@askexenow/exe-os 0.9.65 → 0.9.66

package/dist/lib/exe-daemon.js

@@ -149,6 +149,11 @@ function normalizeAutoUpdate(raw) {
   const userAU = raw.autoUpdate ?? {};
   raw.autoUpdate = { ...defaultAU, ...userAU };
 }
+function normalizeOrchestration(raw) {
+  const defaultOrg = DEFAULT_CONFIG.orchestration;
+  const userOrg = raw.orchestration ?? {};
+  raw.orchestration = { ...defaultOrg, ...userOrg };
+}
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   await ensurePrivateDir(dir);
@@ -173,6 +178,7 @@ async function loadConfig() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     const config2 = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
     if (config2.dbPath.startsWith("~")) {
       config2.dbPath = config2.dbPath.replace(/^~/, os.homedir());
@@ -196,6 +202,7 @@ function loadConfigSync() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
@@ -217,6 +224,7 @@ async function loadConfigFrom(configPath) {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG };
@@ -288,6 +296,10 @@ var init_config = __esm({
         checkOnBoot: true,
         autoInstall: false,
         checkIntervalMs: 24 * 60 * 60 * 1e3
+      },
+      orchestration: {
+        phase: "phase_1_coo",
+        phaseSetBy: "default"
       }
     };
     CONFIG_MIGRATIONS = [
@@ -313,6 +325,15 @@ var init_memory = __esm({
 });
 
 // src/lib/daemon-protocol.ts
+var daemon_protocol_exports = {};
+__export(daemon_protocol_exports, {
+  deserializeArgs: () => deserializeArgs,
+  deserializeResultSet: () => deserializeResultSet,
+  deserializeValue: () => deserializeValue,
+  serializeArgs: () => serializeArgs,
+  serializeResultSet: () => serializeResultSet,
+  serializeValue: () => serializeValue
+});
 function serializeValue(v) {
   if (v === null || v === void 0) return null;
   if (typeof v === "bigint") return Number(v);
@@ -337,6 +358,9 @@ function deserializeValue(v) {
   }
   return v;
 }
+function serializeArgs(args) {
+  return args.map(serializeValue);
+}
 function deserializeArgs(args) {
   return args.map(deserializeValue);
 }
@@ -4319,8 +4343,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync35 } = __require("fs");
-    return readFileSync35("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync36 } = __require("fs");
+    return readFileSync36("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -4611,6 +4635,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Founder -> coordinator (the executive agent, internally routed as 'COO') -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the coordinator does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
       },
+      {
+        title: "Customer orchestration maturity \u2014 recommend, never trap",
+        domain: "workflow",
+        priority: "p1",
+        content: "New customers start best in Phase 1: founder \u2194 coordinator/Chief of Staff, building company context. Suggest Phase 2 executives when domain work repeats; suggest Phase 3 parallel execution only when review/permission gates are ready. This is guidance, not a blocker: users may jump phases anytime. Never overwrite their phase, role titles, identities, or custom org design."
+      },
       {
         title: "Single dispatch path \u2014 create_task only",
         domain: "workflow",
@@ -4669,6 +4699,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Commit discipline \u2014 never leave verified work floating",
+        domain: "workflow",
+        priority: "p1",
+        content: "After any code-change batch passes typecheck/tests/build, run git status, summarize changed files, and commit with a clear message before ending the session. If work must remain uncommitted for review/dogfood, explicitly say so, list the files, and state the blocker. Never imply work is complete while verified changes are still floating locally."
