1,111 @@
+/**
+ * C1 regression: Knowledge Store schema alignment.
+ * Bug: DebugKnowledgeStore and LearnedMemoryStore used .air/shared/ paths,
+ *      had non-canonical column names, and were missing PRAGMAs.
+ * Fix: moved to .air/local/, renamed columns, added WAL/synchronous/foreign_keys PRAGMAs.
+ */
+
+import { describe, it, expect } from 'bun:test'
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+describe('C1: Knowledge Store schema alignment', () => {
+  const debug_src = readFileSync(
+    join(import.meta.dir, '..', '..', 'src', 'knowledge', 'DebugKnowledgeStore.ts'),
+    'utf-8'
+  )
+  const memory_src = readFileSync(
+    join(import.meta.dir, '..', '..', 'src', 'knowledge', 'LearnedMemoryStore.ts'),
+    'utf-8'
+  )
+
+  it('DebugKnowledgeStore DB path uses .air/local/ not .air/shared/', () => {
+    expect(debug_src).toContain("'.air', 'local', 'debug-records.db'")
+    expect(debug_src).not.toContain("'.air', 'shared', 'debug-records.db'")
+  })
+
+  it('LearnedMemoryStore DB path uses .air/local/ not .air/shared/', () => {
+    expect(memory_src).toContain("'.air', 'local', 'learned-memory.db'")
+    expect(memory_src).not.toContain("'.air', 'shared', 'learned-memory.db'")
+  })
+
+  it('DebugRecord has failure_signature not signature', () => {
+    const iface_match = debug_src.match(/export interface DebugRecord\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).toContain('failure_signature')
+    // Should not have bare 'signature' field (failure_signature contains 'signature' as substring, so check for the exact field pattern)
+    expect(iface_body).not.toMatch(/^\s*signature\s*:/m)
+  })
+
+  it('DebugRecord has summary and fix_ref fields', () => {
+    const iface_match = debug_src.match(/export interface DebugRecord\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).toContain('summary')
+    expect(iface_body).toContain('fix_ref')
+  })
+
+  it('DebugRecord does not have error_kind or session_id', () => {
+    const iface_match = debug_src.match(/export interface DebugRecord\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).not.toContain('error_kind')
+    expect(iface_body).not.toContain('session_id')
+  })
+
+  it('DebugKnowledgeStore applies WAL PRAGMA', () => {
+    expect(debug_src).toContain('PRAGMA journal_mode = WAL')
+  })
+
+  it('LearnedMemoryStore table is learned_memories (plural)', () => {
+    expect(memory_src).toContain('learned_memories')
+    // Ensure we don't have the singular form used as table name
+    expect(memory_src).not.toMatch(/FROM learned_memory\b/)
+    expect(memory_src).not.toMatch(/INTO learned_memory\b/)
+    expect(memory_src).not.toMatch(/UPDATE learned_memory\b/)
+    expect(memory_src).not.toMatch(/TABLE.*learned_memory\b/)
+  })
+
+  it('MemoryEntry.memory_type has 4 spec values', () => {
+    const iface_match = memory_src.match(/export interface MemoryEntry\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).toContain("'project_rule'")
+    expect(iface_body).toContain("'toolchain_rule'")
+    expect(iface_body).toContain("'skill_update'")
+    expect(iface_body).toContain("'debug_experience'")
+    expect(iface_body).toContain('memory_type')
+  })
+
+  it('MemoryEntry.status has 4 spec values: candidate, promoted, archived, rejected', () => {
+    const iface_match = memory_src.match(/export interface MemoryEntry\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).toContain("'candidate'")
+    expect(iface_body).toContain("'promoted'")
+    expect(iface_body).toContain("'archived'")
+    expect(iface_body).toContain("'rejected'")
+  })
+
+  it('MemoryEntry.status default is candidate not draft', () => {
+    // Check that the CREATE TABLE DDL uses 'candidate' as default
+    expect(memory_src).toContain("DEFAULT 'candidate'")
+    expect(memory_src).not.toContain("DEFAULT 'draft'")
+  })
+
+  it('MemoryEntry uses source_entity_type + source_entity_id', () => {
+    const iface_match = memory_src.match(/export interface MemoryEntry\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).toContain('source_entity_type')
+    expect(iface_body).toContain('source_entity_id')
+    expect(iface_body).not.toContain('source_task_ids')
+  })
+})