0sec-cli 0.22.1 → 0.23.0

package/chunks/{dist-L3XJWWZ6.js → dist-4LGRIBOC.js}

@@ -24,6 +24,7 @@ import {
   DEFAULT_SEED_DIRS,
   DEFAULT_STRATEGIES,
   DEFAULT_TARGET_SUBSYSTEMS,
+  DEFAULT_WORKBENCH_PROVIDER_LIMITS,
   DISPATCH2022,
   DISTRO_DEFAULTS,
   EnforcementTracker,
@@ -58,6 +59,7 @@ import {
   LinuxBootMatrixImportAdapter,
   LinuxKernelResearchAdapter,
   LiveAgenticScanResearchAdapter,
+  MAX_ENABLED_REVIEW_CHECKS,
   MAX_OBJECTIVE_CHARS,
   MAX_OBJECTIVE_WORDS,
   McpHost,
@@ -78,7 +80,6 @@ import {
   STAGE_ACTION_HISTORY_CAP,
   SYNTH_TOOL,
   SYNTH_TOOL_NAME,
-  ScanCostLedger,
   SourceAuditTargetSchema,
   SuiteOracleObjectiveSchema,
   SuiteTaskTargetSchema,
@@ -96,6 +97,7 @@ import {
   WindowsEvidenceWorkerTransportError,
   WindowsHyperVImportAdapter,
   WindowsVariantResearchAdapter,
+  WorkflowService,
   XNU_RECEIPT_SCHEMA_VERSION,
   XnuIokitResearchAdapter,
   XnuReceiptReplayer,
@@ -178,6 +180,7 @@ import {
   computeSurfaceScore,
   confirmedMissToCandidate,
   connectMcpServers,
+  connectServicePlugins,
   consolidateMemory,
   controlRungForDemo,
   corpusV1Path,
@@ -210,6 +213,7 @@ import {
   createSessionObjectiveService,
   createStubSignatureVerifier,
   createVariantExecutionFactory,
+  createWorkbenchProviderBroker,
   createXnuFuzzReceipt,
   decodeProgram,
   dedupByCrashSignature,
@@ -249,7 +253,10 @@ import {
   evmFinderLenses,
   evmVerifyLenses,
   exampleManifestPath,
+  executeAssessment,
+  executeAssessmentRun,
   executeKernelRun,
+  executeWorkflow,
   extractCorpus,
   extractCraftCpgTargets,
   extractDupeSignature,
@@ -305,6 +312,7 @@ import {
   instantiateGadget,
   isConfirmed,
   isCrossLanguageHint,
+  isDangerousLocalRoot,
   isDispatchTableSymbol,
   isHardToFuzzSurface,
   isHypothesisOnly,
@@ -321,6 +329,7 @@ import {
   listMcpTools,
   listObservations,
   listPrograms,
+  listProjectReviewChecks,
   loadAppsecArchetypes,
   loadAppsecFinderLenses,
   loadCpg,
@@ -372,6 +381,7 @@ import {
   objectiveOracleEvaluatorConfigJson,
   observationDigest,
   observationQueueSummary,
+  orderWorkflowNodes,
   packageAudit,
   pairwiseDeltas,
   parseApprovedObservationShape,
@@ -456,6 +466,8 @@ import {
   resolveNovelty,
   resolveRange,
   retireArchetype,
+  reviewChecksFilePath,
+  reviewChecksProject,
   reviewKernelCrashSubsystems,
   rootProofInstructions,
   runBehavioralRepair,
@@ -520,6 +532,8 @@ import {
   signatureKey,
   sliceAroundTargets,
   snapshotBenchVariant,
+  snapshotProjectReviewChecks,
+  snapshotSmolvmWorkspace,
   solanaFinderLenses,
   solanaVerifyLenses,
   sourceReview,
@@ -537,7 +551,9 @@ import {
   techniquesForBug,
   techniquesForCategory,
   techniquesForEvent,
+  testServicePluginConnection,
   timerfdInterruptGadget,
+  toAssessmentReport,
   toCrossValidatedLeads,
   toHuntCandidate,
