trunk-merge/pr-1164/ddebf2d4-98fe-48e8-90fd-d84e204a8193

.gitignore

@@ -43,3 +43,8 @@ result-*
 
 # NOTE: generated clients (go/gen, packages/compass-client/src/gen)
 # are intentionally committed and CI drift-gated — do not ignore them.
+
+# runner-image build outputs: the staged nix closure (which carries the
+# entrypoint symlink) and the OCI layout, realised by tools/runner-image/build.ts.
+/runner-image/store/
+/runner-image/out/

.moon/workspace.yml

@@ -39,12 +39,23 @@ projects:
   # cache lane or V2a boot bring-up. Same affected-detection posture as
   # compass-agent-image (see guest-image/moon.yml).
   compass-guest-image: 'guest-image'
+  # The Runner container image: the compass-runner binary, the KVM userland and
+  # the guest assets on a minimal hardened base. Its `build` is runInCI:false (it
+  # needs a buildkitd and a multi-GB realise), so registration here is for graph
+  # membership and affected-detection, not a gate leg; the gate coverage is the
+  # runner-image tool's pure-core suite below. See runner-image/moon.yml.
+  compass-runner-image: 'runner-image'
   # The local microVM boot-test lane (RIG-2591): realises the guest image + VMM
   # stack from nix and execs the KVM-gated `go test -tags microvm` suite the
   # untagged compass-go:test lane never builds. Registered so its typecheck +
   # unit tests ride the moon-driven CI sweep; the boot lane itself lives on
   # compass-go:test-microvm (runInCI:false — it needs KVM + a nix build).
   microvm-boot-test: 'tools/microvm-boot-test'
+  # The runner-image build lane: realises the nix closure, stages it, and drives
+  # the Dockerfile build. Registered so its typecheck + pure-core unit tests ride
+  # the CI sweep — that suite is what catches a build-arg or closure-root drift,
+  # since no compass CI step can build the image itself today.
+  runner-image: 'tools/runner-image'
   # The Compass native-app release bundle: a heavy nix build (realises the
   # WebKitGTK cc/pkg-config closure) that stages the versioned tarball. Same
   # affected-detection posture as compass-agent-image — registered here so the

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-	".": "0.2.0"
+	".": "0.2.1"
 }

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.2.1](https://github.com/RigelBuild/compass/compare/v0.2.0...v0.2.1) (2026-09-12)
+
+
+### Features
+
+* **compass-agent:** emit decoded traceparent on the SessionInjection observation (RIG-2894) ([#1132](https://github.com/RigelBuild/compass/issues/1132)) ([2392c9a](https://github.com/RigelBuild/compass/commit/2392c9adca70b3781e69ba2a408fe7fcedd2f8c5))
+* **compass-agent:** re-attach the turn's trigger traceparent on outbound posts (RIG-2894) ([#1139](https://github.com/RigelBuild/compass/issues/1139)) ([1dfcbfc](https://github.com/RigelBuild/compass/commit/1dfcbfc67417a158cd99ee5ecdd30317b66c0585))
+* **envelope:** AES-256-GCM seam for user-secret values (RIG-3655 T1) ([#1111](https://github.com/RigelBuild/compass/issues/1111)) ([d58e256](https://github.com/RigelBuild/compass/commit/d58e256efb135e34b8c88063e014d6844498ddfe))
+* **secrets:** add the DB-backed StoreResolver (RIG-3655 T3) ([#1138](https://github.com/RigelBuild/compass/issues/1138)) ([902feca](https://github.com/RigelBuild/compass/commit/902feca21b9a722673f34f4ed6eb197bba6d4741))
+* **server:** resolve the at-rest master key at boot (RIG-3655 T4) ([#1146](https://github.com/RigelBuild/compass/issues/1146)) ([5c00a05](https://github.com/RigelBuild/compass/commit/5c00a0515418b4abcbfefd56beb664bf4b061eeb))
+* **store:** scope and encrypt user secrets at rest (RIG-3655 T2) ([#1118](https://github.com/RigelBuild/compass/issues/1118)) ([c34e417](https://github.com/RigelBuild/compass/commit/c34e4175e4d23d843ffd054e17dd7b92e2787643))
+
+
+### Bug Fixes
+
+* **release:** put the pinned pkg-config on PATH for the app bundle (RIG-3731) ([#1171](https://github.com/RigelBuild/compass/issues/1171)) ([3692236](https://github.com/RigelBuild/compass/commit/36922361628173c366f826ea6496a84469f20e78))
+
 ## [0.2.0](https://github.com/RigelBuild/compass/compare/v0.1.0...v0.2.0) (2026-09-12)
 
