P0-P8: Full V1.0.0 Alpha implementation + audit reports

Implements 123 tasks across 9 phases (T-001..T-809) totaling 146 source files.

Monorepo (P0):
- 7-package Bun + Turborepo + TypeScript monorepo
- dependency-cruiser enforcing 7 forbidden edges + 5 deep-import rules

Contracts (P0):
- 16 type files (ids/error/event/runtime/ipc/task/worker-result/tool/artifact/evidence/project/provider/permission/ui/capability/platform)

Storage & Events (P1):
- DatabaseManager + MigrationRunner (19 tables, 22 indexes, 5 schema_meta seeds)
- 16 repositories (Repository<T,I,U> pattern, INV-1 status columns via EventStore.project only)
- EventSchemaRegistry (54 durable + 7 ephemeral), EventStore, EventBus, EventIngestor
- Project/Session/Artifact/Evidence stores + 8-step Recovery

Tools & Permission (P2):
- PathClassifier (8 categories), CommandRiskAnalyzer (10 categories), SecretRedactor
- PermissionEngine 6-layer evaluation (capability→profile→task_scope→risk→credential→user_prompt)
- ToolRegistry with 20+ tools across fs/shell/git/project/artifact/context/permission/doctor
- CapabilityManifestValidator + CapabilityRegistry

LLM & Context (P3):
- ModelConfigLoader, CapabilityMatrix, AnthropicCanonicalConverter
- AnthropicAdapter + OpenAICompatibleAdapter
- ProviderManager facade
- PromptLayerLoader (L0/L1/L3/L5), CompactionPolicy, ContextAssembler

Worker IPC & Scheduler (P4):
- WorkerProtocol (NDJSON), WorkerProcess (exit codes 0-5), WorkerManager (spawn/handshake)
- WorkerRuntime (INV-3: IPC only, no direct fs/shell/SQLite)
- 5 worker roles (Executor/Reviewer/Debugger/Compactor/ExperienceMiner)
- TaskGraph, WavePlanner, RetryPlanner, AgentMonitor, WorkspaceManager
- Scheduler (state machine), 8-step Recovery

C++ Toolchain (P5):
- DiagnosticParser, CppProjectDetector, CMakeConfigurator, CppBuilder
- CppTestRunner, CppcheckRunner, ClangdClient
- CppToolRegistrar + capability manifest

Projection & TUI (P6):
- ProjectionStore (hydrate/apply/snapshot/subscribe)
- TuiApp + 8 components (Session/Task/Agent/Tool/Diff/Evidence/Permission/Blocker/Hud)
- ProjectionClient in-process ref

Agents & Knowledge (P7):
- MainAgent, ArchitectureDesigner
- DebugKnowledgeStore + LearnedMemoryStore (single-writer, outbox model)
- Role integration wiring

CLI & Doctor & Release (P8):
- Logger + DeveloperLogEncryptor (AES-256-GCM)
- DoctorService (self_bootstrap first)
- RuntimeApp + ServiceRegistry
- 11 CLI commands: run/init/doctor/provider/resume/compact/history/session/restore/e2e/release
- CliEntrypoint + air<TODO>

Audit (in AirPlan/docs/):
- Deepseek开发阶段审计.md (97 findings)
- Opus开发阶段审计.md (140+ findings, 18 P0 blockers)
- MiniMaxM3开发阶段审计.md (18 P0 blockers, focuses on executability)
- AirPlan/TODO.md (technical debt + 42 TODOs by phase)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/toolchain-cpp/src/CppToolRegistrar.ts

@@ -0,0 +1,97 @@
+/**
+ * CppToolRegistrar - Registers cpp.* tools through CapabilityRegistry
+ * DD §15. INV-4: registered via capability boundary, not direct runtime import.
+ *
+ * @module packages/toolchain-cpp/src/CppToolRegistrar
+ */
+
+import { CPP_TOOLCHAIN_CAPABILITY } from './capability.js'
+import { CppProjectDetector } from './detect/CppProjectDetector.js'
+import { CMakeConfigurator } from './build/CMakeConfigurator.js'
+import { CppBuilder } from './build/CppBuilder.js'
+import { CppTestRunner } from './test/CppTestRunner.js'
+import { CppcheckRunner } from './analysis/CppcheckRunner.js'
+import { ClangdClient } from './analysis/ClangdClient.js'
+
+export class CppToolRegistrar {
+  manifest = CPP_TOOLCHAIN_CAPABILITY
+
+  /**
+   * Register all cpp.* tools with the provided registry.
+   * INV-4: This is called through CapabilityRegistry boundary, never via direct runtime import.
+   */
+  register(registry: { register(name: string, definition: any, executor: (call: any) => Promise<any>): void }, project_root: string): void {
+    const detector = new CppProjectDetector(project_root)
+    const configurator = new CMakeConfigurator()
+    const builder = new CppBuilder()
+    const tester = new CppTestRunner()
+    const cppcheck = new CppcheckRunner()
+    const clangd = new ClangdClient()
+
+    // cpp.detect
+    registry.register('cpp.detect', {
+      name: 'cpp.detect', category: 'toolchain',
+      description: 'Detect C++ project structure and toolchain',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[0].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = detector.detect()
+      return { call_id: call.id, tool_name: 'cpp.detect', type: 'text', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.configure
+    registry.register('cpp.configure', {
+      name: 'cpp.configure', category: 'toolchain',
+      description: 'Configure C++ build with CMake',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[1].input_schema,
+      permissions: { read: true, write: true, network: false }, streaming: false
+    }, async (call) => {
+      const result = configurator.configure({ project_root, generator: call.arguments?.generator as any, build_type: call.arguments?.build_type as any })
+      return { call_id: call.id, tool_name: 'cpp.configure', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.build
+    registry.register('cpp.build', {
+      name: 'cpp.build', category: 'toolchain',
+      description: 'Build C++ project',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[2].input_schema,
+      permissions: { read: true, write: true, network: false }, streaming: false
+    }, async (call) => {
+      const result = builder.build(project_root + '/build', call.arguments?.target as string)
+      return { call_id: call.id, tool_name: 'cpp.build', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.test
+    registry.register('cpp.test', {
+      name: 'cpp.test', category: 'toolchain',
+      description: 'Run C++ tests',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[3].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = tester.run_tests(project_root + '/build')
+      return { call_id: call.id, tool_name: 'cpp.test', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.cppcheck
+    registry.register('cpp.cppcheck', {
+      name: 'cpp.cppcheck', category: 'toolchain',
+      description: 'Run cppcheck static analysis',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[4].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = cppcheck.run(project_root, { enable_all: call.arguments?.enable_all as boolean, check_config: call.arguments?.check_config as boolean })
+      return { call_id: call.id, tool_name: 'cpp.cppcheck', type: result.ok ? 'text' : 'error', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+
+    // cpp.clangd
+    registry.register('cpp.clangd', {
+      name: 'cpp.clangd', category: 'toolchain',
+      description: 'Query clangd for symbol info',
+      input_schema: CPP_TOOLCHAIN_CAPABILITY.tools[5].input_schema,
+      permissions: { read: true, write: false, network: false }, streaming: false
+    }, async (call) => {
+      const result = await clangd.query_symbol(call.arguments?.file as string, call.arguments?.line as number, call.arguments?.column as number)
+      return { call_id: call.id, tool_name: 'cpp.clangd', type: 'text', content: result, metadata: { timestamp: new Date().toISOString() } }
+    })
+  }
+}