   toHuntCandidates,
@@ -551,6 +567,7 @@ import {
   triggerTechniquesForFamily,
   truncateStageAction,
   unconfiguredVerifier,
+  updateProjectReviewChecks,
   validateBundlePlan,
   validateCandidateLens,
   validateCrashReportConsistency,
@@ -571,14 +588,14 @@ import {
   withEnvOverrides,
   withVariantFeatureFlags,
   xnuArtifactDigest
-} from "./chunk-LGCASF2C.js";
+} from "./chunk-4HGGNBKK.js";
 import {
   RateLimiter,
   TokenBucket,
   enumerateJsChunkUrls,
   parseRateLimitFlag,
   parseRetryAfter
-} from "./chunk-XCISCI4T.js";
+} from "./chunk-QMICC5O2.js";
 import {
   extractSpecInvariants,
   mapInvariantsToImplementation,
@@ -589,7 +606,7 @@ import {
 import {
   getEvalCategories,
   runEval
-} from "./chunk-3E2KALZ5.js";
+} from "./chunk-NX4H6L4M.js";
 import {
   classifyUserspacePrimitive,
   crashArtifactToFinding,
@@ -605,7 +622,7 @@ import {
   runMemSafetyScan,
   runUserspaceFuzzLoop,
   sniffMemPrimitive
-} from "./chunk-TM74SSHC.js";
+} from "./chunk-62ENS6XO.js";
 import {
   leadToFinding,
   runNpmDynamicDiscovery
@@ -647,7 +664,7 @@ import {
   runStrategy,
   runWeaponization,
   selectStrategies
-} from "./chunk-7XCKYNLO.js";
+} from "./chunk-XORZUR2H.js";
 import {
   BENIGN_MAX_CLASS,
   UPGRADE_MIN_CLASS,
@@ -658,7 +675,7 @@ import {
   isDangerUpgrade,
   maxDangerClass,
   rankDanger
-} from "./chunk-ZKQ2I3S2.js";
+} from "./chunk-LVGZGG63.js";
 import {
   MAX_POC_BYTES,
   PocFetchError,
@@ -667,12 +684,12 @@ import {
   extractInlineCodeBlock,
   fetchPoc,
   renderAdaptationPrompt
-} from "./chunk-CPWA6RWE.js";
+} from "./chunk-3ZNI7F42.js";
 import {
   applyReachabilityGate,
   classifyPathReachability,
   generateVariantCandidates
-} from "./chunk-4G7OVYJX.js";
+} from "./chunk-WIYNYNL2.js";
 import {
   collectScopeFiles,
   countScopeFilesUpTo
@@ -717,7 +734,7 @@ import {
   violationsToHuntPlan,
   witnessAssumptionViolation,
   witnessDualViewContexts
-} from "./chunk-OSBPGWTE.js";
+} from "./chunk-EJH2TNVH.js";
 import {
   CHROMIUM_BARE_WORDS,
   FREEBSD_BARE_KERNEL_WORDS,
@@ -802,7 +819,7 @@ import {
   unresolvedHuntClaims,
   validateHuntClaimRecord,
   validateResearchProposal
-} from "./chunk-5BTJMINS.js";
+} from "./chunk-P7KDN5PK.js";
 import {
   ACTION_LOG_ARGS_MAX,
   ACTION_LOG_ARG_VALUE_MAX,
@@ -853,23 +870,30 @@ import {
   approveEvolutionCandidate,
   argvForStep,
   assertReadOnlyAction,
+  assertWorkflowNativeRuntime,
   assertionFromStepExpect,
   attackPrompt,
   authorizeEvolutionArtifact,
   blindVerifyPrompt,
+  blockEvolutionCampaign,
   bucketEndpoint,
   bucketInScope,
   buildCandidateHosts,
   buildTodosPayload,
   buildToolCallLogEntry,
   buildToolCallsPayload,
+  campaignKey,
+  campaignPromotionAllowed,
   clampOutboundBody,
   classifyTakeover,
   clearSkillRegistry,
+  compareEvolutionIdentities,
