test(connector-id): migrate fixtures and assertions to pi-mono ids

Replaces legacy adapter ids (codex_local / claude_local / gemini_local /
claude_compatible) across ~42 test files with pi-mono equivalents:
- codex_local → openai-codex
- claude_local → claude-pro
- gemini_local → gemini-cli
- claude_compatible → anthropic

Hand-rewrites where fixture semantics changed:
- connector-matching: TASK_TYPE_PREFERENCE ordering rebased (claude-pro
  first for code/content/management; google first for research)
- connector-model-policy: getModels(provider) from pi-ai instead of the
  deleted adapter.module.models array
- session-management + edge-case-session: adapter exemption removed;
  rotation now uniform under pi-mono
- ipc-core-admin-handlers: CSV compat model replaced with pi-ai anthropic
- connectors.spec: lookup by openai-codex id (catalog now starts with claude-pro)
- onboarding-model-pool: listProviderModels(provider) helper; label text
  changed to "ChatGPT Plus/Pro (Codex)"
- database integration: added vault insecure-fallback env + electron mock
- command-paths: uses new @main/connector-helpers normalizeCommandValue
- pi-mono-migrations: added `as string` casts for 3 negative-existence
  assertions verifying legacy ids were removed

Drops:
- pnpm-workspace.yaml packages: [] (was "packages/*"; directory empty)
- obsolete CONNECTOR_STRENGTHS import; .module.models probing

Verification:
- pnpm typecheck → 0 errors
- pnpm lint → 0 errors / 0 warnings
- pnpm build:verify → 0 errors / 0 warnings
- pnpm test:unit → 508/508 pass
- pnpm test:integration → 96/96 pass
- All 6 adapter hard gates pass (NOT FOUND / 0 matches / empty)
- pi-ai / pi-agent-core / pi-coding-agent all resolved @0.67.6

src/shared/contracts/schemas-agent-event.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+
+/**
+ * The renderer-bound `agent-event` push payload.
+ *
+ * The `event` payload is pi's AgentEvent (discriminated by `type`). We do not
+ * mirror pi's type system in Zod (it would couple the renderer to pi's
+ * internals); we validate the envelope and pass the event through opaquely.
+ */
+export const agentEventPushSchema = z.object({
+  runId: z.string(),
+  agentId: z.string(),
+  companyId: z.string(),
+  taskId: z.string().nullable(),
+  emittedAt: z.string(),
+  event: z.object({
+    type: z.string(),
+  }).passthrough(),
+});
+
+export type AgentEventPush = z.infer<typeof agentEventPushSchema>;

src/shared/contracts/schemas-credentials.ts

@@ -0,0 +1,89 @@
+import { z } from "zod";
+
+export const credentialKindSchema = z.enum([
+  "oauth",
+  "api_key",
+  "aws",
+  "azure",
+  "gcp_adc",
+]);
+
+export const credentialStatusSchema = z.enum([
+  "active",
+  "expired",
+  "revoked",
+  "error",
+  "not_configured",
+]);
+
+export const apiKeyValueSchema = z.object({
+  source: z.enum(["literal", "env"]),
+  value: z.string().min(1),
+});
+
+export const azureCredentialSchema = z.object({
+  apiKey: z.string().min(1),
+  baseUrl: z.string().url().optional().or(z.literal("")),
+  resourceName: z.string().optional().or(z.literal("")),
+  apiVersion: z.string().optional().or(z.literal("")),
+  deploymentMap: z.record(z.string(), z.string()).optional(),
+});
+
+export const awsCredentialSchema = z.object({
+  authMode: z.enum(["profile", "iam", "bearer"]),
+  region: z.string().min(1).default("us-east-1"),
+  awsProfile: z.string().optional(),
+  accessKeyId: z.string().optional(),
+  secretAccessKey: z.string().optional(),
+  sessionToken: z.string().optional(),
+  bearerToken: z.string().optional(),
+  forceCache: z.boolean().optional(),
+  endpointUrl: z.string().optional(),
+  skipAuth: z.boolean().optional(),
+  forceHttp1: z.boolean().optional(),
+});
+
+export const gcpAdcCredentialSchema = z.object({
+  project: z.string().min(1),
+  location: z.string().min(1),
+  credentialsPath: z.string().optional(),
+});
+
+export const credentialPayloadSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("api_key"), value: apiKeyValueSchema }),
+  z.object({ kind: z.literal("azure"), value: azureCredentialSchema }),
+  z.object({ kind: z.literal("aws"), value: awsCredentialSchema }),
+  z.object({ kind: z.literal("gcp_adc"), value: gcpAdcCredentialSchema }),
+]);
+
+export const saveCredentialInputSchema = z.object({
+  connectorId: z.string().min(1),
+  payload: credentialPayloadSchema,
+});
+
+export const removeCredentialInputSchema = z.object({
+  connectorId: z.string().min(1),
+});
+
+export const testCredentialInputSchema = z.object({
+  connectorId: z.string().min(1),
+});
+
+export const credentialSummarySchema = z.object({
+  connectorId: z.string(),
+  kind: credentialKindSchema,
+  displayHint: z.string(),
+  status: credentialStatusSchema,
+  expiresAt: z.string().nullable(),
+  lastRefreshedAt: z.string().nullable(),
+  lastError: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+});
+
+export type CredentialSummary = z.infer<typeof credentialSummarySchema>;
+export type CredentialPayload = z.infer<typeof credentialPayloadSchema>;
+export type SaveCredentialInput = z.infer<typeof saveCredentialInputSchema>;
+export type AwsCredential = z.infer<typeof awsCredentialSchema>;
+export type AzureCredential = z.infer<typeof azureCredentialSchema>;
+export type GcpAdcCredential = z.infer<typeof gcpAdcCredentialSchema>;
+export type ApiKeyValue = z.infer<typeof apiKeyValueSchema>;

