feat(goal-run): add multi-checkpoint goal orchestration with H5 and admin surfaces.

Persist goal runs in MySQL, bind agent runs to checkpoints, expose awaiting-approval
UX in chat, and add admin inspection routes with local verify scripts.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -69,6 +69,7 @@ import { createPortalAuthSessionHelpers } from './server/portal-auth-session-hel
 import { createPortalSessionCoordinator } from './server/portal-session-coordinator.mjs';
 import { attachPortalSessionRoutes } from './server/portal-session-routes.mjs';
 import { attachPortalUserMemoryRoutes } from './server/portal-user-memory-routes.mjs';
+import { attachPortalGoalRunRoutes } from './server/portal-goal-run-routes.mjs';
 import { assertMindSpaceRoute, mindspaceFlags } from './mindspace-flags.mjs';
 import { normalizeWorkspaceRelativePath } from './mindspace-pages.mjs';
 import {
@@ -253,6 +254,7 @@ let sessionStreamStore = null;
 let tkmindProxy = null;
 
 let agentRunGateway = null;
+let goalRunService = null;
 const {
   ownsAgentSession,
   unregisterAgentSessionForUser,
@@ -511,6 +513,7 @@ async function bootstrapUserAuth() {
     toolGateway = gatewayServices.toolGateway;
     agentRunGateway =
       gatewayServices.agentRunGateway;
+    goalRunService = gatewayServices.goalRunService;
     const integrationServices =
       await bootstrapPortalIntegrationServices({
         pool,
@@ -602,6 +605,11 @@ async function resolveAgentCodeRunForClient(userId) {
   }
 }
 
+async function resolveGoalRunForClient(userId) {
+  const { isGoalRunEnabledForUser } = await import('./goal-run-intent.mjs');
+  return { enabled: isGoalRunEnabledForUser(userId, process.env) };
+}
+
 attachPortalCoreAuthRoutes({
   app,
   jsonBody,
@@ -614,6 +622,7 @@ attachPortalCoreAuthRoutes({
   isSecureRequest,
   resolveSkillRuntimeForClient,
   resolveAgentCodeRunForClient,
+  resolveGoalRunForClient,
   getPlazaSeo: () => plazaSeo,
   plazaClientIp,
   logger: console,
@@ -824,6 +833,7 @@ async function resolveUserMemoryItems(userId, { sessionId = null, limit = 200 }
 attachPortalUserMemoryRoutes(api, {
   getMemoryV2: () => memoryV2,
   getTkmindProxy: () => tkmindProxy,
+  getPool: () => pool,
   ensureUserMemoryCapability,
   ownsAgentSession,
   loadUserVisibleConversation,
@@ -831,6 +841,12 @@ attachPortalUserMemoryRoutes(api, {
   resolveUserMemoryItems,
 });
 
+attachPortalGoalRunRoutes(api, {
+  getGoalRunService: () => goalRunService,
+  getAgentRunGateway: () => agentRunGateway,
+  env: process.env,
+});
+
 attachPortalMindSpaceSpaceRoutes(api, {
   getMindSpace: () => mindSpace,
   getScheduleService: () => scheduleService,
@@ -1359,6 +1375,8 @@ attachPortalAgentRuntimeRoutes(api, {
   getTkmindProxy: () => tkmindProxy,
   getLlmProviderService: () => llmProviderService,
   getAgentRunGateway: () => agentRunGateway,
+  getGoalRunService: () => goalRunService,
+  getChatIntentRouter: () => chatIntentRouter,
   getSessionAccess: () => sessionAccess,
   getMindSpaceAssetAgent: () => mindSpaceAssetAgent,
   getCodeRunPolicyService: () => agentCodeRunPolicyService,