   composeGuards,
   createDockerEvolutionSandbox,
   createEvolutionCandidate,
+  createEvolutionComparisonIdentity,
   createEvolutionSandbox,
+  createOrLoadEvolutionCampaign,
   createSmolvmEvolutionSandbox,
   createSmolvmPocTargetRunner,
   decideAddressing,
@@ -887,6 +911,7 @@ import {
   evaluateEvolutionCandidate,
   evaluateGate,
   evaluateGuards,
+  evolutionCorpusIdentity,
   evolutionDigest,
   excerpt,
   executeEvolutionVersion,
@@ -894,11 +919,13 @@ import {
   extractEngagementFromScopeJson,
   extractResponseText,
   fetchScoped,
+  filterWorkflowAgentTools,
   formatJitSkillsInstruction,
   formatScorecardSummary,
   formatUserAgent,
   getSkillById,
   getToolsForRole,
+  getWorkflowAuditExecutionPolicy,
   getWorkspaceHarnessTrust,
   guardApprovalUnavailable,
   guardNetworkRequiresScope,
@@ -907,13 +934,16 @@ import {
   harvestMissesFromScorecard,
   harvestMissesFromTournament,
   harvestedMissesToMissInput,
+  holdoutExposureIdentity,
   hubDir,
   huntMemoryPath,
   isMcpTarget,
   isScopeRequired,
   isValidPeerId,
   isWafEvasionLadderEnabled,
+  isWorkflowAgentToolAllowed,
   listSkillSummaries,
+  loadEvolutionCampaign,
   loadEvolutionRegistry,
   loadSkillRegistry,
   matchTriggers,
@@ -932,12 +962,15 @@ import {
   promoteEvolutionVersion,
   proposeEvolutionEdits,
   readToolCallNames,
+  reconcileCampaignDispatch,
   recordEvolutionVersion,
   redactSecrets,
   redactedArgsPreview,
   renderInboundMessage,
   reportPrompt,
   researchPrompt,
+  reserveCampaignDispatch,
+  reserveHoldoutExposure,
   resolveAttribution,
   resolveEngagementProfile,
   resolveEvolutionConfigImage,
@@ -956,6 +989,7 @@ import {
   sendOperatorMessage,
   sendPrompt,
   setWorkspaceHarnessTrust,
+  settleCampaignDispatch,
   snapshotEvolutionSource,
   sourceVerifyPrompt,
   startEvolutionCanary,
@@ -968,8 +1002,11 @@ import {
   validateUpdateTodosArgs,
   verifyEvolutionSnapshot,
   verifyPrompt,
-  wilson95
-} from "./chunk-HHPWRY2M.js";
+  wilson95,
+  withWorkflowAuditExecutionPolicy,
+  workflowPhasePrompt,
+  workflowPolicyRuntime
+} from "./chunk-EH2WTNY7.js";
 import "./chunk-K2PWUPUI.js";
 import {
   IntelCache,
@@ -1002,11 +1039,11 @@ import {
   searchTargetHistory,
   toGraphSnapshot,
   toOsvEcosystem
-} from "./chunk-YL6YAGLL.js";
+} from "./chunk-JEYIWMGL.js";
 import {
   parseSanitizerLog,
   renderSanitizerVerdict
-} from "./chunk-2OQOQ2FZ.js";
+} from "./chunk-Y4HJRUFE.js";
 import {
   ESCALATION_LADDER,
   ladderUpTo,
@@ -1026,7 +1063,7 @@ import {
   rehydrateContext,
   resolveJournalPaths,
   streamJournal
-} from "./chunk-NLH4LMWH.js";
+} from "./chunk-3E54JYS4.js";
 import {
   defaultDmesgOutPath,
   detectOutOfBandModuleLoad,
@@ -1034,9 +1071,10 @@ import {
   prepareKernelVmArtifacts,
   verifyKernelFinding,
   writeProofFileReadOnly
