0sec-cli 0.22.0 → 0.22.4

package/chunks/{dist-3FNZIBB4.js → dist-27BNG6WD.js}

@@ -24,6 +24,7 @@ import {
   DEFAULT_SEED_DIRS,
   DEFAULT_STRATEGIES,
   DEFAULT_TARGET_SUBSYSTEMS,
+  DEFAULT_WORKBENCH_PROVIDER_LIMITS,
   DISPATCH2022,
   DISTRO_DEFAULTS,
   EnforcementTracker,
@@ -58,6 +59,7 @@ import {
   LinuxBootMatrixImportAdapter,
   LinuxKernelResearchAdapter,
   LiveAgenticScanResearchAdapter,
+  MAX_ENABLED_REVIEW_CHECKS,
   MAX_OBJECTIVE_CHARS,
   MAX_OBJECTIVE_WORDS,
   McpHost,
@@ -78,7 +80,6 @@ import {
   STAGE_ACTION_HISTORY_CAP,
   SYNTH_TOOL,
   SYNTH_TOOL_NAME,
-  ScanCostLedger,
   SourceAuditTargetSchema,
   SuiteOracleObjectiveSchema,
   SuiteTaskTargetSchema,
@@ -178,6 +179,7 @@ import {
   computeSurfaceScore,
   confirmedMissToCandidate,
   connectMcpServers,
+  connectServicePlugins,
   consolidateMemory,
   controlRungForDemo,
   corpusV1Path,
@@ -210,6 +212,7 @@ import {
   createSessionObjectiveService,
   createStubSignatureVerifier,
   createVariantExecutionFactory,
+  createWorkbenchProviderBroker,
   createXnuFuzzReceipt,
   decodeProgram,
   dedupByCrashSignature,
@@ -305,6 +308,7 @@ import {
   instantiateGadget,
   isConfirmed,
   isCrossLanguageHint,
+  isDangerousLocalRoot,
   isDispatchTableSymbol,
   isHardToFuzzSurface,
   isHypothesisOnly,
@@ -321,6 +325,7 @@ import {
   listMcpTools,
   listObservations,
   listPrograms,
+  listProjectReviewChecks,
   loadAppsecArchetypes,
   loadAppsecFinderLenses,
   loadCpg,
@@ -382,6 +387,7 @@ import {
   parseCrashReport,
   parseDispatchTable,
   parseEnsembleModels,
+  parseImpactAssessment,
   parseJudgeJson,
   parseKcsanReport,
   parseKernelConfig,
@@ -455,6 +461,8 @@ import {
   resolveNovelty,
   resolveRange,
   retireArchetype,
+  reviewChecksFilePath,
+  reviewChecksProject,
   reviewKernelCrashSubsystems,
   rootProofInstructions,
   runBehavioralRepair,
@@ -519,6 +527,8 @@ import {
   signatureKey,
   sliceAroundTargets,
   snapshotBenchVariant,
+  snapshotProjectReviewChecks,
+  snapshotSmolvmWorkspace,
   solanaFinderLenses,
   solanaVerifyLenses,
   sourceReview,
@@ -536,6 +546,7 @@ import {
   techniquesForBug,
   techniquesForCategory,
   techniquesForEvent,
+  testServicePluginConnection,
   timerfdInterruptGadget,
   toCrossValidatedLeads,
   toHuntCandidate,
@@ -550,6 +561,7 @@ import {
   triggerTechniquesForFamily,
   truncateStageAction,
   unconfiguredVerifier,
+  updateProjectReviewChecks,
   validateBundlePlan,
   validateCandidateLens,
   validateCrashReportConsistency,
@@ -570,14 +582,14 @@ import {
   withEnvOverrides,
   withVariantFeatureFlags,
   xnuArtifactDigest
-} from "./chunk-EGZGZFAH.js";
+} from "./chunk-OAS5SAVZ.js";
 import {
   RateLimiter,
   TokenBucket,
   enumerateJsChunkUrls,
   parseRateLimitFlag,
   parseRetryAfter
-} from "./chunk-LYUAM3TG.js";
+} from "./chunk-E3OOBVOK.js";
 import {
   extractSpecInvariants,
   mapInvariantsToImplementation,
@@ -588,7 +600,7 @@ import {
 import {
   getEvalCategories,
   runEval
-} from "./chunk-RSIUX3RW.js";
