@amistio/cli 0.1.4 → 0.1.6

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createHash as createHash4, randomUUID } from "node:crypto";
+import { createHash as createHash5, randomUUID } from "node:crypto";
 import { writeFile as writeFile8 } from "node:fs/promises";
 import os5 from "node:os";
-import path11 from "node:path";
+import path12 from "node:path";
 import { Command } from "commander";
 
 // ../shared/src/schemas.ts
@@ -28,6 +28,8 @@ var itemTypeSchema = z.enum([
   "runnerCredential",
   "runnerCommand",
   "planReviewMessage",
+  "assistantMessage",
+  "impactReport",
   "toolSession",
   "activityEvent",
   "pairingSession"
@@ -64,8 +66,41 @@ var workStatusSchema = z.enum([
 ]);
 var sourceSchema = z.enum(["web", "repo", "generated", "runner"]);
 var executionModeSchema = z.enum(["localRunner", "cloudSandbox"]);
-var workKindSchema = z.enum(["brainGeneration", "implementation", "planRevision"]);
+var workKindSchema = z.enum(["brainGeneration", "implementation", "planRevision", "assistantQuestion", "impactPreview"]);
 var generatedDraftStatusSchema = z.enum(["queued", "generating", "reviewing", "approved", "rejected", "changesRequested", "failed"]);
+var assistantQuestionModeSchema = z.enum(["brainOnly", "sourceAware"]);
+var impactRiskLevelSchema = z.enum(["low", "medium", "high", "critical"]);
+var impactReportStatusSchema = z.enum(["queued", "running", "completed", "failed", "stale"]);
+var activityEventTypeSchema = z.enum([
+  "commandSubmitted",
+  "generationQueued",
+  "generationCompleted",
+  "generationFailed",
+  "documentGenerated",
+  "documentReview",
+  "documentSync",
+  "workQueued",
+  "workClaimed",
+  "workStatusChanged",
+  "runnerMilestone",
+  "assistantAnswered",
+  "assistantFailed",
+  "impactPreviewQueued",
+  "impactPreviewCompleted",
+  "impactPreviewFailed",
+  "impactPreviewStale",
+  "handoffExported"
+]);
+var activityEventActorSchema = z.enum(["webUser", "runner", "cli", "system"]);
+var activityEventStatusSchema = z.enum(["info", "queued", "running", "completed", "failed", "blocked", "warning"]);
+var activityMetadataValueSchema = z.union([
+  z.string().max(600),
+  z.number(),
+  z.boolean(),
+  z.null(),
+  z.array(z.string().max(200)).max(20)
+]);
+var activityMetadataSchema = z.record(z.string().min(1).max(80), activityMetadataValueSchema).default({});
 var generatedBrainArtifactSchema = z.object({
   documentType: documentTypeSchema,
   title: z.string().trim().min(1),
@@ -102,11 +137,37 @@ var runnerToolCapabilitySchema = z.object({
   execution: z.enum(["sdk", "command", "unavailable"]),
   supportsSessionReuse: z.boolean(),
   resumabilityScope: sessionResumabilityScopeSchema,
-  supportsModelSelection: z.boolean()
+  supportsModelSelection: z.boolean(),
+  supportsBranchIsolation: z.boolean().optional(),
+  supportsGitWorktreeIsolation: z.boolean().optional()
 });
+var workIsolationModeSchema = z.enum(["none", "primaryCheckout", "branch", "gitWorktree"]);
 var repositoryLinkSourceSchema = z.enum(["web", "cli"]);
 var repositoryCloneStatusSchema = z.enum(["notCloned", "cloned", "validated", "failed"]);
 var projectStatusSchema = z.enum(["active", "archived"]);
+var workspaceScopeKindSchema = z.enum(["personal", "organization"]);
+var personalWorkspaceScopeSchema = z.object({
+  kind: z.literal("personal"),
+  accountId: z.string().min(1),
+  userId: z.string().min(1),
+  label: z.string().trim().min(1).default("Personal workspace")
+});
+var organizationWorkspaceScopeSchema = z.object({
+  kind: z.literal("organization"),
+  accountId: z.string().min(1),
+  organizationId: z.string().min(1),
+  organizationSlug: z.string().trim().min(1).optional(),
+  organizationRole: z.string().trim().min(1).optional(),
+  label: z.string().trim().min(1).default("Organization workspace")
+});
+var activeWorkspaceScopeSchema = z.discriminatedUnion("kind", [personalWorkspaceScopeSchema, organizationWorkspaceScopeSchema]);
+var organizationWorkspaceOnboardingStatusSchema = z.enum(["available", "upgradeRequired", "authRequired", "unconfigured"]);
+var organizationWorkspaceOnboardingSchema = z.object({
+  enabled: z.boolean(),
+  canCreate: z.boolean(),
+  status: organizationWorkspaceOnboardingStatusSchema,
+  reason: z.string().trim().min(1).optional()
+});
 var baseItemSchema = z.object({
   id: z.string().min(1),
   type: itemTypeSchema,
@@ -212,15 +273,36 @@ var workItemSchema = baseItemSchema.extend({
   executionMode: executionModeSchema.optional(),
   title: z.string().min(1),
   requestedBy: z.string().min(1),
+  requestedByUserId: z.string().min(1).optional(),
   approvedBy: z.string().min(1).optional(),
+  approvedByUserId: z.string().min(1).optional(),
   sourceWish: z.string().min(1).optional(),
   generatedDraftId: z.string().min(1).optional(),
+  repositoryLinkId: z.string().min(1).optional(),
   reviewThreadId: z.string().min(1).optional(),
   reviewDocumentId: z.string().min(1).optional(),
   reviewDocumentRevision: z.number().int().nonnegative().optional(),
   reviewMessageId: z.string().min(1).optional(),
+  assistantMessageId: z.string().min(1).optional(),
+  assistantQuestionMode: assistantQuestionModeSchema.optional(),
+  impactReportId: z.string().min(1).optional(),
+  impactDocumentId: z.string().min(1).optional(),
+  impactDocumentRevision: z.number().int().nonnegative().optional(),
   claimedByRunnerId: z.string().optional(),
+  pairedByUserId: z.string().min(1).optional(),
+  machineId: z.string().min(1).optional(),
+  claimLeaseId: z.string().min(1).optional(),
+  claimAttempt: z.number().int().nonnegative().optional(),
   leaseExpiresAt: isoDateTimeSchema.optional(),
+  controllingAdrId: z.string().min(1).optional(),
+  implementationScopeId: z.string().min(1).optional(),
+  executionBranch: z.string().min(1).optional(),
+  executionWorktreeKey: z.string().min(1).optional(),
+  isolationMode: workIsolationModeSchema.optional(),
+  repositoryLockId: z.string().min(1).optional(),
+  baseRevision: z.string().min(1).optional(),
+  baseContentHash: z.string().min(1).optional(),
+  blockerReason: z.string().min(1).optional(),
   attempt: z.number().int().nonnegative().default(0),
   idempotencyKey: z.string().min(1),
   sessionPolicy: sessionPolicySchema.optional(),
@@ -237,10 +319,19 @@ var runnerHeartbeatItemSchema = baseItemSchema.extend({
   runnerId: z.string().min(1),
   repositoryLinkId: z.string().min(1),
   status: z.enum(["online", "offline", "running", "blocked", "removed"]),
+  workspaceId: z.string().min(1).optional(),
+  pairedByUserId: z.string().min(1).optional(),
+  machineId: z.string().min(1).optional(),
   version: z.string().optional(),
   mode: z.enum(["foreground", "background"]).optional(),
   hostname: z.string().min(1).optional(),
   runnerName: z.string().min(1).optional(),
+  supportsBranchIsolation: z.boolean().optional(),
+  supportsGitWorktreeIsolation: z.boolean().optional(),
+  currentWorkItemId: z.string().min(1).optional(),
+  currentImplementationScopeId: z.string().min(1).optional(),
+  currentWorktreeKey: z.string().min(1).optional(),
+  currentBranch: z.string().min(1).optional(),
   capabilities: z.array(runnerToolCapabilitySchema).optional(),
   requestedTool: runnerToolSelectionSchema.optional(),
   requestedInvocationChannel: runnerInvocationChannelSchema.optional(),
@@ -269,6 +360,16 @@ var runnerExecutionLogItemSchema = baseItemSchema.extend({
   workTitle: z.string().min(1).optional(),
   initiatedBy: z.string().min(1).optional(),
   approvedBy: z.string().min(1).optional(),
+  repositoryLinkId: z.string().min(1).optional(),
+  pairedByUserId: z.string().min(1).optional(),
+  machineId: z.string().min(1).optional(),
+  controllingAdrId: z.string().min(1).optional(),
+  implementationScopeId: z.string().min(1).optional(),
+  executionBranch: z.string().min(1).optional(),
+  executionWorktreeKey: z.string().min(1).optional(),
+  isolationMode: workIsolationModeSchema.optional(),
+  repositoryLockId: z.string().min(1).optional(),
+  claimLeaseId: z.string().min(1).optional(),
   status: z.enum(["claimed", "running", "completed", "failed", "blocked", "idle"]),
   executionMode: executionModeSchema.optional(),
   tool: z.string().min(1).optional(),
@@ -293,6 +394,8 @@ var runnerCredentialItemSchema = baseItemSchema.extend({
   projectId: z.string().min(1),
   runnerCredentialId: z.string().min(1),
   repositoryLinkId: z.string().min(1),
+  pairedByUserId: z.string().min(1).optional(),
+  machineId: z.string().min(1).optional(),
   tokenHash: z.string().min(32),
   issuedAt: isoDateTimeSchema,
   lastUsedAt: isoDateTimeSchema.optional(),
@@ -339,6 +442,231 @@ var planReviewMessageItemSchema = baseItemSchema.extend({
   createdByUserId: z.string().min(1).optional(),
   runnerId: z.string().min(1).optional()
 });
+var assistantMessageRoleSchema = z.enum(["user", "assistant", "system"]);
+var assistantMessageStatusSchema = z.enum(["posted", "queued", "running", "completed", "failed"]);
+var assistantSourceBoundarySchema = z.enum(["projectBrain", "localSource", "runnerState", "mixed"]);
+var assistantCitationSchema = z.object({
+  source: assistantSourceBoundarySchema,
+  documentId: z.string().min(1).optional(),
+  title: z.string().min(1).optional(),
+  repoPath: z.string().min(1).optional(),
+  documentRevision: z.number().int().nonnegative().optional(),
+  excerpt: z.string().max(600).optional()
+});
+var assistantMessageItemSchema = baseItemSchema.extend({
+  type: z.literal("assistantMessage"),
+  projectId: z.string().min(1),
+  messageId: z.string().min(1),
+  threadId: z.string().min(1),
+  role: assistantMessageRoleSchema,
+  status: assistantMessageStatusSchema,
+  content: z.string().min(1),
+  questionMode: assistantQuestionModeSchema.optional(),
+  sourceBoundary: assistantSourceBoundarySchema.optional(),
+  citations: z.array(assistantCitationSchema).default([]),
+  relatedDocumentIds: z.array(z.string().min(1)).default([]),
+  workItemId: z.string().min(1).optional(),
+  responseToMessageId: z.string().min(1).optional(),
+  createdByUserId: z.string().min(1).optional(),
+  runnerId: z.string().min(1).optional(),
+  repositoryLinkId: z.string().min(1).optional(),
+  repoFingerprint: z.string().min(1).optional(),
+  answeredAt: isoDateTimeSchema.optional(),
+  error: z.string().optional()
+});
+var assistantAnswerResultSchema = z.object({
+  answer: z.string().trim().min(1),
+  sourceBoundary: assistantSourceBoundarySchema.default("localSource"),
+  citations: z.array(assistantCitationSchema).default([]),
+  summary: z.string().optional()
+});
+var knowledgeSearchScopeSchema = z.enum(["project", "organization"]);
+var knowledgeSourceTypeSchema = z.enum(["brainDocument", "generatedArtifact", "runnerSummary", "knowledgeEntity", "knowledgeRelation"]);
+var knowledgeChunkStatusSchema = z.enum(["approved", "synced", "stale"]);
+var knowledgeEntityTypeSchema = z.enum(["project", "system", "component", "domain", "tool", "decision", "feature", "risk", "team", "workflow", "unknown"]);
+var knowledgeRelationTypeSchema = z.enum(["uses", "depends_on", "decides", "supersedes", "touches", "blocks", "implements", "mentions"]);
+var knowledgeIndexFreshnessSchema = z.object({
+  status: z.enum(["disabled", "fresh", "stale", "indexing", "degraded"]),
+  indexedAt: isoDateTimeSchema.optional(),
+  staleReason: z.string().trim().min(1).optional(),
+  failedChunkCount: z.number().int().nonnegative().default(0),
+  indexedChunkCount: z.number().int().nonnegative().default(0)
+});
+var knowledgeSearchChunkSchema = z.object({
+  chunkId: z.string().min(1),
+  accountId: z.string().min(1),
+  projectId: z.string().min(1),
+  sourceType: knowledgeSourceTypeSchema.default("brainDocument"),
+  documentId: z.string().min(1),
+  documentType: documentTypeSchema,
+  title: z.string().min(1),
+  repoPath: z.string().min(1),
+  revision: z.number().int().nonnegative(),
+  sectionHeading: z.string().trim().min(1).optional(),
+  chunkText: z.string().trim().min(1).max(12e3),
+  chunkHash: z.string().min(1),
+  contentHash: z.string().min(1),
+  sourceBoundary: assistantSourceBoundarySchema.default("projectBrain"),
+  status: knowledgeChunkStatusSchema,
+  embeddingModel: z.string().trim().min(1).optional(),
+  embedding: z.array(z.number()).max(8192).optional(),
+  indexedAt: isoDateTimeSchema.optional(),
+  createdAt: isoDateTimeSchema,
+  updatedAt: isoDateTimeSchema
+});
+var knowledgeEntitySchema = z.object({
+  entityId: z.string().min(1),
+  accountId: z.string().min(1),
+  projectIds: z.array(z.string().min(1)).min(1),
+  name: z.string().trim().min(1).max(200),
+  entityType: knowledgeEntityTypeSchema,
+  aliases: z.array(z.string().trim().min(1).max(200)).default([]),
+  description: z.string().trim().min(1).max(1200).optional(),
+  sourceDocumentIds: z.array(z.string().min(1)).default([]),
+  confidence: z.number().min(0).max(1).default(0.6),
+  createdAt: isoDateTimeSchema,
+  updatedAt: isoDateTimeSchema
+});
+var knowledgeRelationEndpointSchema = z.object({
+  entityId: z.string().min(1),
+  name: z.string().trim().min(1).max(200),
+  entityType: knowledgeEntityTypeSchema.default("unknown")