-} from "./chunk-WZRVS7SB.js";
+} from "./chunk-F344NYUN.js";
 import {
   FixTemplateRegistry,
+  applySourceFixCandidate,
   buildBranchName,
   buildHypothesesMarkdown,
   buildPrBody,
@@ -1055,55 +1093,19 @@ import {
   resolveSourceFixRepository,
   runSourceFix,
   saveSourceFixProjectInputs,
-  templateIdForCategory
-} from "./chunk-XA2O4WXA.js";
+  templateIdForCategory,
+  verifySourceFixCandidate
+} from "./chunk-YYS2H33A.js";
 import {
-  ANALYTICS_ENDPOINT,
-  ANALYTICS_LEVEL_ENV,
-  ANALYTICS_SCHEMA_VERSION,
-  ANALYTICS_SENT_LOG_FILENAME,
-  CONTRIBUTION_ENDPOINT,
-  CloudAuthError,
-  CloudAuthMissingError,
-  DEFAULT_CLOUD_HOST,
   DEFAULT_IMPROVEMENT_PROMOTION_POLICY,
-  DEFAULT_WORKBENCH_BROKER_LIMITS,
-  RunCapture,
-  RunContributionClient,
-  analyticsPipeline,
   appendImprovementLedgerEntry,
-  approveSmolvmWorkbenchImage,
   canonicalEvolutionJson,
-  configureRunContributionsFromEnvironment,
-  contributionChunkSchema,
-  contributionClientPolicySchema,
-  contributionManifestSchema,
-  contributionPurposeSchema,
-  contributionReceiptSchema,
-  contributionTransitionSchema,
-  currentRunContribution,
   evaluateImprovementPromotion,
   evaluateVerificationSpec,
-  eventBus,
-  getConfiguredRunContributionClient,
-  getSmolvmWorkbenchStatus,
-  getWorkbenchBrokerLimits,
-  isAdmittedSmolvmWorkbench,
-  levelAtLeast,
-  loadCloudCredentials,
   loadEvolutionConfigFile,
-  maybeSubscribeAnalyticsPipeline,
   parseEvolutionConfig,
-  presentationEventSink,
-  redactRecordStrings,
-  resolveAnalyticsLevel,
-  resolveSmolvmRuntime,
-  resolveWorkbenchBrokerImage,
-  runWorkbenchBrokerProgram,
-  startWorkbenchBroker,
-  verifyImprovementLedger,
-  withRunContribution
-} from "./chunk-OHHCGDJ2.js";
+  verifyImprovementLedger
+} from "./chunk-AAA4PRWK.js";
 import {
   generateConformanceModel,
   judgeHttpDivergence,
@@ -1121,10 +1123,10 @@ import {
   detectAvailableRuntimes,
   getRuntimeInfo,
   pickRuntimeForStage
-} from "./chunk-IFME676H.js";
+} from "./chunk-UZUELPFW.js";
 import {
   ProcessRuntime
-} from "./chunk-W6UWZFKL.js";
+} from "./chunk-O6KPVYOI.js";
 import {
   AD_ANALYZERS_BY_ID,
   buildAdGraph,
@@ -1244,7 +1246,7 @@ import {
   reachableTo,
   shortestPaths
 } from "./chunk-UFHN6RIU.js";
-import "./chunk-VWITLWXB.js";
+import "./chunk-T7ZEVY5G.js";
 import {
   DISCLOSURE_STATUSES,
   IllegalTransitionError,
@@ -1281,6 +1283,102 @@ import {
   executePocSteps,
   setRuntimeDeps
 } from "./chunk-IXT64DV5.js";
+import {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse as parseNvdResponse2,
+  parseOsvResponse as parseOsvResponse2,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+} from "./chunk-W5VNCB57.js";
+import {
+  detectTargetType,
+  expandHomePath,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath,
+  prepare,
+  resolveLocalTargetPath