+} from "./chunk-5JNTMWPK.js";
 import {
   classifyUserspacePrimitive,
   crashArtifactToFinding,
@@ -646,7 +658,7 @@ import {
   runStrategy,
   runWeaponization,
   selectStrategies
-} from "./chunk-VMRRNRMR.js";
+} from "./chunk-IHPTOTLL.js";
 import {
   BENIGN_MAX_CLASS,
   UPGRADE_MIN_CLASS,
@@ -657,7 +669,7 @@ import {
   isDangerUpgrade,
   maxDangerClass,
   rankDanger
-} from "./chunk-DM5C5L5D.js";
+} from "./chunk-DPUXXMJW.js";
 import {
   MAX_POC_BYTES,
   PocFetchError,
@@ -666,12 +678,12 @@ import {
   extractInlineCodeBlock,
   fetchPoc,
   renderAdaptationPrompt
-} from "./chunk-RRD4XXPU.js";
+} from "./chunk-5WAJGLCW.js";
 import {
   applyReachabilityGate,
   classifyPathReachability,
   generateVariantCandidates
-} from "./chunk-HUNAPTKV.js";
+} from "./chunk-E74LXQFY.js";
 import {
   collectScopeFiles,
   countScopeFilesUpTo
@@ -716,7 +728,7 @@ import {
   violationsToHuntPlan,
   witnessAssumptionViolation,
   witnessDualViewContexts
-} from "./chunk-UU7PQP6N.js";
+} from "./chunk-ELI3BVIK.js";
 import {
   CHROMIUM_BARE_WORDS,
   FREEBSD_BARE_KERNEL_WORDS,
@@ -801,7 +813,7 @@ import {
   unresolvedHuntClaims,
   validateHuntClaimRecord,
   validateResearchProposal
-} from "./chunk-UV5QWZGE.js";
+} from "./chunk-H4DH7COV.js";
 import {
   ACTION_LOG_ARGS_MAX,
   ACTION_LOG_ARG_VALUE_MAX,
@@ -852,23 +864,30 @@ import {
   approveEvolutionCandidate,
   argvForStep,
   assertReadOnlyAction,
+  assertWorkflowNativeRuntime,
   assertionFromStepExpect,
   attackPrompt,
   authorizeEvolutionArtifact,
   blindVerifyPrompt,
+  blockEvolutionCampaign,
   bucketEndpoint,
   bucketInScope,
   buildCandidateHosts,
   buildTodosPayload,
   buildToolCallLogEntry,
   buildToolCallsPayload,
+  campaignKey,
+  campaignPromotionAllowed,
   clampOutboundBody,
   classifyTakeover,
   clearSkillRegistry,
+  compareEvolutionIdentities,
   composeGuards,
   createDockerEvolutionSandbox,
   createEvolutionCandidate,
+  createEvolutionComparisonIdentity,
   createEvolutionSandbox,
+  createOrLoadEvolutionCampaign,
   createSmolvmEvolutionSandbox,
   createSmolvmPocTargetRunner,
   decideAddressing,
@@ -886,6 +905,7 @@ import {
   evaluateEvolutionCandidate,
   evaluateGate,
   evaluateGuards,
+  evolutionCorpusIdentity,
   evolutionDigest,
   excerpt,
   executeEvolutionVersion,
@@ -893,11 +913,13 @@ import {
   extractEngagementFromScopeJson,
   extractResponseText,
   fetchScoped,
+  filterWorkflowAgentTools,
   formatJitSkillsInstruction,
   formatScorecardSummary,
   formatUserAgent,
   getSkillById,
   getToolsForRole,
+  getWorkflowAuditExecutionPolicy,
   getWorkspaceHarnessTrust,
   guardApprovalUnavailable,
   guardNetworkRequiresScope,
@@ -906,13 +928,16 @@ import {
   harvestMissesFromScorecard,
   harvestMissesFromTournament,
   harvestedMissesToMissInput,
+  holdoutExposureIdentity,
   hubDir,
   huntMemoryPath,
   isMcpTarget,
   isScopeRequired,
   isValidPeerId,
   isWafEvasionLadderEnabled,
+  isWorkflowAgentToolAllowed,
   listSkillSummaries,
+  loadEvolutionCampaign,
   loadEvolutionRegistry,