+});
+var knowledgeRelationSchema = z.object({
+  relationId: z.string().min(1),
+  accountId: z.string().min(1),
+  projectIds: z.array(z.string().min(1)).min(1),
+  relationType: knowledgeRelationTypeSchema,
+  from: knowledgeRelationEndpointSchema,
+  to: knowledgeRelationEndpointSchema,
+  summary: z.string().trim().min(1).max(1200),
+  citations: z.array(assistantCitationSchema).default([]),
+  confidence: z.number().min(0).max(1).default(0.6),
+  createdAt: isoDateTimeSchema,
+  updatedAt: isoDateTimeSchema
+});
+var knowledgeSearchRequestSchema = z.object({
+  query: z.string().trim().min(1).max(2e3),
+  scope: knowledgeSearchScopeSchema.default("project"),
+  projectIds: z.array(z.string().min(1)).max(100).optional(),
+  topK: z.number().int().min(1).max(20).default(6),
+  includeRelations: z.boolean().default(true),
+  useSemanticRanking: z.boolean().default(false)
+});
+var knowledgeSearchResultSchema = z.object({
+  chunkId: z.string().min(1),
+  accountId: z.string().min(1),
+  projectId: z.string().min(1),
+  documentId: z.string().min(1),
+  documentType: documentTypeSchema,
+  title: z.string().min(1),
+  repoPath: z.string().min(1),
+  revision: z.number().int().nonnegative(),
+  sectionHeading: z.string().trim().min(1).optional(),
+  excerpt: z.string().trim().min(1).max(1200),
+  sourceBoundary: assistantSourceBoundarySchema.default("projectBrain"),
+  score: z.number().optional(),
+  citation: assistantCitationSchema
+});
+var knowledgeSearchResponseSchema = z.object({
+  query: z.string().trim().min(1),
+  scope: knowledgeSearchScopeSchema,
+  results: z.array(knowledgeSearchResultSchema).default([]),
+  relations: z.array(knowledgeRelationSchema).default([]),
+  freshness: knowledgeIndexFreshnessSchema,
+  degradedReason: z.string().trim().min(1).optional()
+});
+var knowledgeDiagramFormatSchema = z.enum(["mermaid"]);
+var knowledgeDiagramRequestSchema = knowledgeSearchRequestSchema.extend({
+  format: knowledgeDiagramFormatSchema.default("mermaid"),
+  saveAsDocument: z.boolean().default(false),
+  title: z.string().trim().min(1).max(160).optional()
+});
+var knowledgeDiagramResultSchema = z.object({
+  diagramId: z.string().min(1),
+  title: z.string().trim().min(1).max(160),
+  format: knowledgeDiagramFormatSchema,
+  content: z.string().trim().min(1),
+  citations: z.array(assistantCitationSchema).default([]),
+  sourceResultIds: z.array(z.string().min(1)).default([]),
+  documentId: z.string().min(1).optional(),
+  freshness: knowledgeIndexFreshnessSchema,
+  warnings: z.array(z.string().trim().min(1).max(600)).default([])
+});
+var impactAffectedAreaSchema = z.object({
+  name: z.string().trim().min(1),
+  description: z.string().trim().min(1).optional()
+});
+var impactPathSchema = z.object({
+  repoPath: z.string().trim().min(1),
+  reason: z.string().trim().min(1).optional()
+});
+var impactReportItemSchema = baseItemSchema.extend({
+  type: z.literal("impactReport"),
+  projectId: z.string().min(1),
+  impactReportId: z.string().min(1),
+  status: impactReportStatusSchema,
+  riskLevel: impactRiskLevelSchema.optional(),
+  summary: z.string().trim().min(1).optional(),
+  affectedAreas: z.array(impactAffectedAreaSchema).default([]),
+  likelyPaths: z.array(impactPathSchema).default([]),
+  dependencies: z.array(z.string().trim().min(1)).default([]),
+  dataSchemaImpact: z.string().trim().min(1).optional(),
+  securityPrivacyImpact: z.string().trim().min(1).optional(),
+  verificationPlan: z.array(z.string().trim().min(1)).default([]),
+  rollbackPlan: z.string().trim().min(1).optional(),
+  generatedDraftId: z.string().min(1).optional(),
+  sourceWorkItemId: z.string().min(1).optional(),
+  documentId: z.string().min(1).optional(),
+  documentRevision: z.number().int().nonnegative().optional(),
+  repositoryLinkId: z.string().min(1).optional(),
+  repoFingerprint: z.string().min(1).optional(),
+  analyzedRepoRevision: z.number().int().nonnegative().optional(),
+  workItemId: z.string().min(1).optional(),
+  runnerId: z.string().min(1).optional(),
+  createdByUserId: z.string().min(1).optional(),
+  completedAt: isoDateTimeSchema.optional(),
+  staleReason: z.string().optional(),
+  error: z.string().optional()
+});
+var impactPreviewResultSchema = z.object({
+  riskLevel: impactRiskLevelSchema,
+  summary: z.string().trim().min(1),
+  affectedAreas: z.array(impactAffectedAreaSchema).min(1),
+  likelyPaths: z.array(impactPathSchema).default([]),
+  dependencies: z.array(z.string().trim().min(1)).default([]),
+  dataSchemaImpact: z.string().trim().min(1),
+  securityPrivacyImpact: z.string().trim().min(1),
+  verificationPlan: z.array(z.string().trim().min(1)).min(1),
+  rollbackPlan: z.string().trim().min(1),
+  analyzedRepoRevision: z.number().int().nonnegative().optional(),
+  repoFingerprint: z.string().min(1).optional()
+});
+var activityEventItemSchema = baseItemSchema.extend({
+  type: z.literal("activityEvent"),
+  projectId: z.string().min(1),
+  activityEventId: z.string().min(1),
+  eventType: activityEventTypeSchema,
+  actorType: activityEventActorSchema,
+  actorId: z.string().min(1).optional(),
+  status: activityEventStatusSchema,
+  summary: z.string().trim().min(1).max(600),
+  metadata: activityMetadataSchema,
+  idempotencyKey: z.string().min(1),
+  occurredAt: isoDateTimeSchema,
+  relatedWorkItemId: z.string().min(1).optional(),
+  relatedDocumentId: z.string().min(1).optional(),
+  generatedDraftId: z.string().min(1).optional(),
+  runnerId: z.string().min(1).optional(),
+  repositoryLinkId: z.string().min(1).optional(),
+  runnerLogId: z.string().min(1).optional(),
+  commandId: z.string().min(1).optional()
+});
+var activityHandoffExportSchema = z.object({
+  markdown: z.string().min(1),
+  generatedAt: isoDateTimeSchema,
+  eventCount: z.number().int().nonnegative()
+});
 var toolSessionItemSchema = baseItemSchema.extend({
   type: z.literal("toolSession"),
   projectId: z.string().min(1),
@@ -355,6 +683,10 @@ var toolSessionItemSchema = baseItemSchema.extend({
   status: toolSessionStatusSchema,
   createdByUserId: z.string().min(1).optional(),
   runnerId: z.string().min(1).optional(),
+  machineId: z.string().min(1).optional(),
+  implementationScopeId: z.string().min(1).optional(),
+  executionWorktreeKey: z.string().min(1).optional(),
+  isolationMode: workIsolationModeSchema.optional(),
   lastWorkItemId: z.string().min(1).optional(),
   lastActivityAt: isoDateTimeSchema,
   messageCount: z.number().int().nonnegative().optional(),
@@ -387,6 +719,9 @@ var projectItemUnionSchema = z.discriminatedUnion("type", [
   runnerCredentialItemSchema,
   runnerCommandItemSchema,
   planReviewMessageItemSchema,
+  assistantMessageItemSchema,
+  impactReportItemSchema,
+  activityEventItemSchema,
   toolSessionItemSchema
 ]);
 
@@ -412,6 +747,19 @@ function isOfficialAmistioApiUrl(value) {
   }
 }
 
+// ../shared/src/brain-documents.ts
+var controlPlaneRoots = /* @__PURE__ */ new Set(["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"]);
+function isControlPlaneTemplateRepoPath(repoPath) {
+  const normalized = normalizeRepoPath(repoPath);
+  const segments = normalized.split("/").filter(Boolean);
+  const root = segments[0] === "docs" ? segments[1] : segments[0];
+  const basename = segments[segments.length - 1]?.toLowerCase();
+  return Boolean(root && controlPlaneRoots.has(root) && (basename === "_template.md" || basename === "_template.mdx"));
+}
+function normalizeRepoPath(repoPath) {
+  return repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
+}
+
 // ../shared/src/repo-metadata.ts
 import { z as z2 } from "zod";
 var repoLinkMetadataSchema = z2.object({
@@ -504,7 +852,7 @@ function buildParsedRepositoryCloneUrl({ cloneUrl, host, protocol, rawPath }) {
   if (!normalizedHost) {
     throw new Error("Repository URL must include a host.");
   }
-  const pathWithoutSlash = normalizeRepoPath(rawPath);
+  const pathWithoutSlash = normalizeRepoPath2(rawPath);
   const segments = pathWithoutSlash.split("/").filter(Boolean);
   if (segments.length < 2) {
     throw new Error("Repository URL must include an owner and repository name.");
@@ -531,7 +879,7 @@ function buildParsedRepositoryCloneUrl({ cloneUrl, host, protocol, rawPath }) {
     repoFullName
   };
 }
-function normalizeRepoPath(rawPath) {
+function normalizeRepoPath2(rawPath) {
   const withoutLeadingSlash = rawPath.trim().replace(/^\/+/, "").replace(/\/+$/, "");
   if (!withoutLeadingSlash || withoutLeadingSlash.includes("..")) {
     throw new Error("Repository URL path is not supported.");
@@ -886,14 +1234,14 @@ function credentialKey(accountId, projectId, repositoryLinkId) {
 import { mkdir as mkdir3, readFile as readFile2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import path3 from "node:path";
 var controlPlaneFolders = [
-  "architecture",
-  "context",
-  "decisions",
-  "features",
-  "memory",
-  "plans",
-  path3.join("prompts", "shared"),
-  "workflows"
+  path3.join("docs", "architecture"),
+  path3.join("docs", "context"),
+  path3.join("docs", "decisions"),
+  path3.join("docs", "features"),
+  path3.join("docs", "memory"),
+  path3.join("docs", "plans"),
+  path3.join("docs", "prompts", "shared"),
+  path3.join("docs", "workflows")
 ];
 async function initControlPlane(rootDir) {
   const created = [];
@@ -906,10 +1254,10 @@ async function initControlPlane(rootDir) {
   }
   await writeIfMissing(
     path3.join(rootDir, "AGENTS.md"),
-    "# Agents\n\nRoot control-plane folders are the project brain. Keep architecture, context, decisions, features, memory, plans, prompts, and workflows in sync with product intent.\n"
+    "# Agents\n\nThe docs/ control-plane folders are the project brain. Keep docs/architecture, docs/context, docs/decisions, docs/features, docs/memory, docs/plans, docs/prompts, and docs/workflows in sync with product intent.\n"
   );
-  await writeIfMissing(path3.join(rootDir, "context", "product.md"), "# Product Context\n\nDescribe the product direction here.\n");
-  await writeIfMissing(path3.join(rootDir, "architecture", "overview.md"), "# Architecture Overview\n\nDescribe the system shape here.\n");
+  await writeIfMissing(path3.join(rootDir, "docs", "context", "product.md"), "# Product Context\n\nDescribe the product direction here.\n");
+  await writeIfMissing(path3.join(rootDir, "docs", "architecture", "overview.md"), "# Architecture Overview\n\nDescribe the system shape here.\n");
   return created;
 }
 async function inspectControlPlane(rootDir) {
@@ -925,20 +1273,26 @@ async function inspectControlPlane(rootDir) {
   return { present, missing };
 }
 async function writeProjectLink(rootDir, metadata) {
-  const contextDir = path3.join(rootDir, "context");
+  const contextDir = path3.join(rootDir, "docs", "context");
   await mkdir3(contextDir, { recursive: true });
   const filePath = path3.join(contextDir, "amistio-project.md");
   await writeFile2(filePath, createProjectLinkMarkdown(metadata), "utf8");
   return filePath;
 }
 async function readProjectLink(rootDir) {
-  const filePath = path3.join(rootDir, "context", "amistio-project.md");
-  if (!await exists(filePath)) {
-    return void 0;
+  const candidatePaths = [
+    path3.join(rootDir, "docs", "context", "amistio-project.md"),
+    path3.join(rootDir, "context", "amistio-project.md")
+  ];
+  for (const filePath of candidatePaths) {
+    if (!await exists(filePath)) {
+      continue;
+    }
+    const content = await readFile2(filePath, "utf8");
+    const frontmatter = parseFrontmatter(content);
+    return repoLinkMetadataSchema.parse(frontmatter);
   }
-  const content = await readFile2(filePath, "utf8");
-  const frontmatter = parseFrontmatter(content);
-  return repoLinkMetadataSchema.parse(frontmatter);
+  return void 0;
 }
 function parseFrontmatter(content) {
   if (!content.startsWith("---\n")) {
@@ -1017,13 +1371,13 @@ var ApiClient = class {
       }
     );
   }
-  async claimWork(projectId, runnerId, repositoryLinkId, leaseSeconds = 300) {
+  async claimWork(projectId, runnerId, repositoryLinkId, leaseSeconds = 300, metadata = {}) {
     return this.request(
       `/projects/${projectId}/work-items/claim`,
       z3.object({ workItem: workItemSchema.optional() }).transform(({ workItem }) => ({ workItem })),
       {
         method: "POST",
-        body: JSON.stringify({ runnerId, repositoryLinkId, leaseSeconds })
+        body: JSON.stringify({ runnerId, repositoryLinkId, leaseSeconds, ...metadata })
       }
     );
   }
@@ -1049,6 +1403,21 @@ var ApiClient = class {
       { method: "GET" }
     );
   }
+  async listAssistantMessages(projectId) {
+    return this.request(
+      `/projects/${projectId}/assistant-messages`,
+      z3.object({ messages: z3.array(assistantMessageItemSchema) }),
+      { method: "GET" }
+    );
+  }
+  async listImpactReports(projectId, generatedDraftId) {
+    const query = generatedDraftId ? `?generatedDraftId=${encodeURIComponent(generatedDraftId)}` : "";
+    return this.request(
+      `/projects/${projectId}/impact-reports${query}`,
+      z3.object({ reports: z3.array(impactReportItemSchema) }),
