fix(operator): builder tool-name validator, Discord crash guards, pnpm resolver + Rust shadow evidence

[webdevtodayjason]

Operator-reality wave 1 + Rust shadow-credible evidence

From today's operator-reality audit ("what actually works when you sit down"):

Builder — closes the silent tool-grant footgun

validateWorkflowRuntimeCapabilities now cross-checks agent-step toolsAllow entries and builtin tool_grant gate nodes against the registered tool registry → workflow_tool_grant_unknown warning. Grants are fail-closed at runtime, so unknown names silently stripped tools with no signal anywhere — both the canvas palette (image_generation vs real image_generate, palette fixed here too) and the NL builder (AppForge capability ids) have emitted them. Registry set cached per process, injectable for tests, check skipped (not false-warned) when the registry can't build. +4 tests.

Discord — the gateway-killing crash

All three vendor reconnect sites (give-up, fresh-IDENTIFY, HELLO-timeout — the last runs in a timer where a throw is process-fatal) are guarded, and a retired gateway instance gets connect/reconnect no-op'd so late vendor timers can't zombie-reconnect: that exact uncaught error crashed the whole gateway process on 2026-07-02. Discord suite: 173/173 green.

Control UI on service restarts

scripts/ui.js resolveRunner falls back to well-known pnpm homes (execPath sibling, homebrew, ~/Library/pnpm, ~/.local/share/pnpm, nvm versions) — the gateway LaunchAgent's minimal PATH logged Control UI build failed: Missing UI runner on every restart. Verified by running the build under the exact service PATH.

Rust — promotion checklist evidence run (operator-directed "skip the soak")

rust/argent-execd/PROMOTION_CHECKLIST.md boxes checked with dated evidence: workspace cargo tests green, all three smoke/soak scripts passed (single-cycle), protocol gen/check clean, all 42 TS consumer tests green (incl. real-daemon integration), both daemons now installed as KeepAlive LaunchAgents and reachable in argent status (first time running as services), parity report 19/0, promotionReady=true and picked up by argent gateway authority status. Status reached: Shadow-credible, live in shadow. The checklist now also records the honest remainder to real authority: argentd ws transport + gateway method surface (the long pole), the Node→Rust delegation seam, canary receipts end-to-end.

Live-data fixes alongside (not in diff): Task Board Hygiene cron model pin gpt-5.3-codex → gpt-5.5.

Verification: 12/12 capability tests, 173/173 discord, tsc-since 0 net-new (189 baseline), dashboard tsc clean, oxfmt clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T3dkQzz2mSrSNtGBE9cmXr

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: cfa73e99-f39a-4f57-a727-07c63802b557

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/operator-reality-wave1

---

_{Comment @coderabbitai help to get the list of available commands.}