 

docs/designs/DECISIONS.md

@@ -133,6 +133,7 @@ check enforces the mechanical half. Full rationale:
 | DL-361 | Secret resolution is most-specific-wins — `agent > user > tenant`, ONE value per name in the injected environment — collapsed in SQL (`DISTINCT ON` ordered by `scope_kind DESC`, the numeric encoding being the precedence) so shadowed rows never leave Postgres or get decrypted; `FetchSecrets` resolves per agent account using the identity the runnerhub authz maps (`sessionAccounts`/`containerAccounts`) already hold and previously discarded, the user tier reached through the single `agent_accounts.owner_user_id` FK hop. Scope is an ADDITIONAL filter inside a tenant — RLS tenant isolation stays the outer boundary, never replaced. The existing `SetSecret`/`DeleteSecret` verbs stay pinned to the tenant coordinate, preserving inject-all behavior until a scope wire surface is ruled | Active (Matt, 2026-09-11) | [user-secret store §A9](server/compass-user-secret-store.md#a9--scope-model-tenant--user--agent-most-specific-wins) |
 | DL-362 | The canonical user-secret AAD is the five-field tuple `"compass/user-secret/v1\x00" + tenantID + "\x00" + decimal(scopeKind) + "\x00" + scopeID + "\x00" + name + "\x00" + decimal(keyVersion)` (Go: `UserSecretAAD(tenantID string, scopeKind int16, scopeID, name string, keyVersion int16) []byte`; SMALLINTs rendered `strconv.FormatInt(int64(v), 10)`), every field bound unconditionally (a tenant row binds scopeID as the empty string) with `\x00` separators keeping the encoding injective. Fixed BEFORE any migration ships because the AAD is baked into every ciphertext — a scope field added later would force a re-encrypt of every row. Refines DL-351's four-field AAD clause; DL-351's other rulings stand | Active (Matt, 2026-09-11) | [user-secret store §A9](server/compass-user-secret-store.md#a9--scope-model-tenant--user--agent-most-specific-wins) |
 | DL-363 | Writing a tenant-scoped user-secret row requires an admin (`store.UserRoleAdmin`, `go/internal/store/types.go`), reusing the existing role elevation rather than introducing a permission concept: tenant (0) admin-only, user (1) and agent (2) writable by the owning user or an admin. The check lands in the store door inside the same writing transaction as DL-360's FK-substitute referential checks, so one place enforces both. READS are deliberately asymmetric — a plain user's agent resolves tenant rows, which is the point of a shared tenant value under DL-361; reading a shared secret is the feature, writing one is the privileged act. The wire surface for a scoped write stays undecided (a scope selector on `SetSecretRequest` is a public-proto fork) | Active (Matt, 2026-09-12) | [user-secret store §D8](server/compass-user-secret-store.md#resolved-decisions) |
+| DL-366 | The `compass-agent` image publishes as a multi-arch OCI image index carrying exactly `linux/amd64` + `linux/arm64` under the existing `:git-<sha12>`/`:latest`/`:vX.Y.Z` tags, each arch built NATIVELY on its own runner (`ubuntu-latest` + the free public-repo `ubuntu-24.04-arm`, never QEMU) and composed by member digest in a serialized manifest job. Consumer-facing tags stay bare, so every puller relies on engine platform negotiation and no consumer changes; the per-arch `:git-<sha12>-<arch>` tags are internal immutable building blocks. Every single-digest guard is carried forward at manifest-list level rather than dropped — immutability, two-tag coherence and the semver re-tag compare list digests, and the `linux/amd64` platform tripwire becomes an exact platform-SET assertion plus per-member arch/os checks, a stricter contract than the one it replaces. Supersedes the `linux/amd64` single-arch platform contract of the agent-image publish record; that record's tag names, immutability posture, auth pin and build-once mechanism all stay live | Active (Matt, 2026-09-12) | [arm64 agent image §Decision A](infra/ci/compass-agent-arm64-image/design.md#decision-a--consumer-facing-tags-are-a-manifest-list-per-arch-tags-are-internal) |
 