   loadSkillRegistry,
   matchTriggers,
@@ -931,12 +956,15 @@ import {
   promoteEvolutionVersion,
   proposeEvolutionEdits,
   readToolCallNames,
+  reconcileCampaignDispatch,
   recordEvolutionVersion,
   redactSecrets,
   redactedArgsPreview,
   renderInboundMessage,
   reportPrompt,
   researchPrompt,
+  reserveCampaignDispatch,
+  reserveHoldoutExposure,
   resolveAttribution,
   resolveEngagementProfile,
   resolveEvolutionConfigImage,
@@ -955,6 +983,7 @@ import {
   sendOperatorMessage,
   sendPrompt,
   setWorkspaceHarnessTrust,
+  settleCampaignDispatch,
   snapshotEvolutionSource,
   sourceVerifyPrompt,
   startEvolutionCanary,
@@ -967,8 +996,11 @@ import {
   validateUpdateTodosArgs,
   verifyEvolutionSnapshot,
   verifyPrompt,
-  wilson95
-} from "./chunk-SJBCK2EI.js";
+  wilson95,
+  withWorkflowAuditExecutionPolicy,
+  workflowPhasePrompt,
+  workflowPolicyRuntime
+} from "./chunk-H6Q2QAIY.js";
 import "./chunk-K2PWUPUI.js";
 import {
   IntelCache,
@@ -1001,7 +1033,7 @@ import {
   searchTargetHistory,
   toGraphSnapshot,
   toOsvEcosystem
-} from "./chunk-TZFIAMWZ.js";
+} from "./chunk-SCWWLABR.js";
 import {
   parseSanitizerLog,
   renderSanitizerVerdict
@@ -1025,7 +1057,7 @@ import {
   rehydrateContext,
   resolveJournalPaths,
   streamJournal
-} from "./chunk-OAYUPGF6.js";
+} from "./chunk-YED25PA4.js";
 import {
   defaultDmesgOutPath,
   detectOutOfBandModuleLoad,
@@ -1033,9 +1065,10 @@ import {
   prepareKernelVmArtifacts,
   verifyKernelFinding,
   writeProofFileReadOnly
-} from "./chunk-XFCTUKXR.js";
+} from "./chunk-RCRTSKQN.js";
 import {
   FixTemplateRegistry,
+  applySourceFixCandidate,
   buildBranchName,
   buildHypothesesMarkdown,
   buildPrBody,
@@ -1054,55 +1087,19 @@ import {
   resolveSourceFixRepository,
   runSourceFix,
   saveSourceFixProjectInputs,
-  templateIdForCategory
-} from "./chunk-HR2TU42B.js";
+  templateIdForCategory,
+  verifySourceFixCandidate
+} from "./chunk-6WQDXWQC.js";
 import {
-  ANALYTICS_ENDPOINT,
-  ANALYTICS_LEVEL_ENV,
-  ANALYTICS_SCHEMA_VERSION,
-  ANALYTICS_SENT_LOG_FILENAME,
-  CONTRIBUTION_ENDPOINT,
-  CloudAuthError,
-  CloudAuthMissingError,
-  DEFAULT_CLOUD_HOST,
   DEFAULT_IMPROVEMENT_PROMOTION_POLICY,
-  DEFAULT_WORKBENCH_BROKER_LIMITS,
-  RunCapture,
-  RunContributionClient,
-  analyticsPipeline,
   appendImprovementLedgerEntry,
-  approveSmolvmWorkbenchImage,
   canonicalEvolutionJson,
-  configureRunContributionsFromEnvironment,
-  contributionChunkSchema,
-  contributionClientPolicySchema,
-  contributionManifestSchema,
-  contributionPurposeSchema,
-  contributionReceiptSchema,
-  contributionTransitionSchema,
-  currentRunContribution,
   evaluateImprovementPromotion,
   evaluateVerificationSpec,
-  eventBus,
-  getConfiguredRunContributionClient,
-  getSmolvmWorkbenchStatus,
-  getWorkbenchBrokerLimits,
-  isAdmittedSmolvmWorkbench,
-  levelAtLeast,
-  loadCloudCredentials,
   loadEvolutionConfigFile,
-  maybeSubscribeAnalyticsPipeline,
   parseEvolutionConfig,
-  presentationEventSink,