+      { method: "GET" }
+    );
+  }
   async pushBrainDocuments(projectId, documents) {
     return this.request(
       `/projects/${projectId}/brain-documents`,
@@ -1115,6 +1484,16 @@ var ApiClient = class {
       }
     );
   }
+  async recordRunnerLog(projectId, input) {
+    return this.request(
+      `/projects/${projectId}/runner-logs`,
+      z3.object({ runnerLog: runnerExecutionLogItemSchema }),
+      {
+        method: "POST",
+        body: JSON.stringify(input)
+      }
+    );
+  }
   async listToolSessions(projectId) {
     return this.request(
       `/projects/${projectId}/tool-sessions`,
@@ -1142,6 +1521,16 @@ var ApiClient = class {
       }
     );
   }
+  async recordActivityEvent(projectId, event) {
+    return this.request(
+      `/projects/${projectId}/activity-events`,
+      z3.object({ event: activityEventItemSchema }),
+      {
+        method: "POST",
+        body: JSON.stringify(event)
+      }
+    );
+  }
   async updateWorkStatus(projectId, workItemId, status, idempotencyKey, runnerId, telemetry = {}) {
     return this.request(
       `/projects/${projectId}/work-items/${workItemId}/status`,
@@ -1162,6 +1551,26 @@ var ApiClient = class {
       }
     );
   }
+  async submitAssistantResult(projectId, workItemId, result) {
+    return this.request(
+      `/projects/${projectId}/work-items/${workItemId}/assistant-result`,
+      z3.object({ message: assistantMessageItemSchema, answer: assistantMessageItemSchema.optional(), workItem: workItemSchema }),
+      {
+        method: "POST",
+        body: JSON.stringify(result)
+      }
+    );
+  }
+  async submitImpactPreviewResult(projectId, workItemId, result) {
+    return this.request(
+      `/projects/${projectId}/work-items/${workItemId}/impact-result`,
+      z3.object({ report: impactReportItemSchema, workItem: workItemSchema, implementationWorkItem: workItemSchema.optional() }),
+      {
+        method: "POST",
+        body: JSON.stringify(result)
+      }
+    );
+  }
   async request(urlPath, schema, init) {
     const response = await fetch(resolveApiUrl(this.options.apiUrl, urlPath), {
       ...init,
@@ -1200,12 +1609,16 @@ var toolSessionMutationSchema = z3.object({
   sessionGroupKey: z3.string().min(1).optional(),
   reusePolicy: sessionPolicySchema.optional(),
   sessionDecision: sessionDecisionSchema.optional(),
-  closedReason: z3.string().optional()
+  closedReason: z3.string().optional(),
+  machineId: z3.string().min(1).optional(),
+  implementationScopeId: z3.string().min(1).optional(),
+  executionWorktreeKey: z3.string().min(1).optional(),
+  isolationMode: workIsolationModeSchema.optional()
 });
 function resolveApiUrl(apiUrl, urlPath) {
   const base = apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl;
-  const path12 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
-  return new URL(`${base}${path12}`);
+  const path13 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
+  return new URL(`${base}${path13}`);
 }
 
 // src/orchestrator.ts
@@ -1225,12 +1638,12 @@ async function createOrchestrationPrompt(options) {
     "",
     "## Orchestrator Principle",
     "",
-    "The root control-plane files are the project brain. They exist so agentic coding sessions can continue from established context, decisions, memory, plans, workflows, and prompts instead of drifting into a fresh interpretation each time.",
+    "The docs/ control-plane files are the project brain. They exist so agentic coding sessions can continue from established context, decisions, memory, plans, workflows, and prompts instead of drifting into a fresh interpretation each time.",
     "",
     "## Repository Rules",
     "",
     "- Read AGENTS.md first when it exists.",
-    "- Read existing architecture, context, decisions, features, memory, plans, prompts, and workflows before proposing changes.",
+    "- Read existing docs/architecture, docs/context, docs/decisions, docs/features, docs/memory, docs/plans, docs/prompts, and docs/workflows files before proposing changes.",
     "- Preserve existing intent. Add the next useful orchestration layer instead of replacing old content wholesale.",
     "- Prefer small additive edits, dated notes, explicit decisions, focused plans, and executable prompts.",
     "- Do not modify product source code unless the user's goal explicitly asks for implementation.",
@@ -1241,14 +1654,14 @@ async function createOrchestrationPrompt(options) {
     "## Control-Plane Areas",
     "",
     "- AGENTS.md for agent operating rules.",
-    "- architecture/**/*.md for system shape and boundaries.",
-    "- context/**/*.md for product, stack, and implementation context.",
-    "- decisions/**/*.md for ADRs and durable choices.",
-    "- features/**/*.md for behavior specs and acceptance criteria.",
-    "- memory/**/*.md for lessons, patterns, and known pitfalls.",
-    "- plans/**/*.md for near-term execution plans.",
-    "- prompts/**/*.md for model-agnostic implementation prompts.",
-    "- workflows/**/*.md for repeatable procedures.",
+    "- docs/architecture/**/*.md for system shape and boundaries.",
+    "- docs/context/**/*.md for product, stack, and implementation context.",
+    "- docs/decisions/**/*.md for ADRs and durable choices.",
+    "- docs/features/**/*.md for behavior specs and acceptance criteria.",
+    "- docs/memory/**/*.md for lessons, patterns, and known pitfalls.",
+    "- docs/plans/**/*.md for near-term execution plans.",
+    "- docs/prompts/**/*.md for model-agnostic implementation prompts.",
+    "- docs/workflows/**/*.md for repeatable procedures.",
     "",
     "## Current Control-Plane Folder Status",
     "",
@@ -2020,9 +2433,22 @@ function sessionIneligibleReason(session, input, now) {
   if (session.repositoryLinkId && session.repositoryLinkId !== input.repositoryLinkId) {
     return "repository link mismatch";
   }
+  if (session.machineId && session.machineId !== input.machineId) {
+    return "session is scoped to another machine";
+  }
   if (session.resumabilityScope === "localMachine" && session.runnerId && session.runnerId !== input.runnerId) {
     return "session is scoped to another runner machine";
   }
+  const requestedByUserId = input.workItem.requestedByUserId ?? input.workItem.requestedBy;
+  if (session.createdByUserId && session.createdByUserId !== requestedByUserId) {
+    return "session belongs to another requester";
+  }
+  if (input.workItem.implementationScopeId && session.implementationScopeId !== input.workItem.implementationScopeId) {
+    return "implementation scope mismatch";
+  }
+  if (input.workItem.executionWorktreeKey && session.executionWorktreeKey !== input.workItem.executionWorktreeKey) {
+    return "worktree scope mismatch";
+  }
   if (session.status === "closed" || session.status === "archived" || session.status === "blocked" || session.status === "unavailable") {
     return `session is ${session.status}`;
   }
@@ -2074,11 +2500,13 @@ function tokens(value) {
 // src/sync.ts
 import { mkdir as mkdir6, readdir as readdir3, readFile as readFile4, stat as stat3, writeFile as writeFile6 } from "node:fs/promises";
 import path7 from "node:path";
-var syncRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
+var legacySyncRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
+var syncRoots = legacySyncRoots.map((syncRoot) => `docs/${syncRoot}`);
 async function collectSyncStatus(rootDir, webDocuments = []) {
   const localDocuments = await readLocalSyncedDocuments(rootDir);
-  const webByDocumentId = new Map(webDocuments.map((document) => [document.documentId, document]));
-  const pullableWebDocuments = webDocuments.filter((document) => document.status === "approved" || document.syncState === "approved" || document.syncState === "synced");
+  const normalizedWebDocuments = webDocuments.map((document) => ({ ...document, repoPath: canonicalControlPlaneRepoPath(document.repoPath) }));
+  const webByDocumentId = new Map(normalizedWebDocuments.map((document) => [document.documentId, document]));
+  const pullableWebDocuments = normalizedWebDocuments.filter((document) => !isControlPlaneTemplateRepoPath(document.repoPath) && (document.status === "approved" || document.syncState === "approved" || document.syncState === "synced"));
   const localByDocumentId = new Map(localDocuments.map((document) => [document.frontmatter.amistioDocumentId, document]));
   const items = [];
   for (const localDocument of localDocuments) {
@@ -2155,9 +2583,13 @@ async function readLocalSyncedDocuments(rootDir) {
     if (!parsed) {
       continue;
     }
+    const repoPath = toRepoPath(rootDir, fullPath);
+    if (isControlPlaneTemplateRepoPath(repoPath)) {
+      continue;
+    }
     documents.push({
       fullPath,
-      repoPath: toRepoPath(rootDir, fullPath),
+      repoPath,
       frontmatter: parsed.frontmatter,
       content: parsed.content,
       contentHash: sha256ContentHash(parsed.content)
@@ -2168,10 +2600,15 @@ async function readLocalSyncedDocuments(rootDir) {
 async function materializeBrainDocuments(rootDir, documents, options = {}) {
   const result = { written: [], skipped: [], conflicts: [] };
   for (const inputDocument of documents) {
-    const document = brainDocumentItemSchema.parse(inputDocument);
+    const parsedDocument = brainDocumentItemSchema.parse(inputDocument);
+    const document = { ...parsedDocument, repoPath: canonicalControlPlaneRepoPath(parsedDocument.repoPath) };
     const fullPath = safeRepoPath(rootDir, document.repoPath);
+    if (isControlPlaneTemplateRepoPath(document.repoPath)) {
+      result.skipped.push(document.repoPath);
+      continue;
+    }
     if (!isControlPlanePath(document.repoPath)) {
-      result.conflicts.push(`${document.repoPath}: refusing to write outside root control-plane folders`);
+      result.conflicts.push(`${document.repoPath}: refusing to write outside docs control-plane folders`);
       continue;
     }
     const existing = await readExistingSyncedDocument(fullPath);
@@ -2315,6 +2752,14 @@ function isControlPlanePath(repoPath) {
   const normalized = path7.normalize(repoPath);
   return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path7.sep}`));
 }
+function canonicalControlPlaneRepoPath(repoPath) {
+  const normalized = repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
+  const [firstSegment] = normalized.split("/");
+  if (firstSegment && legacySyncRoots.includes(firstSegment)) {
+    return `docs/${normalized}`;
+  }
+  return normalized;
+}
 function toRepoPath(rootDir, fullPath) {
   return path7.relative(rootDir, fullPath).split(path7.sep).join("/");
 }
@@ -2381,6 +2826,10 @@ function defaultSessionStorePath() {
 // src/work-runner.ts
 var generationResultStart = "AMISTIO_BRAIN_GENERATION_RESULT_START";
 var generationResultEnd = "AMISTIO_BRAIN_GENERATION_RESULT_END";
+var assistantAnswerStart = "AMISTIO_ASSISTANT_ANSWER_START";
+var assistantAnswerEnd = "AMISTIO_ASSISTANT_ANSWER_END";
+var impactPreviewStart = "AMISTIO_IMPACT_PREVIEW_START";
+var impactPreviewEnd = "AMISTIO_IMPACT_PREVIEW_END";
 function createWorkExecutionPrompt(workItem, context) {
   if (workItem.workKind === "brainGeneration") {
     return createBrainGenerationPrompt(workItem);
@@ -2388,6 +2837,12 @@ function createWorkExecutionPrompt(workItem, context) {
   if (workItem.workKind === "planRevision") {
     return createPlanRevisionPrompt(workItem, context?.planRevision);
   }
+  if (workItem.workKind === "assistantQuestion") {
+    return createAssistantQuestionPrompt(workItem, context?.assistantQuestion);
+  }
+  if (workItem.workKind === "impactPreview") {
+    return createImpactPreviewPrompt(workItem, context?.impactPreview);
+  }
   return [
     "# Amistio Work Execution",
     "",
@@ -2399,11 +2854,15 @@ function createWorkExecutionPrompt(workItem, context) {
     `Title: ${workItem.title}`,
     `Work item ID: ${workItem.workItemId}`,
     `Project ID: ${workItem.projectId}`,
+    `Implementation scope: ${workItem.implementationScopeId ?? workItem.controllingAdrId ?? "work-item"}`,
+    `Execution branch: ${workItem.executionBranch ?? "managed by Amistio CLI"}`,
+    `Execution worktree key: ${workItem.executionWorktreeKey ?? "managed by Amistio CLI"}`,
     "",
     "## Rules",
     "",
     "- Read AGENTS.md first when it exists.",
-    "- Read the relevant root control-plane files before implementation so the work stays aligned with existing direction.",
+    "- Read AGENTS.md and the relevant docs/ control-plane files before implementation so the work stays aligned with existing direction.",
+    "- Treat the current working directory as the Amistio-managed implementation worktree; do not switch back to the paired primary checkout for mutating work.",
     "- Keep changes focused on this work item.",
     "- Preserve old decisions, plans, memory, and prompts unless the work item explicitly supersedes them.",
     "- Do not commit changes.",
@@ -2412,6 +2871,116 @@ function createWorkExecutionPrompt(workItem, context) {
     "- Run relevant verification commands when feasible and summarize results."