+      },
       {
         title: "Desktop and TUI are the same product",
         domain: "architecture",
@@ -6006,10 +6042,10 @@ async function disposeEmbedder() {
 async function embedDirect(text3) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync42 } = await import("fs");
-  const path55 = await import("path");
-  const modelPath = path55.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync42(modelPath)) {
+  const { existsSync: existsSync43 } = await import("fs");
+  const path56 = await import("path");
+  const modelPath = path56.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync43(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -7100,10 +7136,10 @@ async function hybridSearch(queryText, agentId, options) {
     };
     try {
       const fs = await import("fs");
-      const path55 = await import("path");
+      const path56 = await import("path");
       const os24 = await import("os");
-      const logPath = path55.join(os24.homedir(), ".exe-os", "search-quality.jsonl");
-      fs.mkdirSync(path55.dirname(logPath), { recursive: true });
+      const logPath = path56.join(os24.homedir(), ".exe-os", "search-quality.jsonl");
+      fs.mkdirSync(path56.dirname(logPath), { recursive: true });
       fs.appendFileSync(logPath, JSON.stringify(logEntry) + "\n");
     } catch {
     }
@@ -8736,8 +8772,8 @@ __export(wiki_client_exports, {
   listDocuments: () => listDocuments,
   listWorkspaces: () => listWorkspaces
 });
-async function wikiFetch(config2, path55, method = "GET", body) {
-  const url = `${config2.baseUrl}/api/v1${path55}`;
+async function wikiFetch(config2, path56, method = "GET", body) {
+  const url = `${config2.baseUrl}/api/v1${path56}`;
   const headers = {
     Authorization: `Bearer ${config2.apiKey}`,
     "Content-Type": "application/json"
@@ -8770,7 +8806,7 @@ async function wikiFetch(config2, path55, method = "GET", body) {
       }
     }
     if (!response.ok) {
-      throw new Error(`Wiki API ${method} ${path55}: ${response.status} ${response.statusText}`);
+      throw new Error(`Wiki API ${method} ${path56}: ${response.status} ${response.statusText}`);
     }
     return response.json();
   } finally {
@@ -14348,10 +14384,10 @@ function registerCreateTask(server) {
         skipDispatch: true
       });
       try {
-        const { existsSync: existsSync42, mkdirSync: mkdirSync21, writeFileSync: writeFileSync25 } = await import("fs");
+        const { existsSync: existsSync43, mkdirSync: mkdirSync22, writeFileSync: writeFileSync26 } = await import("fs");
         const { identityPath: identityPath2 } = await Promise.resolve().then(() => (init_identity(), identity_exports));
         const idPath = identityPath2(assigned_to);
-        if (!existsSync42(idPath)) {
+        if (!existsSync43(idPath)) {
           const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
           const employees = await loadEmployees2();
           const emp = employees.find((e) => e.name === assigned_to);
@@ -14360,8 +14396,8 @@ function registerCreateTask(server) {
             const template = getTemplateForTitle2(emp.role);
             if (template) {
               const dir = (await import("path")).dirname(idPath);
-              if (!existsSync42(dir)) mkdirSync21(dir, { recursive: true });
-              writeFileSync25(idPath, template.replace(/^agent_id: \w+/m, `agent_id: ${assigned_to}`), "utf-8");
+              if (!existsSync43(dir)) mkdirSync22(dir, { recursive: true });
+              writeFileSync26(idPath, template.replace(/^agent_id: \w+/m, `agent_id: ${assigned_to}`), "utf-8");
             }
           }
         }
@@ -17845,12 +17881,12 @@ function registerExportGraph(server) {
         }
         const html = await exportGraphHTML(client);
         const fs = await import("fs");
-        const path55 = await import("path");
+        const path56 = await import("path");
         const os24 = await import("os");
-        const outDir = path55.join(os24.homedir(), ".exe-os", "exports");
+        const outDir = path56.join(os24.homedir(), ".exe-os", "exports");
         fs.mkdirSync(outDir, { recursive: true });
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