-  redactRecordStrings,
-  resolveAnalyticsLevel,
-  resolveSmolvmRuntime,
-  resolveWorkbenchBrokerImage,
-  runWorkbenchBrokerProgram,
-  startWorkbenchBroker,
-  verifyImprovementLedger,
-  withRunContribution
-} from "./chunk-RE5EZDG2.js";
+  verifyImprovementLedger
+} from "./chunk-CF3MNS3O.js";
 import {
   generateConformanceModel,
   judgeHttpDivergence,
@@ -1120,10 +1117,10 @@ import {
   detectAvailableRuntimes,
   getRuntimeInfo,
   pickRuntimeForStage
-} from "./chunk-5MWAG3FT.js";
+} from "./chunk-WBRGXCU2.js";
 import {
   ProcessRuntime
-} from "./chunk-W6UWZFKL.js";
+} from "./chunk-O6KPVYOI.js";
 import {
   AD_ANALYZERS_BY_ID,
   buildAdGraph,
@@ -1243,7 +1240,7 @@ import {
   reachableTo,
   shortestPaths
 } from "./chunk-UFHN6RIU.js";
-import "./chunk-VNRY6AWF.js";
+import "./chunk-L2CCO4KE.js";
 import {
   DISCLOSURE_STATUSES,
   IllegalTransitionError,
@@ -1280,6 +1277,101 @@ import {
   executePocSteps,
   setRuntimeDeps
 } from "./chunk-IXT64DV5.js";
+import {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse as parseNvdResponse2,
+  parseOsvResponse as parseOsvResponse2,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+} from "./chunk-3BPX75OR.js";
+import {
+  detectTargetType,
+  expandHomePath,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath,
+  prepare,
+  resolveLocalTargetPath
+} from "./chunk-GVY3S5E5.js";
+import "./chunk-CPCHLL6A.js";
+import {
+  ScanCostLedger
+} from "./chunk-YAZARMJY.js";
+import "./chunk-NJLKFC66.js";
+import {
+  CodexCatalogRefreshError,
+  loadCodexModelCatalog
+} from "./chunk-G2BE2FC7.js";
+import {
+  FEATURE_PRESETS,
+  LlmApiRuntime,
+  MAX_BUFFERED,
+  MAX_CODE_LENGTH,
+  MAX_FIELDS,
+  MAX_FIELD_VALUE_LENGTH,
+  MAX_MESSAGE_LENGTH,
+  OperatorAbortError,
+  QuotaExhaustedError,
+  _resetDiagnosticsForTests,
+  applyFeaturePreset,
+  applyFeaturePresetFromEnv,
+  claimDiagnostics,
+  diag,
+  features,
+  formatDiagnosticLine,
+  isDiagnosticsClaimed,
+  parseUsageLimitReached,
+  recentDiagnostics,
+  resolveFeaturePreset,
+  stderrDiagnosticSink,
+  subscribeDiagnostics
+} from "./chunk-QVIRWJ45.js";
+import {
+  ANALYTICS_ENDPOINT,
+  ANALYTICS_LEVEL_ENV,
+  ANALYTICS_SCHEMA_VERSION,
+  ANALYTICS_SENT_LOG_FILENAME,
+  CONTRIBUTION_ENDPOINT,
+  CloudAuthError,
+  CloudAuthMissingError,
+  DEFAULT_CLOUD_HOST,
+  DEFAULT_WORKBENCH_BROKER_LIMITS,
+  RunCapture,
+  RunContributionClient,
+  WORKBENCH_BROKER_WORKSPACE,
+  analyticsOptedOut,
+  analyticsPipeline,
+  approveSmolvmWorkbenchImage,
+  configureRunContributionsFromEnvironment,
+  contributionChunkSchema,
+  contributionClientPolicySchema,
+  contributionManifestSchema,
+  contributionPurposeSchema,
+  contributionReceiptSchema,
+  contributionTransitionSchema,
+  currentRunContribution,
+  getConfiguredRunContributionClient,
+  getSmolvmWorkbenchStatus,
+  getWorkbenchBrokerLimits,
+  isAdmittedSmolvmWorkbench,
+  levelAtLeast,
+  loadCloudCredentials,
+  maybeSubscribeAnalyticsPipeline,
+  redactRecordStrings,
+  resolveAnalyticsLevel,
+  resolveSmolvmRuntime,
