Agent M2: WorkflowAgent core, provider registry, context snapshots and the investigation workflow

[cevheri]

Goal

Ship the durable agent core end-to-end for ONE workflow (investigation) on PostgreSQL + SQLite, behind the feature flag (default off).

Scope

Runtime and API

• Thin AgentRunService over AI SDK WorkflowAgent: start/status/cancel/resume/stream APIs; runs survive refresh/restart via the World chosen in M0
• Planning mode receives a genuinely empty tool set server-side; Agent mode receives only the server-selected R0/R1 tools from M1
• Workflow state carries only serializable IDs/data - no credentials, no DB clients, no raw large results ({ artifactId, summary, evidenceRefs } instead)
• Domain contracts limited to product-meaningful types (AgentRun, semantic AgentEvent, ContextSnapshot, ArtifactRef, EvidenceRef); AI SDK message/tool/stream types are not re-modeled

Models

• AI SDK provider registry for Gemini, OpenAI, Claude, Ollama, OpenAI-compatible custom
• Adapter maps the existing src/lib/llm settings into the registry - users configure keys once, no second settings surface
• Capability probe (tool calling, structured output, streaming) with explicit fallback UX to chat/NL2SQL for failing models

Context and tools

• L0 ContextSnapshot at connection-active/run-start: schema/relations/index inventory + fingerprint, incremental refresh, task-aware packing (never dump the full schema into every prompt)
• AI SDK tool() wrappers over M1 operations: schema.*, profile.table, monitor.snapshot, query.read, query.explain, artifact.chart, report.compose
• Structured tool outcomes + bounded repair loop (max 3, no same-fingerprint blind retries; denials never retried as wrong SQL)
• Database content treated as untrusted input: tool-result labeling/quoting in prompts

Workspace UI (v1)

• Right agent rail on Studio.tsx: resizable (min ~300px), Planning default with free mode switching, timeline of semantic events, citations, budget meter (tools/DB-time/tokens/repairs), pause/resume/cancel
• Agent artifacts hydrate the existing BottomPanel surfaces (ResultsGrid/Explain/Charts) with an "Agent run #N - read-only" provenance badge; explicit "Apply to editor" / "Show in results"; no second Monaco or grid inside the rail
• Rail gated behind an additive/optional capability prop; invisible in the embedded platform build (Phase 1 is standalone-only)
• Mobile: rail opens as a Sheet/drawer below md; jsx-a11y error gate holds

Acceptance criteria

• A scripted investigation run on the PostgreSQL and SQLite fixtures completes end-to-end: draft, failing identifier, repair via schema tool, verified query, artifacts, cited report.
• Kill the server mid-run; the run resumes without duplicate tool executions.
• Planning runs execute zero database operations (policy unit test, not only eval).
• All six local gates plus build:lib + attw green; 100% coverage including streaming/durable paths (agent tests live in an isolated test group to survive mock.module process-wide behavior).

---

Part of #325