+} from "./chunk-YAEJAZYW.js";
+import "./chunk-65H3MRBF.js";
+import {
+  ScanCostLedger,
+  budgetNativeRuntime
+} from "./chunk-CP6HANBE.js";
+import "./chunk-NJLKFC66.js";
+import {
+  CodexCatalogRefreshError,
+  loadCodexModelCatalog
+} from "./chunk-K55B4OH4.js";
+import {
+  FEATURE_PRESETS,
+  LlmApiRuntime,
+  MAX_BUFFERED,
+  MAX_CODE_LENGTH,
+  MAX_FIELDS,
+  MAX_FIELD_VALUE_LENGTH,
+  MAX_MESSAGE_LENGTH,
+  OperatorAbortError,
+  QuotaExhaustedError,
+  _resetDiagnosticsForTests,
+  applyFeaturePreset,
+  applyFeaturePresetFromEnv,
+  claimDiagnostics,
+  diag,
+  features,
+  formatDiagnosticLine,
+  isDiagnosticsClaimed,
+  parseUsageLimitReached,
+  recentDiagnostics,
+  resolveFeaturePreset,
+  stderrDiagnosticSink,
+  subscribeDiagnostics
+} from "./chunk-BF5FIK7H.js";
+import {
+  ANALYTICS_ENDPOINT,
+  ANALYTICS_LEVEL_ENV,
+  ANALYTICS_SCHEMA_VERSION,
+  ANALYTICS_SENT_LOG_FILENAME,
+  CONTRIBUTION_ENDPOINT,
+  CloudAuthError,
+  CloudAuthMissingError,
+  DEFAULT_CLOUD_HOST,
+  DEFAULT_WORKBENCH_BROKER_LIMITS,
+  RunCapture,
+  RunContributionClient,
+  WORKBENCH_BROKER_WORKSPACE,
+  analyticsOptedOut,
+  analyticsPipeline,
+  approveSmolvmWorkbenchImage,
+  configureRunContributionsFromEnvironment,
+  contributionChunkSchema,
+  contributionClientPolicySchema,
+  contributionManifestSchema,
+  contributionPurposeSchema,
+  contributionReceiptSchema,
+  contributionTransitionSchema,
+  currentRunContribution,
+  getConfiguredRunContributionClient,
+  getSmolvmWorkbenchStatus,
+  getWorkbenchBrokerLimits,
+  isAdmittedSmolvmWorkbench,
+  levelAtLeast,
+  loadCloudCredentials,
+  maybeSubscribeAnalyticsPipeline,
+  redactRecordStrings,
+  resolveAnalyticsLevel,
+  resolveSmolvmRuntime,
+  resolveWorkbenchBrokerImage,
+  runWorkbenchBrokerProgram,
+  startWorkbenchBroker,
+  withRunContribution
+} from "./chunk-NI6QYQSK.js";
+import "./chunk-RS4MAN3Q.js";
 import {
   Cvss4ParseError,
   EmptyPocError,
@@ -1306,29 +1404,9 @@ import {
   verifyAgainstRef
 } from "./chunk-UELXHK2Y.js";
 import {
-  classifyReferences,
-  findCveArtifacts,
-  findRedHatTrackerUrls,
-  findUbuntuTrackerUrls,
-  normaliseCveId,
-  parseGhsaResponse,
-  parseNvdResponse as parseNvdResponse2,
-  parseOsvResponse as parseOsvResponse2,
-  parseRedHatTracker,
-  parseUbuntuTracker,
-  scoreCodeCandidate,
-  scoreRepoCandidate
-} from "./chunk-XDKB2P5X.js";
-import {
-  detectTargetType,
-  expandHomePath,
-  isExistingLocalTargetPath,
-  isExplicitLocalTargetPath,
-  prepare,
-  resolveLocalTargetPath
-} from "./chunk-V36HVTUL.js";
-import "./chunk-4VGLO2YS.js";
-import "./chunk-6YNKRUMC.js";
+  eventBus,
+  presentationEventSink
+} from "./chunk-A5QO7N3S.js";
 import {
   BUILTIN_PLUGINS,
   DEFAULT_CALL_TIMEOUT_MS,
@@ -1381,6 +1459,7 @@ import {
   manifestDrift,
   matchUrl,