+  resolveWorkbenchBrokerImage,
+  runWorkbenchBrokerProgram,
+  startWorkbenchBroker,
+  withRunContribution
+} from "./chunk-2WWAPKAW.js";
+import "./chunk-RS4MAN3Q.js";
 import {
   Cvss4ParseError,
   EmptyPocError,
@@ -1305,29 +1397,9 @@ import {
   verifyAgainstRef
 } from "./chunk-UELXHK2Y.js";
 import {
-  classifyReferences,
-  findCveArtifacts,
-  findRedHatTrackerUrls,
-  findUbuntuTrackerUrls,
-  normaliseCveId,
-  parseGhsaResponse,
-  parseNvdResponse as parseNvdResponse2,
-  parseOsvResponse as parseOsvResponse2,
-  parseRedHatTracker,
-  parseUbuntuTracker,
-  scoreCodeCandidate,
-  scoreRepoCandidate
-} from "./chunk-LPTRPRZR.js";
-import {
-  detectTargetType,
-  expandHomePath,
-  isExistingLocalTargetPath,
-  isExplicitLocalTargetPath,
-  prepare,
-  resolveLocalTargetPath
-} from "./chunk-V36HVTUL.js";
-import "./chunk-4VGLO2YS.js";
-import "./chunk-6YNKRUMC.js";
+  eventBus,
+  presentationEventSink
+} from "./chunk-4ZYYX5GY.js";
 import {
   BUILTIN_PLUGINS,
   DEFAULT_CALL_TIMEOUT_MS,
@@ -1380,6 +1452,7 @@ import {
   manifestDrift,
   matchUrl,
   nodeChildSpawner,
+  normalizeScopeHostname,
   pluginsRootDir,
   readEnablement,
   readInstalledPlugin,
@@ -1388,39 +1461,11 @@ import {
   validatePluginManifest,
   withScopeEnforcement,
   writeEnablement
-} from "./chunk-7DEHG7YT.js";
+} from "./chunk-C6JPA32H.js";
 import "./chunk-5IBCBQEH.js";
-import {
-  CodexCatalogRefreshError,
-  loadCodexModelCatalog
-} from "./chunk-IO7R7WBM.js";
-import {
-  FEATURE_PRESETS,
-  LlmApiRuntime,
-  MAX_BUFFERED,
-  MAX_CODE_LENGTH,
-  MAX_FIELDS,
-  MAX_FIELD_VALUE_LENGTH,
-  MAX_MESSAGE_LENGTH,
-  OperatorAbortError,
-  QuotaExhaustedError,
-  _resetDiagnosticsForTests,
-  applyFeaturePreset,
-  applyFeaturePresetFromEnv,
-  claimDiagnostics,
-  diag,
-  features,
-  formatDiagnosticLine,
-  isDiagnosticsClaimed,
-  parseUsageLimitReached,
-  recentDiagnostics,
-  resolveFeaturePreset,
-  stderrDiagnosticSink,
-  subscribeDiagnostics
-} from "./chunk-2GV4HQKE.js";
 import {
   estimateCost
-} from "./chunk-76KSBWOQ.js";
+} from "./chunk-6KFB6AYN.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {
@@ -1482,6 +1527,7 @@ export {
   DEFAULT_SUBDOMAIN_WORDLIST,
   DEFAULT_TARGET_SUBSYSTEMS,
   DEFAULT_WORKBENCH_BROKER_LIMITS,
+  DEFAULT_WORKBENCH_PROVIDER_LIMITS,
   DETECTOR_REGISTRY,
   DETECTOR_REGISTRY_BY_ID,
   DISCLOSURE_STATUSES,
@@ -1567,6 +1613,7 @@ export {
   MAX_CAPTURE_BYTES,
   MAX_CLAIM_STATEMENT_CHARS,
   MAX_CODE_LENGTH,
+  MAX_ENABLED_REVIEW_CHECKS,
   MAX_EVIDENCE_PER_CLAIM,
   MAX_EXTENSIONS_PER_SESSION,
   MAX_FIELDS,
@@ -1675,6 +1722,7 @@ export {
   STREAM_EXCERPT_BYTES as VERIFY_STREAM_EXCERPT_BYTES,
   WEAPONIZATION_PROVEN_BAR,
   WEB_GOALS,
+  WORKBENCH_BROKER_WORKSPACE,
   WindowsEvidenceWorkerClient,
   WindowsEvidenceWorkerTransportError,
   WindowsHyperVImportAdapter,
@@ -1698,6 +1746,7 @@ export {
   allocateCandidatesAcrossLanes,
   allowedNextStatuses,
   alreadyFixedInTarget,
+  analyticsOptedOut,
   analyticsPipeline,
   analyzeAppRegistrations,