-        const filePath = path55.join(outDir, `graph-${timestamp}.html`);
+        const filePath = path56.join(outDir, `graph-${timestamp}.html`);
         fs.writeFileSync(filePath, html, "utf-8");
         return {
           content: [
@@ -21029,6 +21065,259 @@ var init_conflict_detector = __esm({
   }
 });
 
+// src/adapters/runtime-hook-manifest.ts
+function manifestEntryForCommand(command) {
+  return EXE_HOOK_MANIFEST.find((entry) => command.includes(entry.commandMarker));
+}
+var EXE_HOOKS, EXE_HOOK_MANIFEST, LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS;
+var init_runtime_hook_manifest = __esm({
+  "src/adapters/runtime-hook-manifest.ts"() {
+    "use strict";
+    EXE_HOOKS = {
+      postToolCombined: "dist/hooks/post-tool-combined.js",
+      sessionStart: "dist/hooks/session-start.js",
+      promptSubmit: "dist/hooks/prompt-submit.js",
+      heartbeat: "dist/hooks/exe-heartbeat-hook.js",
+      stop: "dist/hooks/stop.js",
+      preToolUse: "dist/hooks/pre-tool-use.js",
+      subagentStop: "dist/hooks/subagent-stop.js",
+      preCompact: "dist/hooks/pre-compact.js",
+      postCompact: "dist/hooks/post-compact.js",
+      sessionEnd: "dist/hooks/session-end.js",
+      notification: "dist/hooks/notification.js",
+      instructionsLoaded: "dist/hooks/instructions-loaded.js"
+    };
+    EXE_HOOK_MANIFEST = [
+      {
+        key: "postToolCombined",
+        event: "PostToolUse",
+        commandMarker: EXE_HOOKS.postToolCombined,
+        owner: "exe-os",
+        purpose: "Single PostToolUse entrypoint for ingestion, error recall, summaries, and bug detection.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "sessionStart",
+        event: "SessionStart",
+        commandMarker: EXE_HOOKS.sessionStart,
+        owner: "exe-os",
+        purpose: "Loads agent identity, procedures, and boot context.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "promptSubmit",
+        event: "UserPromptSubmit",
+        commandMarker: EXE_HOOKS.promptSubmit,
+        owner: "exe-os",
+        purpose: "Injects current tasks, pending reviews, and local context before each prompt.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "heartbeat",
+        event: "UserPromptSubmit",
+        commandMarker: EXE_HOOKS.heartbeat,
+        owner: "exe-os",
+        purpose: "Lightweight heartbeat/status sidecar for Claude Code sessions.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      },
+      {
+        key: "stop",
+        event: "Stop",
+        commandMarker: EXE_HOOKS.stop,
+        owner: "exe-os",
+        purpose: "Finalizes task state, capacity signals, and emergency checkpointing.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "capacity_checkpoint"
+      },
+      {
+        key: "preToolUse",
+        event: "PreToolUse",
+        commandMarker: EXE_HOOKS.preToolUse,
+        owner: "exe-os",
+        purpose: "Preflight guardrails before shell/tool execution.",
+        runtimes: ["claude", "codex", "opencode"],
+        checkpointRole: "none"
+      },
+      {
+        key: "subagentStop",
+        event: "SubagentStop",
+        commandMarker: EXE_HOOKS.subagentStop,
+        owner: "exe-os",
+        purpose: "Captures subagent completion context.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      },
+      {
+        key: "preCompact",
+        event: "PreCompact",
+        commandMarker: EXE_HOOKS.preCompact,
+        owner: "exe-os",
+        purpose: "Writes active-task snapshot and compaction recovery context.",
+        runtimes: ["claude"],
+        checkpointRole: "recovery_context"
+      },
+      {
+        key: "postCompact",
+        event: "PostCompact",
+        commandMarker: EXE_HOOKS.postCompact,
+        owner: "exe-os",
+        purpose: "Rehydrates recovery context after compaction.",
+        runtimes: ["claude"],
+        checkpointRole: "recovery_context"
+      },
+      {
+        key: "sessionEnd",
+        event: "SessionEnd",
+        commandMarker: EXE_HOOKS.sessionEnd,
+        owner: "exe-os",
+        purpose: "Stores session-end checkpoint and triages orphaned in-progress tasks.",
+        runtimes: ["claude"],
+        checkpointRole: "session_summary"