   ].join("\n");
 }
+function createImpactPreviewPrompt(workItem, context) {
+  const implementationPrompt = context?.implementationPrompt;
+  const approvedContext = (context?.documents ?? []).filter((document) => document.status === "approved" || document.syncState === "approved" || document.syncState === "synced").slice(0, 16).map((document) => [
+    `### ${document.title}`,
+    `documentId: ${document.documentId}`,
+    `documentType: ${document.documentType}`,
+    `repoPath: ${document.repoPath}`,
+    `revision: ${document.revision}`,
+    document.content.slice(0, 3e3)
+  ].join("\n")).join("\n\n");
+  return [
+    "# Amistio Implementation Impact Preview",
+    "",
+    "You are running locally through the Amistio CLI inside the user's repository.",
+    "Analyze the likely impact of the approved implementation prompt. This is a preview-only task.",
+    "Do not modify files, do not create branches, do not run implementation commands, and do not commit changes.",
+    "",
+    "## Work Item",
+    "",
+    `Title: ${workItem.title}`,
+    `Work item ID: ${workItem.workItemId}`,
+    `Project ID: ${workItem.projectId}`,
+    `Generated draft ID: ${workItem.generatedDraftId ?? "unknown"}`,
+    `Impact report ID: ${workItem.impactReportId ?? "unknown"}`,
+    `Analyzed repo revision: ${context?.analyzedRepoRevision ?? "unknown"}`,
+    "",
+    "## Approved Implementation Prompt",
+    "",
+    implementationPrompt ? implementationPrompt.content : workItem.sourceWish ?? workItem.title,
+    "",
+    "## Approved Project Brain Context",
+    "",
+    approvedContext || "No approved project-brain records were loaded. Inspect the local repository and explain the gap in the report.",
+    "",
+    "## Report Requirements",
+    "",
+    "- Identify affected product areas and likely modules/files using safe path summaries.",
+    "- Assign riskLevel as low, medium, high, or critical with operational reasoning in summary.",
+    "- Include data/schema/migration impact, security/privacy/access-control considerations, verification plan, and rollback plan.",
+    "- Keep repository source and secrets local. Do not include raw source dumps, credentials, local secret paths, or provider session references.",
+    "- If you inspect files, cite paths only through likelyPaths and concise reasons.",
+    "",
+    "## Output Contract",
+    "",
+    "Print exactly one JSON object between the markers below. The CLI will submit only this structured report back to Amistio.",
+    "",
+    impactPreviewStart,
+    '{"riskLevel":"medium","summary":"Touches the workspace command flow and runner claim gate.","affectedAreas":[{"name":"Workspace UI","description":"Shows impact before execution"}],"likelyPaths":[{"repoPath":"src/apps/web/components/workspace-client.tsx","reason":"Workspace action wiring"}],"dependencies":["local runner"],"dataSchemaImpact":"Adds an impact report project item.","securityPrivacyImpact":"Source remains local; SaaS stores summaries and paths only.","verificationPlan":["Run shared, web, and CLI tests","Run root verify"],"rollbackPlan":"Disable the impact gate and remove queued preview work if needed."}',
+    impactPreviewEnd,
+    "",
+    "Do not put Markdown fences around the markers. Do not implement the work."
+  ].join("\n");
+}
+function createAssistantQuestionPrompt(workItem, context) {
+  const question = context?.question.content ?? workItem.sourceWish ?? workItem.title;
+  const priorMessages = (context?.messages ?? []).filter((message) => message.messageId !== context?.question.messageId).slice(-12).map((message) => `- ${message.role} / ${message.status}: ${message.content}`).join("\n");
+  const brainContext = (context?.documents ?? []).filter((document) => document.status === "approved" || document.syncState === "approved" || document.syncState === "synced").slice(0, 12).map((document) => [
+    `### ${document.title}`,
+    `documentId: ${document.documentId}`,
+    `repoPath: ${document.repoPath}`,
+    `revision: ${document.revision}`,
+    document.content.slice(0, 2400)
+  ].join("\n")).join("\n\n");
+  return [
+    "# Amistio Project Knowledge Assistant",
+    "",
+    "You are running locally through the Amistio CLI inside the user's repository.",
+    "Answer the user's project question using approved project-brain context and local repository inspection when useful.",
+    "This is an answer-only task. Do not modify files, do not create branches, and do not commit changes.",
+    "",
+    "## User Question",
+    "",
+    question,
+    "",
+    "## Work Item",
+    "",
+    `Title: ${workItem.title}`,
+    `Work item ID: ${workItem.workItemId}`,
+    `Project ID: ${workItem.projectId}`,
+    `Assistant message ID: ${workItem.assistantMessageId ?? context?.question.messageId ?? "unknown"}`,
+    "",
+    "## Approved Project Brain Context",
+    "",
+    brainContext || "No approved project-brain records were loaded. Say what you inspected locally and avoid pretending citations exist.",
+    "",
+    "## Recent Assistant Conversation",
+    "",
+    priorMessages || "No prior assistant messages were loaded.",
+    "",
+    "## Source Boundary Rules",
+    "",
+    "- Keep repository source, secrets, tokens, local credential paths, and provider session references local.",
+    "- Summarize findings instead of dumping source code. Tiny identifiers, filenames, and short excerpts are acceptable when necessary.",
+    '- Use sourceBoundary "projectBrain" when the answer only uses project-brain records.',
+    '- Use sourceBoundary "localSource" when you inspected local repository files.',
+    '- Use sourceBoundary "mixed" when both project-brain records and local files shaped the answer.',
+    "- Include citations for project-brain records with documentId/title/repoPath where relevant.",
+    "- Include local file citations with repoPath only; do not include raw source dumps.",
+    "",
+    "## Output Contract",
+    "",
+    "Print exactly one JSON object between the markers below. The CLI will submit only this structured answer back to Amistio.",
+    "",
+    assistantAnswerStart,
+    '{"answer":"Concise answer with concrete next steps.","sourceBoundary":"mixed","citations":[{"source":"projectBrain","documentId":"doc_123","title":"ADR-001","repoPath":"docs/decisions/ADR-001.md","excerpt":"Short supporting excerpt"},{"source":"localSource","repoPath":"src/apps/web/example.ts","excerpt":"Short local finding"}]}',
+    assistantAnswerEnd,
+    "",
+    "Do not put Markdown fences around the markers. Do not include implementation diffs."
+  ].join("\n");
+}
 function createPlanRevisionPrompt(workItem, context) {
   const messages = context?.messages ?? [];
   return [
@@ -2439,10 +3008,10 @@ function createPlanRevisionPrompt(workItem, context) {
     "## Output Contract",
     "",
     "Print exactly one JSON object between the markers below with an artifacts array containing one revised plan artifact.",
-    'The artifact must use documentType "plan", keep the plan under plans/, and include the complete revised plan content.',
+    'The artifact must use documentType "plan", keep the plan under docs/plans/, and include the complete revised plan content.',
     "",
     generationResultStart,
-    '{"artifacts":[{"documentType":"plan","title":"Revised Plan","repoPath":"plans/PLAN-revised.md","content":"# Revised Plan\\n\\n## Goal\\n..."}]}',
+    '{"artifacts":[{"documentType":"plan","title":"Revised Plan","repoPath":"docs/plans/PLAN-revised.md","content":"# Revised Plan\\n\\n## Goal\\n..."}]}',
     generationResultEnd,
     "",
     "Do not put Markdown fences around the markers. Do not claim implementation is complete."
@@ -2458,6 +3027,26 @@ function parseBrainGenerationArtifacts(output) {
   const parsed = JSON.parse(stripJsonFence(payload));
   return brainGenerationResultSchema.parse(parsed).artifacts;
 }
+function parseAssistantAnswerResult(output) {
+  const start = output.indexOf(assistantAnswerStart);
+  const end = output.indexOf(assistantAnswerEnd, start + assistantAnswerStart.length);
+  if (start === -1 || end === -1 || end <= start) {
+    throw new Error("Local AI answer did not return an Amistio assistant answer block.");
+  }
+  const payload = output.slice(start + assistantAnswerStart.length, end).trim();
+  const parsed = JSON.parse(stripJsonFence(payload));
+  return assistantAnswerResultSchema.parse(parsed);
+}
+function parseImpactPreviewResult(output) {
+  const start = output.indexOf(impactPreviewStart);
+  const end = output.indexOf(impactPreviewEnd, start + impactPreviewStart.length);
+  if (start === -1 || end === -1 || end <= start) {
+    throw new Error("Local AI preview did not return an Amistio impact preview block.");
+  }
+  const payload = output.slice(start + impactPreviewStart.length, end).trim();
+  const parsed = JSON.parse(stripJsonFence(payload));
+  return impactPreviewResultSchema.parse(parsed);
+}
 function createBrainGenerationPrompt(workItem) {
   const wish = workItem.sourceWish ?? workItem.title;
   return [
@@ -2480,21 +3069,21 @@ function createBrainGenerationPrompt(workItem) {
     "## Read First",
     "",
     "- Read AGENTS.md first when it exists.",
-    "- Read relevant files under architecture/, context/, decisions/, features/, memory/, plans/, prompts/, and workflows/ before drafting.",
+    "- Read relevant files under docs/architecture/, docs/context/, docs/decisions/, docs/features/, docs/memory/, docs/plans/, docs/prompts/, and docs/workflows/ before drafting.",
     "- Keep source code and secrets local. Do not include source-code payloads, access tokens, API keys, local credential paths, or provider session references in the result.",
     "",
     "## Generate Artifacts",
     "",
     "Return Markdown artifacts that should enter human review before implementation. Use only these document types and matching repo roots:",
     "",
-    "- architecture -> architecture/",
-    "- context -> context/",
-    "- decision -> decisions/",
-    "- feature -> features/",
-    "- memory -> memory/",
-    "- plan -> plans/",
-    "- prompt -> prompts/",
-    "- workflow -> workflows/",
+    "- architecture -> docs/architecture/",
+    "- context -> docs/context/",
+    "- decision -> docs/decisions/",
+    "- feature -> docs/features/",
+    "- memory -> docs/memory/",
+    "- plan -> docs/plans/",
+    "- prompt -> docs/prompts/",
+    "- workflow -> docs/workflows/",
     "",
     "Each artifact needs documentType, title, repoPath, and content. Include at least a plan and an implementation prompt when implementation work is implied. Use model-agnostic prompt wording.",
     "",
@@ -2503,7 +3092,7 @@ function createBrainGenerationPrompt(workItem) {
     "Print exactly one JSON object between the markers below. The CLI will submit only this structured result back to Amistio.",
     "",
     generationResultStart,
-    '{"artifacts":[{"documentType":"plan","title":"Plan: Example","repoPath":"plans/PLAN-example.md","content":"# Plan: Example\\n\\n## Goal\\n..."}]}',
+    '{"artifacts":[{"documentType":"plan","title":"Plan: Example","repoPath":"docs/plans/PLAN-example.md","content":"# Plan: Example\\n\\n## Goal\\n..."}]}',
     generationResultEnd,
     "",
     "Do not put Markdown fences around the markers. Do not claim implementation is complete."