   analyzeConditionalAccess,
@@ -1719,6 +1768,7 @@ export {
   applyFeaturePreset,
   applyFeaturePresetFromEnv,
   applyReachabilityGate,
+  applySourceFixCandidate,
   applySurfaceRanking,
   applyUnifiedDiff,
   applyVerificationToFinding,
@@ -1739,6 +1789,7 @@ export {
   assembleEvidencePack,
   assembleReproducibilityManifest,
   assertReadOnlyAction,
+  assertWorkflowNativeRuntime,
   assertionFromStepExpect,
   assessEscalation,
   assumptionsToHuntPlan,
@@ -1755,6 +1806,7 @@ export {
   autonomousClimb,
   availableRefuterCandidates,
   blindVerifyPrompt,
+  blockEvolutionCampaign,
   bootedCacheKey,
   boundaryCrossings,
   branchJournal,
@@ -1807,6 +1859,7 @@ export {
   cairoFinderLenses,
   cairoVerifyLenses,
   callMcpTool,
+  campaignPromotionAllowed,
   canTransition,
   candidateGrepPatterns,
   candidateReferenceTokens,
@@ -1851,6 +1904,7 @@ export {
   coerceEnablementRecord,
   collectScopeFiles,
   collectTenantSnapshot,
+  compareEvolutionIdentities,
   compareScorecards,
   compileAndRunReproducer,
   composeExploitSession,
@@ -1866,6 +1920,7 @@ export {
   configureRunContributionsFromEnvironment,
   confirmedMissToCandidate,
   connectMcpServers,
+  connectServicePlugins,
   consolidateMemory,
   contributionChunkSchema,
   contributionClientPolicySchema,
@@ -1899,6 +1954,7 @@ export {
   createDockerEvolutionSandbox,
   createDockerWebProvisioner,
   createEvolutionCandidate,
+  createEvolutionComparisonIdentity,
   createEvolutionSandbox,
   createEvolvedFinder,
   createHerdrEventSink,
@@ -1906,6 +1962,7 @@ export {
   createJournalWriter,
   createLiveHttpSender,
   createOperationalEventSink,
+  createOrLoadEvolutionCampaign,
   createOsvAdvisoryLookup,
   createPackageAuditScanAdapter,
   createProposalAttempt,
@@ -1920,6 +1977,7 @@ export {
   createSmolvmPocTargetRunner,
   createStubSignatureVerifier,
   createVariantExecutionFactory,
+  createWorkbenchProviderBroker,
   createXnuFuzzReceipt,
   crossCheckAssumptions,
   crossFamilyRefuteEnabled,
@@ -2029,6 +2087,8 @@ export {
   evidenceKindForFinding,
   evmFinderLenses,
   evmVerifyLenses,
+  campaignKey as evolutionCampaignKey,
+  evolutionCorpusIdentity,
   evolutionDigest,
   exampleManifestPath,
   executeEvolutionVersion,
@@ -2058,6 +2118,7 @@ export {
   fetchScoped,
   fileDiff,
   filterArchetypes,
+  filterWorkflowAgentTools,
   finalize,
   findAclAbuseChains,
   findAdcsEscalation,
@@ -2139,6 +2200,7 @@ export {
   getTechnique,
   getToolsForRole,
   getWorkbenchBrokerLimits,
+  getWorkflowAuditExecutionPolicy,
   getWorkspaceHarnessTrust,
   grantedPermissionNames,
   guardApprovalUnavailable,
@@ -2159,6 +2221,7 @@ export {
   heuristicCraftCandidateScore,
   hex64,
   highValueTargetIds,
+  holdoutExposureIdentity,
   holdsHighImpactPermission,
   holdsTier0Permission,
   hubDir,
@@ -2194,6 +2257,7 @@ export {
   isCrossApiAssumption,
   isCrossLanguageHint,
   isDangerUpgrade,
+  isDangerousLocalRoot,
   isDiagnosticsClaimed,
   isDisclosureWorthy,
   isDispatchTableSymbol,