+      },
+      {
+        key: "notification",
+        event: "Notification",
+        commandMarker: EXE_HOOKS.notification,
+        owner: "exe-os",
+        purpose: "Captures runtime notifications and nudges.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      },
+      {
+        key: "instructionsLoaded",
+        event: "InstructionsLoaded",
+        commandMarker: EXE_HOOKS.instructionsLoaded,
+        owner: "exe-os",
+        purpose: "Applies runtime instruction post-processing.",
+        runtimes: ["claude"],
+        checkpointRole: "none"
+      }
+    ];
+    LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS = [
+      "dist/hooks/ingest.js",
+      "dist/hooks/error-recall.js",
+      "dist/hooks/ingest-worker.js"
+    ];
+  }
+});
+
+// src/lib/key-backup-status.ts
+var key_backup_status_exports = {};
+__export(key_backup_status_exports, {
+  getKeyBackupStatus: () => getKeyBackupStatus,
+  keyBackupMarkerPath: () => keyBackupMarkerPath,
+  markKeyBackupConfirmed: () => markKeyBackupConfirmed
+});
+import { existsSync as existsSync30, mkdirSync as mkdirSync12, readFileSync as readFileSync23, writeFileSync as writeFileSync16 } from "fs";
+import path35 from "path";
+function keyBackupMarkerPath() {
+  return path35.join(EXE_AI_DIR, "key-backup-confirmed.json");
+}
+function getKeyBackupStatus() {
+  const marker = keyBackupMarkerPath();
+  if (!existsSync30(marker)) return { exists: false };
+  try {
+    const parsed = JSON.parse(readFileSync23(marker, "utf8"));
+    return {
+      exists: true,
+      confirmedAt: parsed.confirmedAt,
+      source: parsed.source
+    };
+  } catch {
+    return { exists: true };
+  }
+}
+function markKeyBackupConfirmed(source) {
+  mkdirSync12(EXE_AI_DIR, { recursive: true, mode: 448 });
+  writeFileSync16(
+    keyBackupMarkerPath(),
+    JSON.stringify({ confirmedAt: (/* @__PURE__ */ new Date()).toISOString(), source }, null, 2) + "\n",
+    { mode: 384 }
+  );
+}
+var init_key_backup_status = __esm({
+  "src/lib/key-backup-status.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+
+// src/bin/fast-db-init.ts
+var fast_db_init_exports = {};
+__export(fast_db_init_exports, {
+  fastDbInit: () => fastDbInit
+});
+async function fastDbInit() {
+  const { isInitialized: isInitialized2, getClient: getClient2, setExternalClient: setExternalClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  if (isInitialized2()) {
+    return getClient2();
+  }
+  try {
+    const { connectEmbedDaemon: connectEmbedDaemon2, sendDaemonRequest: sendDaemonRequest2, isClientConnected: isClientConnected2 } = await Promise.resolve().then(() => (init_exe_daemon_client(), exe_daemon_client_exports));
+    const { deserializeResultSet: deserializeResultSet2 } = await Promise.resolve().then(() => (init_daemon_protocol(), daemon_protocol_exports));
+    await connectEmbedDaemon2();
+    if (isClientConnected2()) {
+      const daemonClient = {
+        async execute(stmt) {
+          const sql = typeof stmt === "string" ? stmt : stmt.sql;
+          const args = typeof stmt === "string" ? [] : Array.isArray(stmt.args) ? stmt.args : [];
+          const resp = await sendDaemonRequest2({ type: "db-execute", sql, args });
+          if (resp.error) throw new Error(String(resp.error));
+          if (resp.db) return deserializeResultSet2(resp.db);
+          throw new Error("Unexpected daemon response");
+        },
+        async batch(stmts, mode) {
+          const statements = stmts.map((s) => {
+            const sql = typeof s === "string" ? s : s.sql;
+            const args = typeof s === "string" ? [] : Array.isArray(s.args) ? s.args : [];
+            return { sql, args };
+          });
+          const resp = await sendDaemonRequest2({ type: "db-batch", statements, mode: mode ?? "deferred" });
+          if (resp.error) throw new Error(String(resp.error));
+          const batchResults = resp["db-batch"];
+          if (batchResults) return batchResults.map(deserializeResultSet2);
+          throw new Error("Unexpected daemon batch response");
+        },
+        async transaction(_mode) {
+          throw new Error("Transactions not supported via daemon socket");