   nodeChildSpawner,
+  normalizeScopeHostname,
   pluginsRootDir,
   readEnablement,
   readInstalledPlugin,
@@ -1389,39 +1468,11 @@ import {
   validatePluginManifest,
   withScopeEnforcement,
   writeEnablement
-} from "./chunk-X7LAEEUW.js";
+} from "./chunk-ITES7BCY.js";
 import "./chunk-5IBCBQEH.js";
-import {
-  CodexCatalogRefreshError,
-  loadCodexModelCatalog
-} from "./chunk-WSDDGFA6.js";
-import {
-  FEATURE_PRESETS,
-  LlmApiRuntime,
-  MAX_BUFFERED,
-  MAX_CODE_LENGTH,
-  MAX_FIELDS,
-  MAX_FIELD_VALUE_LENGTH,
-  MAX_MESSAGE_LENGTH,
-  OperatorAbortError,
-  QuotaExhaustedError,
-  _resetDiagnosticsForTests,
-  applyFeaturePreset,
-  applyFeaturePresetFromEnv,
-  claimDiagnostics,
-  diag,
-  features,
-  formatDiagnosticLine,
-  isDiagnosticsClaimed,
-  parseUsageLimitReached,
-  recentDiagnostics,
-  resolveFeaturePreset,
-  stderrDiagnosticSink,
-  subscribeDiagnostics
-} from "./chunk-AV2LG2L7.js";
 import {
   estimateCost
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-LTEE2JWK.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {
@@ -1483,6 +1534,7 @@ export {
   DEFAULT_SUBDOMAIN_WORDLIST,
   DEFAULT_TARGET_SUBSYSTEMS,
   DEFAULT_WORKBENCH_BROKER_LIMITS,
+  DEFAULT_WORKBENCH_PROVIDER_LIMITS,
   DETECTOR_REGISTRY,
   DETECTOR_REGISTRY_BY_ID,
   DISCLOSURE_STATUSES,
@@ -1568,6 +1620,7 @@ export {
   MAX_CAPTURE_BYTES,
   MAX_CLAIM_STATEMENT_CHARS,
   MAX_CODE_LENGTH,
+  MAX_ENABLED_REVIEW_CHECKS,
   MAX_EVIDENCE_PER_CLAIM,
   MAX_EXTENSIONS_PER_SESSION,
   MAX_FIELDS,
@@ -1676,10 +1729,12 @@ export {
   STREAM_EXCERPT_BYTES as VERIFY_STREAM_EXCERPT_BYTES,
   WEAPONIZATION_PROVEN_BAR,
   WEB_GOALS,
+  WORKBENCH_BROKER_WORKSPACE,
   WindowsEvidenceWorkerClient,
   WindowsEvidenceWorkerTransportError,
   WindowsHyperVImportAdapter,
   WindowsVariantResearchAdapter,
+  WorkflowService,
   XNU_RECEIPT_SCHEMA_VERSION,
   XnuIokitResearchAdapter,
   XnuReceiptReplayer,
@@ -1699,6 +1754,7 @@ export {
   allocateCandidatesAcrossLanes,
   allowedNextStatuses,
   alreadyFixedInTarget,
+  analyticsOptedOut,
   analyticsPipeline,
   analyzeAppRegistrations,
   analyzeConditionalAccess,
@@ -1720,6 +1776,7 @@ export {
   applyFeaturePreset,
   applyFeaturePresetFromEnv,
   applyReachabilityGate,
+  applySourceFixCandidate,
   applySurfaceRanking,
   applyUnifiedDiff,
   applyVerificationToFinding,
@@ -1740,6 +1797,7 @@ export {
   assembleEvidencePack,
   assembleReproducibilityManifest,
   assertReadOnlyAction,
+  assertWorkflowNativeRuntime,
   assertionFromStepExpect,
   assessEscalation,
   assumptionsToHuntPlan,
@@ -1756,12 +1814,14 @@ export {
   autonomousClimb,
   availableRefuterCandidates,
   blindVerifyPrompt,
+  blockEvolutionCampaign,
   bootedCacheKey,
   boundaryCrossings,
   branchJournal,
   breakRecordToFinding,
   bucketEndpoint,
   bucketInScope,