@@ -2518,6 +3107,7 @@ function stripJsonFence(value) {
 }
 
 // src/runner-status.ts
+import { createHash as createHash3 } from "node:crypto";
 var watchStateReminderMs = 60 * 1e3;
 function formatWatchStartupContext(input) {
   return [
@@ -2537,28 +3127,32 @@ function shouldPrintWatchState(action, previous, nowMs, reminderMs = watchStateR
 function watchStateKey(action) {
   return [action.kind, action.message, action.workItemId, action.documentId, action.runnerId].filter(Boolean).join(":");
 }
+function stableRunnerId(input) {
+  const digest = createHash3("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
+  return `runner_${digest}`;
+}
 
 // src/importer.ts
 import { execFile as execFile2 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readdir as readdir4, readFile as readFile6, stat as stat4 } from "node:fs/promises";
 import path9 from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFileAsync2 = promisify2(execFile2);
 var defaultMaxFileKb = 256;
-var controlPlaneRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
+var controlPlaneRoots2 = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
 var excludedDirectoryNames = /* @__PURE__ */ new Set([".git", "node_modules", ".pnpm-store", ".next", "dist", "build", "coverage", ".cache", "cache", "tmp", "temp", "vendor"]);
-var excludedFileNames = /* @__PURE__ */ new Set(["context/amistio-project.md"]);
+var excludedFileNames = /* @__PURE__ */ new Set(["docs/context/amistio-project.md", "context/amistio-project.md"]);
 var generatedPathSegments = /* @__PURE__ */ new Set(["generated", "__generated__", "vendor", "vendors"]);
 var documentFolderByType = {
-  architecture: "architecture",
-  context: "context",
-  decision: "decisions",
-  feature: "features",
-  memory: "memory",
-  plan: "plans",
-  prompt: "prompts/shared",
-  workflow: "workflows"
+  architecture: "docs/architecture",
+  context: "docs/context",
+  decision: "docs/decisions",
+  feature: "docs/features",
+  memory: "docs/memory",
+  plan: "docs/plans",
+  prompt: "docs/prompts/shared",
+  workflow: "docs/workflows"
 };
 async function inspectLocalRepository(rootDir, defaultBranch) {
   const requestedRoot = path9.resolve(rootDir);
@@ -2645,7 +3239,7 @@ function buildImportedBrainDocuments(options) {
       documentId,
       documentType: candidate.documentType,
       title: candidate.title,
-      status: "reviewing",
+      status: "approved",
       repoPath: candidate.repoPath,
       content: candidate.content,
       contentHash: candidate.contentHash,
@@ -2658,10 +3252,10 @@ function buildImportedBrainDocuments(options) {
       },
       revision,
       source: "repo",
-      syncState: "dirtyInRepo",
+      syncState: "approved",
       createdAt: existing?.createdAt ?? importedAt,
       updatedAt: importedAt,
-      ...existing?.approvedRevision !== void 0 ? { approvedRevision: existing.approvedRevision } : {}
+      approvedRevision: revision
     };
   });
 }
@@ -2688,7 +3282,7 @@ function parseOptionalOriginCloneUrl(originUrl) {
 async function listRepositoryPaths(rootDir) {
   const gitFiles = await runGit2(["-C", rootDir, "ls-files", "--cached", "--others", "--exclude-standard"]).catch(() => void 0);
   if (gitFiles !== void 0) {
-    return gitFiles.split("\n").map((line) => normalizeRepoPath2(line)).filter((line) => line.length > 0);
+    return gitFiles.split("\n").map((line) => normalizeRepoPath3(line)).filter((line) => line.length > 0);
   }
   const files = [];
   await walkRepository(rootDir, rootDir, files);
@@ -2698,7 +3292,7 @@ async function walkRepository(rootDir, directory, files) {
   const entries = await readdir4(directory, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     const fullPath = path9.join(directory, entry.name);
-    const repoPath = normalizeRepoPath2(path9.relative(rootDir, fullPath));
+    const repoPath = normalizeRepoPath3(path9.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!excludedDirectoryNames.has(entry.name)) {
         await walkRepository(rootDir, fullPath, files);
@@ -2718,7 +3312,7 @@ function matchesIncludeExclude(repoPath, include, exclude) {
   return true;
 }
 function wildcardMatch(pattern, repoPath) {
-  const normalizedPattern = normalizeRepoPath2(pattern);
+  const normalizedPattern = normalizeRepoPath3(pattern);
   const escaped = normalizedPattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "::DOUBLE_STAR_SLASH::").replace(/\*\*/g, "::DOUBLE_STAR::").replace(/\?/g, "[^/]").replace(/\*/g, "[^/]*").replace(/::DOUBLE_STAR_SLASH::/g, "(?:.*/)?").replace(/::DOUBLE_STAR::/g, ".*");
   return new RegExp(`^${escaped}$`).test(repoPath);
 }
@@ -2726,6 +3320,7 @@ function isMarkdownDocument(repoPath) {
   return /\.(md|mdx)$/i.test(repoPath);
 }
 function isExcludedRepoPath(repoPath) {
+  if (isControlPlaneTemplateRepoPath(repoPath)) return true;
   if (excludedFileNames.has(repoPath)) return true;
   const segments = repoPath.split("/");
   if (segments.some((segment) => excludedDirectoryNames.has(segment) || generatedPathSegments.has(segment))) return true;
@@ -2748,9 +3343,12 @@ function classifyLegacyDocument(repoPath, content) {
   return "context";
 }
 function canonicalImportPath(sourcePath, documentType) {
-  if (isControlPlanePath2(sourcePath)) {
+  if (isCanonicalControlPlanePath(sourcePath)) {
     return sourcePath;
   }
+  if (isLegacyControlPlanePath(sourcePath)) {
+    return `docs/${sourcePath}`;
+  }
   const baseSlug = slugFromPath(sourcePath);
   return `${documentFolderByType[documentType]}/imported/${baseSlug}.md`;
 }
@@ -2766,9 +3364,13 @@ function uniqueDestinationPath(basePath, sourcePath, usedPaths) {
   usedPaths.add(uniquePath);
   return uniquePath;
 }
-function isControlPlanePath2(repoPath) {
+function isCanonicalControlPlanePath(repoPath) {
+  const [firstSegment, secondSegment] = normalizeRepoPath3(repoPath).split("/");
+  return firstSegment === "docs" && Boolean(secondSegment && controlPlaneRoots2.includes(secondSegment));
+}
+function isLegacyControlPlanePath(repoPath) {
   const [firstSegment] = repoPath.split("/");
-  return Boolean(firstSegment && controlPlaneRoots.includes(firstSegment));
+  return Boolean(firstSegment && controlPlaneRoots2.includes(firstSegment));
 }
 function inferTitle2(content, repoPath) {
   const body = stripFrontmatter(content);
@@ -2796,9 +3398,9 @@ function stableImportDocumentId(accountId, projectId, repositoryLinkId, sourcePa
   return `doc_import_${hashText(`${accountId}\0${projectId}\0${repositoryLinkId}\0${sourcePath}`, 24)}`;
 }
 function hashText(value, length) {
-  return createHash3("sha256").update(value).digest("hex").slice(0, length);
+  return createHash4("sha256").update(value).digest("hex").slice(0, length);
 }
-function normalizeRepoPath2(value) {
+function normalizeRepoPath3(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
 }
 async function runGit2(args) {
@@ -2842,6 +3444,9 @@ function buildBackgroundRunnerArgs(options) {
   if (!options.stream) {
     args.push("--no-stream");
   }
+  if (options.verbose) {
+    args.push("--verbose");
+  }
   return args;
 }
 async function runOfficialCliUpdate() {
@@ -2880,12 +3485,110 @@ function truncateProcessOutput(value) {
   return trimmed.length > 1200 ? `${trimmed.slice(0, 1200)}...` : trimmed;
 }
 
+// src/git-worktree.ts
+import { execFile as execFile3 } from "node:child_process";
+import { mkdir as mkdir8, stat as stat5 } from "node:fs/promises";
+import path11 from "node:path";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
+function needsGitWorktreeIsolation(workItem) {
+  return (workItem.workKind ?? "implementation") === "implementation";
+}
+function resolveWorktreeIdentity(workItem) {
+  const implementationScopeId = workItem.controllingAdrId ?? workItem.implementationScopeId ?? workItem.impactDocumentId ?? workItem.reviewDocumentId ?? workItem.generatedDraftId ?? workItem.workItemId;
+  const slug = workIsolationSlug(implementationScopeId, workItem.title);
+  return {
+    implementationScopeId,
+    branch: workItem.executionBranch ?? `amistio/work/${slug}`,
+    worktreeKey: workItem.executionWorktreeKey ?? `amistio/worktrees/${slug}`,
+    ...workItem.repositoryLockId ? { repositoryLockId: workItem.repositoryLockId } : {}
+  };
+}
+async function prepareGitWorktreeIsolation(rootDir, workItem) {
+  const identity = resolveWorktreeIdentity(workItem);
+  const repoRoot = await gitOutput(rootDir, ["rev-parse", "--show-toplevel"]).catch((error) => {
+    throw new Error(`Git worktree isolation requires a paired Git checkout: ${errorMessage2(error)}`);
+  });
+  const currentHead = await gitOutput(repoRoot, ["rev-parse", "HEAD"]);
+  await assertBaseRevision(repoRoot, workItem.baseRevision, currentHead);
+  const baseRevision = currentHead;
+  const worktreePath = localWorktreePath(repoRoot, identity.worktreeKey);
+  if (await pathExists(worktreePath)) {
+    await assertExistingWorktree(worktreePath, identity.branch);
+    return { ...identity, baseRevision, worktreePath };
+  }
+  await mkdir8(path11.dirname(worktreePath), { recursive: true });
+  const branchExists = await gitCommandSucceeds(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${identity.branch}`]);
+  const worktreeArgs = branchExists ? ["worktree", "add", worktreePath, identity.branch] : ["worktree", "add", "-b", identity.branch, worktreePath, baseRevision];
+  await gitOutput(repoRoot, worktreeArgs).catch((error) => {
+    throw new Error(`Could not create Git worktree ${identity.worktreeKey} on ${identity.branch}: ${errorMessage2(error)}`);
+  });
+  return { ...identity, baseRevision, worktreePath };
+}
+function localWorktreePath(repoRoot, worktreeKey) {
+  const repoName = path11.basename(repoRoot);
+  const worktreeSlug = worktreeKey.split("/").filter(Boolean).pop() ?? "work";
+  return path11.join(path11.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
+}
+async function assertExistingWorktree(worktreePath, branch) {
+  await gitOutput(worktreePath, ["rev-parse", "--is-inside-work-tree"]);
+  const currentBranch = await gitOutput(worktreePath, ["branch", "--show-current"]);
+  if (currentBranch && currentBranch !== branch) {
+    throw new Error(`Existing worktree is on ${currentBranch}; expected ${branch}.`);
+  }
+}
+async function assertBaseRevision(repoRoot, baseRevision, currentHead) {
+  if (!baseRevision || baseRevision === currentHead) {
+    return;
+  }
+  const revisionExists = await gitCommandSucceeds(repoRoot, ["cat-file", "-e", `${baseRevision}^{commit}`]);
+  if (!revisionExists) {
+    throw new Error(`Work item base revision ${baseRevision} is not available in this checkout; sync the repository before running implementation work.`);
+  }
+  const isAncestor = await gitCommandSucceeds(repoRoot, ["merge-base", "--is-ancestor", baseRevision, currentHead]);
+  if (!isAncestor) {
+    throw new Error(`Work item base revision ${baseRevision} is not an ancestor of ${currentHead}; refresh the work item before implementation.`);
+  }
+}
+async function gitOutput(cwd, args) {
+  const { stdout } = await execFileAsync3("git", args, { cwd, maxBuffer: 1024 * 1024 });
+  return stdout.trim();
+}
+async function gitCommandSucceeds(cwd, args) {
+  return execFileAsync3("git", args, { cwd }).then(() => true, () => false);
+}
+async function pathExists(value) {
+  return stat5(value).then(() => true, () => false);
+}
+function workIsolationSlug(scopeId, title) {
+  const scopeSlug = slugify(scopeId);
+  const titleSlug = slugify(title).slice(0, 32);
+  const combined = titleSlug && !scopeSlug.includes(titleSlug) ? `${scopeSlug}-${titleSlug}` : scopeSlug;
+  return combined.slice(0, 96).replace(/-+$/g, "") || "work";
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "work";
+}
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/version.ts
+import { readFileSync } from "node:fs";
+function readCliPackageVersion() {
+  const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  if (typeof packageJson.version !== "string" || !packageJson.version.trim()) {
+    throw new Error("@amistio/cli package version is missing.");
+  }
+  return packageJson.version.trim();
+}
+var CLI_VERSION = readCliPackageVersion();
+
 // src/index.ts
 var program = new Command();
 var defaultRoot = process.env.INIT_CWD ?? process.cwd();
 var apiUrlOptionDescription = `Amistio API URL override (or ${AMISTIO_API_URL_ENV})`;
-program.name("amistio").description("Amistio project brain CLI").version("0.1.4");
-var CLI_VERSION = "0.1.4";
+program.name("amistio").description("Amistio project brain CLI").version(CLI_VERSION);
 program.command("init").description("Create Amistio control-plane folders for a new project").option("--root <path>", "Repository root", defaultRoot).action(async (options) => {
   const created = await initControlPlane(options.root);
   console.log(created.length ? `Created ${created.length} control-plane folders.` : "Control-plane folders already exist.");
@@ -2926,7 +3629,7 @@ program.command("bootstrap").description("Clone a linked repository locally, pre
   console.log(`Wrote non-secret project metadata to ${filePath}.`);
   console.log(`Next: cd ${formatShellArg(checkout.targetDir)} && amistio run${formatApiUrlFlag(options.apiUrl)} --watch`);
 });
-program.command("import").description("Pair an existing checkout and import legacy Markdown docs for review").argument("[code]", "Short-lived pairing code from the Amistio app").option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--root <path>", "Repository root", defaultRoot).option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--default-branch <branch>", "Default branch fallback", "main").option("--include <glob>", "Only import files matching a repo-relative glob", collectRepeatedOption, []).option("--exclude <glob>", "Exclude files matching a repo-relative glob", collectRepeatedOption, []).option("--max-file-kb <kb>", "Maximum Markdown file size to import", parsePositiveInteger, 256).option("--dry-run", "Inspect and print import candidates without consuming the code or uploading documents").action(async (code, options) => {
+program.command("import").description("Pair an existing checkout and import legacy Markdown docs as accepted brain records").argument("[code]", "Short-lived pairing code from the Amistio app").option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--root <path>", "Repository root", defaultRoot).option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--default-branch <branch>", "Default branch fallback", "main").option("--include <glob>", "Only import files matching a repo-relative glob", collectRepeatedOption, []).option("--exclude <glob>", "Exclude files matching a repo-relative glob", collectRepeatedOption, []).option("--max-file-kb <kb>", "Maximum Markdown file size to import", parsePositiveInteger, 256).option("--dry-run", "Inspect and print import candidates without consuming the code or uploading documents").action(async (code, options) => {
   const pairingCode = (options.pairingCode ?? code)?.trim();
   if (!pairingCode) {