+        },
+        async executeMultiple(_sql) {
+          throw new Error("executeMultiple not supported via daemon socket");
+        },
+        async migrate(_stmts) {
+          throw new Error("migrate not supported via daemon socket");
+        },
+        sync() {
+          return Promise.resolve(void 0);
+        },
+        close() {
+        },
+        get closed() {
+          return false;
+        },
+        get protocol() {
+          return "file";
+        }
+      };
+      setExternalClient2(daemonClient);
+      return daemonClient;
+    }
+  } catch {
+  }
+  const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+  await initStore2({ lightweight: true });
+  return getClient2();
+}
+var init_fast_db_init = __esm({
+  "src/bin/fast-db-init.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/db-backup.ts
 var db_backup_exports = {};
 __export(db_backup_exports, {
@@ -21040,33 +21329,33 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync, existsSync as existsSync30, mkdirSync as mkdirSync12, readdirSync as readdirSync10, unlinkSync as unlinkSync10, statSync as statSync5 } from "fs";
-import path35 from "path";
+import { copyFileSync, existsSync as existsSync31, mkdirSync as mkdirSync13, readdirSync as readdirSync10, unlinkSync as unlinkSync10, statSync as statSync5 } from "fs";
+import path36 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
-    const p = path35.join(EXE_AI_DIR, name);
-    if (existsSync30(p)) return p;
+    const p = path36.join(EXE_AI_DIR, name);
+    if (existsSync31(p)) return p;
   }
   return null;
 }
 function createBackup(reason = "manual") {
   const dbPath = findActiveDb();
   if (!dbPath) return null;
-  mkdirSync12(BACKUP_DIR, { recursive: true });
-  const dbName = path35.basename(dbPath, ".db");
+  mkdirSync13(BACKUP_DIR, { recursive: true });
+  const dbName = path36.basename(dbPath, ".db");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const backupName = `${dbName}-${reason}-${timestamp}.db`;
-  const backupPath = path35.join(BACKUP_DIR, backupName);
+  const backupPath = path36.join(BACKUP_DIR, backupName);
   copyFileSync(dbPath, backupPath);
   const walPath = dbPath + "-wal";
-  if (existsSync30(walPath)) {
+  if (existsSync31(walPath)) {
     try {
       copyFileSync(walPath, backupPath + "-wal");
     } catch {
     }
   }
   const shmPath = dbPath + "-shm";
-  if (existsSync30(shmPath)) {
+  if (existsSync31(shmPath)) {
     try {
       copyFileSync(shmPath, backupPath + "-shm");
     } catch {
@@ -21075,14 +21364,14 @@ function createBackup(reason = "manual") {
   return backupPath;
 }
 function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
-  if (!existsSync30(BACKUP_DIR)) return 0;
+  if (!existsSync31(BACKUP_DIR)) return 0;
   const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
   let deleted = 0;
   try {
     const files = readdirSync10(BACKUP_DIR);
     for (const file of files) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
-      const filePath = path35.join(BACKUP_DIR, file);
+      const filePath = path36.join(BACKUP_DIR, file);
       try {
         const stat = statSync5(filePath);
         if (stat.mtimeMs < cutoff) {
@@ -21097,11 +21386,11 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
   return deleted;
 }
 function listBackups() {
-  if (!existsSync30(BACKUP_DIR)) return [];
+  if (!existsSync31(BACKUP_DIR)) return [];
   try {
     const files = readdirSync10(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
-      const p = path35.join(BACKUP_DIR, name);
+      const p = path36.join(BACKUP_DIR, name);
       const stat = statSync5(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
@@ -21126,7 +21415,7 @@ var init_db_backup = __esm({
   "src/lib/db-backup.ts"() {
     "use strict";
     init_config();
-    BACKUP_DIR = path35.join(EXE_AI_DIR, "backups");
+    BACKUP_DIR = path36.join(EXE_AI_DIR, "backups");
     DEFAULT_KEEP_DAYS = 3;
     DB_NAMES = ["memories.db", "exe-mem.db", "exe-os.db", "exe.db"];
   }
@@ -21134,9 +21423,9 @@ var init_db_backup = __esm({
 
 // src/bin/exe-doctor.ts
 import os16 from "os";
-import { existsSync as existsSync31, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync24 } from "fs";