src/shared/contracts/schemas-oauth.ts

@@ -0,0 +1,60 @@
+import { z } from "zod";
+
+export const oauthStartInputSchema = z.object({
+  connectorId: z.string().min(1),
+});
+
+export const oauthCancelInputSchema = z.object({
+  connectorId: z.string().min(1),
+});
+
+export const oauthPromptResponseSchema = z.object({
+  connectorId: z.string().min(1),
+  requestId: z.string().min(1),
+  value: z.string(),
+});
+
+export const oauthManualCodeResponseSchema = z.object({
+  connectorId: z.string().min(1),
+  requestId: z.string().min(1),
+  code: z.string().min(1),
+});
+
+export const oauthAuthInfoSchema = z.object({
+  connectorId: z.string(),
+  url: z.string().url(),
+  instructions: z.string().optional(),
+});
+
+export const oauthProgressSchema = z.object({
+  connectorId: z.string(),
+  message: z.string(),
+});
+
+export const oauthStatusSchema = z.object({
+  connectorId: z.string(),
+  status: z.enum(["active", "cancelled", "error", "in_progress"]),
+  errorMessage: z.string().optional(),
+});
+
+export const oauthPromptRequestSchema = z.object({
+  connectorId: z.string(),
+  requestId: z.string(),
+  message: z.string(),
+  placeholder: z.string().optional(),
+  allowEmpty: z.boolean().optional(),
+});
+
+export const oauthManualCodeRequestSchema = z.object({
+  connectorId: z.string(),
+  requestId: z.string(),
+});
+
+export type OAuthStartInput = z.infer<typeof oauthStartInputSchema>;
+export type OAuthAuthInfoEvent = z.infer<typeof oauthAuthInfoSchema>;
+export type OAuthProgressEvent = z.infer<typeof oauthProgressSchema>;
+export type OAuthStatusEvent = z.infer<typeof oauthStatusSchema>;
+export type OAuthPromptRequestEvent = z.infer<typeof oauthPromptRequestSchema>;
+export type OAuthManualCodeRequestEvent = z.infer<typeof oauthManualCodeRequestSchema>;
+export type OAuthPromptResponseInput = z.infer<typeof oauthPromptResponseSchema>;
+export type OAuthManualCodeResponseInput = z.infer<typeof oauthManualCodeResponseSchema>;

src/shared/types/records-core.ts

@@ -6,6 +6,7 @@ import type {
   WorkspaceState,
   DepartmentId,
   AgentStatus,
+  AgentRoleLevel,
   GoalStatus,
   ProjectStatus,
   TaskStatus,
@@ -73,6 +74,8 @@ export interface AgentRecord {
   name: string;
   role: string;
   title: string;
+  /** Seniority enum used for leadership detection; free-text `role` remains UI-editable. */
+  roleLevel: AgentRoleLevel;
   department: DepartmentId | null;
   status: AgentStatus;
   reportsTo: string | null;