     throw new Error("Provide a pairing code as `amistio import <code>` or with `--pairing-code <code>`.");
@@ -2991,7 +3694,7 @@ program.command("import").description("Pair an existing checkout and import lega
   }
   console.log(`Pairing confirmed for ${pairing.repositoryLink.repoName}; repository link ${pairing.repositoryLinkAction}.`);
   console.log(`Wrote non-secret project metadata to ${metadataFilePath}.`);
-  console.log(`Imported ${documents.length} legacy document${documents.length === 1 ? "" : "s"} for review.`);
+  console.log(`Imported ${documents.length} legacy document${documents.length === 1 ? "" : "s"} as accepted brain record${documents.length === 1 ? "" : "s"}.`);
   console.log(`Next: amistio sync status${formatApiUrlFlag(options.apiUrl)}`);
 });
 program.command("pair").description("Pair this repository with an Amistio web project").requiredOption("--account <accountId>", "Amistio account ID").requiredOption("--project <projectId>", "Amistio project ID").option("--repository-link <repositoryLinkId>", "Existing repository link ID").option("--default-branch <branch>", "Default branch", "main").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--token <token>", "Runner/device credential to store outside the repository").option("--root <path>", "Repository root", defaultRoot).action(async (options, command) => {
@@ -3139,7 +3842,7 @@ work.command("prompt").description("Print or write an approved work prompt witho
     console.log(workItemId ? `No work item found for ${workItemId}.` : "No approved work item is ready for prompt export.");
     return;
   }
-  const prompt = createWorkExecutionPrompt(workItem);
+  const prompt = await createRunnerWorkPrompt(context.client, context.metadata.amistioProjectId, workItem);
   if (options.out) {
     await writeFile8(options.out, prompt, "utf8");
     console.log(`Wrote work prompt to ${options.out}.`);
@@ -3189,7 +3892,7 @@ program.command("orchestrate").description("Update the Amistio control plane thr
     process.exitCode = result.exitCode;
   }
 });
-program.command("run").description("Claim and run approved Amistio work locally").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--runner-id <runnerId>", "Stable runner ID", `runner_${randomUUID()}`).option("--root <path>", "Repository root", defaultRoot).option("--tool <name>", "Local tool to use: auto, none, opencode, claude, codex, copilot, gemini, aider, cursor-agent").option("--invocation-channel <channel>", "Local invocation channel: auto, sdk, or command", parseInvocationChannel).option("--model <model>", "Model to request when the selected local tool supports model selection").option("--tool-command <command>", "Custom local command. Use {promptFile} and {root} placeholders when supported").option("--session <policy>", "Tool session policy: auto, new, continue:<toolSessionId>, or none", "auto").option("--dry-run", "Claim work and print the generated execution prompt without running a tool").option("--watch", "Keep polling for approved work until stopped").option("--background", "Start a detached background runner that watches for approved work").option("--interval-seconds <seconds>", "Polling interval for --watch", parsePositiveInteger, 10).option("--max-iterations <count>", "Stop watch mode after this many polling attempts", parsePositiveInteger).option("--no-stream", "Capture local tool output instead of streaming it").action(async (options, command) => {
+program.command("run").description("Claim and run approved Amistio work locally").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--runner-id <runnerId>", "Stable runner ID").option("--root <path>", "Repository root", defaultRoot).option("--tool <name>", "Local tool to use: auto, none, opencode, claude, codex, copilot, gemini, aider, cursor-agent").option("--invocation-channel <channel>", "Local invocation channel: auto, sdk, or command", parseInvocationChannel).option("--model <model>", "Model to request when the selected local tool supports model selection").option("--tool-command <command>", "Custom local command. Use {promptFile} and {root} placeholders when supported").option("--session <policy>", "Tool session policy: auto, new, continue:<toolSessionId>, or none", "auto").option("--dry-run", "Claim work and print the generated execution prompt without running a tool").option("--watch", "Keep polling for approved work until stopped").option("--background", "Start a detached background runner that watches for approved work").option("--interval-seconds <seconds>", "Polling interval for --watch", parsePositiveInteger, 10).option("--max-iterations <count>", "Stop watch mode after this many polling attempts", parsePositiveInteger).option("--no-stream", "Capture local tool output instead of streaming it").option("--verbose", "Print detailed runner errors while watching").action(async (options, command) => {
   const context = await loadPairedApiContext(options.root, options.apiUrl);
   if (!context) {
     console.log("Repository is not paired. Run `amistio pair` first.");
@@ -3200,6 +3903,13 @@ program.command("run").description("Claim and run approved Amistio work locally"
     process.exitCode = 1;
     return;
   }
+  const runnerId = options.runnerId ?? stableRunnerId({
+    accountId: context.metadata.amistioAccountId,
+    projectId: context.metadata.amistioProjectId,
+    repositoryLinkId: context.metadata.repositoryLinkId,
+    machineId: runnerMachineId()
+  });
+  const resolvedOptions = { ...options, runnerId };
   if (options.background) {
     if (options.dryRun) {
       console.log("Background runners cannot be started in dry-run mode.");
@@ -3210,10 +3920,10 @@ program.command("run").description("Claim and run approved Amistio work locally"
       accountId: context.metadata.amistioAccountId,
       projectId: context.metadata.amistioProjectId,
       repositoryLinkId: context.metadata.repositoryLinkId,
-      runnerId: options.runnerId,
-      rootDir: path11.resolve(options.root),
+      runnerId,
+      rootDir: path12.resolve(options.root),
       apiUrl: options.apiUrl,
-      args: buildBackgroundRunnerArgs(options)
+      args: buildBackgroundRunnerArgs(resolvedOptions)
     });
     console.log(`Started background runner ${metadata.runnerId} with PID ${metadata.pid}.`);
     if (metadata.logPath) {
@@ -3222,59 +3932,60 @@ program.command("run").description("Claim and run approved Amistio work locally"
     return;
   }
   if (options.watch) {
-    for (const line of formatWatchStartupContext({ runnerId: options.runnerId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, apiUrl: options.apiUrl, intervalSeconds: options.intervalSeconds })) {
+    for (const line of formatWatchStartupContext({ runnerId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, apiUrl: options.apiUrl, intervalSeconds: options.intervalSeconds })) {
       console.log(line);
     }
   }
+  let offlineSent = false;
+  const sendOfflineHeartbeat = async (message) => {
+    if (offlineSent || options.dryRun) return;
+    offlineSent = true;
+    await context.client.sendRunnerHeartbeat(context.metadata.amistioProjectId, runnerId, context.metadata.repositoryLinkId, "offline", { ...runnerHeartbeatMetadata(), ...message ? { preferenceMessage: message } : {} }).catch(() => void 0);
+  };
+  const handleShutdownSignal = (signal) => {
+    void sendOfflineHeartbeat(`Runner stopped by ${signal}.`).finally(() => {
+      process.exit(signal === "SIGINT" ? 130 : 143);
+    });
+  };
+  process.once("SIGINT", handleShutdownSignal);
+  process.once("SIGTERM", handleShutdownSignal);
   let iterations = 0;
   let lastWatchStateLog;
-  while (true) {
-    iterations += 1;
-    const result = await runNextWorkItem({
-      apiClient: context.client,
-      projectId: context.metadata.amistioProjectId,
-      repositoryLinkId: context.metadata.repositoryLinkId,
-      runnerId: options.runnerId,
-      root: options.root,
-      sessionPolicy: normalizeSessionPolicy(options.session),
-      ...command.getOptionValueSource("tool") === "cli" && options.tool ? { explicitTool: options.tool } : {},
-      ...command.getOptionValueSource("invocationChannel") === "cli" && options.invocationChannel ? { explicitInvocationChannel: options.invocationChannel } : {},
-      ...command.getOptionValueSource("model") === "cli" && options.model ? { explicitModel: options.model } : {},
-      ...options.toolCommand ? { toolCommand: options.toolCommand } : {},
-      dryRun: Boolean(options.dryRun),
-      stream: options.stream,
-      commandContext: {
-        accountId: context.metadata.amistioAccountId,
-        apiUrl: options.apiUrl,
-        backgroundArgs: buildBackgroundRunnerArgs(options),
-        projectId: context.metadata.amistioProjectId,
-        repositoryLinkId: context.metadata.repositoryLinkId,
-        root: options.root,
-        runnerId: options.runnerId
-      },
-      suppressIdleOutput: Boolean(options.watch)
-    });
-    if (!options.watch || options.dryRun) {
-      if (result.exitCode !== 0) {
-        process.exitCode = result.exitCode;
+  try {
+    while (true) {
+      iterations += 1;
+      const result = await runWatchIteration({
+        command,
+        context,
+        options: resolvedOptions,
+        runnerId
+      });
+      if (!options.watch || options.dryRun) {
+        if (result.exitCode !== 0) {
+          process.exitCode = result.exitCode;
+        }
+        return;
       }
-      return;
-    }
-    if (result.status === "idle" && result.nextAction) {
-      const nowMs = Date.now();
-      if (shouldPrintWatchState(result.nextAction, lastWatchStateLog, nowMs)) {
-        console.log(formatWatchIdleLine(result.nextAction, options.intervalSeconds));
-        lastWatchStateLog = { key: watchStateKey(result.nextAction), printedAtMs: nowMs };
+      if (result.status === "idle" && result.nextAction) {
+        const nowMs = Date.now();
+        if (shouldPrintWatchState(result.nextAction, lastWatchStateLog, nowMs)) {
+          console.log(formatWatchIdleLine(result.nextAction, options.intervalSeconds));
+          lastWatchStateLog = { key: watchStateKey(result.nextAction), printedAtMs: nowMs };
+        }
       }
+      if (result.stopRunner) {
+        return;
+      }
+      if (options.maxIterations !== void 0 && iterations >= options.maxIterations) {
+        console.log(`Runner stopped after ${iterations} polling attempt${iterations === 1 ? "" : "s"}.`);
+        return;
+      }
+      await delay(options.intervalSeconds * 1e3);
     }
-    if (result.stopRunner) {
-      return;
-    }
-    if (options.maxIterations !== void 0 && iterations >= options.maxIterations) {
-      console.log(`Runner stopped after ${iterations} polling attempt${iterations === 1 ? "" : "s"}.`);
-      return;
-    }
-    await delay(options.intervalSeconds * 1e3);
+  } finally {
+    process.off("SIGINT", handleShutdownSignal);
+    process.off("SIGTERM", handleShutdownSignal);
+    await sendOfflineHeartbeat("Runner stopped.");
   }
 });
 var runner = program.command("runner").description("Manage local Amistio runner processes");
@@ -3348,6 +4059,59 @@ runner.command("stop").description("Stop a background runner for the paired repo
   }).catch(() => void 0);
   console.log(stopResult === "stopped" ? `Stopped background runner ${record.runnerId}.` : `Marked background runner ${record.runnerId} stopped; process was not running.`);
 });
+async function runWatchIteration({ command, context, options, runnerId }) {
+  try {
+    return await runNextWorkItem({
+      apiClient: context.client,
+      projectId: context.metadata.amistioProjectId,
+      repositoryLinkId: context.metadata.repositoryLinkId,
+      runnerId,
+      root: options.root,
+      sessionPolicy: normalizeSessionPolicy(options.session),
+      ...command.getOptionValueSource("tool") === "cli" && options.tool ? { explicitTool: options.tool } : {},
+      ...command.getOptionValueSource("invocationChannel") === "cli" && options.invocationChannel ? { explicitInvocationChannel: options.invocationChannel } : {},
+      ...command.getOptionValueSource("model") === "cli" && options.model ? { explicitModel: options.model } : {},
+      ...options.toolCommand ? { toolCommand: options.toolCommand } : {},
+      dryRun: Boolean(options.dryRun),
+      stream: options.stream,
+      commandContext: {
+        accountId: context.metadata.amistioAccountId,
+        apiUrl: options.apiUrl,
+        backgroundArgs: buildBackgroundRunnerArgs(options),
+        projectId: context.metadata.amistioProjectId,
+        repositoryLinkId: context.metadata.repositoryLinkId,
+        root: options.root,
+        runnerId
+      },
+      suppressIdleOutput: Boolean(options.watch),
+      verbose: Boolean(options.verbose)
+    });
+  } catch (error) {
+    if (!options.watch) {
+      throw error;
+    }
+    const detail = truncateLogExcerpt(errorDetail(error));
+    const message = "Runner hit an error while watching and will keep listening.";
+    if (options.verbose) {
+      console.error(`${message}
+${detail}`);
+    } else {
+      console.error(`${message} Run with --verbose for details.`);
+    }
+    await Promise.allSettled([
+      context.client.sendRunnerHeartbeat(context.metadata.amistioProjectId, runnerId, context.metadata.repositoryLinkId, "blocked", { ...runnerHeartbeatMetadata(), preferenceMessage: message }),
+      context.client.recordRunnerLog(context.metadata.amistioProjectId, {
+        runnerId,
+        repositoryLinkId: context.metadata.repositoryLinkId,
+        status: "failed",
+        message,
+        error: detail,
+        machineId: runnerMachineId()
+      })
+    ]);
+    return { status: "failed", exitCode: 1, message };
+  }
+}
 async function runNextWorkItem({
   apiClient,
   dryRun,
@@ -3362,7 +4126,8 @@ async function runNextWorkItem({
   explicitTool,
   toolCommand,
   commandContext,
-  suppressIdleOutput
+  suppressIdleOutput,
+  verbose
 }) {
   const toolConfig = await resolveRunnerToolConfig({
     apiClient,
@@ -3384,7 +4149,7 @@ async function runNextWorkItem({
     console.log(toolConfig.message);
     return { status: "blocked", exitCode: 1 };
   }
-  const result = await apiClient.claimWork(projectId, runnerId, repositoryLinkId);
+  const result = await apiClient.claimWork(projectId, runnerId, repositoryLinkId, 300, runnerIsolationCapabilityMetadata());
   if (!result.workItem) {
     const nextAction = await loadProjectNextAction(apiClient, projectId, repositoryLinkId, root);
     const message = formatProjectNextAction(nextAction);
@@ -3393,51 +4158,100 @@ async function runNextWorkItem({
     }
     return { status: "idle", exitCode: 0, nextAction, message };
   }
-  await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "running", runnerHeartbeatMetadata(toolConfig));
   const prompt = await createRunnerWorkPrompt(apiClient, projectId, result.workItem);
   if (dryRun || toolConfig.tool === "none") {
     console.log(prompt);
     await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