 > Note (2026-07-31, RIG-1570 R5): DL-065's retired internal `ResumeContext
 > resume = 12` envelope field is NOT silently reintroduced — the collapsed
@@ -287,6 +288,7 @@ check enforces the mechanical half. Full rationale:
 | DL-208 | Both Solid-2 blocker deps are FORKED into the RigelBuild org and consumed as externalized pinned artifacts, never vendored into the compass tree (matching the org-wide fork-externalization ruling): `@tanstack/solid-virtual` is forked with Solid-2 support + an upstream PR to TanStack/virtual (a 136-line thin wrapper over the framework-agnostic `@tanstack/virtual-core`, likely to land), consumed via a `package.json` git ref (`github:RigelBuild/virtual`) until upstream merges then dropped; `solid-markdown` (effectively abandoned upstream) is forked-and-owned, published as `@rigelbuild/solid-markdown` with the `solid-js` 2.x peer bump + Solid-2 codemods (imports + effect lifecycle, no algorithmic rewrite, no in-repo AST renderer). Overrides this record's earlier adapter-over-core virtualizer recommendation | Active (Matt, 2026-08-18) / solid-markdown clause superseded by DL-218 (Matt, 2026-08-19) | [solid v2 migration §Resolved decisions](ui/compass-ui-solid-v2/design.md#resolved-decisions) |
 | DL-209 | The Wails packaged-shell seam under Solid 2 is low-risk-but-verified (no automation): the seam is Solid-free plain TS (`daemon-transport.ts` string-name `Call`/`Events`; `MarkdownText.tsx:1` `Browser.openExternal`), so effect-flush timing is the lesser risk; the packaged shell is the first place the babel-preset-solid 2 / vite-plugin-solid 3 / `@solidjs/web` production-build compilation and v2's render-root-owned delegated events run outside dev/happy-dom, so S7's manual packaged-shell smoke (RPC round-trip + openExternal) stays the mandatory gate — no automation justified for a one-shot migration | Active (Matt, 2026-08-18) | [solid v2 migration §Resolved decisions](ui/compass-ui-solid-v2/design.md#resolved-decisions) |
 | DL-218 | The owned `RigelBuild/solid-markdown` fork adopts upstream `andi23rosca/solid-markdown` #44 (the react-markdown-10 API rewrite — a third-party draft, upstream effectively inactive on it) + #45 (the bundle-deps jsdom-compat fix), re-ported to Solid 2 via a fork-local `src/jsx-runtime.ts` `jsx`/`jsxs`/`Fragment` triple over `createComponent`/`merge` + `@solidjs/web` `Dynamic` (solid-jsx dropped as Solid-1-bound), published as a clean `@rigelbuild/solid-markdown@3.0.0` (no `-rigel.N` suffix — the fork is ours and sets its own versions); this retires the fork's in-repo AST renderer in favor of the maintained `hast-util-to-jsx-runtime`. The apps/ui consumer injects @mention chips via a consumer-side rehype plugin over the existing `mentionRuns` splitter (the removed `text` component override), derives inline-vs-block code structurally via a `pre`/`code` override split (the removed `inline` prop), keeps `renderingStrategy="reconcile"` (un-deprecated in the owned fork), and adds a synchronous consumer-side `(lang, code)` highlight cache that `CodeBlock` reads at initial render (seeding highlighted HTML and bypassing the debounce + async `createResource` on a hit) to suppress the code-highlight flash caused by #44's per-tick component teardown (accepting marginal within-stream selection loss; the fine-grained-walker re-port is the escalation if it bites). Supersedes DL-208's `solid-markdown` clause ONLY (no-algorithmic-rewrite/no-in-repo-AST-renderer) — DL-208's `@tanstack/solid-virtual` clause and its org-wide fork-externalization stance stay Active | Active (Matt, 2026-08-19) | [markdown react10 §Approach](ui/compass-ui-markdown-react10/design.md#approach) |
+| DL-367 | Compass UI chrome glyphs are dot-matrix `crispEdges` SVG on an 11×11 grid, adopting the technique DL-150/DL-199 froze at 9×9 for `StateDot`/`BadgeGlyph` (which stay 9×9 — two grid sizes coexist, the components are separate). `ActivityBarItem.icon: string` is split AT THE ITEM into `GlyphTabItem { kind: "glyph"; name: GlyphName }` and `AvatarTabItem { kind: "avatar"; letter: string }` — the field conflated a fixed symbol with an agent handle's initial, and a field-level union was rejected because it preserves exactly that confusion. The avatar initial is NFKD-normalized and combining-marks-stripped before an ASCII clamp (`É`→`E`), falling back to `?` only for scripts no Latin letter represents — a bare clamp would collapse distinct non-ASCII handles to identical `?` tabs, defeating the per-agent distinguishability the initial exists for. 11×11 does NOT resolve the pre-existing 15px slot violation (that rule governs Departure Mono font sizes via UPM, not SVG boxes); the real hazard is half-pixel placement in the 34px tab, so the glyph box is pinned to a whole-pixel offset. Conversion is wholesale — every chrome symbol becomes a `<Glyph/>`, including ones Space Mono covers — accepting baseline churn for one vocabulary. This is the path that retires the ~14 MB Unifont pin, in its own stacked PR after the glyph lane recaptures baselines | Active (Matt, 2026-09-12) | [glyph primitives](ui/compass-glyph-primitives/design.md) |
 
 ## Threading & rendering