+  budgetNativeRuntime,
   buildAdGraph,
   buildAttackPath,
   buildBranchName,
@@ -1808,6 +1868,7 @@ export {
   cairoFinderLenses,
   cairoVerifyLenses,
   callMcpTool,
+  campaignPromotionAllowed,
   canTransition,
   candidateGrepPatterns,
   candidateReferenceTokens,
@@ -1852,6 +1913,7 @@ export {
   coerceEnablementRecord,
   collectScopeFiles,
   collectTenantSnapshot,
+  compareEvolutionIdentities,
   compareScorecards,
   compileAndRunReproducer,
   composeExploitSession,
@@ -1867,6 +1929,7 @@ export {
   configureRunContributionsFromEnvironment,
   confirmedMissToCandidate,
   connectMcpServers,
+  connectServicePlugins,
   consolidateMemory,
   contributionChunkSchema,
   contributionClientPolicySchema,
@@ -1900,6 +1963,7 @@ export {
   createDockerEvolutionSandbox,
   createDockerWebProvisioner,
   createEvolutionCandidate,
+  createEvolutionComparisonIdentity,
   createEvolutionSandbox,
   createEvolvedFinder,
   createHerdrEventSink,
@@ -1907,6 +1971,7 @@ export {
   createJournalWriter,
   createLiveHttpSender,
   createOperationalEventSink,
+  createOrLoadEvolutionCampaign,
   createOsvAdvisoryLookup,
   createPackageAuditScanAdapter,
   createProposalAttempt,
@@ -1921,6 +1986,7 @@ export {
   createSmolvmPocTargetRunner,
   createStubSignatureVerifier,
   createVariantExecutionFactory,
+  createWorkbenchProviderBroker,
   createXnuFuzzReceipt,
   crossCheckAssumptions,
   crossFamilyRefuteEnabled,
@@ -2030,11 +2096,16 @@ export {
   evidenceKindForFinding,
   evmFinderLenses,
   evmVerifyLenses,
+  campaignKey as evolutionCampaignKey,
+  evolutionCorpusIdentity,
   evolutionDigest,
   exampleManifestPath,
+  executeAssessment,
+  executeAssessmentRun,
   executeEvolutionVersion,
   executeKernelRun,
   executePocSteps,
+  executeWorkflow,
   expandHomePath,
   extractAttributionFromScopeJson,
   extractCFromLlmOutput,
@@ -2059,6 +2130,7 @@ export {
   fetchScoped,
   fileDiff,
   filterArchetypes,
+  filterWorkflowAgentTools,
   finalize,
   findAclAbuseChains,
   findAdcsEscalation,
@@ -2140,6 +2212,7 @@ export {
   getTechnique,
   getToolsForRole,
   getWorkbenchBrokerLimits,
+  getWorkflowAuditExecutionPolicy,
   getWorkspaceHarnessTrust,
   grantedPermissionNames,
   guardApprovalUnavailable,
@@ -2160,6 +2233,7 @@ export {
   heuristicCraftCandidateScore,
   hex64,
   highValueTargetIds,
+  holdoutExposureIdentity,
   holdsHighImpactPermission,
   holdsTier0Permission,
   hubDir,
@@ -2195,6 +2269,7 @@ export {
   isCrossApiAssumption,
   isCrossLanguageHint,
   isDangerUpgrade,
+  isDangerousLocalRoot,
   isDiagnosticsClaimed,
   isDisclosureWorthy,
   isDispatchTableSymbol,
@@ -2217,6 +2292,7 @@ export {
   isValidPeerId,
   isVariable,
   isWafEvasionLadderEnabled,
+  isWorkflowAgentToolAllowed,
   jaccard,
   joinDirectories,
   judgeCraftCandidatesWithLlm,
@@ -2239,6 +2315,7 @@ export {
   listMcpTools,
   listObservations,
   listPrograms,
+  listProjectReviewChecks,
   listSkillSummaries,
   liveGit,
   loadAppsecArchetypes,
@@ -2248,6 +2325,7 @@ export {
   loadCloudCredentials,
   loadCodexModelCatalog,
   loadCpg,
+  loadEvolutionCampaign,
   loadEvolutionConfigFile,
   loadEvolutionRegistry,
   loadFreebsdArchetypes,
@@ -2349,6 +2427,7 @@ export {
   normalizeGuid,
   normalizeId,
   normalizeProposalPath,
+  normalizeScopeHostname,
   normalizeStageAction,
   normalizeStageEndDetail,
   objectTypeToken,
@@ -2359,6 +2438,7 @@ export {
   observationDigest,
   observationQueueSummary,
   oracleForCategory,
+  orderWorkflowNodes,
   packageAudit,
   pairwiseDeltas,
   parseApiSpec,
@@ -2476,6 +2556,7 @@ export {
   readUnstableDetector,
   recentDiagnostics,
   reconcile,
+  reconcileCampaignDispatch,
   recordEvolutionVersion,
   redactRecordStrings,
   redactSecrets,
@@ -2516,6 +2597,8 @@ export {
   researchPrompt,
   researchVariantDescriptor,
   researchVariantDescriptorDigest,
+  reserveCampaignDispatch,
+  reserveHoldoutExposure,
   resolveAnalyticsLevel,
   resolveAttribution,
   resolveDetectors,
@@ -2536,6 +2619,8 @@ export {
   resolveWorkbenchBrokerImage,
   retireArchetype,
   reviewAgentPrompt,
+  reviewChecksFilePath,
+  reviewChecksProject,
   reviewKernelCrashSubsystems,
   roleNodeId,
   rollbackEvolutionVersion,
@@ -2650,12 +2735,15 @@ export {
   setEnv,
   setRuntimeDeps,
   setWorkspaceHarnessTrust,
+  settleCampaignDispatch,
   shortestPaths,
   shouldWeaponize2 as shouldWeaponize,
   signatureKey,
   sliceAroundTargets,
   snapshotBenchVariant,
   snapshotEvolutionSource,
+  snapshotProjectReviewChecks,
+  snapshotSmolvmWorkspace,
   sniffMemPrimitive,
   solanaFinderLenses,
   solanaVerifyLenses,
@@ -2701,8 +2789,10 @@ export {
   techniquesForEvent,
   templateIdForCategory,
   tenantNodeId,
+  testServicePluginConnection,
   tier0TargetIds,
   timerfdInterruptGadget,
+  toAssessmentReport,
   toCrossValidatedLeads,
   toGraphSnapshot,
   toHuntCandidate,
@@ -2723,6 +2813,7 @@ export {
   tryRecoverPreviousFeedback,
   unconfiguredVerifier,
   unresolvedHuntClaims,
+  updateProjectReviewChecks,
   validateAwsCredentials,
   validateBundlePlan,
   validateCandidateLens,
@@ -2747,6 +2838,7 @@ export {
   persistArtifact as verifyPersistArtifact,
   verifyPrompt,
   verifyRootProof,
+  verifySourceFixCandidate,
   verifyStandaloneKernelReproducer,
   verifyStaticKernelFinding,
   verifyStatusFromOutcome,
@@ -2759,8 +2851,11 @@ export {
   withRunContribution,
   withScopeEnforcement,
   withVariantFeatureFlags,
+  withWorkflowAuditExecutionPolicy,
   witnessAssumptionViolation,
   witnessDualViewContexts,
+  workflowPhasePrompt,
+  workflowPolicyRuntime,
   writeEnablement,
   writeProofFileReadOnly,
   writebackEnabled,