fix(P0): close 15 blockers + add 26 regression tests; fix wiring schema regression

Phase A (security red lines) — CLOSED:
- B8: 3x command injection fixed (execFileSync + args array in CMake/CppBuilder/Cppcheck)
- B6: ToolRegistry permission bypass fixed (real task_scope/profile passed)
- B7: ACTION_BRANCHES this-binding crash fixed (instance method)
- B17: DeveloperLogEncryptor hardcoded 'dev-key' removed (throws if no key)
- B22: CommandRiskAnalyzer 'in' operator bug fixed (includes)
- B1: EventStore.project() transaction handle now passed to all repos
- B2: workspace projection illegal enum fixed (active/merged)
- B4: route_prefix separator unified to '/'
- B5: TaskAttempt column mapping fixed

Other blockers fixed:
- B3: project-level DB schema aligned to db-schema §20 (.air/local, learned_memories)
- B9: cpp.* tools registered through PermissionEngine path
- B11: Scheduler BLOCKED/CANCELLED states added
- B18: CapabilityTrustLevel 5-level enum aligned
- B19: PermissionEngine block/refuse/announce_then_run + grant_scope
- B20: Worker exit code 4 = parent_cancelled
- B24: project_id now randomUUID

Regression fix (introduced by B3 schema refactor):
- wiring.ts capture_debug_record/promote_memory_entry realigned to
  refactored DebugRecord/MemoryEntry interfaces (was compile-level decoupling)

Tests: 128 regression/unit tests pass (22 regression + 3 unit + 3 e2e suites)

Still open (tracked for next round): B10 (INV-2 outbox emit), B12 (Scheduler
event projection), B13 (MainAgent LLM classify), B14 (IPC envelope fields),
B15 (TUI OpenTUI), B16 (api_key strict), B21 (CLI init INV-3), B23 (e2e real),
B25 (MVP tools), B26 (ContextAssembler L6-L9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/test/regression/permission-engine-actions.test.ts

@@ -0,0 +1,87 @@
+/**
+ * C4 regression: PermissionEngine action alignment with contracts §13.
+ * Bug: local PermissionAction had prompt/read_only/sandbox/audit_log
+ *      which didn't match contracts allow/announce_then_run/ask_user/deny/block/refuse.
+ * Fix: aligned all action values, fixed decision.redacted → decision.reason.
+ */
+
+import { describe, it, expect } from 'bun:test'
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+describe('C4: PermissionEngine action alignment', () => {
+  const perm_src = readFileSync(
+    join(import.meta.dir, '..', '..', 'src', 'security', 'PermissionEngine.ts'),
+    'utf-8'
+  )
+  const registry_src = readFileSync(
+    join(import.meta.dir, '..', '..', 'src', 'tools', 'ToolRegistry.ts'),
+    'utf-8'
+  )
+
+  it('PermissionAction includes allow, announce_then_run, ask_user, deny, block, refuse', () => {
+    const type_match = perm_src.match(/export type PermissionAction\s*=\s*\n([\s\S]*?)(?=\n\n|\nexport)/)
+    expect(type_match).not.toBeNull()
+    const type_block = type_match![1]
+
+    expect(type_block).toContain("'allow'")
+    expect(type_block).toContain("'announce_then_run'")
+    expect(type_block).toContain("'ask_user'")
+    expect(type_block).toContain("'deny'")
+    expect(type_block).toContain("'block'")
+    expect(type_block).toContain("'refuse'")
+  })
+
+  it('PermissionAction does not include legacy prompt/read_only/sandbox/audit_log', () => {
+    const type_match = perm_src.match(/export type PermissionAction\s*=\s*\n([\s\S]*?)(?=\n\n|\nexport)/)
+    expect(type_match).not.toBeNull()
+    const type_block = type_match![1]
+
+    expect(type_block).not.toContain("'prompt'")
+    expect(type_block).not.toContain("'read_only'")
+    expect(type_block).not.toContain("'sandbox'")
+    expect(type_block).not.toContain("'audit_log'")
+  })
+
+  it('PermissionDecision has grant_scope field', () => {
+    const iface_match = perm_src.match(/export interface PermissionDecision\s*\{([\s\S]*?)\}/)
+    expect(iface_match).not.toBeNull()
+    const iface_body = iface_match![1]
+
+    expect(iface_body).toContain('grant_scope')
+  })
+
+  it('finalize_decision uses decision.reason not decision.redacted', () => {
+    // The finalize_decision method should reference decision.reason, not decision.redacted
+    const finalize_match = perm_src.match(/private finalize_decision[\s\S]*?^  \}/m)
+    expect(finalize_match).not.toBeNull()
+    const finalize_body = finalize_match![0]
+
+    expect(finalize_body).toContain('decision.reason')
+    expect(finalize_body).not.toContain('decision.redacted')
+  })
+
+  it('ToolRegistry execute_branch handles all 6 new actions', () => {
+    const branch_match = registry_src.match(/private async execute_branch[\s\S]*?^  \}/m)
+    expect(branch_match).not.toBeNull()
+    const branch_body = branch_match![0]
+
+    expect(branch_body).toContain("case 'allow'")
+    expect(branch_body).toContain("case 'announce_then_run'")
+    expect(branch_body).toContain("case 'ask_user'")
+    expect(branch_body).toContain("case 'deny'")
+    expect(branch_body).toContain("case 'block'")
+    expect(branch_body).toContain("case 'refuse'")
+  })
+
+  it('ToolRegistry execute_branch does not have legacy read_only/sandbox/audit_log', () => {
+    const branch_match = registry_src.match(/private async execute_branch[\s\S]*?^  \}/m)
+    expect(branch_match).not.toBeNull()
+    const branch_body = branch_match![0]
+
+    expect(branch_body).not.toContain("case 'read_only'")
+    expect(branch_body).not.toContain("case 'sandbox'")
+    expect(branch_body).not.toContain("case 'audit_log'")
+    expect(branch_body).not.toContain("case 'prompt'")
+  })
+})