     return { status: "preview", exitCode: 0 };
   }
-  const preview = await createToolRunPreview({ rootDir: root, prompt, tool: toolConfig.tool, invocationChannel: toolConfig.requestedInvocationChannel ?? "auto", ...toolCommand ? { toolCommand } : {}, ...toolConfig.model ? { model: toolConfig.model } : {} });
+  const worktreeIsolation = await prepareWorktreeForClaimedItem({ apiClient, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem: result.workItem });
+  if (worktreeIsolation.status === "blocked") {
+    return { status: "blocked", exitCode: 1, message: worktreeIsolation.message };
+  }
+  const executionRoot = worktreeIsolation.isolation?.worktreePath ?? root;
+  const isolationTelemetry = workItemIsolationTelemetry(result.workItem, worktreeIsolation.isolation);
+  await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "running", {
+    ...runnerHeartbeatMetadata(toolConfig),
+    currentWorkItemId: result.workItem.workItemId,
+    ...isolationTelemetry.implementationScopeId ? { currentImplementationScopeId: isolationTelemetry.implementationScopeId } : {},
+    ...isolationTelemetry.executionWorktreeKey ? { currentWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
+    ...isolationTelemetry.executionBranch ? { currentBranch: isolationTelemetry.executionBranch } : {}
+  });
+  const preview = await createToolRunPreview({ rootDir: executionRoot, prompt, tool: toolConfig.tool, invocationChannel: toolConfig.requestedInvocationChannel ?? "auto", ...toolCommand ? { toolCommand } : {}, ...toolConfig.model ? { model: toolConfig.model } : {} });
   const sessionContext = await prepareToolSession({
     apiClient,
     projectId,
     repositoryLinkId,
     runnerId,
+    machineId: runnerMachineId(),
     sessionPolicy: result.workItem.sessionPolicy ?? sessionPolicy,
     toolName: preview.toolName,
     ...toolConfig.model ? { model: toolConfig.model } : {},
     supportsSessionReuse: preview.supportsSessionReuse,
     resumabilityScope: preview.resumabilityScope,
-    workItem: result.workItem
+    workItem: result.workItem,
+    isolationTelemetry
   });
   console.log(`Claimed ${result.workItem.workItemId}. Running ${preview.toolName}: ${preview.displayCommand}`);
+  await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+    status: "running",
+    summary: `Local runner started ${preview.toolName} execution.`,
+    idempotencyKey: `runner_milestone_started_${result.workItem.workItemId}_${result.workItem.attempt}`,
+    metadata: { tool: preview.toolName, invocationChannel: toolConfig.requestedInvocationChannel ?? "auto" }
+  });
   const startedAt = Date.now();
   const providerSessionStore = new LocalToolSessionStore();
   const providerSessionId = sessionContext.toolSession ? await providerSessionStore.getProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName) : void 0;
-  const toolResult = await runLocalTool({
-    rootDir: root,
-    prompt,
-    tool: toolConfig.tool,
-    invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
-    ...toolCommand ? { toolCommand } : {},
-    ...toolConfig.model ? { model: toolConfig.model } : {},
-    streamOutput: stream,
-    ...sessionContext.toolSession ? {
-      session: {
-        toolSessionId: sessionContext.toolSession.toolSessionId,
-        policy: sessionContext.policy,
-        decision: sessionContext.decision,
-        ...providerSessionId ? { providerSessionId } : {}
-      }
-    } : {}
-  }).catch(async (error) => {
-    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "blocked", runnerHeartbeatMetadata(toolConfig));
-    await markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage2(error));
-    throw error;
-  });
+  let toolResult;
+  try {
+    toolResult = await runLocalTool({
+      rootDir: executionRoot,
+      prompt,
+      tool: toolConfig.tool,
+      invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
+      ...toolCommand ? { toolCommand } : {},
+      ...toolConfig.model ? { model: toolConfig.model } : {},
+      streamOutput: stream,
+      ...sessionContext.toolSession ? {
+        session: {
+          toolSessionId: sessionContext.toolSession.toolSessionId,
+          policy: sessionContext.policy,
+          decision: sessionContext.decision,
+          ...providerSessionId ? { providerSessionId } : {}
+        }
+      } : {}
+    });
+  } catch (error) {
+    const detail = truncateLogExcerpt(errorDetail(error));
+    const durationMs2 = Date.now() - startedAt;
+    const message = `${preview.toolName} failed before returning a result.`;
+    await Promise.allSettled([
+      apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
+      markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage3(error)),
+      apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "failed", `run_failed_${result.workItem.workItemId}_${result.workItem.attempt}_${runnerId}`, runnerId, {
+        ...isolationTelemetry,
+        tool: preview.toolName,
+        ...toolConfig.model ? { model: toolConfig.model } : {},
+        durationMs: durationMs2,
+        message,
+        error: detail,
+        ...sessionContext.toolSession ? { toolSessionId: sessionContext.toolSession.toolSessionId } : {},
+        sessionPolicy: sessionContext.policy,
+        sessionDecision: sessionContext.decision,
+        sessionDecisionReason: sessionContext.reason
+      }),
+      recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+        status: "failed",
+        summary: message,
+        idempotencyKey: `runner_milestone_tool_throw_${result.workItem.workItemId}_${result.workItem.attempt}`,
+        metadata: { tool: preview.toolName, error: detail }
+      })
+    ]);
+    if (verbose || !stream) {
+      console.error(detail);
+    }
+    return { status: "failed", exitCode: 1, message };
+  }
   if (sessionContext.toolSession && toolResult.providerSessionId) {
     await providerSessionStore.setProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName, toolResult.providerSessionId);
   }
@@ -3461,6 +4275,35 @@ async function runNextWorkItem({
       workItem: result.workItem
     });
   }
+  if (result.workItem.workKind === "assistantQuestion") {
+    return finalizeAssistantQuestionWork({
+      apiClient,
+      durationMs: Date.now() - startedAt,
+      projectId,
+      repositoryLinkId,
+      runnerId,
+      sessionContext,
+      toolConfig,
+      toolName: preview.toolName,
+      toolResult,
+      workItem: result.workItem
+    });
+  }
+  if (result.workItem.workKind === "impactPreview") {
+    return finalizeImpactPreviewWork({
+      apiClient,
+      durationMs: Date.now() - startedAt,
+      projectId,
+      repositoryLinkId,
+      root,
+      runnerId,
+      sessionContext,
+      toolConfig,
+      toolName: preview.toolName,
+      toolResult,
+      workItem: result.workItem
+    });
+  }
   const finalStatus = toolResult.exitCode === 0 ? "completed" : "failed";
   const durationMs = Date.now() - startedAt;
   const failureExcerpt = toolResult.exitCode === 0 ? void 0 : truncateLogExcerpt(toolResult.stderr || toolResult.stdout);
@@ -3488,6 +4331,7 @@ async function runNextWorkItem({
       ...toolResult.model ? { model: toolResult.model } : {},
       durationMs,
       message: `${preview.toolName} exited with code ${toolResult.exitCode}.`,
+      ...isolationTelemetry,
       sessionPolicy: sessionContext.policy,
       sessionDecision: sessionContext.decision,
       sessionDecisionReason: sessionContext.reason,
@@ -3499,11 +4343,85 @@ async function runNextWorkItem({
       ...failureExcerpt ? { error: failureExcerpt } : {}
     }
   );
+  await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+    status: finalStatus,
+    summary: `${preview.toolName} exited with code ${toolResult.exitCode}.`,
+    idempotencyKey: `runner_milestone_finished_${result.workItem.workItemId}_${statusResult.workItem.idempotencyKey}`,
+    metadata: { tool: preview.toolName, durationMs, exitCode: toolResult.exitCode, verificationSummary: finalStatus === "completed" ? "Local execution reported completion." : "Local execution reported failure.", executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
+  });
   await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
   const durationSeconds = Math.round(durationMs / 1e3);
   console.log(`Marked ${statusResult.workItem.workItemId} ${statusResult.workItem.status} after ${durationSeconds}s.`);
   return { status: finalStatus, exitCode: toolResult.exitCode };
 }
+async function prepareWorktreeForClaimedItem({ apiClient, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem }) {
+  if (!needsGitWorktreeIsolation(workItem)) {
+    return { status: "ready" };
+  }
+  const identity = resolveWorktreeIdentity(workItem);
+  try {
+    const isolation = await prepareGitWorktreeIsolation(root, workItem);
+    await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+      status: "running",
+      summary: `Prepared Git worktree ${isolation.worktreeKey} on ${isolation.branch}.`,
+      idempotencyKey: `runner_milestone_worktree_${workItem.workItemId}_${workItem.attempt}`,
+      metadata: { executionWorktreeKey: isolation.worktreeKey, executionBranch: isolation.branch, implementationScopeId: isolation.implementationScopeId }
+    });
+    return { status: "ready", isolation };
+  } catch (error) {
+    const message = errorMessage3(error);
+    const telemetry = workItemIsolationTelemetry(workItem, { ...identity, baseRevision: workItem.baseRevision ?? "unknown", worktreePath: "" });
+    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, "blocked", `worktree_${workItem.workItemId}_${randomUUID()}`, runnerId, {
+      ...telemetry,
+      message,
+      blockerReason: message,
+      error: message
+    });
+    await recordRunnerMilestone(apiClient, projectId, statusResult.workItem, runnerId, repositoryLinkId, {
+      status: "blocked",
+      summary: message,
+      idempotencyKey: `runner_milestone_worktree_blocked_${workItem.workItemId}_${statusResult.workItem.idempotencyKey}`,
+      metadata: { executionWorktreeKey: telemetry.executionWorktreeKey ?? "", executionBranch: telemetry.executionBranch ?? "", implementationScopeId: telemetry.implementationScopeId ?? "" }
+    });
+    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "blocked", {
+      ...runnerHeartbeatMetadata(toolConfig),
+      currentWorkItemId: workItem.workItemId,
+      ...telemetry.implementationScopeId ? { currentImplementationScopeId: telemetry.implementationScopeId } : {},
+      ...telemetry.executionWorktreeKey ? { currentWorktreeKey: telemetry.executionWorktreeKey } : {},
+      ...telemetry.executionBranch ? { currentBranch: telemetry.executionBranch } : {}
+    });
+    console.error(message);
+    return { status: "blocked", message };
+  }
+}
+function workItemIsolationTelemetry(workItem, isolation) {
+  const implementationScopeId = isolation?.implementationScopeId ?? workItem.implementationScopeId;
+  const executionBranch = isolation?.branch ?? workItem.executionBranch;
+  const executionWorktreeKey = isolation?.worktreeKey ?? workItem.executionWorktreeKey;
+  const repositoryLockId = isolation?.repositoryLockId ?? workItem.repositoryLockId;
+  return {
+    ...needsGitWorktreeIsolation(workItem) ? { isolationMode: "gitWorktree" } : workItem.isolationMode ? { isolationMode: workItem.isolationMode } : {},
+    ...workItem.claimLeaseId ? { claimLeaseId: workItem.claimLeaseId } : {},
+    ...workItem.controllingAdrId ? { controllingAdrId: workItem.controllingAdrId } : {},
+    ...implementationScopeId ? { implementationScopeId } : {},
+    ...executionBranch ? { executionBranch } : {},
+    ...executionWorktreeKey ? { executionWorktreeKey } : {},
+    ...repositoryLockId ? { repositoryLockId } : {},
+    ...isolation?.baseRevision && isolation.baseRevision !== "unknown" ? { baseRevision: isolation.baseRevision } : {},
+    machineId: runnerMachineId()
+  };
+}
+async function recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, input) {
+  await apiClient.recordActivityEvent(projectId, {
+    eventType: "runnerMilestone",
+    runnerId,
+    repositoryLinkId,
+    relatedWorkItemId: workItem.workItemId,
+    ...workItem.reviewDocumentId ? { relatedDocumentId: workItem.reviewDocumentId } : workItem.impactDocumentId ? { relatedDocumentId: workItem.impactDocumentId } : {},
+    ...workItem.generatedDraftId ? { generatedDraftId: workItem.generatedDraftId } : {},
+    ...input
+  }).catch(() => void 0);
+}
 async function runPendingRunnerCommand(apiClient, context, heartbeatMetadata) {
   const { commands } = await apiClient.listRunnerCommands(context.projectId, context.runnerId, context.repositoryLinkId).catch(() => ({ commands: [] }));
   const command = commands.filter((item) => item.status === "pending" || item.status === "acknowledged" || item.status === "running").sort((first, second) => Date.parse(first.createdAt) - Date.parse(second.createdAt))[0];
@@ -3554,7 +4472,7 @@ async function restartCurrentRunner(context) {
     const replacement = await restartRunnerDaemonProcess(metadata, context.backgroundArgs);
     return { succeeded: true, stopRunner: true, message: `Replacement background runner started with PID ${replacement.pid}.` };
   } catch (error) {
-    return { succeeded: false, message: "Background restart failed.", error: errorMessage2(error) };
+    return { succeeded: false, message: "Background restart failed.", error: errorMessage3(error) };
   }
 }
 function runnerCommandLabel(commandKind) {
@@ -3581,7 +4499,7 @@ async function finalizeBrainGenerationWork({
       artifacts = parseBrainGenerationArtifacts(`${toolResult.stdout}
 ${toolResult.stderr}`);
     } catch (error) {
-      generationError = errorMessage2(error);
+      generationError = errorMessage3(error);
     }
   } else {
     generationError = truncateLogExcerpt(toolResult.stderr || toolResult.stdout) || `${toolName} exited with code ${toolResult.exitCode}.`;
@@ -3619,11 +4537,17 @@ ${toolResult.stderr}`);
       ...sessionTelemetry,
       message: completionMessage
     });
+    await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+      status: "completed",
+      summary: completionMessage,
+      idempotencyKey: `runner_milestone_generation_completed_${workItem.workItemId}_${result.workItem.idempotencyKey}`,
+      metadata: { tool: toolName, durationMs, artifactCount: result.documents.length, verificationSummary: "Generated artifacts were accepted by the Amistio API for review." }
+    });
     await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
     console.log(workItem.workKind === "planRevision" ? "Revised plan returned for review." : `Generated ${result.documents.length} brain artifact${result.documents.length === 1 ? "" : "s"} for review.`);
     return { status: "completed", exitCode: 0 };
   }
-  await apiClient.submitBrainGenerationResult(projectId, workItem.workItemId, {
+  const failedResult = await apiClient.submitBrainGenerationResult(projectId, workItem.workItemId, {
     status: "failed",
     runnerId,
