feat(workbench): read-only host discovery page over the install doctor (#105 stage 4)

[ScriptedAlchemy]

Summary

Stage 4 of #105 per the G6 gate in #107 (read-only discovery approved; #101 mutation never enters the Workbench): a Hosts Workbench page surfacing the #236/#243 read-only install doctor — host presence (binaries/versions), installed-bundle inventory, drift vs the current build, and runtime endpoint health.

Architecture

• Direct library invocation, no reinvented probes: HostDiscoveryService (src/dev/playground/host-discovery-service.ts) calls runDoctor from src/install/doctor.ts in-process — never shells to the CLI. Production wiring feeds the doctor from: <root>/dist plus the prepared build's source revision through a prepared() callback, so drift findings are bound to the build they were computed against. Single-flight coalescing, zero result caching past settlement.
• Wire contract: new src/contracts/discovery.ts; the service's per-field mapping pins it to the doctor types at compile time. GET /api/discovery (host-discovery-routes.ts) is GET-only, session-authorized like every sibling route, no query params, named 16 MiB budget. New diagnostics AB8215–AB8218 registered in docs/diagnostics.md.
• Workbench: src/discovery/ — strict zod client (own decoder, AB8234), pure presentation model, dedicated browser-state atoms module (third sanctioned module, added to docs/effect-conventions.md; no stream atoms), desktop 1440×900 page.

Honest states (absent ≠ error)

Absent binary → neutral "Not installed" (e2e asserts the badge class is neutral and no role="alert" exists). Unknown inventory → "Unknown — host owns its registry". No valid build → info, not error. win32/endpoint skips honest. Diagnostics render severity + recovery as text.

G6 compliance

Zero mutation affordances. The only controls are navigation and "Re-run discovery" (user-initiated, read-only re-probe). Repair guidance appears only as diagnostic recovery text.

Stale → repair

The report carries the manifest digest it was generated against; the page compares it to the live routes.sourceRevision and shows a stale banner after a rebuild, repaired by explicit re-run — proven in e2e via a real watched-source rebuild.

Test plan (all local, on this base)

• pnpm lint — 0 errors / 0 warnings (977 files)
• pnpm typecheck — all three projects
• pnpm test:unit + pnpm test:route-unit — full pools green (2500+ tests)
• Integration + real-Chrome e2e at 1440×900: host-discovery-dev-server, discovery.e2e (populated + honest-absent + stale→repair legs, zero page errors), discovery-atoms-disposal, plus regressions lifecycles.e2e, overview.e2e, runtime-playground.e2e, and both prior atom-disposal suites — no failures
• Changeset: agent-bundle patch

Stage 5 (user-initiated live MCP probing with consent + redaction) remains the final #105 stage.

[changeset-bot]

🦋 Changeset detected

Latest commit: a8e78e4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T06:03:54.919639Z	a8e78e4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.