P0-P8: Full V1.0.0 Alpha implementation + audit reports

Implements 123 tasks across 9 phases (T-001..T-809) totaling 146 source files.

Monorepo (P0):
- 7-package Bun + Turborepo + TypeScript monorepo
- dependency-cruiser enforcing 7 forbidden edges + 5 deep-import rules

Contracts (P0):
- 16 type files (ids/error/event/runtime/ipc/task/worker-result/tool/artifact/evidence/project/provider/permission/ui/capability/platform)

Storage & Events (P1):
- DatabaseManager + MigrationRunner (19 tables, 22 indexes, 5 schema_meta seeds)
- 16 repositories (Repository<T,I,U> pattern, INV-1 status columns via EventStore.project only)
- EventSchemaRegistry (54 durable + 7 ephemeral), EventStore, EventBus, EventIngestor
- Project/Session/Artifact/Evidence stores + 8-step Recovery

Tools & Permission (P2):
- PathClassifier (8 categories), CommandRiskAnalyzer (10 categories), SecretRedactor
- PermissionEngine 6-layer evaluation (capability→profile→task_scope→risk→credential→user_prompt)
- ToolRegistry with 20+ tools across fs/shell/git/project/artifact/context/permission/doctor
- CapabilityManifestValidator + CapabilityRegistry

LLM & Context (P3):
- ModelConfigLoader, CapabilityMatrix, AnthropicCanonicalConverter
- AnthropicAdapter + OpenAICompatibleAdapter
- ProviderManager facade
- PromptLayerLoader (L0/L1/L3/L5), CompactionPolicy, ContextAssembler

Worker IPC & Scheduler (P4):
- WorkerProtocol (NDJSON), WorkerProcess (exit codes 0-5), WorkerManager (spawn/handshake)
- WorkerRuntime (INV-3: IPC only, no direct fs/shell/SQLite)
- 5 worker roles (Executor/Reviewer/Debugger/Compactor/ExperienceMiner)
- TaskGraph, WavePlanner, RetryPlanner, AgentMonitor, WorkspaceManager
- Scheduler (state machine), 8-step Recovery

C++ Toolchain (P5):
- DiagnosticParser, CppProjectDetector, CMakeConfigurator, CppBuilder
- CppTestRunner, CppcheckRunner, ClangdClient
- CppToolRegistrar + capability manifest

Projection & TUI (P6):
- ProjectionStore (hydrate/apply/snapshot/subscribe)
- TuiApp + 8 components (Session/Task/Agent/Tool/Diff/Evidence/Permission/Blocker/Hud)
- ProjectionClient in-process ref

Agents & Knowledge (P7):
- MainAgent, ArchitectureDesigner
- DebugKnowledgeStore + LearnedMemoryStore (single-writer, outbox model)
- Role integration wiring

CLI & Doctor & Release (P8):
- Logger + DeveloperLogEncryptor (AES-256-GCM)
- DoctorService (self_bootstrap first)
- RuntimeApp + ServiceRegistry
- 11 CLI commands: run/init/doctor/provider/resume/compact/history/session/restore/e2e/release
- CliEntrypoint + air<TODO>

Audit (in AirPlan/docs/):
- Deepseek开发阶段审计.md (97 findings)
- Opus开发阶段审计.md (140+ findings, 18 P0 blockers)
- MiniMaxM3开发阶段审计.md (18 P0 blockers, focuses on executability)
- AirPlan/TODO.md (technical debt + 42 TODOs by phase)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/cli/src/bootstrap/createRuntime.ts

@@ -0,0 +1,39 @@
+/**
+ * createRuntime - Bootstrap the full AirCoding runtime
+ * DD §22.2. Wires all subsystems via ServiceRegistry.
+ *
+ * @module packages/cli/src/bootstrap/createRuntime
+ */
+
+import { RuntimeApp } from '@aircoding/runtime'
+import type { AirConfig } from './loadConfig.js'
+
+export interface BootResult {
+  app: RuntimeApp
+  start: () => Promise<void>
+  shutdown: () => Promise<void>
+}
+
+/**
+ * Create and start the AirCoding runtime.
+ */
+export async function createRuntime(config: AirConfig): Promise<BootResult> {
+  const project_root = config.project_root || process.cwd()
+
+  // Generate session and project IDs
+  const session_id = `session_${Date.now()}`
+  const project_id = `project_${Date.now()}` // Would be loaded from .air/shared/project.json
+
+  const app = new RuntimeApp({
+    project_root,
+    session_id,
+    project_id,
+    log_dir: `${project_root}/.air/logs`
+  })
+
+  return {
+    app,
+    start: () => app.start(),
+    shutdown: () => app.shutdown()
+  }
+}

packages/cli/src/bootstrap/loadConfig.ts

@@ -0,0 +1,60 @@
+/**
+ * loadConfig - Load configuration for the AirCoding CLI
+ * DD §22.2. Loads global + project config.
+ *
+ * @module packages/cli/src/bootstrap/loadConfig
+ */
+
+import { readFileSync, existsSync } from 'fs'
+import { join } from 'path'
+import { homedir } from 'os'
+
+export interface AirConfig {
+  project_root?: string
+  provider: string
+  model: string
+  api_key?: string
+  base_url?: string
+  log_level: string
+  max_concurrency: number
+  token_budget: number
+}
+
+const DEFAULT_CONFIG: AirConfig = {
+  provider: 'anthropic',
+  model: 'claude-sonnet-4-6',
+  log_level: 'info',
+  max_concurrency: 4,
+  token_budget: 200000
+}
+
+export function loadConfig(project_root?: string): AirConfig {
+  let config = { ...DEFAULT_CONFIG }
+
+  // Load global config: ~/.air/config.json
+  const global_path = join(homedir(), '.air', 'config.json')
+  if (existsSync(global_path)) {
+    try {
+      const global = JSON.parse(readFileSync(global_path, 'utf-8'))
+      config = { ...config, ...global }
+    } catch {
+      // Ignore malformed global config
+    }
+  }
+
+  // Load project config: .air/local/config.json
+  if (project_root) {
+    const project_path = join(project_root, '.air', 'local', 'config.json')
+    if (existsSync(project_path)) {
+      try {
+        const project = JSON.parse(readFileSync(project_path, 'utf-8'))
+        config = { ...config, ...project }
+      } catch {
+        // Ignore malformed project config
+      }
+    }
+    config.project_root = project_root
+  }
+
+  return config
+}