 import { spawn as spawn2 } from "child_process";
-import path36 from "path";
+import path37 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 function parseFlags(argv) {
   const flags = { fix: false, dryRun: false, verbose: false, conflicts: false };
@@ -21288,7 +21577,7 @@ async function auditOrphanedProjects(client) {
   for (const row of result.rows) {
     const name = row.project_name;
     const count = Number(row.cnt);
-    const exists = existsSync31(path36.join(home, name)) || existsSync31(path36.join(home, "..", name)) || existsSync31(path36.join(process.cwd(), "..", name));
+    const exists = existsSync32(path37.join(home, name)) || existsSync32(path37.join(home, "..", name)) || existsSync32(path37.join(process.cwd(), "..", name));
     if (!exists) {
       orphans.push({ project_name: name, count });
     }
@@ -21296,18 +21585,18 @@ async function auditOrphanedProjects(client) {
   return orphans;
 }
 function auditHookHealth() {
-  const logPath = path36.join(
+  const logPath = path37.join(
     process.env.HOME ?? process.env.USERPROFILE ?? "",
     ".exe-os",
     "logs",
     "hooks.log"
   );
-  if (!existsSync31(logPath)) {
+  if (!existsSync32(logPath)) {
     return { logExists: false, totalLines: 0, errorsLastHour: 0, topPatterns: [] };
   }
   let content;
   try {
-    content = readFileSync23(logPath, "utf-8");
+    content = readFileSync24(logPath, "utf-8");
   } catch {
     return { logExists: false, totalLines: 0, errorsLastHour: 0, topPatterns: [] };
   }
@@ -21335,6 +21624,121 @@ function auditHookHealth() {
   const topPatterns = [...patternCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([pattern, count]) => ({ pattern, count }));
   return { logExists: true, totalLines, errorsLastHour, topPatterns };
 }
+function safeReadJson(filePath) {
+  if (!existsSync32(filePath)) return null;
+  try {
+    return JSON.parse(readFileSync24(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function collectHookCommandsFromClaudeSettings(settings) {
+  const hooks = settings?.hooks;
+  if (!hooks || typeof hooks !== "object") return [];
+  const commands = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      const hooksForGroup = group?.hooks;
+      if (!Array.isArray(hooksForGroup)) continue;
+      for (const hook of hooksForGroup) {
+        const command = hook?.command;
+        if (typeof command === "string") commands.push({ event, command });
+      }
+    }
+  }
+  return commands;
+}
+function collectHookCommandsFromCodexHooks(config2) {
+  const commands = [];
+  if (!config2 || typeof config2 !== "object") return commands;
+  const root = config2;
+  for (const [event, value] of Object.entries(root)) {
+    const entries = Array.isArray(value) ? value : value && typeof value === "object" ? Object.values(value) : [];
+    for (const entry of entries) {
+      if (typeof entry === "string") commands.push({ event, command: entry });
+      const command = entry?.command;
+      if (typeof command === "string") commands.push({ event, command });
+    }
+  }
+  return commands;
+}
+function buildHookOwnershipIssues(runtime, commands) {
+  const issues = [];
+  for (const marker of LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS) {
+    const count = commands.filter((cmd) => cmd.command.includes(marker)).length;
+    if (count > 0) {
+      issues.push({
+        runtime,
+        event: "PostToolUse",
+        marker,
+        count,
+        message: `Legacy split PostToolUse hook still installed: ${marker}`
+      });
+    }
+  }
+  for (const entry of EXE_HOOK_MANIFEST.filter((hook) => hook.runtimes.includes(runtime))) {
+    const matching = commands.filter((cmd) => cmd.command.includes(entry.commandMarker));
+    if (matching.length > 1) {
+      issues.push({
+        runtime,
+        event: entry.event,
+        marker: entry.commandMarker,
+        count: matching.length,
+        message: `Duplicate exe-os hook owner for ${entry.event}: ${entry.commandMarker}`
+      });
+    }
+    for (const cmd of matching) {
+      if (cmd.event !== entry.event) {
+        issues.push({
+          runtime,
+          event: cmd.event,
