feat(api,cli): extend Engineering Marble to backend + CLI

[devin-ai-integration]

Summary

Follows up on PR #1 (web) — the brief was to take the same engineering-marble language across the whole stack so the tool reads as one carved object, the way OpenClaw does. One palette, one voice, one response shape, zero drift between the web UI, the HTTP surface, and the CLI.

Three seams, same marble:

surface	seam	primitives
web (in main)	apps/web/src/index.css, components/marble.tsx	design tokens, Panel, Chip, Eyebrow, Crosshairs
api (this PR)	apps/api/src/lib/{marble,envelope,request-id,mono-logger}.ts	banner, rule, endpointLine, ok/fail, request id
cli (this PR)	apps/cli/src/lib/{palette,ui}.ts	banner, rule, kv, chip, table, step, mark

Backend API (apps/api)

• Response envelope. Every route now returns the same shape:

  { "ok": true,  "data": <T>,                               "meta": { "requestId": "r_…", "timestamp": "…" } }
  { "ok": false, "error": { "code": "…", "message": "…" }, "meta": { "requestId": "r_…", "timestamp": "…" } }

• Triad. GET /healthz (liveness) · GET /readyz (readiness + DB probe) · GET /v1/meta (version, uptime, node, commit, mode). Mirrors OpenClaw's health / status / doctor.
• Curl-friendly index. GET / returns a plain-text marble spec sheet with banner + endpoint list + envelope legend + source link.
• Versioned routes. Everything under /v1/*; /api/* kept as an alias for the existing web client.
• Mono HTTP log. Replaced Morgan with a compact HH:MM:SS MET STATUS ms path request-id line so successive requests register as a visual stack.
• Request id. Every Request is assigned an opaque 16-char id (r_…); honoured from upstream X-Request-Id, echoed in the response header, surfaced in the envelope meta.
• Uniform error handler. ZodError → 400 VALIDATION_FAILED with full issues; anything else → fail(). Stderr trace is one styled line, not a stack dump.

CLI (apps/cli)

• Every command rewritten. init, config, set-llm, analyze, tailor, cost summary|recent|budget, track list|stats|add, onboard, doctor — plus new health and status commands mirroring the API triad.
• No chalk rainbow. One palette (c.ivory, c.bone, c.graphite, c.muted, c.vein, c.signal, c.ok, c.warn, c.err), all output composed through banner / rule / kv / chip / step / mark / table. No emojis.
• TTY-aware. NO_COLOR respected. --no-color / --plain disable ANSI. --json short-circuits styling entirely and emits machine-readable payloads for health / status / config.
• OSC-8 hyperlinks in terminals that support them (e.g. onboard links to docs and issues).

Cross-cutting

• One palette across three surfaces. Web HSL tokens, API 256-colour ANSI, CLI 256-colour ANSI — all map to the same ramp, so a screenshot from any layer is recognisably the same object.
• Zero emojis in engineered output. The whole stack is legible in a logfile, a pipe, and a paste.
• Build + types + lint green. npx turbo run type-check lint build → 18/18 tasks pass.

Evidence

Rendered with aha so the ANSI lands truthfully in PNG:

surface	shot
API · boot banner + mono HTTP log
API · GET / curl-friendly spec sheet
CLI · applypilot health
CLI · applypilot status
CLI · applypilot config
CLI · applypilot track stats

Review & Testing Checklist for Human

Risk: yellow — the envelope is a behavioural change on the HTTP surface, and the existing web client currently calls /api/* (kept as an alias, but worth eyeballing).

• Confirm the web app still works end-to-end (apps/web → apps/api on /api/*). The envelope changes shape from { jobs: […] } to { ok, data: { jobs: […] }, meta }; any consumer reading response.jobs needs to now read response.data.jobs.
• Hit GET / on the running API in a terminal (curl http://localhost:8092/) and confirm the marble spec sheet renders — and that the endpoint list matches what you actually serve.
• Run applypilot health, applypilot status, applypilot doctor, applypilot config and sanity-check the output against your own environment. Also try --json, --plain, and NO_COLOR=1.
• Decide whether to drop the /api/* alias entirely and migrate the web client fully to /v1/* in a follow-up.

Notes

• No CI is configured on the repo, so there are no checks to wait on. Local npx turbo run type-check lint build is green on this branch (18/18 tasks).
• The MockQuery.all: … lines visible in the CLI status and track stats screenshots are coming from the mock tracker/DB layer in @applypilot/tracker (stdout logging on the mock Database), not from the CLI rewrite — easy follow-up to silence once a real SQLite/Postgres adapter is wired in.
• Core packages (@applypilot/core, @applypilot/jd, @applypilot/resume, @applypilot/tracker, @applypilot/portals) are intentionally untouched — the marble aesthetic is applied to the surfaces only, keeping this PR reviewable.

Link to Devin session: https://app.devin.ai/sessions/d189411bcf4d4e7fbefe3d6adb8ddd24

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring