@amaster.ai/employee-runtime-connector 0.1.1-beta.80 → 0.1.1-beta.82

package/dist/amaster-runtime-daemon.mjs

@@ -4,9 +4,9 @@
 // src/amaster-runtime-daemon.mjs
 import { createHash as createHash13 } from "node:crypto";
 import { createRequire } from "node:module";
-import { chmodSync as chmodSync5, copyFileSync as copyFileSync2, existsSync as existsSync12, lstatSync as lstatSync6, mkdirSync as mkdirSync8, mkdtempSync, readFileSync as readFileSync11, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync6, rmSync as rmSync6, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { chmodSync as chmodSync6, copyFileSync as copyFileSync2, existsSync as existsSync12, lstatSync as lstatSync6, mkdirSync as mkdirSync8, mkdtempSync, readFileSync as readFileSync12, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync7, rmSync as rmSync7, statSync as statSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
-import { basename as basename6, delimiter as delimiter3, dirname as dirname8, extname as extname2, isAbsolute as isAbsolute6, join as join13, relative as relative7, resolve as resolve10 } from "node:path";
+import { basename as basename6, delimiter as delimiter3, dirname as dirname9, extname as extname2, isAbsolute as isAbsolute6, join as join14, relative as relative7, resolve as resolve10 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -1936,24 +1936,24 @@ function reconcileManagedCodexMcpProfiles(rootPath, options = {}) {
 // src/amaster-runtime-daemon/pi-managed-mcp-profile.mjs
 import { createHash as createHash3 } from "node:crypto";
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   chownSync as chownSync2,
   copyFileSync,
   existsSync as existsSync3,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   realpathSync as realpathSync2,
   readdirSync as readdirSync3,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
   rmdirSync,
   statSync as statSync2,
   symlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
 import { arch as arch2, platform as platform2 } from "node:os";
-import { basename as basename2, delimiter, dirname as dirname3, isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import { basename as basename2, delimiter, dirname as dirname4, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 
 // src/amaster-runtime-daemon/pi-provider-config.mjs
@@ -2520,6 +2520,190 @@ function piMcpAdapterServerConfigIdentity(definition, adapterVersion) {
 
 // src/amaster-runtime-daemon/pi-effective-tools-attestor.mjs
 import { createHash as createHash2 } from "node:crypto";
+
+// src/amaster-runtime-daemon/source-acquisition-execution-receipt.mjs
+import { randomBytes } from "node:crypto";
+import { chmodSync as chmodSync3, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
+var SOURCE_ACQUISITION_EXECUTION_RECEIPT_SCHEMA_VERSION = "mirrorx.source-acquisition-execution-receipt.v1";
+var ATTESTOR_STATUSES = /* @__PURE__ */ new Set(["pending", "attested", "rejected", "unknown"]);
+var MODEL_CONTRACT_STATUSES = /* @__PURE__ */ new Set(["pending", "validated", "rejected", "unknown"]);
+var ATTESTOR_REASON_CODES = /* @__PURE__ */ new Set([
+  "effective_tool_manifest_invalid",
+  "effective_tool_surface_mismatch",
+  "effective_tool_set_hash_mismatch",
+  "managed_mcp_cache_mismatch",
+  "managed_mcp_config_mismatch",
+  "attestor_unknown"
+]);
+var MODEL_CONTRACT_REASON_CODES = /* @__PURE__ */ new Set([
+  "model_missing",
+  "model_output_contract_failed",
+  "model_contract_unknown"
+]);
+var SPAWN_ERRNO = /* @__PURE__ */ new Set(["EACCES", "EMFILE", "ENFILE", "ENOENT", "ENOMEM", "EPERM"]);
+function sourceAcquisitionSpawnErrno(value) {
+  const code = typeof value === "string" ? value.trim().toUpperCase() : "";
+  return SPAWN_ERRNO.has(code) ? code : null;
+}
+function validIdentity(identity2) {
+  return identity2 && typeof identity2.commandId === "string" && identity2.commandId.length > 0 && typeof identity2.attemptId === "string" && identity2.attemptId.length > 0 && Number.isSafeInteger(identity2.epoch) && identity2.epoch >= 1;
+}
+function sameIdentity(receipt, identity2) {
+  return validIdentity(identity2) && receipt.commandId === identity2.commandId && receipt.attemptId === identity2.attemptId && receipt.epoch === identity2.epoch;
+}
+function isNullableBoolean(value) {
+  return value === true || value === false || value === null;
+}
+function normalizeReceipt(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const receipt = {
+    schemaVersion: value.schemaVersion,
+    commandId: value.commandId,
+    attemptId: value.attemptId,
+    epoch: value.epoch,
+    attestorStatus: value.attestorStatus,
+    attestorReasonCode: value.attestorReasonCode ?? null,
+    modelContractStatus: value.modelContractStatus,
+    modelContractReasonCode: value.modelContractReasonCode ?? null,
+    modelInvocationStarted: value.modelInvocationStarted,
+    sourceReadStarted: value.sourceReadStarted,
+    spawnErrno: value.spawnErrno ?? null
+  };
+  if (receipt.schemaVersion !== SOURCE_ACQUISITION_EXECUTION_RECEIPT_SCHEMA_VERSION || !validIdentity(receipt) || !ATTESTOR_STATUSES.has(receipt.attestorStatus) || !MODEL_CONTRACT_STATUSES.has(receipt.modelContractStatus) || !isNullableBoolean(receipt.modelInvocationStarted) || !isNullableBoolean(receipt.sourceReadStarted) || receipt.attestorReasonCode !== null && !ATTESTOR_REASON_CODES.has(receipt.attestorReasonCode) || receipt.modelContractReasonCode !== null && !MODEL_CONTRACT_REASON_CODES.has(receipt.modelContractReasonCode) || receipt.spawnErrno !== null && !SPAWN_ERRNO.has(receipt.spawnErrno)) return null;
+  return receipt;
+}
+function writeReceiptAtomic(path, receipt) {
+  const temporaryPath = join4(dirname3(path), `.source-receipt-${randomBytes(12).toString("hex")}.tmp`);
+  try {
+    writeFileSync3(temporaryPath, `${JSON.stringify(receipt)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    chmodSync3(temporaryPath, 384);
+    renameSync2(temporaryPath, path);
+    chmodSync3(path, 384);
+  } finally {
+    rmSync2(temporaryPath, { force: true });
+  }
+}
+function createSourceAcquisitionExecutionReceipt(path, identity2) {
+  if (!validIdentity(identity2)) throw new Error("source_acquisition_execution_receipt_identity_invalid");
+  const receipt = {
+    schemaVersion: SOURCE_ACQUISITION_EXECUTION_RECEIPT_SCHEMA_VERSION,
+    commandId: identity2.commandId,
+    attemptId: identity2.attemptId,
+    epoch: identity2.epoch,
+    attestorStatus: "pending",
+    attestorReasonCode: null,
+    modelContractStatus: "pending",
+    modelContractReasonCode: null,
+    modelInvocationStarted: false,
+    sourceReadStarted: false,
+    spawnErrno: null
+  };
+  writeReceiptAtomic(path, receipt);
+  return receipt;
+}
+function readSourceAcquisitionExecutionReceipt(path, identity2) {
+  try {
+    const receipt = normalizeReceipt(JSON.parse(readFileSync3(path, "utf8")));
+    return receipt && sameIdentity(receipt, identity2) ? receipt : null;
+  } catch {
+    return null;
+  }
+}
+function monotonicBoolean(previous, next) {
+  if (next === void 0 || next === previous) return previous;
+  if (previous === false && next === true) return true;
+  if (previous === null && next === null) return null;
+  throw new Error("source_acquisition_execution_receipt_non_monotonic");
+}
+function monotonicStatus(previous, next, pending) {
+  if (next === void 0 || next === previous) return previous;
+  if (previous === pending && next !== pending) return next;
+  throw new Error("source_acquisition_execution_receipt_non_monotonic");
+}
+function updateSourceAcquisitionExecutionReceipt(path, identity2, patch) {
+  const previous = readSourceAcquisitionExecutionReceipt(path, identity2);
+  if (!previous) throw new Error("source_acquisition_execution_receipt_invalid");
+  const next = {
+    ...previous,
+    attestorStatus: monotonicStatus(previous.attestorStatus, patch.attestorStatus, "pending"),
+    ...patch.attestorReasonCode === void 0 ? {} : { attestorReasonCode: patch.attestorReasonCode },
+    modelContractStatus: monotonicStatus(
+      previous.modelContractStatus,
+      patch.modelContractStatus,
+      "pending"
+    ),
+    ...patch.modelContractReasonCode === void 0 ? {} : { modelContractReasonCode: patch.modelContractReasonCode },
+    ...patch.spawnErrno === void 0 ? {} : { spawnErrno: patch.spawnErrno },
+    modelInvocationStarted: monotonicBoolean(previous.modelInvocationStarted, patch.modelInvocationStarted),
+    sourceReadStarted: monotonicBoolean(previous.sourceReadStarted, patch.sourceReadStarted)
+  };
+  const normalized = normalizeReceipt(next);
+  if (!normalized) throw new Error("source_acquisition_execution_receipt_patch_invalid");
+  writeReceiptAtomic(path, normalized);
+  return normalized;
+}
+function failureSummary(receipt, input, overrides) {
+  const sourceReadStarted = input.readerSideEffectObserved === true && receipt?.sourceReadStarted !== true ? null : receipt?.sourceReadStarted ?? null;
+  return {
+    failureCode: overrides.failureCode ?? "source_acquisition_executor_config_failed",
+    reasonCode: overrides.reasonCode,
+    phase: overrides.phase,
+    retryClass: overrides.retryClass,
+    autoRetryEligible: overrides.retryClass === "transient_infra" && receipt?.modelInvocationStarted === false && sourceReadStarted === false,
+    modelInvocationStarted: receipt?.modelInvocationStarted ?? null,
+    sourceReadStarted
+  };
+}
+function classifySourceAcquisitionExecutionFailure(input) {
+  const receipt = normalizeReceipt(input.receipt);
+  if (!receipt || !sameIdentity(receipt, input.identity)) {
+    return failureSummary(null, input, { reasonCode: "execution_receipt_missing", phase: "unknown", retryClass: "unknown" });
+  }
+  if (input.readerSideEffectObserved === true && receipt.sourceReadStarted !== true) {
+    return failureSummary(receipt, input, { reasonCode: "source_read_receipt_inconsistent", phase: "unknown", retryClass: "unknown" });
+  }
+  if (receipt.spawnErrno) {
+    const mapping = {
+      ENOENT: ["source_acquisition_executor_binary_missing", "executor_binary_missing", "operator_repair"],
+      EACCES: ["source_acquisition_executor_permission_denied", "executor_permission_denied", "operator_repair"],
+      EPERM: ["source_acquisition_executor_permission_denied", "executor_permission_denied", "operator_repair"],
+      ENOMEM: ["source_acquisition_executor_resource_exhausted", "executor_resource_exhausted", "transient_infra"],
+      EMFILE: ["source_acquisition_executor_resource_exhausted", "executor_resource_exhausted", "transient_infra"],
+      ENFILE: ["source_acquisition_executor_resource_exhausted", "executor_resource_exhausted", "transient_infra"]
+    };
+    const [failureCode2, reasonCode, retryClass] = mapping[receipt.spawnErrno];
+    return failureSummary(receipt, input, { failureCode: failureCode2, reasonCode, phase: "spawn", retryClass });
+  }
+  if (receipt.attestorStatus === "rejected") {
+    return failureSummary(receipt, input, {
+      failureCode: "source_acquisition_tool_attestation_rejected",
+      reasonCode: receipt.attestorReasonCode ?? "attestor_unknown",
+      phase: "attestation",
+      retryClass: "operator_repair"
+    });
+  }
+  if (receipt.modelContractStatus === "rejected") {
+    return failureSummary(receipt, input, {
+      failureCode: receipt.modelContractReasonCode === "model_missing" ? "source_acquisition_model_missing" : "source_acquisition_model_contract_failed",
+      reasonCode: receipt.modelContractReasonCode ?? "model_contract_unknown",
+      phase: "model_contract",
+      retryClass: "operator_repair"
+    });
+  }
+  return failureSummary(receipt, input, {
+    reasonCode: Number(input.exitCode) === 78 ? "executor_exit_78_unknown" : "executor_failure_unknown",
+    phase: "unknown",
+    retryClass: "unknown"
+  });
+}
+
+// src/amaster-runtime-daemon/pi-effective-tools-attestor.mjs
 var MANAGED_PI_EFFECTIVE_TOOLS_ATTESTOR_FILENAME = "amaster-effective-tools-attestor.js";
 var MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION = "amaster.pi-effective-tools.v1";
 function normalizedSchema(value, adapterNormalized) {
@@ -2568,12 +2752,15 @@ function stablePiManagedMcpCacheSemanticHash(value) {
   return createHash2("sha256").update(stablePiJson(parsed)).digest("hex");
 }
 function managedPiEffectiveToolsAttestorExtensionSource() {
-  return String.raw`import { createHash } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+  return String.raw`import { createHash, randomBytes } from "node:crypto";
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Value } from "typebox/value";
 
 const SCHEMA_VERSION = ${JSON.stringify(MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION)};
+const SOURCE_EXECUTION_RECEIPT_SCHEMA_VERSION = ${JSON.stringify(SOURCE_ACQUISITION_EXECUTION_RECEIPT_SCHEMA_VERSION)};
+const sourceExecutionReceiptPath = process.env.AMASTER_SOURCE_ACQUISITION_EXECUTION_RECEIPT?.trim() || null;
 
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -2624,6 +2811,47 @@ function safeWriteReceipt(receiptPath, receipt) {
   writeFileSync(receiptPath, JSON.stringify(receipt) + "\n", { encoding: "utf8", mode: 0o600 });
 }
 
+function sourceReceiptReason(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (message.includes("manifest identity")) return "effective_tool_manifest_invalid";
+  if (message.includes("tool surface")) return "effective_tool_surface_mismatch";
+  if (message.includes("tool set hash")) return "effective_tool_set_hash_mismatch";
+  if (message.includes("cache")) return "managed_mcp_cache_mismatch";
+  if (message.includes("config")) return "managed_mcp_config_mismatch";
+  return "attestor_unknown";
+}
+
+function updateSourceExecutionReceipt(patch) {
+  // Runtime-generated counterpart to updateSourceAcquisitionExecutionReceipt.
+  // Keep its monotonic transition and private atomic-write behavior covered by
+  // pi-effective-tools-attestor.test.mjs when the canonical receipt changes.
+  const path = sourceExecutionReceiptPath;
+  if (!path) return true;
+  let temporaryPath = null;
+  try {
+    const receipt = JSON.parse(readFileSync(path, "utf8"));
+    if (receipt.schemaVersion !== SOURCE_EXECUTION_RECEIPT_SCHEMA_VERSION) return false;
+    for (const [key, pending] of [["attestorStatus", "pending"], ["modelContractStatus", "pending"]]) {
+      if (!(key in patch) || patch[key] === receipt[key]) continue;
+      if (receipt[key] !== pending || patch[key] === pending) return false;
+    }
+    for (const key of ["modelInvocationStarted", "sourceReadStarted"]) {
+      if (!(key in patch)) continue;
+      if (receipt[key] === true && patch[key] !== true) return false;
+      if (receipt[key] === null || typeof patch[key] !== "boolean") return false;
+    }
+    const next = { ...receipt, ...patch };
+    temporaryPath = join(dirname(path), ".source-receipt-" + randomBytes(12).toString("hex") + ".tmp");
+    writeFileSync(temporaryPath, JSON.stringify(next) + "\n", { encoding: "utf8", flag: "wx", mode: 0o600 });
+    renameSync(temporaryPath, path);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (temporaryPath) rmSync(temporaryPath, { force: true });
+  }
+}
+
 function safeWritePhase(phasePath, phase) {
   if (!phasePath) return;
   let history = [];
@@ -2772,6 +3000,9 @@ export default function amasterEffectiveToolsAttestor(pi) {
         attestedAt: new Date().toISOString(),
       };
       safeWriteReceipt(receiptPath, receipt);
+      if (!updateSourceExecutionReceipt({ attestorStatus: "attested", attestorReasonCode: null })) {
+        process.exit(78);
+      }
       safeWritePhase(phasePath, "attested");
       if (mode === "probe") process.exit(0);
     } catch (error) {
@@ -2784,11 +3015,33 @@ export default function amasterEffectiveToolsAttestor(pi) {
         attestedAt: new Date().toISOString(),
       };
       safeWriteReceipt(receiptPath, receipt);
+      updateSourceExecutionReceipt({
+        attestorStatus: "rejected",
+        attestorReasonCode: sourceReceiptReason(error),
+      });
       safeWritePhase(phasePath, "rejected");
       process.exit(78);
     }
   });
 
+  pi.on("before_agent_start", async (_event, context) => {
+    // Model establishment is a Source Acquisition execution receipt contract,
+    // not an invariant of every diagnosis/full direct-typed governed run.
+    if (mode !== "enforce" || !sourceExecutionReceiptPath) return;
+    if (!context.model) {
+      updateSourceExecutionReceipt({
+        modelContractStatus: "rejected",
+        modelContractReasonCode: "model_missing",
+      });
+      process.exit(78);
+    }
+    if (!updateSourceExecutionReceipt({
+      modelContractStatus: "validated",
+      modelContractReasonCode: null,
+      modelInvocationStarted: true,
+    })) process.exit(78);
+  });
+
   pi.on("tool_call", (event) => {
     const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
     const entry = Array.isArray(manifest.entries)
@@ -2796,8 +3049,12 @@ export default function amasterEffectiveToolsAttestor(pi) {
       : null;
     if (!entry) return;
     const reason = inputErrorReason(entry.schema, event.input);
-    if (!reason) return;
-    return { block: true, reason: "Governed tool input rejected: " + reason };
+    if (reason) return { block: true, reason: "Governed tool input rejected: " + reason };
+    if (["source_open", "source_snapshot", "source_screenshot", "source_analyze_screenshot", "source_wait"].includes(event.toolName)) {
+      if (!updateSourceExecutionReceipt({ sourceReadStarted: true })) {
+        return { block: true, reason: "Source execution receipt unavailable" };
+      }
+    }
   });
 }
 `;
@@ -3133,7 +3390,7 @@ function createManagedPiMcpProfileApi(options = {}) {
   function readJsonObjectFile(filePath) {
     if (!existsSync3(filePath)) return {};
     try {
-      const value = JSON.parse(readFileSync3(filePath, "utf8"));
+      const value = JSON.parse(readFileSync4(filePath, "utf8"));
       if (!value || typeof value !== "object" || Array.isArray(value)) {
         throw new Error("JSON value is not an object");
       }
@@ -3151,8 +3408,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
   }
   function writePrivateFile2(filePath, contents) {
-    writeFileSync3(filePath, contents, { mode: 384, flag: "wx" });
-    chmodSync3(filePath, 384);
+    writeFileSync4(filePath, contents, { mode: 384, flag: "wx" });
+    chmodSync4(filePath, 384);
     const mode = statSync2(filePath).mode & 511;
     if (mode !== 384) throw new Error(`pi_managed_mcp_permissions_failed: ${filePath} mode=${mode.toString(8)}`);
   }
@@ -3163,7 +3420,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       throw new Error(`pi_managed_mcp_source_config_unsafe: ${source}`);
     }
     copyFileSync(source, target, 0);
-    chmodSync3(target, 384);
+    chmodSync4(target, 384);
     return true;
   }
   function findPiSessionRollout(sessionsRoot, sessionId) {
@@ -3177,7 +3434,7 @@ function createManagedPiMcpProfileApi(options = {}) {
         throw new Error("pi_managed_mcp_session_rollout_unsafe: sessions path is not a private directory");
       }
       for (const entry of readdirSync3(current, { withFileTypes: true })) {
-        const candidate = join4(current, entry.name);
+        const candidate = join5(current, entry.name);
         if (entry.isSymbolicLink()) throw new Error("pi_managed_mcp_session_rollout_unsafe: symlinks are forbidden");
         if (entry.isDirectory()) pending.push(candidate);
         else if (entry.isFile() && entry.name.endsWith(`_${sessionId}.jsonl`)) matches.push(candidate);
@@ -3197,18 +3454,18 @@ function createManagedPiMcpProfileApi(options = {}) {
     nonEmpty2(session.actionRequestId, "nativeSession.actionRequestId");
     nonEmpty2(session.invocationId, "nativeSession.invocationId");
     const sourceWorkspacePath = nonEmpty2(session.cwd, "nativeSession.cwd");
-    const issueRoot = dirname3(runDir);
+    const issueRoot = dirname4(runDir);
     const managedSourceRunDirName = `${sourceRunId}-${createHash3("sha256").update(sourceRunId).digest("hex").slice(0, 8)}`;
-    const sourceRunDirs = readdirSync3(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join4(issueRoot, entry.name));
+    const sourceRunDirs = readdirSync3(issueRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && (entry.name === sourceRunId || entry.name === managedSourceRunDirName)).map((entry) => join5(issueRoot, entry.name));
     if (sourceRunDirs.length !== 1) {
       throw new Error(`pi_managed_mcp_session_rollout_missing: expected one source run directory for ${sourceRunId}, received ${sourceRunDirs.length}`);
     }
-    const cacheRoot = join4(sourceRunDirs[0], relative2(runDir, executorHome), "session-rollout");
-    const markerPath = join4(cacheRoot, SESSION_ROLLOUT_MARKER2);
+    const cacheRoot = join5(sourceRunDirs[0], relative2(runDir, executorHome), "session-rollout");
+    const markerPath = join5(cacheRoot, SESSION_ROLLOUT_MARKER2);
     if (!existsSync3(markerPath) || lstatSync3(markerPath).isSymbolicLink() || !lstatSync3(markerPath).isFile()) {
       throw new Error("pi_managed_mcp_session_rollout_missing: source rollout marker is unavailable");
     }
-    const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
+    const marker = JSON.parse(readFileSync4(markerPath, "utf8"));
     if (marker?.version !== 1 || marker?.companyId !== authority.companyId || marker?.agentId !== authority.agentId || marker?.issueId !== authority.issueId || marker?.sourceRunId !== sourceRunId || marker?.sourceCommandId !== sourceCommandId || marker?.sessionId !== sessionId || marker?.sourceWorkspacePath !== sourceWorkspacePath) {
       throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
     }
@@ -3220,8 +3477,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!within2(targetRollout, sessionsRoot)) {
       throw new Error("pi_managed_mcp_session_rollout_unsafe: target rollout path is invalid");
     }
-    mkdirSync3(dirname3(targetRollout), { recursive: true, mode: 448 });
-    writePrivateFile2(targetRollout, readFileSync3(sourceRollout));
+    mkdirSync3(dirname4(targetRollout), { recursive: true, mode: 448 });
+    writePrivateFile2(targetRollout, readFileSync4(sourceRollout));
     return { sessionId, sourceRunId, sourceCommandId, rolloutPath: targetRollout, cacheRoot };
   }
   function parseVersion(stdout, label, minimum) {
@@ -3262,12 +3519,12 @@ function createManagedPiMcpProfileApi(options = {}) {
         hash.update(`d:${relativePath}
 `);
         const children = readdirSync3(current).filter((child) => current !== root || !ignoredRootEntries.has(child)).sort().reverse();
-        for (const child of children) pending.push(join4(current, child));
+        for (const child of children) pending.push(join5(current, child));
         continue;
       }
       if (!currentStat.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
       hash.update(`f:${relativePath}:${currentStat.mode & 73 ? "x" : "-"}:`);
-      hash.update(readFileSync3(current));
+      hash.update(readFileSync4(current));
       hash.update("\n");
     }
     return hash.digest("hex");
@@ -3279,10 +3536,10 @@ function createManagedPiMcpProfileApi(options = {}) {
       throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${source}`);
     }
     mkdirSync3(targetPath, { recursive: true, mode: 448 });
-    chmodSync3(targetPath, 448);
+    chmodSync4(targetPath, 448);
     for (const entry of readdirSync3(source, { withFileTypes: true })) {
-      const from = join4(source, entry.name);
-      const to = join4(targetPath, entry.name);
+      const from = join5(source, entry.name);
+      const to = join5(targetPath, entry.name);
       if (entry.isSymbolicLink()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${from}`);
       if (entry.isDirectory()) {
         copyTrustedTree(from, to);
@@ -3290,7 +3547,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       }
       if (!entry.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${from}`);
       copyFileSync(from, to, 0);
-      chmodSync3(to, 384 | lstatSync3(from).mode & 73);
+      chmodSync4(to, 384 | lstatSync3(from).mode & 73);
     }
   }
   function makeTrustedTreeReadOnly(rootPath) {
@@ -3303,13 +3560,13 @@ function createManagedPiMcpProfileApi(options = {}) {
       if (currentStat.isSymbolicLink()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
       if (currentStat.isDirectory()) {
         directories.push(current);
-        for (const entry of readdirSync3(current)) pending.push(join4(current, entry));
+        for (const entry of readdirSync3(current)) pending.push(join5(current, entry));
         continue;
       }
       if (!currentStat.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
-      chmodSync3(current, 256 | currentStat.mode & 73);
+      chmodSync4(current, 256 | currentStat.mode & 73);
     }
-    for (const directory of directories.reverse()) chmodSync3(directory, 320);
+    for (const directory of directories.reverse()) chmodSync4(directory, 320);
   }
   function makeTrustedTreeWritable(rootPath) {
     const pending = [resolve3(rootPath)];
@@ -3318,33 +3575,33 @@ function createManagedPiMcpProfileApi(options = {}) {
       const currentStat = lstatSync3(current);
       if (currentStat.isSymbolicLink()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
       if (currentStat.isDirectory()) {
-        chmodSync3(current, 448);
-        for (const entry of readdirSync3(current)) pending.push(join4(current, entry));
+        chmodSync4(current, 448);
+        for (const entry of readdirSync3(current)) pending.push(join5(current, entry));
         continue;
       }
       if (!currentStat.isFile()) throw new Error(`pi_managed_mcp_bootstrap_cache_unsafe: ${current}`);
-      chmodSync3(current, 384 | currentStat.mode & 73);
+      chmodSync4(current, 384 | currentStat.mode & 73);
     }
   }
   function piLoaderIdentity(executorPath) {
-    let cursor = dirname3(realpathSync2(executorPath));
+    let cursor = dirname4(realpathSync2(executorPath));
     for (let depth = 0; depth < 4; depth += 1) {
-      const packagePath = join4(cursor, "package.json");
-      const loaderPath = join4(cursor, "dist", "core", "extensions", "loader.js");
+      const packagePath = join5(cursor, "package.json");
+      const loaderPath = join5(cursor, "dist", "core", "extensions", "loader.js");
       if (existsSync3(packagePath) && existsSync3(loaderPath)) {
-        const packageJson = JSON.parse(readFileSync3(packagePath, "utf8"));
+        const packageJson = JSON.parse(readFileSync4(packagePath, "utf8"));
         return sha2562(stablePiJson({
           name: packageJson.name,
           version: packageJson.version,
-          loaderSha256: sha2562(readFileSync3(loaderPath))
+          loaderSha256: sha2562(readFileSync4(loaderPath))
         }));
       }
-      cursor = dirname3(cursor);
+      cursor = dirname4(cursor);
     }
-    return sha2562(readFileSync3(realpathSync2(executorPath)));
+    return sha2562(readFileSync4(realpathSync2(executorPath)));
   }
   function effectiveToolsBootstrapKey(input, sharedRuntime, executorCommand) {
-    const adapterRoot = join4(sharedRuntime.home, "npm", "node_modules", "pi-mcp-adapter");
+    const adapterRoot = join5(sharedRuntime.home, "npm", "node_modules", "pi-mcp-adapter");
     const resolvedExecutorCommand = resolvePiExecutablePath(executorCommand, input.baseEnv);
     return sha2562(stablePiJson({
       schemaVersion: PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION,
@@ -3365,24 +3622,24 @@ function createManagedPiMcpProfileApi(options = {}) {
     }));
   }
   function prepareEffectiveToolsBootstrapCache(input, sharedRuntime, executorCommand, tmpPath) {
-    const cacheRoot = resolve3(nonEmpty2(input.runtimeCacheRoot ?? join4(dirname3(input.runDir), ".runtime-cache"), "runtimeCacheRoot"));
-    const bootstrapRoot = join4(cacheRoot, "pi-effective-tools-jiti-v1");
+    const cacheRoot = resolve3(nonEmpty2(input.runtimeCacheRoot ?? join5(dirname4(input.runDir), ".runtime-cache"), "runtimeCacheRoot"));
+    const bootstrapRoot = join5(cacheRoot, "pi-effective-tools-jiti-v1");
     mkdirSync3(bootstrapRoot, { recursive: true, mode: 448 });
     const bootstrapRootStat = lstatSync3(bootstrapRoot);
     if (!bootstrapRootStat.isDirectory() || bootstrapRootStat.isSymbolicLink()) {
       throw new Error("pi_managed_mcp_bootstrap_cache_unsafe: root");
     }
     const key = effectiveToolsBootstrapKey(input, sharedRuntime, executorCommand);
-    const entryPath = join4(bootstrapRoot, key);
-    const markerPath = join4(entryPath, "manifest.json");
-    const sourceCachePath = join4(entryPath, "jiti");
-    const runCachePath = join4(tmpPath, "jiti");
+    const entryPath = join5(bootstrapRoot, key);
+    const markerPath = join5(entryPath, "manifest.json");
+    const sourceCachePath = join5(entryPath, "jiti");
+    const runCachePath = join5(tmpPath, "jiti");
     let status = "miss";
     if (existsSync3(entryPath)) {
       try {
         const entryStat = lstatSync3(entryPath);
         const markerStat = lstatSync3(markerPath);
-        const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
+        const marker = JSON.parse(readFileSync4(markerPath, "utf8"));
         if (!entryStat.isDirectory() || entryStat.isSymbolicLink() || !markerStat.isFile() || markerStat.isSymbolicLink() || marker.schemaVersion !== PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION || marker.key !== key || marker.treeSha256 !== trustedTreeDigest(sourceCachePath)) throw new Error("bootstrap marker mismatch");
         copyTrustedTree(sourceCachePath, runCachePath);
         status = "hit";
@@ -3392,7 +3649,7 @@ function createManagedPiMcpProfileApi(options = {}) {
           throw new Error("pi_managed_mcp_bootstrap_cache_unsafe: entry");
         }
         makeTrustedTreeWritable(resolvedEntry);
-        rmSync2(resolvedEntry, { recursive: true, force: true });
+        rmSync3(resolvedEntry, { recursive: true, force: true });
         status = "invalidated";
       }
     }
@@ -3409,16 +3666,16 @@ function createManagedPiMcpProfileApi(options = {}) {
     const stagingPath = `${cache.entryPath}.tmp-${process.pid}-${currentTimeMs()}`;
     try {
       mkdirSync3(stagingPath, { mode: 448 });
-      const stagingCachePath = join4(stagingPath, "jiti");
+      const stagingCachePath = join5(stagingPath, "jiti");
       copyTrustedTree(cache.runCachePath, stagingCachePath);
-      writePrivateFile2(join4(stagingPath, "manifest.json"), `${JSON.stringify({
+      writePrivateFile2(join5(stagingPath, "manifest.json"), `${JSON.stringify({
         schemaVersion: PI_EFFECTIVE_TOOLS_BOOTSTRAP_SCHEMA_VERSION,
         key: cache.key,
         treeSha256: trustedTreeDigest(stagingCachePath)
       })}
 `);
       try {
-        renameSync2(stagingPath, cache.entryPath);
+        renameSync3(stagingPath, cache.entryPath);
         makeTrustedTreeReadOnly(cache.entryPath);
       } catch (error) {
         if (error?.code !== "EEXIST" && error?.code !== "ENOTEMPTY") throw error;
@@ -3426,7 +3683,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     } finally {
       if (existsSync3(stagingPath)) {
         makeTrustedTreeWritable(stagingPath);
-        rmSync2(stagingPath, { recursive: true, force: true });
+        rmSync3(stagingPath, { recursive: true, force: true });
       }
     }
     return existsSync3(cache.entryPath) ? `${cache.status}_published` : `${cache.status}_unavailable`;
@@ -3435,7 +3692,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     let history = [];
     if (existsSync3(phasePath)) {
       try {
-        const parsed = JSON.parse(readFileSync3(phasePath, "utf8"));
+        const parsed = JSON.parse(readFileSync4(phasePath, "utf8"));
         history = Array.isArray(parsed.history) ? parsed.history.slice(0, 16) : [];
       } catch {
         history = [];
@@ -3450,17 +3707,17 @@ function createManagedPiMcpProfileApi(options = {}) {
       if (!phaseStat.isFile() || phaseStat.isSymbolicLink()) {
         throw new Error("pi_managed_mcp_probe_phase_unsafe");
       }
-      writeFileSync3(phasePath, contents, { encoding: "utf8", mode: 384 });
-      chmodSync3(phasePath, 384);
+      writeFileSync4(phasePath, contents, { encoding: "utf8", mode: 384 });
+      chmodSync4(phasePath, 384);
       return;
     }
     writeOwnedFileAtomic(phasePath, contents);
   }
   function piMcpAdapterVersion(piHome) {
-    const packagePath = join4(piHome, "npm", "node_modules", "pi-mcp-adapter", "package.json");
+    const packagePath = join5(piHome, "npm", "node_modules", "pi-mcp-adapter", "package.json");
     let packageJson;
     try {
-      packageJson = JSON.parse(readFileSync3(packagePath, "utf8"));
+      packageJson = JSON.parse(readFileSync4(packagePath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_adapter_version_unavailable");
     }
@@ -3556,7 +3813,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     const pathEntries = String(env?.PATH ?? "").split(delimiter).filter(Boolean);
     for (const entry of pathEntries) {
       try {
-        const candidate = realpathSync2(join4(entry, executorCommand));
+        const candidate = realpathSync2(join5(entry, executorCommand));
         const stat = lstatSync3(candidate);
         if (stat.isFile() && !stat.isSymbolicLink()) return candidate;
       } catch {
@@ -3571,7 +3828,7 @@ function createManagedPiMcpProfileApi(options = {}) {
       if (!executableStat.isFile() || executableStat.isSymbolicLink()) {
         throw Object.assign(new Error("Pi executable is not a regular file"), { code: "EUNSAFE" });
       }
-      const contentSha256 = createHash3("sha256").update(readFileSync3(realPath)).digest("hex");
+      const contentSha256 = createHash3("sha256").update(readFileSync4(realPath)).digest("hex");
       return `sha256:${createHash3("sha256").update(JSON.stringify({ realPath, contentSha256 })).digest("hex")}`;
     } catch (error) {
       const errorCode = typeof error?.code === "string" ? error.code : "UNKNOWN";
@@ -3739,7 +3996,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!existsSync3(filePath)) return false;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync3(filePath, "utf8"));
+      parsed = JSON.parse(readFileSync4(filePath, "utf8"));
     } catch {
       return true;
     }
@@ -3754,25 +4011,25 @@ function createManagedPiMcpProfileApi(options = {}) {
     while (within2(cursor, boundary)) {
       visit(cursor, cursor === start);
       if (cursor === boundary) break;
-      cursor = dirname3(cursor);
+      cursor = dirname4(cursor);
     }
   }
   function assertNoProjectMcpOverride(cwd, runDir) {
     walkProjectMcpConfigs(cwd, runDir, (level) => {
-      for (const relativePath of [".mcp.json", join4(".pi", "mcp.json")]) {
-        const configPath = join4(level, relativePath);
+      for (const relativePath of [".mcp.json", join5(".pi", "mcp.json")]) {
+        const configPath = join5(level, relativePath);
         if (projectMcpConfigHasContent(configPath)) throw new Error(`pi_managed_mcp_project_override_blocked: ${configPath}`);
       }
     });
   }
   function assertWorkspaceMcpOverrideClear(cwd, runDir) {
     walkProjectMcpConfigs(cwd, runDir, (level, isCwd) => {
-      const sharedProjectConfig = join4(level, ".mcp.json");
+      const sharedProjectConfig = join5(level, ".mcp.json");
       if (projectMcpConfigHasContent(sharedProjectConfig)) {
         throw new Error(`pi_managed_mcp_project_override_blocked: ${sharedProjectConfig}`);
       }
       if (!isCwd) {
-        const ancestorPiConfig = join4(level, ".pi", "mcp.json");
+        const ancestorPiConfig = join5(level, ".pi", "mcp.json");
         if (projectMcpConfigHasContent(ancestorPiConfig)) {
           throw new Error(`pi_managed_mcp_project_override_blocked: ${ancestorPiConfig}`);
         }
@@ -3783,11 +4040,11 @@ function createManagedPiMcpProfileApi(options = {}) {
     return resolve3(path).replaceAll("\\", "/").endsWith("/.pi/mcp.json");
   }
   function managedRunRootForProfile(profileRoot) {
-    const executorsRoot = dirname3(dirname3(resolve3(profileRoot)));
+    const executorsRoot = dirname4(dirname4(resolve3(profileRoot)));
     if (basename2(executorsRoot) !== "executors") {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: profile is outside a managed run");
     }
-    return dirname3(executorsRoot);
+    return dirname4(executorsRoot);
   }
   function workspaceMcpConfigBelongsToProfile(configPath, profileRoot) {
     const target = resolve3(configPath);
@@ -3800,11 +4057,11 @@ function createManagedPiMcpProfileApi(options = {}) {
         throw new Error(`pi_managed_mcp_workspace_config_unsafe: ${filePath}`);
       }
     }
-    mkdirSync3(dirname3(filePath), { recursive: true, mode: 448 });
+    mkdirSync3(dirname4(filePath), { recursive: true, mode: 448 });
     const tempPath = `${filePath}.tmp.${process.pid}`;
-    writeFileSync3(tempPath, contents, { mode: 384 });
-    renameSync2(tempPath, filePath);
-    chmodSync3(filePath, 384);
+    writeFileSync4(tempPath, contents, { mode: 384 });
+    renameSync3(tempPath, filePath);
+    chmodSync4(filePath, 384);
     const mode = statSync2(filePath).mode & 511;
     if (mode !== 384) throw new Error(`pi_managed_mcp_permissions_failed: ${filePath} mode=${mode.toString(8)}`);
   }
@@ -3814,11 +4071,11 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!homeStat.isDirectory() || homeStat.isSymbolicLink()) {
       throw new Error("pi_managed_mcp_source_config_unsafe: Pi home");
     }
-    const settingsPath = join4(home, "settings.json");
+    const settingsPath = join5(home, "settings.json");
     let settings = {};
     if (existsSync3(settingsPath)) {
       try {
-        settings = record6(JSON.parse(readFileSync3(settingsPath, "utf8")));
+        settings = record6(JSON.parse(readFileSync4(settingsPath, "utf8")));
       } catch {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi settings are invalid");
       }
@@ -3837,17 +4094,17 @@ function createManagedPiMcpProfileApi(options = {}) {
     if (!SKILL_PROFILE_NAME.test(skillProfile) || !within2(agentFile, agentsRoot) || !existsSync3(agentFile)) {
       throw new Error(`pi_managed_mcp_skill_profile_unknown:${skillProfile}`);
     }
-    const declared = readFileSync3(agentFile, "utf8").match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1].match(/^skills:\s*(.+)$/m)?.[1].split(",").map((entry) => entry.trim()).filter(Boolean) ?? [];
+    const declared = readFileSync4(agentFile, "utf8").match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1].match(/^skills:\s*(.+)$/m)?.[1].split(",").map((entry) => entry.trim()).filter(Boolean) ?? [];
     const bundlesRoot = resolve3(piHome, "bundles");
     const profile = [];
     for (const name of declared) {
-      let source = join4(bundlesRoot, skillProfile, "skills", name);
-      if (!existsSync3(join4(source, "SKILL.md"))) {
+      let source = join5(bundlesRoot, skillProfile, "skills", name);
+      if (!existsSync3(join5(source, "SKILL.md"))) {
         const candidates = [];
         for (const category of readdirSync3(bundlesRoot).sort()) {
           if (category === skillProfile) continue;
-          const candidate = join4(bundlesRoot, category, "skills", name);
-          if (existsSync3(join4(candidate, "SKILL.md"))) candidates.push(candidate);
+          const candidate = join5(bundlesRoot, category, "skills", name);
+          if (existsSync3(join5(candidate, "SKILL.md"))) candidates.push(candidate);
         }
         if (candidates.length > 1) {
           throw new Error(`pi_managed_mcp_skill_profile_ambiguous:${skillProfile}:${name}`);
@@ -3865,8 +4122,8 @@ function createManagedPiMcpProfileApi(options = {}) {
     const skillsRoot = resolve3(piHome, "bundles", "common", "skills");
     if (!existsSync3(skillsRoot)) return [];
     return readdirSync3(skillsRoot).sort().flatMap((name) => {
-      const source = join4(skillsRoot, name);
-      return existsSync3(join4(source, "SKILL.md")) ? [{ name, source }] : [];
+      const source = join5(skillsRoot, name);
+      return existsSync3(join5(source, "SKILL.md")) ? [{ name, source }] : [];
     });
   }
   function resolveManagedRoleSkills(piHome, skillProfiles) {
@@ -3888,7 +4145,7 @@ function createManagedPiMcpProfileApi(options = {}) {
     }
     const entries = [...entriesByName.values()].map((entry) => ({
       name: entry.name,
-      filePath: realpathSync2(join4(entry.source, "SKILL.md"))
+      filePath: realpathSync2(join5(entry.source, "SKILL.md"))
     }));
     return {
       enabled: entries.map((entry) => entry.name),
@@ -3916,18 +4173,18 @@ function createManagedPiMcpProfileApi(options = {}) {
     const protectedValues = [];
     for (const entry of readdirSync3(source, { withFileTypes: true })) {
       if (entry.name === "mcp.json" || entry.name === "mcp-cache.json") continue;
-      const sourcePath = join4(source, entry.name);
-      const targetPath = join4(agentDir, entry.name);
+      const sourcePath = join5(source, entry.name);
+      const targetPath = join5(agentDir, entry.name);
       if (entry.isDirectory()) {
         symlinkSync(sourcePath, targetPath, platform2() === "win32" ? "junction" : "dir");
       } else if (entry.isFile()) {
         copyPrivateFile(sourcePath, targetPath);
       }
     }
-    const authSource = join4(source, "auth.json");
+    const authSource = join5(source, "auth.json");
     if (existsSync3(authSource)) {
       try {
-        collectAuthSecretStrings2(JSON.parse(readFileSync3(authSource, "utf8")), protectedValues);
+        collectAuthSecretStrings2(JSON.parse(readFileSync4(authSource, "utf8")), protectedValues);
       } catch {
         throw new Error("pi_delegated_mcp_attestation_failed: source Pi auth is invalid");
       }
@@ -3985,7 +4242,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     }
     let effectiveConfig;
     try {
-      effectiveConfig = JSON.parse(readFileSync3(configPath, "utf8"));
+      effectiveConfig = JSON.parse(readFileSync4(configPath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_attestation_failed: managed MCP config is invalid JSON");
     }
@@ -4012,7 +4269,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     let history = [];
     if (existsSync3(phasePath)) {
       try {
-        const phaseState = JSON.parse(readFileSync3(phasePath, "utf8"));
+        const phaseState = JSON.parse(readFileSync4(phasePath, "utf8"));
         phase = typeof phaseState.phase === "string" ? phaseState.phase : "present";
         history = Array.isArray(phaseState.history) ? phaseState.history : [];
       } catch {
@@ -4021,7 +4278,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     }
     if (!existsSync3(receiptPath)) return { phase, history, receipt: null };
     try {
-      const receipt = JSON.parse(readFileSync3(receiptPath, "utf8"));
+      const receipt = JSON.parse(readFileSync4(receiptPath, "utf8"));
       const receiptPhase = receipt?.status === "attested" || receipt?.status === "rejected" ? receipt.status : phase === "missing" ? "present" : phase;
       return { phase: receiptPhase, history, receipt };
     } catch {
@@ -4134,7 +4391,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (circuitKey) effectiveToolsProbeCircuits.delete(circuitKey);
     let receipt;
     try {
-      receipt = JSON.parse(readFileSync3(input.receiptPath, "utf8"));
+      receipt = JSON.parse(readFileSync4(input.receiptPath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt missing");
     }
@@ -4142,10 +4399,10 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (receipt.status !== "attested" || receipt.mode !== "probe" || receipt.proxyMode !== input.proxyMode || receipt.proxyPresent !== expectedProxyPresent || receipt.effectiveSetHash !== input.effectiveSetHash || receipt.attestorSourceSha256 !== input.attestorSourceSha256 || receipt.configSha256 !== input.configSha256 || receipt.cacheSha256 !== input.cacheSha256) {
       throw new Error("pi_managed_mcp_effective_tools_failed: probe receipt mismatch");
     }
-    if (sha2562(readFileSync3(input.configPath)) !== input.configSha256) {
+    if (sha2562(readFileSync4(input.configPath)) !== input.configSha256) {
       throw new Error("pi_managed_mcp_effective_tools_failed: config drifted during probe");
     }
-    if (sha2562(readFileSync3(input.cachePath)) !== input.cacheSha256) {
+    if (sha2562(readFileSync4(input.cachePath)) !== input.cacheSha256) {
       throw new Error("pi_managed_mcp_effective_tools_failed: cache drifted during probe");
     }
     if (circuitKey) effectiveToolsProbeCircuits.delete(circuitKey);
@@ -4177,19 +4434,19 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     const runDir = resolve3(nonEmpty2(input.runDir, "runDir"));
     const cwd = resolve3(nonEmpty2(input.cwd, "cwd"));
     const executorHome = resolve3(nonEmpty2(input.executorHome, "executorHome"));
-    if (!within2(executorHome, join4(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
+    if (!within2(executorHome, join5(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
     assertWorkspaceMcpOverrideClear(cwd, runDir);
-    const profileRoot = join4(executorHome, "managed-mcp");
+    const profileRoot = join5(executorHome, "managed-mcp");
     if (existsSync3(profileRoot)) throw new Error(`pi_managed_mcp_profile_exists: ${profileRoot}`);
-    const home = join4(profileRoot, "home");
-    const piAgentHome = join4(profileRoot, "pi-agent-home");
-    const sessionsRoot = join4(profileRoot, "sessions");
-    const tmp = join4(profileRoot, "tmp");
+    const home = join5(profileRoot, "home");
+    const piAgentHome = join5(profileRoot, "pi-agent-home");
+    const sessionsRoot = join5(profileRoot, "sessions");
+    const tmp = join5(profileRoot, "tmp");
     for (const directory of [home, piAgentHome, sessionsRoot, tmp]) mkdirSync3(directory, { recursive: true, mode: 448 });
-    const workspaceMcpConfigPath = join4(cwd, ".pi", "mcp.json");
+    const workspaceMcpConfigPath = join5(cwd, ".pi", "mcp.json");
     const configPath = workspaceMcpConfigPath;
     try {
-      const markerPath = join4(profileRoot, PROFILE_MARKER2);
+      const markerPath = join5(profileRoot, PROFILE_MARKER2);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({
         version: 1,
@@ -4229,16 +4486,16 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       writeOwnedFileAtomic(configPath, `${JSON.stringify(config, null, 2)}
 `);
       const extensionArgs = directCatalog ? ["--mcp-config", configPath] : [];
-      const profileExtensionsDir = join4(profileRoot, "extensions");
+      const profileExtensionsDir = join5(profileRoot, "extensions");
       const writeProfileExtension = (fileName, source) => {
         mkdirSync3(profileExtensionsDir, { recursive: true, mode: 448 });
-        const extensionPath = join4(profileExtensionsDir, fileName);
+        const extensionPath = join5(profileExtensionsDir, fileName);
         writePrivateFile2(extensionPath, source);
         extensionArgs.push("--extension", extensionPath);
         return extensionPath;
       };
       if (directCatalog) {
-        const adapterExtensionPath = join4(
+        const adapterExtensionPath = join5(
           sharedRuntime.home,
           "npm",
           "node_modules",
@@ -4257,8 +4514,17 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       if (mcpToolMode !== MANAGED_PI_DIRECT_TYPED_MCP_TOOL_MODE) {
         writeProfileExtension(MANAGED_PI_MCP_ARGS_NORMALIZER_FILENAME, managedPiMcpArgsNormalizerExtensionSource());
       }
-      const cachePath = join4(profileRoot, "mcp-cache.json");
+      const cachePath = join5(profileRoot, "mcp-cache.json");
       let directAttestationInput = null;
+      const sourceExecutionIdentity = input.sourceAcquisition && typeof input.sourceAcquisition.profile?.attemptId === "string" && Number.isSafeInteger(input.sourceAcquisition.profile?.epoch) ? {
+        commandId: input.commandId,
+        attemptId: input.sourceAcquisition.profile.attemptId,
+        epoch: input.sourceAcquisition.profile.epoch
+      } : null;
+      const sourceExecutionReceiptPath = sourceExecutionIdentity ? join5(tmp, "source-acquisition-execution-receipt.json") : null;
+      if (sourceExecutionReceiptPath) {
+        createSourceAcquisitionExecutionReceipt(sourceExecutionReceiptPath, sourceExecutionIdentity);
+      }
       const adapterVersion = piMcpAdapterVersion(sharedRuntime.home);
       if (directCatalog) {
         writeProfileExtension(
@@ -4282,11 +4548,11 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         };
         writeOwnedFileAtomic(cachePath, `${JSON.stringify(cache, null, 2)}
 `);
-        const cacheSha256 = sha2562(readFileSync3(cachePath));
+        const cacheSha256 = sha2562(readFileSync4(cachePath));
         const attestorSourceSha256 = sha2562(managedPiEffectiveToolsAttestorExtensionSource());
-        const manifestPath = join4(profileRoot, "effective-tools-manifest.json");
-        const receiptPath = join4(tmp, "effective-tools-receipt.json");
-        const phasePath = join4(tmp, "effective-tools-phase.json");
+        const manifestPath = join5(profileRoot, "effective-tools-manifest.json");
+        const receiptPath = join5(tmp, "effective-tools-receipt.json");
+        const phasePath = join5(tmp, "effective-tools-phase.json");
         const manifest = {
           schemaVersion: MANAGED_PI_EFFECTIVE_TOOLS_SCHEMA_VERSION,
           serverName: SUPPORTED_SERVER_NAME2,
@@ -4302,9 +4568,9 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           }))),
           proxyMode: "forbidden",
           attestorSourceSha256,
-          configSha256: sha2562(readFileSync3(configPath)),
+          configSha256: sha2562(readFileSync4(configPath)),
           cacheSha256,
-          cacheSemanticHash: stablePiManagedMcpCacheSemanticHash(readFileSync3(cachePath))
+          cacheSemanticHash: stablePiManagedMcpCacheSemanticHash(readFileSync4(cachePath))
         };
         writePrivateFile2(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -4371,9 +4637,9 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           receiptPath,
           phasePath,
           cacheSha256,
-          cacheContentsBase64: Buffer.from(readFileSync3(cachePath)).toString("base64"),
+          cacheContentsBase64: Buffer.from(readFileSync4(cachePath)).toString("base64"),
           configPath,
-          configSha256: sha2562(readFileSync3(configPath)),
+          configSha256: sha2562(readFileSync4(configPath)),
           attestorSourceSha256,
           effectiveSetHash: manifest.effectiveSetHash,
           proxyMode: manifest.proxyMode,
@@ -4409,6 +4675,9 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
           AMASTER_PI_EFFECTIVE_TOOLS_CACHE: directAttestationInput.cachePath,
           AMASTER_PI_EFFECTIVE_TOOLS_CONFIG: directAttestationInput.configPath
         } : {},
+        ...sourceExecutionReceiptPath ? {
+          AMASTER_SOURCE_ACQUISITION_EXECUTION_RECEIPT: sourceExecutionReceiptPath
+        } : {},
         ...input.sourceAcquisition ? sourceAcquisitionBrowserEnvironment(input.sourceAcquisition, input.baseEnv) : {}
       };
       if (directAttestationInput) {
@@ -4475,6 +4744,10 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         extensionArgs,
         spawnIdentity,
         workspaceMcpConfigPath,
+        ...sourceExecutionReceiptPath ? {
+          sourceAcquisitionExecutionReceiptPath: sourceExecutionReceiptPath,
+          sourceAcquisitionExecutionIdentity: sourceExecutionIdentity
+        } : {},
         ...directAttestationInput ? {
           runExitClosureBaseline: {
             schemaVersion: directAttestationInput.closureProfile ? "amaster.pi-run-exit-closure-baseline.v2" : "amaster.pi-run-exit-closure-baseline.v1",
@@ -4485,7 +4758,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
             cacheContentsBase64: directAttestationInput.cacheContentsBase64,
             cacheOwnership: runExitClosureOwnership ? { uid: runExitClosureOwnership.cache.uid, gid: runExitClosureOwnership.cache.gid } : null,
             manifestPath: directAttestationInput.manifestPath,
-            manifestSha256: sha2562(readFileSync3(directAttestationInput.manifestPath)),
+            manifestSha256: sha2562(readFileSync4(directAttestationInput.manifestPath)),
             configPath: directAttestationInput.configPath,
             configSha256: directAttestationInput.configSha256,
             receiptPath: directAttestationInput.receiptPath,
@@ -4517,7 +4790,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         }
       };
     } catch (error) {
-      rmSync2(profileRoot, { recursive: true, force: true });
+      rmSync3(profileRoot, { recursive: true, force: true });
       removeWorkspaceMcpConfig(workspaceMcpConfigPath, profileRoot);
       throw error;
     }
@@ -4567,7 +4840,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (closureToolAllowlist && (closureToolAllowlist.length !== RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size || new Set(closureToolAllowlist).size !== RUN_EXIT_CLOSURE_DIRECT_TYPED_TOOL_NAMES.size || closureToolAllowlist.some((name) => !PROVIDER_SAFE_TOOL_NAME.test(name)))) {
       throw new Error("pi_run_exit_closure_baseline_tool_allowlist_invalid");
     }
-    const currentManifestSha256 = sha2562(readFileSync3(manifestPath));
+    const currentManifestSha256 = sha2562(readFileSync4(manifestPath));
     const acceptedManifestDigests = /* @__PURE__ */ new Set([
       nonEmpty2(baseline.manifestSha256, "runExitClosureBaseline.manifestSha256"),
       ...closureProfile ? [nonEmpty2(closureProfile.manifestSha256, "closureProfile.manifestSha256")] : []
@@ -4575,7 +4848,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!acceptedManifestDigests.has(currentManifestSha256)) {
       throw new Error("pi_run_exit_closure_baseline_manifest_drift");
     }
-    const currentConfigSha256 = sha2562(readFileSync3(configPath));
+    const currentConfigSha256 = sha2562(readFileSync4(configPath));
     const acceptedConfigDigests = /* @__PURE__ */ new Set([
       nonEmpty2(baseline.configSha256, "runExitClosureBaseline.configSha256"),
       ...closureProfile ? [nonEmpty2(closureProfile.configSha256, "closureProfile.configSha256")] : []
@@ -4612,7 +4885,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       ownership: baselineCacheOwnership,
       label: "cache"
     }];
-    if (existsSync3(receiptPath)) rmSync2(receiptPath);
+    if (existsSync3(receiptPath)) rmSync3(receiptPath);
     for (const entry of phaseContents) {
       if (sha2562(entry.bytes) !== entry.expectedSha256) {
         throw new Error(`pi_run_exit_closure_${entry.label}_digest_mismatch`);
@@ -4623,7 +4896,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       if (replacedStat.uid !== recordedOwnership.uid || replacedStat.gid !== recordedOwnership.gid) {
         chownSyncImpl(entry.path, recordedOwnership.uid, recordedOwnership.gid);
       }
-      if (sha2562(readFileSync3(entry.path)) !== entry.expectedSha256) {
+      if (sha2562(readFileSync4(entry.path)) !== entry.expectedSha256) {
         throw new Error(`pi_run_exit_closure_${entry.label}_restore_failed`);
       }
       const restoredStat = ownershipStatSyncImpl(entry.path);
@@ -4653,7 +4926,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       throw new Error(`pi_run_exit_closure_baseline_unsafe: ${receiptPath}`);
     }
     try {
-      const receipt = record6(JSON.parse(readFileSync3(receiptPath, "utf8")));
+      const receipt = record6(JSON.parse(readFileSync4(receiptPath, "utf8")));
       return {
         status: nonEmpty2(receipt.status, "effectiveToolsReceipt.status"),
         ...typeof receipt.mode === "string" ? { mode: receipt.mode } : {},
@@ -4675,15 +4948,15 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!within2(cwd, runDir)) throw new Error("pi_delegated_mcp_owner_mismatch: cwd is outside the managed run");
     assertNoProjectMcpOverride(cwd, runDir);
     const executorHome = resolve3(nonEmpty2(input.executorHome, "executorHome"));
-    if (!within2(executorHome, join4(runDir, "executors"))) throw new Error("pi_delegated_mcp_owner_mismatch: executorHome is outside the managed run");
-    const profileRoot = join4(executorHome, "delegated-mcp");
+    if (!within2(executorHome, join5(runDir, "executors"))) throw new Error("pi_delegated_mcp_owner_mismatch: executorHome is outside the managed run");
+    const profileRoot = join5(executorHome, "delegated-mcp");
     if (existsSync3(profileRoot)) throw new Error(`pi_delegated_mcp_profile_exists: ${profileRoot}`);
-    const piCodingAgentDir = join4(profileRoot, "pi-coding-agent-dir");
-    const sessionsRoot = join4(profileRoot, "sessions");
-    const tmp = join4(profileRoot, "tmp");
+    const piCodingAgentDir = join5(profileRoot, "pi-coding-agent-dir");
+    const sessionsRoot = join5(profileRoot, "sessions");
+    const tmp = join5(profileRoot, "tmp");
     for (const directory of [profileRoot, piCodingAgentDir, sessionsRoot, tmp]) mkdirSync3(directory, { recursive: true, mode: 448 });
     try {
-      const markerPath = join4(profileRoot, DELEGATED_PROFILE_MARKER);
+      const markerPath = join5(profileRoot, DELEGATED_PROFILE_MARKER);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot, piCodingAgentDir })}
 `);
@@ -4701,8 +4974,8 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         throw new Error("pi_delegated_mcp_source_config_unsafe: Pi home");
       }
       const seededRuntime = seedDelegatedPiRuntime(sourcePiHome, piCodingAgentDir);
-      const sourceMcp = readJsonObjectFile(join4(sourcePiHome, "mcp.json"));
-      const configPath = join4(piCodingAgentDir, "mcp.json");
+      const sourceMcp = readJsonObjectFile(join5(sourcePiHome, "mcp.json"));
+      const configPath = join5(piCodingAgentDir, "mcp.json");
       const directToolNames = directCatalog?.tools.map((tool) => tool.exposedName) ?? [];
       const serverConfig = {
         type: "http",
@@ -4729,8 +5002,8 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       let enabledRoleSkills = null;
       if (skillProfiles.length > 0) {
         const roleSkills = resolveManagedRoleSkills(sourcePiHome, skillProfiles);
-        const extensionsDir = join4(profileRoot, "extensions");
-        const extensionPath = join4(extensionsDir, MANAGED_PI_ROLE_SKILLS_VISIBILITY_FILENAME);
+        const extensionsDir = join5(profileRoot, "extensions");
+        const extensionPath = join5(extensionsDir, MANAGED_PI_ROLE_SKILLS_VISIBILITY_FILENAME);
         mkdirSync3(extensionsDir, { recursive: true, mode: 448 });
         writePrivateFile2(
           extensionPath,
@@ -4765,7 +5038,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         sessionId: gateway.sessionId,
         sourcePiHome,
         piCodingAgentDir,
-        configSha256: sha2562(readFileSync3(configPath)),
+        configSha256: sha2562(readFileSync4(configPath)),
         ...skillProfilesAttestation(skillProfiles, enabledRoleSkills)
       };
       return {
@@ -4786,7 +5059,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         }
       };
     } catch (error) {
-      rmSync2(profileRoot, { recursive: true, force: true });
+      rmSync3(profileRoot, { recursive: true, force: true });
       throw error;
     }
   }
@@ -4799,13 +5072,13 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!rolloutRelativePath || rolloutRelativePath.startsWith("..") || isAbsolute2(rolloutRelativePath)) {
       throw new Error("pi_managed_mcp_session_rollout_unsafe: rollout escaped the managed Pi home");
     }
-    const cacheRoot = join4(dirname3(resolve3(profile.profileRoot)), "session-rollout");
-    if (existsSync3(cacheRoot)) rmSync2(cacheRoot, { recursive: true, force: false });
+    const cacheRoot = join5(dirname4(resolve3(profile.profileRoot)), "session-rollout");
+    if (existsSync3(cacheRoot)) rmSync3(cacheRoot, { recursive: true, force: false });
     mkdirSync3(cacheRoot, { recursive: true, mode: 448 });
-    const targetRollout = join4(cacheRoot, rolloutRelativePath);
-    mkdirSync3(dirname3(targetRollout), { recursive: true, mode: 448 });
-    writePrivateFile2(targetRollout, readFileSync3(sourceRollout));
-    writePrivateFile2(join4(cacheRoot, SESSION_ROLLOUT_MARKER2), `${JSON.stringify({
+    const targetRollout = join5(cacheRoot, rolloutRelativePath);
+    mkdirSync3(dirname4(targetRollout), { recursive: true, mode: 448 });
+    writePrivateFile2(targetRollout, readFileSync4(sourceRollout));
+    writePrivateFile2(join5(cacheRoot, SESSION_ROLLOUT_MARKER2), `${JSON.stringify({
       version: 1,
       cacheRoot,
       preservedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -4828,12 +5101,12 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     }
     try {
       const stat = lstatSync3(target);
-      if (stat.isFile() && !stat.isSymbolicLink()) rmSync2(target);
+      if (stat.isFile() && !stat.isSymbolicLink()) rmSync3(target);
     } catch (error) {
       if (error?.code !== "ENOENT") throw error;
     }
     try {
-      rmdirSync(dirname3(target));
+      rmdirSync(dirname4(target));
     } catch (error) {
       if (!["ENOENT", "ENOTEMPTY", "ENOTDIR"].includes(error?.code)) throw error;
     }
@@ -4850,21 +5123,21 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: profile root is not an owned directory");
     }
-    const markerPath = join4(profileRoot, PROFILE_MARKER2);
+    const markerPath = join5(profileRoot, PROFILE_MARKER2);
     const markerStat = existsSync3(markerPath) ? lstatSync3(markerPath) : null;
     if (!markerStat?.isFile() || markerStat.isSymbolicLink()) {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: ownership marker is missing or unsafe");
     }
     let marker;
     try {
-      marker = JSON.parse(readFileSync3(markerPath, "utf8"));
+      marker = JSON.parse(readFileSync4(markerPath, "utf8"));
     } catch {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: ownership marker is invalid");
     }
     if (marker?.version !== 1 || marker?.profileRoot !== profileRoot || marker?.commandId !== owner?.commandId || marker?.runId !== owner?.runId) {
       throw new Error("pi_managed_mcp_cleanup_owner_mismatch: ownership marker does not match command/run");
     }
-    rmSync2(profileRoot, { recursive: true, force: false });
+    rmSync3(profileRoot, { recursive: true, force: false });
     if (existsSync3(profileRoot)) throw new Error("pi_managed_mcp_cleanup_failed: profile root still exists");
     if (typeof profile?.workspaceMcpConfigPath === "string") {
       removeWorkspaceMcpConfig(profile.workspaceMcpConfigPath, profileRoot);
@@ -4878,21 +5151,21 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
       throw new Error("pi_delegated_mcp_cleanup_owner_mismatch: profile root is not an owned directory");
     }
-    const markerPath = join4(profileRoot, DELEGATED_PROFILE_MARKER);
+    const markerPath = join5(profileRoot, DELEGATED_PROFILE_MARKER);
     const markerStat = existsSync3(markerPath) ? lstatSync3(markerPath) : null;
     if (!markerStat?.isFile() || markerStat.isSymbolicLink()) {
       throw new Error("pi_delegated_mcp_cleanup_owner_mismatch: ownership marker is missing or unsafe");
     }
     let marker;
     try {
-      marker = JSON.parse(readFileSync3(markerPath, "utf8"));
+      marker = JSON.parse(readFileSync4(markerPath, "utf8"));
     } catch {
       throw new Error("pi_delegated_mcp_cleanup_owner_mismatch: ownership marker is invalid");
     }
     if (marker?.version !== 1 || marker?.profileRoot !== profileRoot || marker?.commandId !== owner?.commandId || marker?.runId !== owner?.runId) {
       throw new Error("pi_delegated_mcp_cleanup_owner_mismatch: ownership marker does not match command/run");
     }
-    rmSync2(profileRoot, { recursive: true, force: false });
+    rmSync3(profileRoot, { recursive: true, force: false });
     if (existsSync3(profileRoot)) throw new Error("pi_delegated_mcp_cleanup_failed: profile root still exists");
     return { status: "removed", profileRoot };
   }
@@ -4908,7 +5181,7 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const currentStat = lstatSync3(current);
       if (!currentStat.isDirectory() || currentStat.isSymbolicLink()) continue;
       for (const entry of readdirSync3(current, { withFileTypes: true })) {
-        const fullPath = join4(current, entry.name);
+        const fullPath = join5(current, entry.name);
         if (entry.isDirectory() && !entry.isSymbolicLink()) pending.push(fullPath);
         else if (entry.isFile() && entry.name === PROFILE_MARKER2) profileMarkers.push(fullPath);
         else if (entry.isFile() && entry.name === SESSION_ROLLOUT_MARKER2) rolloutMarkers.push(fullPath);
@@ -4920,9 +5193,9 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     const failures = [];
     const protectedCommandIds = new Set(Array.isArray(options2.protectedCommandIds) ? options2.protectedCommandIds.filter((value) => typeof value === "string" && value) : []);
     for (const markerPath of profileMarkers) {
-      const profileRoot = dirname3(markerPath);
+      const profileRoot = dirname4(markerPath);
       try {
-        const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
+        const marker = JSON.parse(readFileSync4(markerPath, "utf8"));
         const markerProfileRoot = typeof marker?.profileRoot === "string" ? resolve3(marker.profileRoot) : null;
         if (!markerProfileRoot || !existsSync3(markerProfileRoot) || !within2(realpathSync2(profileRoot), canonicalRoot) || realpathSync2(markerProfileRoot) !== realpathSync2(profileRoot)) throw new Error("ownership marker root mismatch");
         if (protectedCommandIds.has(marker?.commandId)) {
@@ -4945,17 +5218,17 @@ ${result3.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     const nowMs = Number.isFinite(options2.nowMs) ? options2.nowMs : Date.now();
     const rolloutTtlMs = Number.isFinite(options2.sessionRolloutTtlMs) && options2.sessionRolloutTtlMs > 0 ? options2.sessionRolloutTtlMs : DEFAULT_SESSION_ROLLOUT_TTL_MS2;
     for (const markerPath of rolloutMarkers) {
-      const cacheRoot = dirname3(markerPath);
+      const cacheRoot = dirname4(markerPath);
       try {
         const markerStat = lstatSync3(markerPath);
         const cacheStat = lstatSync3(cacheRoot);
-        const marker = JSON.parse(readFileSync3(markerPath, "utf8"));
+        const marker = JSON.parse(readFileSync4(markerPath, "utf8"));
         const markerCacheRoot = typeof marker?.cacheRoot === "string" ? resolve3(marker.cacheRoot) : null;
         if (!within2(realpathSync2(cacheRoot), canonicalRoot) || basename2(cacheRoot) !== "session-rollout" || markerStat.isSymbolicLink() || !markerStat.isFile() || cacheStat.isSymbolicLink() || !cacheStat.isDirectory() || marker?.version !== 1 || typeof marker?.companyId !== "string" || typeof marker?.agentId !== "string" || typeof marker?.sourceRunId !== "string" || typeof marker?.sourceCommandId !== "string" || typeof marker?.sessionId !== "string" || !markerCacheRoot || !existsSync3(markerCacheRoot) || realpathSync2(markerCacheRoot) !== realpathSync2(cacheRoot)) throw new Error("session rollout ownership marker mismatch");
         const preservedAtMs = typeof marker.preservedAt === "string" ? Date.parse(marker.preservedAt) : Number.NaN;
         const markerAgeMs = nowMs - (Number.isFinite(preservedAtMs) ? preservedAtMs : markerStat.mtimeMs);
         if (markerAgeMs < rolloutTtlMs) continue;
-        rmSync2(cacheRoot, { recursive: true, force: false });
+        rmSync3(cacheRoot, { recursive: true, force: false });
         if (existsSync3(cacheRoot)) throw new Error("session rollout cache still exists");
         removedRollouts += 1;
       } catch (error) {
@@ -4999,7 +5272,7 @@ function selectExecutor(config, command) {
 }
 
 // src/amaster-runtime-daemon/executor-process.mjs
-import { readdirSync as readdirSync4, readFileSync as readFileSync4 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync5 } from "node:fs";
 var TERMINAL_LINUX_PROCESS_STATES = /* @__PURE__ */ new Set(["Z", "X", "x"]);
 function processGroupIdForChild(child, processPlatform = process.platform) {
   return processPlatform === "win32" || typeof child.pid !== "number" || child.pid <= 0 ? null : child.pid;
@@ -5012,7 +5285,7 @@ function linuxProcState(stat) {
   const processGroupId = Number.parseInt(fields[2], 10);
   return Number.isInteger(processGroupId) ? { state: fields[0], processGroupId } : null;
 }
-function linuxProcessGroupHasLiveMembers(processGroupId, procRoot = "/proc", fsApi = { readdirSync: readdirSync4, readFileSync: readFileSync4 }) {
+function linuxProcessGroupHasLiveMembers(processGroupId, procRoot = "/proc", fsApi = { readdirSync: readdirSync4, readFileSync: readFileSync5 }) {
   let entries;
   try {
     entries = fsApi.readdirSync(procRoot, { withFileTypes: true });
@@ -5059,7 +5332,7 @@ function isProcessIdAlive(pid, processApi = process) {
     processApi.kill(pid, 0);
     if (processApi.platform === "linux") {
       try {
-        const parsed = linuxProcState(readFileSync4(`/proc/${pid}/stat`, "utf8"));
+        const parsed = linuxProcState(readFileSync5(`/proc/${pid}/stat`, "utf8"));
         if (parsed && TERMINAL_LINUX_PROCESS_STATES.has(parsed.state)) return false;
       } catch {
       }
@@ -5109,8 +5382,8 @@ function isTerminalResultOutboxStatus(status) {
 }
 
 // src/amaster-runtime-daemon/run-completion-state.mjs
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, readdirSync as readdirSync5, renameSync as renameSync3, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync5, renameSync as renameSync4, unlinkSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join6 } from "node:path";
 var RUN_COMPLETION_STATE_VERSION = 1;
 var RUN_COMPLETION_USAGE_SCHEMA_VERSION = "runtime-command-usage-v1";
 var RUN_COMPLETION_PHASES = /* @__PURE__ */ new Set([
@@ -5340,22 +5613,22 @@ function assertValidRunCompletionState(value) {
 function writeRunCompletionState(directory, state) {
   const valid = assertValidRunCompletionState(state);
   mkdirSync4(directory, { recursive: true, mode: 448 });
-  const filePath = join5(directory, runCompletionStateFileName(valid.commandId));
+  const filePath = join6(directory, runCompletionStateFileName(valid.commandId));
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync4(temporaryPath, `${JSON.stringify(valid, null, 2)}
+  writeFileSync5(temporaryPath, `${JSON.stringify(valid, null, 2)}
 `, { mode: 384 });
-  renameSync3(temporaryPath, filePath);
+  renameSync4(temporaryPath, filePath);
   return filePath;
 }
 function readRunCompletionState(filePath) {
-  return assertValidRunCompletionState(JSON.parse(readFileSync5(filePath, "utf8")));
+  return assertValidRunCompletionState(JSON.parse(readFileSync6(filePath, "utf8")));
 }
 function listRunCompletionStateFiles(directory) {
   if (!existsSync4(directory)) return [];
-  return readdirSync5(directory).filter((name) => name.endsWith(".json")).sort().map((name) => join5(directory, name));
+  return readdirSync5(directory).filter((name) => name.endsWith(".json")).sort().map((name) => join6(directory, name));
 }
 function removeRunCompletionState(directory, commandId) {
-  const filePath = join5(directory, runCompletionStateFileName(commandId));
+  const filePath = join6(directory, runCompletionStateFileName(commandId));
   if (existsSync4(filePath)) unlinkSync(filePath);
 }
 
@@ -5801,7 +6074,7 @@ function taskAcceptanceContractSection(context, input) {
   const validCriteria = criteria.length > 0 && criteria.every((criterion) => readString(criterion.ref) && readString(criterion.text));
   const validEnrollmentIdentity = schemaVersion === "mirrorx.task-acceptance-contract.v1" && readString(enrollment.id) && Number.isInteger(enrollment.revision) && enrollmentRequirementRevision && readString(enrollment.request_hash) && sourceRef === `business_task_enrollment:${readString(enrollment.id)}@${enrollmentRequirementRevision}`;
   const validParentGovernedChildIdentity = schemaVersion === "mirrorx.task-acceptance-contract.v2" && Object.keys(enrollment).length === 0 && readString(authority.kind) === "parent_governed_child" && parentRequirementRevision && readString(authority.requirements_hash) === canonicalSha256(requirements) && ["required_execution", "final_aggregation"].includes(readString(authority.completion_role)) && ["none", "package", "own_deliverable"].includes(readString(authority.review_authority)) && sourceRef === `parent_governed_child:${readString(contract.issue_id)}@${parentRequirementRevision}`;
-  const validIdentity = readString(contract.company_id) && readString(contract.issue_id) && Number.isInteger(contract.execution_epoch) && readString(contract.observed_at) && requirementRevision && Boolean(validEnrollmentIdentity || validParentGovernedChildIdentity);
+  const validIdentity2 = readString(contract.company_id) && readString(contract.issue_id) && Number.isInteger(contract.execution_epoch) && readString(contract.observed_at) && requirementRevision && Boolean(validEnrollmentIdentity || validParentGovernedChildIdentity);
   const noManifestDelivery = delivery.contract_state === "not_required";
   const uniqueAllowedKinds = new Set(allowedKinds).size === allowedKinds.length;
   const validNoManifestDelivery = noManifestDelivery && allowedKinds.length === 0 && acceptanceContracts.length === 0;
@@ -5810,7 +6083,7 @@ function taskAcceptanceContractSection(context, input) {
   const validOwnedAcceptance = readString(acceptance.owner_agent_id) && Object.keys(asRecord(acceptance.policy)).length > 0 && readString(acceptance.expected_outcome_at);
   const validParentDelegatedAcceptance = validParentGovernedChildIdentity && readString(requirementIntent.reason) === "parent_governed_child" && ["required_execution", "final_aggregation"].includes(readString(requirementCompletion.role)) && readString(requirementOutcome.mode) === "none" && readString(acceptance.delegated_to) === "parent" && acceptance.owner_agent_id === null && acceptance.policy === null && acceptance.expected_outcome_at === null;
   const validAcceptance = validOwnedAcceptance || validParentDelegatedAcceptance;
-  if (!validIdentity || !validCriteria || !validDelivery || !validAcceptance) {
+  if (!validIdentity2 || !validCriteria || !validDelivery || !validAcceptance) {
     throw taskAcceptanceContractError(
       "task_acceptance_contract_invalid",
       "Task Acceptance Contract is incomplete or internally inconsistent"
@@ -7738,9 +8011,9 @@ function resolveAgentInstructionSystemKernelBundle(bundle, options = {}) {
 }
 
 // src/amaster-runtime-daemon/config-state.mjs
-import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync7, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir2, hostname } from "node:os";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { dirname as dirname5, join as join7 } from "node:path";
 
 // src/amaster-runtime-daemon/executor-discovery.mjs
 import { spawnSync as spawnSync3 } from "node:child_process";
@@ -7872,11 +8145,11 @@ function defaultMachineId() {
 }
 function runtimeHome(env) {
   return expandHomePath(String(
-    env.AMASTER_RUNTIME_STATE_HOME || env.AMASTER_RUNTIME_HOME || join6(homedir2(), ".amaster-employee")
+    env.AMASTER_RUNTIME_STATE_HOME || env.AMASTER_RUNTIME_HOME || join7(homedir2(), ".amaster-employee")
   ));
 }
 function stateFilePath(env) {
-  return env.AMASTER_DAEMON_STATE_FILE ? expandHomePath(String(env.AMASTER_DAEMON_STATE_FILE)) : join6(runtimeHome(env), "runtime-connector-state.json");
+  return env.AMASTER_DAEMON_STATE_FILE ? expandHomePath(String(env.AMASTER_DAEMON_STATE_FILE)) : join7(runtimeHome(env), "runtime-connector-state.json");
 }
 function corruptStatePath(path) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);
@@ -7891,7 +8164,7 @@ function readState(env) {
   const path = stateFilePath(env);
   if (!existsSync5(path)) return {};
   try {
-    const state = JSON.parse(readFileSync6(path, "utf8"));
+    const state = JSON.parse(readFileSync7(path, "utf8"));
     if (!state || typeof state !== "object" || Array.isArray(state)) {
       throw new TypeError("runtime connector state must be a JSON object");
     }
@@ -7899,7 +8172,7 @@ function readState(env) {
   } catch {
     const quarantinePath = corruptStatePath(path);
     try {
-      renameSync4(path, quarantinePath);
+      renameSync5(path, quarantinePath);
       process.stderr.write(`AMaster runtime state was invalid and quarantined at ${quarantinePath}
 `);
     } catch (error) {
@@ -7913,17 +8186,17 @@ function readState(env) {
 }
 function writeState(env, state) {
   const path = stateFilePath(env);
-  mkdirSync5(dirname4(path), { recursive: true });
+  mkdirSync5(dirname5(path), { recursive: true });
   const temporaryPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
   try {
-    writeFileSync5(temporaryPath, `${JSON.stringify(state, null, 2)}
+    writeFileSync6(temporaryPath, `${JSON.stringify(state, null, 2)}
 `, {
       flag: "wx",
       mode: 384
     });
-    renameSync4(temporaryPath, path);
+    renameSync5(temporaryPath, path);
   } finally {
-    rmSync3(temporaryPath, { force: true });
+    rmSync4(temporaryPath, { force: true });
   }
 }
 function buildConfig(env = process.env, flags = {}) {
@@ -7935,10 +8208,10 @@ function buildConfig(env = process.env, flags = {}) {
   const authHeader = String(flags.authHeader ?? env.AMASTER_CONNECTOR_AUTH_HEADER ?? "");
   const home = runtimeHome(env);
   const runtimeWorkspacesRoot = expandHomePath(
-    String(flags.runtimeWorkspacesRoot ?? env.AMASTER_RUNTIME_WORKSPACES_ROOT ?? join6(home, "workspaces"))
+    String(flags.runtimeWorkspacesRoot ?? env.AMASTER_RUNTIME_WORKSPACES_ROOT ?? join7(home, "workspaces"))
   );
   const browserSessionStateRoot = expandHomePath(String(
-    flags.browserSessionStateRoot ?? env.AMASTER_BROWSER_SESSION_STATE_ROOT ?? join6(home, "browser-auth")
+    flags.browserSessionStateRoot ?? env.AMASTER_BROWSER_SESSION_STATE_ROOT ?? join7(home, "browser-auth")
   ));
   const piToolArgumentGuardModeValue = String(
     flags.piToolArgumentGuardMode ?? env.AMASTER_PI_TOOL_ARGUMENT_GUARD_MODE ?? "shadow"
@@ -9729,7 +10002,7 @@ var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
 import { createHash as createHash8 } from "node:crypto";
-import { closeSync, constants, fstatSync, lstatSync as lstatSync4, openSync, readFileSync as readFileSync7, realpathSync as realpathSync3 } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync as lstatSync4, openSync, readFileSync as readFileSync8, realpathSync as realpathSync3 } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve4 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
 function requiredString(value, name) {
@@ -9781,7 +10054,7 @@ function readOwnedWorkspaceFile(rootPath, sourceRelativePath, label = "Runtime w
         );
       }
     }
-    const body = readFileSync7(descriptor);
+    const body = readFileSync8(descriptor);
     options.afterRead?.({ sourcePath, descriptor });
     const after = fstatSync(descriptor);
     const pathAfter = lstatSync4(sourcePath);
@@ -10067,11 +10340,11 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 // src/amaster-runtime-daemon/workspace-guard.mjs
 import { createHash as createHash10 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync6, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
-import { basename as basename4, join as join8, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "node:path";
+import { basename as basename4, join as join9, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5 } from "node:path";
 
 // src/amaster-runtime-daemon/workspace-manifest.mjs
-import { chownSync as chownSync3, existsSync as existsSync6, readFileSync as readFileSync8, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename as basename3, dirname as dirname5, join as join7 } from "node:path";
+import { chownSync as chownSync3, existsSync as existsSync6, readFileSync as readFileSync9, renameSync as renameSync6, rmSync as rmSync5, statSync as statSync3, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename3, dirname as dirname6, join as join8 } from "node:path";
 var WORKSPACE_MANIFEST_FILENAME = ".amaster-runtime.json";
 function syncManifestDirOwnership(manifestPath, deps = {}) {
   const stat = deps.statSync ?? statSync3;
@@ -10079,7 +10352,7 @@ function syncManifestDirOwnership(manifestPath, deps = {}) {
   const geteuid = deps.geteuid ?? (typeof process.geteuid === "function" ? process.geteuid.bind(process) : () => null);
   try {
     if (geteuid() !== 0) return false;
-    const dirStat = stat(dirname5(manifestPath));
+    const dirStat = stat(dirname6(manifestPath));
     if (dirStat.uid === 0 && dirStat.gid === 0) return false;
     chown(manifestPath, dirStat.uid, dirStat.gid);
     return true;
@@ -10092,31 +10365,31 @@ function nowIso() {
 }
 function workspaceManifestPath(workspaceOrCwd) {
   if (!workspaceOrCwd) return null;
-  if (typeof workspaceOrCwd === "string") return join7(workspaceOrCwd, WORKSPACE_MANIFEST_FILENAME);
-  if (typeof workspaceOrCwd.cwd === "string") return join7(workspaceOrCwd.cwd, WORKSPACE_MANIFEST_FILENAME);
+  if (typeof workspaceOrCwd === "string") return join8(workspaceOrCwd, WORKSPACE_MANIFEST_FILENAME);
+  if (typeof workspaceOrCwd.cwd === "string") return join8(workspaceOrCwd.cwd, WORKSPACE_MANIFEST_FILENAME);
   return null;
 }
 function readWorkspaceManifest(manifestPath) {
   if (!manifestPath || !existsSync6(manifestPath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync8(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(manifestPath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
 function writeWorkspaceManifest(manifestPath, manifest, deps) {
-  const tempPath = join7(
-    dirname5(manifestPath),
+  const tempPath = join8(
+    dirname6(manifestPath),
     `.${basename3(manifestPath)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`
   );
   try {
-    writeFileSync6(tempPath, `${JSON.stringify(manifest, null, 2)}
+    writeFileSync7(tempPath, `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
-    renameSync5(tempPath, manifestPath);
+    renameSync6(tempPath, manifestPath);
     syncManifestDirOwnership(manifestPath, deps);
   } catch (err) {
-    rmSync4(tempPath, { force: true });
+    rmSync5(tempPath, { force: true });
     throw err;
   }
   return manifest;
@@ -10229,9 +10502,9 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
   const workspaceKey = `${safeSegment(workspaceLabel(sourceWorkspacePath, payload), "workspace")}-${shortHash(sourceWorkspacePath)}`;
   const issueKey = `${safeSegment(issueLabel(command, payload), "issue")}-${shortHash(issueId, 8)}`;
   const runKey = `${safeSegment(runId, "run")}-${shortHash(runId, 8)}`;
-  const runDir = join8(root, workspaceKey, issueKey, runKey);
-  const cwd = join8(runDir, "workdir");
-  const executorHome = join8(runDir, "executors", safeSegment(executorKind, "executor"));
+  const runDir = join9(root, workspaceKey, issueKey, runKey);
+  const cwd = join9(runDir, "workdir");
+  const executorHome = join9(runDir, "executors", safeSegment(executorKind, "executor"));
   mkdirSync6(cwd, { recursive: true });
   mkdirSync6(executorHome, { recursive: true });
   const workspace = {
@@ -10256,7 +10529,7 @@ function resolveExecutionWorkspace(config, command, opts = {}) {
 
 // src/amaster-runtime-daemon/workspace-gc.mjs
 import { existsSync as existsSync8, readdirSync as readdirSync6, statSync as statSync5 } from "node:fs";
-import { join as join9, resolve as resolve6 } from "node:path";
+import { join as join10, resolve as resolve6 } from "node:path";
 function readIsoTime(value) {
   if (typeof value !== "string" || !value.trim()) return null;
   const time = new Date(value).getTime();
@@ -10279,7 +10552,7 @@ function walkWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join9(current, entry.name);
+      const fullPath = join10(current, entry.name);
       if (entry.name === "workdir" && existsSync8(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
@@ -10311,7 +10584,7 @@ function directorySizeBytes(path) {
         continue;
       }
       for (const entry of entries) {
-        stack.push(join9(current, entry.name));
+        stack.push(join10(current, entry.name));
       }
       continue;
     }
@@ -10384,7 +10657,7 @@ function planManagedWorkspaceGcDryRun(input) {
 
 // src/amaster-runtime-daemon/runtime-status-summary.mjs
 import { existsSync as existsSync9, readdirSync as readdirSync7, statSync as statSync6 } from "node:fs";
-import { dirname as dirname6, join as join10, resolve as resolve7 } from "node:path";
+import { dirname as dirname7, join as join11, resolve as resolve7 } from "node:path";
 function runtimeStatusDirectoryEntries(path) {
   try {
     return readdirSync7(path, { withFileTypes: true });
@@ -10407,7 +10680,7 @@ function runtimeStatusDirectorySizeBytes(path) {
     if (!stat || stat.isSymbolicLink()) continue;
     if (stat.isDirectory()) {
       for (const entry of runtimeStatusDirectoryEntries(current)) {
-        stack.push(join10(current, entry.name));
+        stack.push(join11(current, entry.name));
       }
       continue;
     }
@@ -10424,7 +10697,7 @@ function walkRuntimeStatusManagedWorkdirs(root) {
     if (!current) continue;
     for (const entry of runtimeStatusDirectoryEntries(current)) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join10(current, entry.name);
+      const fullPath = join11(current, entry.name);
       if (entry.name === "workdir" && existsSync9(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
@@ -10466,7 +10739,7 @@ function summarizeRuntimeStatusRecentRun(workdir, manifest) {
 }
 function runtimeStatusOutboxDir(config) {
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join10(dirname6(stateFilePath({
+  return join11(dirname7(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "result-outbox");
 }
@@ -10474,7 +10747,7 @@ function runtimeStatusRunCompletionDir(config) {
   const explicit = config.AMASTER_RUN_COMPLETION_STATE_DIR ?? config.runCompletionStateDir;
   if (typeof explicit === "string" && explicit.trim()) return resolve7(explicit);
   const statePath = config.AMASTER_DAEMON_STATE_FILE ?? config.daemonStateFile;
-  return join10(dirname6(stateFilePath({
+  return join11(dirname7(stateFilePath({
     AMASTER_DAEMON_STATE_FILE: statePath
   })), "run-completion-state");
 }
@@ -10511,9 +10784,9 @@ function summarizeRuntimeLocalState(input) {
     }
   }
   const pendingOutboxDir = runtimeStatusOutboxDir(config);
-  const invalidOutboxDir = join10(pendingOutboxDir, "invalid");
+  const invalidOutboxDir = join11(pendingOutboxDir, "invalid");
   const pendingRunCompletionDir = runtimeStatusRunCompletionDir(config);
-  const invalidRunCompletionDir = join10(pendingRunCompletionDir, "invalid");
+  const invalidRunCompletionDir = join11(pendingRunCompletionDir, "invalid");
   return {
     managedWorkspacesRoot: root,
     managedWorkdirCount: workdirs.length,
@@ -10637,8 +10910,8 @@ function summarizeAmasterRuntimeVersionDrift(input = {}) {
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync8, readFileSync as readFileSync9, statSync as statSync7 } from "node:fs";
-import { basename as basename5, extname, isAbsolute as isAbsolute5, join as join11, relative as relative5, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync8, readFileSync as readFileSync10, statSync as statSync7 } from "node:fs";
+import { basename as basename5, extname, isAbsolute as isAbsolute5, join as join12, relative as relative5, resolve as resolve8 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -10707,7 +10980,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File(filePath) {
-  return createHash11("sha256").update(readFileSync9(filePath)).digest("hex");
+  return createHash11("sha256").update(readFileSync10(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -10756,7 +11029,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       if (entry.name.startsWith(".") && entry.name !== ".amaster-runtime.json") {
         if (entry.name === ".git") continue;
       }
-      const fullPath = join11(current, entry.name);
+      const fullPath = join12(current, entry.name);
       const relativePath = normalizeRelativePath(root, fullPath);
       if (!isSafeRelativePath(relativePath)) continue;
       if (basename5(relativePath) === ".amaster-runtime.json") continue;
@@ -10834,10 +11107,10 @@ function sanitizeRuntimeService(entry) {
   };
 }
 function readRuntimeServicesSnapshot(cwd) {
-  const snapshotPath = join11(resolve8(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
+  const snapshotPath = join12(resolve8(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
   if (!existsSync10(snapshotPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync9(snapshotPath, "utf8"));
+    const parsed = JSON.parse(readFileSync10(snapshotPath, "utf8"));
     const rawServices = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.services) ? parsed.services : [];
     return rawServices.map((entry) => sanitizeRuntimeService(entry)).filter((entry) => entry !== null).slice(0, 50);
   } catch {
@@ -11069,16 +11342,16 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
 // src/amaster-runtime-daemon/browser-session-broker.mjs
 import { createHash as createHash12 } from "node:crypto";
 import {
-  chmodSync as chmodSync4,
+  chmodSync as chmodSync5,
   existsSync as existsSync11,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync10,
-  rmSync as rmSync5,
+  readFileSync as readFileSync11,
+  rmSync as rmSync6,
   statSync as statSync8,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
-import { dirname as dirname7, join as join12, relative as relative6, resolve as resolve9 } from "node:path";
+import { dirname as dirname8, join as join13, relative as relative6, resolve as resolve9 } from "node:path";
 var MARKER_NAME = ".amaster-browser-session.json";
 var HUMAN_LEASE_HARD_CAP_MS = 2 * 60 * 60 * 1e3;
 function brokerError(code) {
@@ -11103,7 +11376,7 @@ function ensurePrivateRoot(stateRoot) {
     throw brokerError("browser_session_profile_root_symlink");
   }
   mkdirSync7(root, { recursive: true, mode: 448 });
-  chmodSync4(root, 448);
+  chmodSync5(root, 448);
   if (lstatSync5(root).isSymbolicLink()) {
     throw brokerError("browser_session_profile_root_symlink");
   }
@@ -11125,7 +11398,7 @@ function expectedOwner(payload) {
 function exactProfile(stateRoot, payload, { create = false } = {}) {
   const root = ensurePrivateRoot(stateRoot);
   const profilePath = resolve9(root, profileName(payload));
-  if (!pathWithin3(profilePath, root) || dirname7(profilePath) !== root) {
+  if (!pathWithin3(profilePath, root) || dirname8(profilePath) !== root) {
     throw brokerError("browser_session_profile_path_invalid");
   }
   if (existsSync11(profilePath) && lstatSync5(profilePath).isSymbolicLink()) {
@@ -11134,9 +11407,9 @@ function exactProfile(stateRoot, payload, { create = false } = {}) {
   if (!existsSync11(profilePath)) {
     if (!create) throw brokerError("browser_session_profile_not_found");
     mkdirSync7(profilePath, { mode: 448 });
-    chmodSync4(profilePath, 448);
-    writeFileSync7(
-      join12(profilePath, MARKER_NAME),
+    chmodSync5(profilePath, 448);
+    writeFileSync8(
+      join13(profilePath, MARKER_NAME),
       `${JSON.stringify(expectedOwner(payload))}
 `,
       { encoding: "utf8", mode: 384, flag: "wx" }
@@ -11147,7 +11420,7 @@ function exactProfile(stateRoot, payload, { create = false } = {}) {
   }
   let owner;
   try {
-    owner = JSON.parse(readFileSync10(join12(profilePath, MARKER_NAME), "utf8"));
+    owner = JSON.parse(readFileSync11(join13(profilePath, MARKER_NAME), "utf8"));
   } catch {
     throw brokerError("browser_session_profile_owner_invalid");
   }
@@ -11298,7 +11571,7 @@ function createBrowserSessionBroker({
       await existing.context.close();
       active.delete(payload.localOpaqueRef);
     }
-    rmSync5(profilePath, { recursive: true, force: false });
+    rmSync6(profilePath, { recursive: true, force: false });
     return {
       bindingId: payload.bindingId,
       localOpaqueRef: payload.localOpaqueRef,
@@ -11327,7 +11600,7 @@ function createBrowserSessionBroker({
       if (resolve9(payload.userDataDir) !== expectedPath) {
         throw brokerError("browser_session_profile_path_invalid");
       }
-      const marker = JSON.parse(readFileSync10(join12(expectedPath, MARKER_NAME), "utf8"));
+      const marker = JSON.parse(readFileSync11(join13(expectedPath, MARKER_NAME), "utf8"));
       if (marker.version !== 1 || typeof marker.provider !== "string" || !marker.provider.trim() || marker.companyId !== payload.companyId || marker.bindingId !== payload.bindingId || marker.localOpaqueRef !== payload.localOpaqueRef || marker.origin !== payload.origin) {
         throw brokerError("browser_session_profile_owner_mismatch");
       }
@@ -11377,7 +11650,7 @@ var source_acquisition_compatibility_default = {
 };
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.80";
+var CONNECTOR_VERSION = "0.1.1-beta.82";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = source_acquisition_compatibility_default.profileVersion;
 var daemonRequire = createRequire(import.meta.url);
@@ -11421,7 +11694,7 @@ function resultOutboxPendingCount(config) {
   try {
     let pending = 0;
     for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json"))) {
-      if (readValidResultOutboxEntryOrQuarantine(config, file, join13(dir, file))) {
+      if (readValidResultOutboxEntryOrQuarantine(config, file, join14(dir, file))) {
         pending += 1;
       }
     }
@@ -11433,17 +11706,17 @@ function resultOutboxPendingCount(config) {
 function runCompletionStateDir(config) {
   const explicit = readString(process.env.AMASTER_RUN_COMPLETION_STATE_DIR);
   if (explicit) return resolve10(expandHomePath(explicit));
-  return join13(dirname8(stateFilePath(process.env)), "run-completion-state");
+  return join14(dirname9(stateFilePath(process.env)), "run-completion-state");
 }
 function runCompletionStateInvalidDir(config) {
-  return join13(runCompletionStateDir(config), "invalid");
+  return join14(runCompletionStateDir(config), "invalid");
 }
 function quarantineInvalidRunCompletionState(config, filePath, reason) {
   const invalidDir = runCompletionStateInvalidDir(config);
   mkdirSync8(invalidDir, { recursive: true, mode: 448 });
-  const destination = join13(invalidDir, basename6(filePath));
+  const destination = join14(invalidDir, basename6(filePath));
   try {
-    renameSync6(filePath, destination);
+    renameSync7(filePath, destination);
   } catch {
     copyFileSync2(filePath, destination);
     unlinkSync2(filePath);
@@ -11498,7 +11771,7 @@ function resultOutboxActiveRunCommands(config) {
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
   for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json")).sort()) {
-    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join13(dir, file));
+    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join14(dir, file));
     if (!entry) continue;
     const activeRun = asRecord(entry.activeRun);
     const commandId = readString(activeRun.commandId) ?? readString(entry.commandId);
@@ -11533,7 +11806,7 @@ function resultOutboxFailedRunCommands(config) {
   for (const file of readdirSync9(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
     try {
-      entry = asRecord(JSON.parse(readFileSync11(join13(dir, file), "utf8")));
+      entry = asRecord(JSON.parse(readFileSync12(join14(dir, file), "utf8")));
     } catch {
       continue;
     }
@@ -11600,7 +11873,7 @@ function safeExpandPath(value) {
 }
 function safeJsonObjectFromFile(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync11(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync12(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -11643,10 +11916,10 @@ function safeSkillRootSummary(kind, source, pathValue) {
     try {
       for (const name of readdirSync9(pathValue)) {
         if (name.startsWith(".")) continue;
-        const skillDir = join13(pathValue, name);
+        const skillDir = join14(pathValue, name);
         try {
           if (!statSync9(skillDir).isDirectory()) continue;
-          if (!existsSync12(join13(skillDir, "SKILL.md"))) continue;
+          if (!existsSync12(join14(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -11697,7 +11970,7 @@ function objectKeyCount(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).length : 0;
 }
 function defaultPiCodingAgentDir() {
-  return join13(homedir3(), ".pi", "agent");
+  return join14(homedir3(), ".pi", "agent");
 }
 function piCapabilitySourcesDiagnostics() {
   const configuredPiCodingAgentDir = safeExpandPath(process.env.PI_CODING_AGENT_DIR);
@@ -11706,14 +11979,14 @@ function piCapabilitySourcesDiagnostics() {
   const configuredPiAgentHome = safeExpandPath(process.env.PI_AGENT_HOME);
   const piAgentHome = configuredPiAgentHome ?? piCodingAgentDir;
   const piAgentHomeSource = configuredPiAgentHome ? "PI_AGENT_HOME" : piCodingAgentDirSource;
-  const userSkillsPath = piAgentHome ? join13(piAgentHome, "skills") : null;
+  const userSkillsPath = piAgentHome ? join14(piAgentHome, "skills") : null;
   const configuredMarketplaceSkillsPath = safeExpandPath(
     process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR
   );
-  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join13(piAgentHome, "marketplace", "skills") : null);
+  const marketplaceSkillsPath = configuredMarketplaceSkillsPath ?? (piAgentHome ? join14(piAgentHome, "marketplace", "skills") : null);
   const builtinSkillsPath = safeExpandPath(process.env.PI_AGENT_BUILTIN_SKILLS_DIR) ?? safeExpandPath(process.env.AMASTER_BUILTIN_SKILLS);
-  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join13(piAgentHome, "mcp.json") : null);
-  const settingsConfigPath = piCodingAgentDir ? join13(piCodingAgentDir, "settings.json") : null;
+  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join14(piAgentHome, "mcp.json") : null);
+  const settingsConfigPath = piCodingAgentDir ? join14(piCodingAgentDir, "settings.json") : null;
   const skillRoots = [
     safeSkillRootSummary("user", `${piAgentHomeSource}/skills`, userSkillsPath),
     safeSkillRootSummary(
@@ -11833,7 +12106,7 @@ function buildExecutorReadiness(config) {
 function sourceAcquisitionPackageMetadata(packageName) {
   const agentDir = readString(process.env.PI_CODING_AGENT_DIR ?? process.env.PI_AGENT_HOME);
   if (!agentDir) return null;
-  const packagePath = join13(
+  const packagePath = join14(
     resolve10(expandHomePath(agentDir)),
     "npm",
     "node_modules",
@@ -12220,7 +12493,7 @@ AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
 AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
-AMASTER_DAEMON_STATE_FILE=${quoteShell(join13(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
+AMASTER_DAEMON_STATE_FILE=${quoteShell(join14(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
 
 set -a
@@ -12676,7 +12949,7 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
   const stateRoot = resolve10(config.browserSessionStateRoot);
   const userDataDir = resolve10(stateRoot, profileName2);
   if (!pathWithin2(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
-  const markerPath = join13(userDataDir, ".amaster-browser-session.json");
+  const markerPath = join14(userDataDir, ".amaster-browser-session.json");
   if (!existsSync12(userDataDir) || lstatSync6(userDataDir).isSymbolicLink() || !lstatSync6(userDataDir).isDirectory() || !existsSync12(markerPath) || lstatSync6(markerPath).isSymbolicLink()) throw new Error("source_acquisition_browser_profile_invalid");
   const marker = readJsonFile2(markerPath);
   if (marker.version !== 1 || marker.companyId !== companyId || marker.bindingId !== bindingId || marker.localOpaqueRef !== localOpaqueRef || !readString(marker.provider) || marker.origin !== exactOrigin || Object.keys(marker).length !== 6) {
@@ -12695,7 +12968,7 @@ async function sourceAcquisitionRuntimeProfile(config, command) {
 }
 function readJsonFile2(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync11(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync12(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -12754,8 +13027,8 @@ async function materializeAgentInstructionsBundle(config, command, workspace, bu
     if (!content) continue;
     const target = safeAgentInstructionMaterializationTarget(workspace, filePath);
     if (!target) continue;
-    mkdirSync8(dirname8(target.targetPath), { recursive: true });
-    writeFileSync8(target.targetPath, content, "utf8");
+    mkdirSync8(dirname9(target.targetPath), { recursive: true });
+    writeFileSync9(target.targetPath, content, "utf8");
     materialized.push({
       path: target.relativePath,
       byteSize: Buffer.byteLength(content, "utf8")
@@ -12782,7 +13055,7 @@ function wikiTreePathForCommand(command, workspaceBindings) {
     const candidates = [];
     if (root.endsWith("paperclipai.plugin-llm-wiki")) candidates.push(root);
     if (basename6(root) === "plugin-data" && companyId) {
-      candidates.push(join13(root, companyId, "paperclipai.plugin-llm-wiki"));
+      candidates.push(join14(root, companyId, "paperclipai.plugin-llm-wiki"));
     }
     for (const candidate of candidates) {
       try {
@@ -12926,18 +13199,18 @@ function buildExecutorEnv(config, command, workspace) {
   };
 }
 function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
-  const profileRoot = mkdtempSync(join13(tmpdir(), "amaster-pi-model-call-"));
-  const home = join13(profileRoot, "home");
-  const sessionsDir = join13(profileRoot, "sessions");
-  const tempDir = join13(profileRoot, "tmp");
+  const profileRoot = mkdtempSync(join14(tmpdir(), "amaster-pi-model-call-"));
+  const home = join14(profileRoot, "home");
+  const sessionsDir = join14(profileRoot, "sessions");
+  const tempDir = join14(profileRoot, "tmp");
   for (const directory of [home, sessionsDir, tempDir]) {
     mkdirSync8(directory, { recursive: true, mode: 448 });
   }
   try {
     const extensionArgs = [];
     if (options.responseContract) {
-      const extensionPath = join13(profileRoot, "model-call-output-contract.js");
-      writeFileSync8(
+      const extensionPath = join14(profileRoot, "model-call-output-contract.js");
+      writeFileSync9(
         extensionPath,
         modelCallOutputContractExtensionSource(options.responseContract.maxOutputTokens),
         { mode: 384 }
@@ -12957,12 +13230,12 @@ function preparePiModelCallProfile(commandId, baseEnv, options = {}) {
       }
     };
   } catch (error) {
-    rmSync6(profileRoot, { recursive: true, force: true });
+    rmSync7(profileRoot, { recursive: true, force: true });
     throw error;
   }
 }
 function cleanupPiModelCallProfile(profile) {
-  if (profile?.profileRoot) rmSync6(profile.profileRoot, { recursive: true, force: true });
+  if (profile?.profileRoot) rmSync7(profile.profileRoot, { recursive: true, force: true });
 }
 function splitExtraArgs(value) {
   return splitList(value).flatMap((entry) => entry.split(/\s+/).filter(Boolean));
@@ -13725,7 +13998,7 @@ function walkManagedWorkdirs(root) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join13(current, entry.name);
+      const fullPath = join14(current, entry.name);
       if (entry.name === "workdir" && existsSync12(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
@@ -13862,6 +14135,7 @@ function runExecutor(command, args, options) {
     let closeCode = null;
     let closeSignal = null;
     let spawnError = null;
+    let spawnErrorCode = null;
     let outputDrainForcedClosed = false;
     let killedWorkspaceResidents = [];
     let stoppedResidentDrainUntil = 0;
@@ -13983,6 +14257,7 @@ function runExecutor(command, args, options) {
         signal: closeSignal,
         timedOut: stopReason === "timeout",
         spawnError,
+        spawnErrorCode,
         cancelled: aborted
       });
     };
@@ -14092,6 +14367,7 @@ function runExecutor(command, args, options) {
     });
     child.on("error", (err) => {
       spawnError = err.message;
+      spawnErrorCode = sourceAcquisitionSpawnErrno(err.code);
     });
     child.on("exit", (code, signal) => {
       childExited = true;
@@ -15392,10 +15668,10 @@ async function completeCommand(config, command, status, result3, error) {
 function resultOutboxDir(config) {
   const explicit = readString(process.env.AMASTER_RESULT_OUTBOX_DIR);
   if (explicit) return resolve10(expandHomePath(explicit));
-  return join13(dirname8(stateFilePath(process.env)), "result-outbox");
+  return join14(dirname9(stateFilePath(process.env)), "result-outbox");
 }
 function resultOutboxInvalidDir(config) {
-  return join13(resultOutboxDir(config), "invalid");
+  return join14(resultOutboxDir(config), "invalid");
 }
 function writeResultOutboxEntry(config, entry) {
   const dir = resultOutboxDir(config);
@@ -15407,16 +15683,16 @@ function writeResultOutboxEntry(config, entry) {
     lastAttemptAt: null,
     ...entry
   };
-  writeFileSync8(join13(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
+  writeFileSync9(join14(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
 }
 function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail, original) {
   const invalidDir = resultOutboxInvalidDir(config);
   mkdirSync8(invalidDir, { recursive: true });
-  const invalidPath = join13(invalidDir, file);
+  const invalidPath = join14(invalidDir, file);
   if (original === void 0) {
     try {
-      renameSync6(fullPath, invalidPath);
+      renameSync7(fullPath, invalidPath);
     } catch {
       copyFileSync2(fullPath, invalidPath);
       unlinkSync2(fullPath);
@@ -15429,14 +15705,14 @@ function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail,
     ...detail ? { detail: truncateText(detail, 1e3) } : {},
     original
   };
-  writeFileSync8(invalidPath, `${JSON.stringify(evidence, null, 2)}
+  writeFileSync9(invalidPath, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 384 });
   unlinkSync2(fullPath);
 }
 function readValidResultOutboxEntryOrQuarantine(config, file, fullPath) {
   let entry;
   try {
-    entry = JSON.parse(readFileSync11(fullPath, "utf8"));
+    entry = JSON.parse(readFileSync12(fullPath, "utf8"));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     moveResultOutboxEntryToInvalid(config, file, fullPath, "malformed_result_outbox_json", message);
@@ -15466,7 +15742,7 @@ function updateResultOutboxAttempt(fullPath, entry, err) {
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  writeFileSync8(fullPath, `${JSON.stringify(next, null, 2)}
+  writeFileSync9(fullPath, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
   return next;
 }
@@ -15480,8 +15756,8 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  const invalidPath = join13(invalidDir, file);
-  writeFileSync8(invalidPath, `${JSON.stringify(body, null, 2)}
+  const invalidPath = join14(invalidDir, file);
+  writeFileSync9(invalidPath, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
   try {
     unlinkSync2(fullPath);
@@ -15499,7 +15775,7 @@ async function flushResultOutbox(config) {
   const files = readdirSync9(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
-    const fullPath = join13(dir, file);
+    const fullPath = join14(dir, file);
     const entry = readValidResultOutboxEntryOrQuarantine(config, file, fullPath);
     if (!entry) continue;
     try {
@@ -15696,7 +15972,7 @@ async function materializeIssueAttachments(config, command, workspace) {
     runtimeAuth,
     issueId
   );
-  const targetDir = join13(workspace.cwd, "input-attachments");
+  const targetDir = join14(workspace.cwd, "input-attachments");
   mkdirSync8(targetDir, { recursive: true });
   const usedFilenames = /* @__PURE__ */ new Set();
   const materialized = [];
@@ -15711,9 +15987,9 @@ async function materializeIssueAttachments(config, command, workspace) {
       filename = `${stem}-${index + 1}${ext}`;
     }
     usedFilenames.add(filename);
-    const targetPath = join13(targetDir, filename);
+    const targetPath = join14(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    writeFileSync8(targetPath, body);
+    writeFileSync9(targetPath, body);
     const attachmentId = readString(attachment.id);
     const actualSha256 = createHash13("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
@@ -15787,8 +16063,8 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
     throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
   }
-  const targetRoot = join13(workspace.cwd, "input-artifacts");
-  rmSync6(targetRoot, { recursive: true, force: true });
+  const targetRoot = join14(workspace.cwd, "input-artifacts");
+  rmSync7(targetRoot, { recursive: true, force: true });
   mkdirSync8(targetRoot, { recursive: true });
   const usedPaths = /* @__PURE__ */ new Set();
   const materialized = [];
@@ -15818,18 +16094,18 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       id: attachmentId,
       originalFilename: readString(entry.originalFilename)
     }, index);
-    let relativePath = join13("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    let relativePath = join14("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     if (usedPaths.has(relativePath)) {
       const ext = extname2(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
-      relativePath = join13("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+      relativePath = join14("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     }
     usedPaths.add(relativePath);
-    const targetPath = join13(workspace.cwd, relativePath);
-    mkdirSync8(dirname8(targetPath), { recursive: true });
-    writeFileSync8(targetPath, body);
-    chmodSync5(targetPath, 292);
+    const targetPath = join14(workspace.cwd, relativePath);
+    mkdirSync8(dirname9(targetPath), { recursive: true });
+    writeFileSync9(targetPath, body);
+    chmodSync6(targetPath, 292);
     materialized.push({
       id: attachmentId,
       workProductId,
@@ -15848,9 +16124,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
     version: 1,
     entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
   };
-  const manifestPath = join13(targetRoot, "artifact-input-manifest.json");
-  writeFileSync8(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
-  chmodSync5(manifestPath, 292);
+  const manifestPath = join14(targetRoot, "artifact-input-manifest.json");
+  writeFileSync9(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
+  chmodSync6(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
   await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
     artifactInputCount: materialized.length,
@@ -15859,12 +16135,12 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   return materialized;
 }
 function issueCheckpointDir(workspace) {
-  return join13(dirname8(workspace.runDir), "checkpoint");
+  return join14(dirname9(workspace.runDir), "checkpoint");
 }
 async function clearIssueCheckpoint(config, command, workspace, reason) {
   const checkpointDir = issueCheckpointDir(workspace);
   if (!existsSync12(checkpointDir)) return false;
-  rmSync6(checkpointDir, { recursive: true, force: true });
+  rmSync7(checkpointDir, { recursive: true, force: true });
   await ingestLog(config, command, "system", "info", "Cleared issue continuation checkpoint", { reason });
   return true;
 }
@@ -15877,28 +16153,28 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash13("sha256").update(readFileSync11(filePath)).digest("hex");
+  return createHash13("sha256").update(readFileSync12(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const manifestPath = join13(checkpointDir, "manifest.json");
+  const manifestPath = join14(checkpointDir, "manifest.json");
   if (!existsSync12(manifestPath)) return [];
   let manifest;
   try {
-    manifest = asRecord(JSON.parse(readFileSync11(manifestPath, "utf8")));
+    manifest = asRecord(JSON.parse(readFileSync12(manifestPath, "utf8")));
   } catch (err) {
-    rmSync6(checkpointDir, { recursive: true, force: true });
+    rmSync7(checkpointDir, { recursive: true, force: true });
     throw new Error(`invalid issue checkpoint manifest: ${err instanceof Error ? err.message : String(err)}`);
   }
   const expiresAt = Date.parse(readString(manifest.expiresAt) ?? "");
   if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || readString(manifest.issueId) !== commandIssueId(command)) {
-    rmSync6(checkpointDir, { recursive: true, force: true });
+    rmSync7(checkpointDir, { recursive: true, force: true });
     return [];
   }
   try {
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     if (files.length > 20) throw new Error("issue checkpoint manifest exceeds the limit of 20 files");
-    const filesRoot = realpathSync5(join13(checkpointDir, "files"));
+    const filesRoot = realpathSync5(join14(checkpointDir, "files"));
     const workspaceRoot = realpathSync5(workspace.cwd);
     const validated = [];
     let totalBytes = 0;
@@ -15936,8 +16212,8 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       } catch (err) {
         if (err?.code !== "ENOENT") throw err;
       }
-      mkdirSync8(dirname8(target), { recursive: true });
-      const targetParent = realpathSync5(dirname8(target));
+      mkdirSync8(dirname9(target), { recursive: true });
+      const targetParent = realpathSync5(dirname9(target));
       if (!pathWithin2(targetParent, workspaceRoot)) {
         throw new Error(`issue checkpoint target escapes its workspace: ${relativePath}`);
       }
@@ -15965,8 +16241,8 @@ async function materializeIssueCheckpoint(config, command, workspace) {
 }
 async function saveIssueCheckpoint(config, command, workspace, candidates) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const filesDir = join13(checkpointDir, "files");
-  rmSync6(checkpointDir, { recursive: true, force: true });
+  const filesDir = join14(checkpointDir, "files");
+  rmSync7(checkpointDir, { recursive: true, force: true });
   mkdirSync8(filesDir, { recursive: true });
   const files = [];
   let totalBytes = 0;
@@ -15983,13 +16259,13 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     if (byteSize <= 0 || totalBytes + byteSize > MAX_CHECKPOINT_BYTES) continue;
     const target = resolve10(filesDir, relativePath);
     if (!pathWithin2(target, filesDir)) continue;
-    mkdirSync8(dirname8(target), { recursive: true });
+    mkdirSync8(dirname9(target), { recursive: true });
     copyFileSync2(ownedSource, target);
     totalBytes += byteSize;
     files.push({ path: relativePath, byteSize, sha256: hashFileSha256(ownedSource) });
   }
   if (files.length === 0) {
-    rmSync6(checkpointDir, { recursive: true, force: true });
+    rmSync7(checkpointDir, { recursive: true, force: true });
     return null;
   }
   const manifest = {
@@ -16001,7 +16277,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     totalBytes,
     files
   };
-  writeFileSync8(join13(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync9(join14(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await ingestLog(config, command, "system", "warn", `Saved ${files.length} required deliverable(s) for continuation recovery`, manifest);
   return manifest;
@@ -16172,7 +16448,7 @@ async function executeRunCommand(config, command) {
           executorCommand: invocation.command,
           executorHome: workspace.executorHome,
           runDir: workspace.runDir,
-          runtimeCacheRoot: join13(dirname8(config.daemonStateFile), "cache"),
+          runtimeCacheRoot: join14(dirname9(config.daemonStateFile), "cache"),
           cwd,
           runtimeAuth: commandRuntimeAuth(command),
           nativeSession: asRecord(asRecord(command.payload).nativeSession),
@@ -16600,7 +16876,24 @@ async function executeRunCommand(config, command) {
     const succeeded = !cancelled && !hasOutputFlood && !hasArgumentAmplification && !hasMemoryLimit && (execution.exitCode === 0 || completionOutputStopped || repairedPiTerminalOutputStop) && !execution.timedOut && !execution.spawnError && !parsedErrorMessage;
     const resultStderr = filterExecutionStderrForResult(executor.kind, execution.stderr);
     const unsafeError = execution.timedOut ? `Executor timed out after ${config.executorTimeoutSeconds}s` : cancelled ? "Executor cancelled by AMaster control plane" : execution.spawnError ?? parsedErrorMessage ?? (succeeded ? null : `Executor exited with code ${execution.exitCode ?? "unknown"}`);
-    const sourceErrorCode = sourceAcquisition ? execution.timedOut ? "source_acquisition_timeout" : cancelled ? "source_acquisition_cancelled" : hasOutputFlood ? "source_acquisition_output_flood" : hasMemoryLimit ? "source_acquisition_memory_limit" : execution.spawnError ? "source_acquisition_executor_unavailable" : succeeded ? null : "source_acquisition_executor_failed" : null;
+    const sourceExecutionReceiptPath = readString(managedMcpProfile?.sourceAcquisitionExecutionReceiptPath);
+    const sourceExecutionIdentity = asRecord(managedMcpProfile?.sourceAcquisitionExecutionIdentity);
+    if (sourceExecutionReceiptPath && execution.spawnErrorCode) {
+      try {
+        updateSourceAcquisitionExecutionReceipt(
+          sourceExecutionReceiptPath,
+          sourceExecutionIdentity,
+          { spawnErrno: execution.spawnErrorCode }
+        );
+      } catch {
+      }
+    }
+    const sourceExecutionFailure = sourceAcquisition && !succeeded ? classifySourceAcquisitionExecutionFailure({
+      identity: sourceExecutionIdentity,
+      receipt: sourceExecutionReceiptPath ? readSourceAcquisitionExecutionReceipt(sourceExecutionReceiptPath, sourceExecutionIdentity) : null,
+      exitCode: execution.exitCode
+    }) : null;
+    const sourceErrorCode = sourceAcquisition ? execution.timedOut ? "source_acquisition_timeout" : cancelled ? "source_acquisition_cancelled" : hasOutputFlood ? "source_acquisition_output_flood" : hasMemoryLimit ? "source_acquisition_memory_limit" : execution.spawnError ? "source_acquisition_executor_unavailable" : succeeded ? null : sourceExecutionFailure?.failureCode ?? "source_acquisition_executor_failed" : null;
     const error = sourceAcquisition ? sourceErrorCode : unsafeError;
     const costUsage = parsedCostUsage(parsed.usage);
     const cleanPiTerminalOutputStop = succeeded && (completionOutputStopped || repairedPiTerminalOutputStop) && execution.completionOutputType === "agent_end" && parsed.terminalEventType === "agent_end" && Number.isInteger(parsed.terminalEventIndex);
@@ -16651,7 +16944,8 @@ async function executeRunCommand(config, command) {
           retentionVersion: sourceAcquisition.profile.retention,
           attemptId: sourceAcquisition.profile.attemptId,
           epoch: sourceAcquisition.profile.epoch
-        }
+        },
+        ...sourceExecutionFailure ? { sourceAcquisitionFailureV1: sourceExecutionFailure } : {}
       } : hasArgumentAmplification ? {
         stdout: "",
         stderr: truncateText(resultStderr, 8e3)
@@ -16708,6 +17002,13 @@ async function executeRunCommand(config, command) {
         }
       } : {}
     };
+    if (sourceAcquisition && sourceErrorCode) {
+      result3 = {
+        ...result3,
+        errorCode: sourceErrorCode,
+        errorFamily: "source_acquisition"
+      };
+    }
     if (sourceAcquisition) {
       execution.stdout = "";
       execution.stderr = "";