@@ -2216,6 +2280,7 @@ export {
   isValidPeerId,
   isVariable,
   isWafEvasionLadderEnabled,
+  isWorkflowAgentToolAllowed,
   jaccard,
   joinDirectories,
   judgeCraftCandidatesWithLlm,
@@ -2238,6 +2303,7 @@ export {
   listMcpTools,
   listObservations,
   listPrograms,
+  listProjectReviewChecks,
   listSkillSummaries,
   liveGit,
   loadAppsecArchetypes,
@@ -2247,6 +2313,7 @@ export {
   loadCloudCredentials,
   loadCodexModelCatalog,
   loadCpg,
+  loadEvolutionCampaign,
   loadEvolutionConfigFile,
   loadEvolutionRegistry,
   loadFreebsdArchetypes,
@@ -2348,6 +2415,7 @@ export {
   normalizeGuid,
   normalizeId,
   normalizeProposalPath,
+  normalizeScopeHostname,
   normalizeStageAction,
   normalizeStageEndDetail,
   objectTypeToken,
@@ -2379,6 +2447,7 @@ export {
   parseGhsaResponse,
   parseGitHubAdvisories,
   parseHarnessGenerationSpec,
+  parseImpactAssessment,
   parseNvdResponse as parseIntelNvdResponse,
   parseOsvResponse as parseIntelOsvResponse,
   parseKcsanReport,
@@ -2474,6 +2543,7 @@ export {
   readUnstableDetector,
   recentDiagnostics,
   reconcile,
+  reconcileCampaignDispatch,
   recordEvolutionVersion,
   redactRecordStrings,
   redactSecrets,
@@ -2514,6 +2584,8 @@ export {
   researchPrompt,
   researchVariantDescriptor,
   researchVariantDescriptorDigest,
+  reserveCampaignDispatch,
+  reserveHoldoutExposure,
   resolveAnalyticsLevel,
   resolveAttribution,
   resolveDetectors,
@@ -2534,6 +2606,8 @@ export {
   resolveWorkbenchBrokerImage,
   retireArchetype,
   reviewAgentPrompt,
+  reviewChecksFilePath,
+  reviewChecksProject,
   reviewKernelCrashSubsystems,
   roleNodeId,
   rollbackEvolutionVersion,
@@ -2648,12 +2722,15 @@ export {
   setEnv,
   setRuntimeDeps,
   setWorkspaceHarnessTrust,
+  settleCampaignDispatch,
   shortestPaths,
   shouldWeaponize2 as shouldWeaponize,
   signatureKey,
   sliceAroundTargets,
   snapshotBenchVariant,
   snapshotEvolutionSource,
+  snapshotProjectReviewChecks,
+  snapshotSmolvmWorkspace,
   sniffMemPrimitive,
   solanaFinderLenses,
   solanaVerifyLenses,
@@ -2699,6 +2776,7 @@ export {
   techniquesForEvent,
   templateIdForCategory,
   tenantNodeId,
+  testServicePluginConnection,
   tier0TargetIds,
   timerfdInterruptGadget,
   toCrossValidatedLeads,
@@ -2721,6 +2799,7 @@ export {
   tryRecoverPreviousFeedback,
   unconfiguredVerifier,
   unresolvedHuntClaims,
+  updateProjectReviewChecks,
   validateAwsCredentials,
   validateBundlePlan,
   validateCandidateLens,
@@ -2745,6 +2824,7 @@ export {
   persistArtifact as verifyPersistArtifact,
   verifyPrompt,
   verifyRootProof,
+  verifySourceFixCandidate,
   verifyStandaloneKernelReproducer,
   verifyStaticKernelFinding,
   verifyStatusFromOutcome,
@@ -2757,8 +2837,11 @@ export {
   withRunContribution,
   withScopeEnforcement,
   withVariantFeatureFlags,
+  withWorkflowAuditExecutionPolicy,
   witnessAssumptionViolation,
   witnessDualViewContexts,
+  workflowPhasePrompt,
+  workflowPolicyRuntime,
   writeEnablement,
   writeProofFileReadOnly,
   writebackEnabled,