     idempotencyKey: `generation_${workItem.workItemId}_${randomUUID()}`,
@@ -3633,11 +4557,216 @@ ${toolResult.stderr}`);
     message: `${toolName} did not produce valid brain artifacts.`,
     ...generationError ? { error: generationError } : {}
   });
+  await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+    status: "failed",
+    summary: generationError ?? `${toolName} did not produce valid brain artifacts.`,
+    idempotencyKey: `runner_milestone_generation_failed_${workItem.workItemId}_${failedResult.workItem.idempotencyKey}`,
+    metadata: { tool: toolName, durationMs, verificationSummary: "Generation output could not be parsed into approved artifact JSON." }
+  });
   await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
   console.error(generationError ?? "Local runner generation failed.");
   return { status: "failed", exitCode: toolResult.exitCode || 1 };
 }
+async function finalizeAssistantQuestionWork({
+  apiClient,
+  durationMs,
+  projectId,
+  repositoryLinkId,
+  runnerId,
+  sessionContext,
+  toolConfig,
+  toolName,
+  toolResult,
+  workItem
+}) {
+  let answerResult;
+  let answerError;
+  if (toolResult.exitCode === 0) {
+    try {
+      answerResult = parseAssistantAnswerResult(`${toolResult.stdout}
+${toolResult.stderr}`);
+    } catch (error) {
+      answerError = errorMessage3(error);
+    }
+  } else {
+    answerError = truncateLogExcerpt(toolResult.stderr || toolResult.stdout) || `${toolName} exited with code ${toolResult.exitCode}.`;
+  }
+  const finalStatus = answerResult ? "completed" : "failed";
+  const updatedToolSession = await finalizeToolSession({
+    apiClient,
+    projectId,
+    status: finalStatus,
+    runnerId,
+    workItemId: workItem.workItemId,
+    stdout: toolResult.stdout,
+    ...sessionContext.toolSession ? { session: sessionContext.toolSession } : {},
+    ...toolResult.messageCount !== void 0 ? { messageCount: toolResult.messageCount } : {},
+    ...toolResult.tokensIn !== void 0 ? { tokensIn: toolResult.tokensIn } : {},
+    ...toolResult.tokensOut !== void 0 ? { tokensOut: toolResult.tokensOut } : {},
+    ...toolResult.costUsd !== void 0 ? { costUsd: toolResult.costUsd } : {}
+  });
+  const sessionTelemetry = {
+    sessionPolicy: sessionContext.policy,
+    sessionDecision: sessionContext.decision,
+    sessionDecisionReason: sessionContext.reason,
+    ...updatedToolSession ? { toolSessionId: updatedToolSession.toolSessionId } : {},
+    ...updatedToolSession?.sessionGroupKey ? { sessionGroupKey: updatedToolSession.sessionGroupKey } : {}
+  };
+  if (answerResult) {
+    const result = await apiClient.submitAssistantResult(projectId, workItem.workItemId, {
+      status: "completed",
+      runnerId,
+      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID()}`,
+      answer: answerResult.answer,
+      sourceBoundary: answerResult.sourceBoundary,
+      citations: answerResult.citations,
+      tool: toolName,
+      durationMs,
+      ...sessionTelemetry,
+      message: `${toolName} returned a project knowledge answer.`
+    });
+    await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+      status: "completed",
+      summary: `${toolName} returned a project knowledge answer.`,
+      idempotencyKey: `runner_milestone_assistant_completed_${workItem.workItemId}_${result.workItem.idempotencyKey}`,
+      metadata: { tool: toolName, durationMs, sourceBoundary: answerResult.sourceBoundary, citationCount: answerResult.citations.length }
+    });
+    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
+    console.log("Project knowledge answer returned.");
+    return { status: "completed", exitCode: 0 };
+  }
+  const failedResult = await apiClient.submitAssistantResult(projectId, workItem.workItemId, {
+    status: "failed",
+    runnerId,
+    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID()}`,
+    tool: toolName,
+    durationMs,
+    ...sessionTelemetry,
+    message: `${toolName} did not produce a valid project knowledge answer.`,
+    ...answerError ? { error: answerError } : {}
+  });
+  await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+    status: "failed",
+    summary: answerError ?? `${toolName} did not produce a valid project knowledge answer.`,
+    idempotencyKey: `runner_milestone_assistant_failed_${workItem.workItemId}_${failedResult.workItem.idempotencyKey}`,
+    metadata: { tool: toolName, durationMs, verificationSummary: "Assistant output did not include a valid structured answer." }
+  });
+  await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
+  console.error(answerError ?? "Local runner assistant answer failed.");
+  return { status: "failed", exitCode: toolResult.exitCode || 1 };
+}
+async function finalizeImpactPreviewWork({
+  apiClient,
+  durationMs,
+  projectId,
+  repositoryLinkId,
+  root,
+  runnerId,
+  sessionContext,
+  toolConfig,
+  toolName,
+  toolResult,
+  workItem
+}) {
+  let report = void 0;
+  let previewError;
+  if (toolResult.exitCode === 0) {
+    try {
+      report = parseImpactPreviewResult(`${toolResult.stdout}
+${toolResult.stderr}`);
+    } catch (error) {
+      previewError = errorMessage3(error);
+    }
+  } else {
+    previewError = truncateLogExcerpt(toolResult.stderr || toolResult.stdout) || `${toolName} exited with code ${toolResult.exitCode}.`;
+  }
+  const finalStatus = report ? "completed" : "failed";
+  const updatedToolSession = await finalizeToolSession({
+    apiClient,
+    projectId,
+    status: finalStatus,
+    runnerId,
+    workItemId: workItem.workItemId,
+    stdout: toolResult.stdout,
+    ...sessionContext.toolSession ? { session: sessionContext.toolSession } : {},
+    ...toolResult.messageCount !== void 0 ? { messageCount: toolResult.messageCount } : {},
+    ...toolResult.tokensIn !== void 0 ? { tokensIn: toolResult.tokensIn } : {},
+    ...toolResult.tokensOut !== void 0 ? { tokensOut: toolResult.tokensOut } : {},
+    ...toolResult.costUsd !== void 0 ? { costUsd: toolResult.costUsd } : {}
+  });
+  const sessionTelemetry = {
+    sessionPolicy: sessionContext.policy,
+    sessionDecision: sessionContext.decision,
+    sessionDecisionReason: sessionContext.reason,
+    ...updatedToolSession ? { toolSessionId: updatedToolSession.toolSessionId } : {},
+    ...updatedToolSession?.sessionGroupKey ? { sessionGroupKey: updatedToolSession.sessionGroupKey } : {}
+  };
+  if (report) {
+    const metadata = await readProjectLink(root).catch(() => void 0);
+    const result = await apiClient.submitImpactPreviewResult(projectId, workItem.workItemId, {
+      status: "completed",
+      runnerId,
+      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID()}`,
+      report: {
+        ...report,
+        analyzedRepoRevision: report.analyzedRepoRevision ?? metadata?.lastSyncedRevision
+      },
+      tool: toolName,
+      durationMs,
+      ...sessionTelemetry,
+      message: `${toolName} returned an implementation impact preview.`
+    });
+    await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+      status: "completed",
+      summary: `${toolName} returned an implementation impact preview.`,
+      idempotencyKey: `runner_milestone_impact_completed_${workItem.workItemId}_${result.workItem.idempotencyKey}`,
+      metadata: { tool: toolName, durationMs, riskLevel: report.riskLevel, likelyPathCount: report.likelyPaths.length, verificationSummary: report.verificationPlan }
+    });
+    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
+    console.log(result.implementationWorkItem ? "Impact preview returned; implementation work is now queued." : "Impact preview returned.");
+    return { status: "completed", exitCode: 0 };
+  }
+  const failedResult = await apiClient.submitImpactPreviewResult(projectId, workItem.workItemId, {
+    status: "failed",
+    runnerId,
+    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID()}`,
+    tool: toolName,
+    durationMs,
+    ...sessionTelemetry,
+    message: `${toolName} did not produce a valid impact preview.`,
+    ...previewError ? { error: previewError } : {}
+  });
+  await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+    status: "failed",
+    summary: previewError ?? `${toolName} did not produce a valid impact preview.`,
+    idempotencyKey: `runner_milestone_impact_failed_${workItem.workItemId}_${failedResult.workItem.idempotencyKey}`,
+    metadata: { tool: toolName, durationMs, verificationSummary: "Impact preview output did not include valid structured JSON." }
+  });
+  await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
+  console.error(previewError ?? "Local runner impact preview failed.");
+  return { status: "failed", exitCode: toolResult.exitCode || 1 };
+}
 async function createRunnerWorkPrompt(apiClient, projectId, workItem) {
+  if (workItem.workKind === "assistantQuestion") {
+    const [{ documents: documents2 }, { messages: messages2 }] = await Promise.all([
+      apiClient.listBrainDocuments(projectId),
+      apiClient.listAssistantMessages(projectId)
+    ]);
+    const question = messages2.find((message) => message.messageId === workItem.assistantMessageId || message.id === workItem.assistantMessageId) ?? messages2.filter((message) => message.workItemId === workItem.workItemId).sort((first, second) => Date.parse(first.createdAt) - Date.parse(second.createdAt))[0];
+    return createWorkExecutionPrompt(workItem, {
+      ...question ? { assistantQuestion: { question, messages: messages2, documents: documents2 } } : {}
+    });
+  }
+  if (workItem.workKind === "impactPreview") {
+    const { documents: documents2 } = await apiClient.listBrainDocuments(projectId);
+    const implementationPrompt = workItem.impactDocumentId ? documents2.find((document) => document.documentId === workItem.impactDocumentId || document.id === workItem.impactDocumentId) : documents2.find((document) => document.frontmatter.generatedDraftId === workItem.generatedDraftId && (document.frontmatter.createsWorkItem === true || document.documentType === "prompt"));
+    return createWorkExecutionPrompt(workItem, {
+      impactPreview: {
+        documents: documents2,
+        ...implementationPrompt ? { implementationPrompt } : {}
+      }
+    });
+  }
   if (workItem.workKind !== "planRevision" || !workItem.reviewDocumentId) {
     return createWorkExecutionPrompt(workItem);
   }
@@ -3710,6 +4839,8 @@ function isPromptReadyStatus(status) {
 }
 async function prepareToolSession({
   apiClient,
+  isolationTelemetry,
+  machineId,
   projectId,
   repositoryLinkId,
   runnerId,
@@ -3728,6 +4859,7 @@ async function prepareToolSession({
     toolName,
     runnerId,
     repositoryLinkId,
+    machineId,
     supportsSessionReuse
   });
   if (selection.decision === "skipped") {
@@ -3737,8 +4869,12 @@ async function prepareToolSession({
     const { toolSession: toolSession2 } = await apiClient.updateToolSession(projectId, selection.toolSession.toolSessionId, {
       status: "active",
       runnerId,
+      machineId,
       lastWorkItemId: workItem.workItemId,
-      reusePolicy: sessionPolicy
+      reusePolicy: sessionPolicy,
+      ...isolationTelemetry.implementationScopeId ? { implementationScopeId: isolationTelemetry.implementationScopeId } : {},
+      ...isolationTelemetry.executionWorktreeKey ? { executionWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
+      ...isolationTelemetry.isolationMode ? { isolationMode: isolationTelemetry.isolationMode } : {}
     });
     return { ...selection, toolSession: toolSession2 };
   }
@@ -3754,9 +4890,14 @@ async function prepareToolSession({
     summary: selection.reason,
     status: "active",
     runnerId,
+    machineId,
     lastWorkItemId: workItem.workItemId,
     messageCount: 0,
     reusePolicy: sessionPolicy,
+    ...workItem.requestedByUserId ?? workItem.requestedBy ? { createdByUserId: workItem.requestedByUserId ?? workItem.requestedBy } : {},
+    ...isolationTelemetry.implementationScopeId ? { implementationScopeId: isolationTelemetry.implementationScopeId } : {},
+    ...isolationTelemetry.executionWorktreeKey ? { executionWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
+    ...isolationTelemetry.isolationMode ? { isolationMode: isolationTelemetry.isolationMode } : {},
     ...workItem.sessionGroupKey ? { sessionGroupKey: workItem.sessionGroupKey } : {}
   });
   return { ...selection, toolSession };
@@ -3817,9 +4958,12 @@ function summarizeToolOutput(value) {
   }
   return trimmed.length > 300 ? `${trimmed.slice(0, 300)}...` : trimmed;
 }
-function errorMessage2(error) {
+function errorMessage3(error) {
   return error instanceof Error ? error.message : String(error);
 }
+function errorDetail(error) {
+  return error instanceof Error ? error.stack ?? error.message : String(error);
+}
 function truncateLogExcerpt(value) {
   const trimmed = value.trim();
   return trimmed.length > 1200 ? `${trimmed.slice(0, 1200)}...` : trimmed;
@@ -3844,10 +4988,10 @@ function parseInvocationChannel(value) {
   throw new Error(`Expected invocation channel auto, sdk, or command; received ${value}.`);
 }
 function inferRepoName(root) {
-  return path11.basename(path11.resolve(root)) || "repository";
+  return path12.basename(path12.resolve(root)) || "repository";
 }
 function createRepoFingerprint(accountId, projectId, repositoryLinkId) {
-  return createHash4("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
+  return createHash5("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
 }
 function defaultApiUrl() {
   const envApiUrl = process.env[AMISTIO_API_URL_ENV]?.trim();
@@ -3961,14 +5105,24 @@ function toRunnerToolCapabilities(tools) {
     execution: tool.execution,
     supportsSessionReuse: tool.supportsSessionReuse,
     resumabilityScope: tool.resumabilityScope,
-    supportsModelSelection: tool.supportsModelSelection
+    supportsModelSelection: tool.supportsModelSelection,
+    supportsBranchIsolation: true,
+    supportsGitWorktreeIsolation: true
   }));
 }
+function runnerIsolationCapabilityMetadata() {
+  return {
+    machineId: runnerMachineId(),
+    supportsBranchIsolation: true,
+    supportsGitWorktreeIsolation: true
+  };
+}
 function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode()) {
   return {
     version: CLI_VERSION,
     mode,
     hostname: os5.hostname(),
+    ...runnerIsolationCapabilityMetadata(),
     ...toolConfig?.capabilities ? { capabilities: toolConfig.capabilities } : {},
     ...toolConfig?.requestedTool ? { requestedTool: toolConfig.requestedTool } : {},
     ...toolConfig?.requestedInvocationChannel ? { requestedInvocationChannel: toolConfig.requestedInvocationChannel } : {},
@@ -3980,6 +5134,9 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode()) {
     ...toolConfig?.message ? { preferenceMessage: toolConfig.message } : {}
   };
 }
+function runnerMachineId() {
+  return createHash5("sha256").update(`${os5.hostname()}:${os5.platform()}:${os5.arch()}`).digest("hex").slice(0, 20);
+}
 async function delay(milliseconds) {
   await new Promise((resolve) => setTimeout(resolve, milliseconds));
 }