+          marker: entry.commandMarker,
+          count: 1,
+          message: `exe-os hook ${entry.commandMarker} is registered under ${cmd.event}, expected ${entry.event}`
+        });
+      }
+    }
+  }
+  for (const cmd of commands) {
+    if (!cmd.command.includes("dist/hooks/")) continue;
+    if (!cmd.command.includes("exe-os")) continue;
+    const entry = manifestEntryForCommand(cmd.command);
+    const isLegacy = LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS.some((marker) => cmd.command.includes(marker));
+    if (!entry && !isLegacy) {
+      issues.push({
+        runtime,
+        event: cmd.event,
+        marker: "dist/hooks/",
+        count: 1,
+        message: `Unknown exe-os hook command not present in ownership manifest: ${cmd.command.slice(0, 160)}`
+      });
+    }
+  }
+  return issues;
+}
+function auditHookOwnership() {
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  const checkedFiles = [];
+  const issues = [];
+  const claudeSettingsPath = path37.join(home, ".claude", "settings.json");
+  const claudeSettings = safeReadJson(claudeSettingsPath);
+  if (claudeSettings) {
+    checkedFiles.push(claudeSettingsPath);
+    issues.push(...buildHookOwnershipIssues("claude", collectHookCommandsFromClaudeSettings(claudeSettings)));
+  }
+  const codexHooksPath = path37.join(home, ".codex", "hooks.json");
+  const codexHooks = safeReadJson(codexHooksPath);
+  if (codexHooks) {
+    checkedFiles.push(codexHooksPath);
+    issues.push(...buildHookOwnershipIssues("codex", collectHookCommandsFromCodexHooks(codexHooks)));
+  }
+  return {
+    checkedFiles,
+    issues,
+    staleLegacyHooks: issues.filter((issue) => issue.message.includes("Legacy split"))
+  };
+}
 async function auditShards() {
   try {
     const { auditShardHealth: auditShardHealth2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
@@ -21350,16 +21754,33 @@ async function auditShards() {
     return { total: 0, ok: 0, unreadable: 0, archived: 0, unreadableNames: [] };
   }
 }
+async function auditKeyHealth() {
+  try {
+    const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+    const { getKeyBackupStatus: getKeyBackupStatus2 } = await Promise.resolve().then(() => (init_key_backup_status(), key_backup_status_exports));
+    const key = await getMasterKey2();
+    const backup = getKeyBackupStatus2();
+    return {
+      masterKeyPresent: Boolean(key),
+      recoveryBackupMarked: backup.exists,
+      recoveryBackupConfirmedAt: backup.confirmedAt,
+      recoveryBackupSource: backup.source
+    };
+  } catch {
+    return { masterKeyPresent: false, recoveryBackupMarked: false };
+  }
+}
 async function runAudit(client, flags) {
   const runConflicts = flags.conflicts || process.env.EXE_AUDIT_CONFLICTS === "1";
-  const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards] = await Promise.all([
+  const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards, keyHealth] = await Promise.all([
     auditStats(client, flags),
     auditNullVectors(client, flags),
     auditDuplicates(client, flags),
     auditBloated(client, flags),
     auditFts(client),
     auditOrphanedProjects(client),
-    auditShards()
+    auditShards(),
+    auditKeyHealth()
   ]);
   let conflicts;
   if (runConflicts) {
@@ -21379,7 +21800,8 @@ async function runAudit(client, flags) {
   }
   const duplicateCount = duplicates.reduce((sum, d) => sum + d.delete_ids.length, 0);
   const hookHealth = auditHookHealth();
-  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, shards };
+  const hookOwnership = auditHookOwnership();
+  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, shards, keyHealth };
 }
 function indicator(value, warn) {
   if (value === 0) return "\u{1F7E2}";
@@ -21427,6 +21849,15 @@ function formatReport(report, flags) {
   lines.push(`${indicator(report.bloated.length, 20)} Bloated (>5KB):   ${fmtNum(report.bloated.length)} / ${fmtNum(s.total)} (${pct(report.bloated.length, s.total)})`);
   const ftsIndicator = report.fts.inSync ? "\u{1F7E2}" : "\u{1F534}";
   lines.push(`${ftsIndicator} FTS index:        ${report.fts.inSync ? "in sync" : "OUT OF SYNC"} (${fmtNum(report.fts.memoryCount)} / ${fmtNum(report.fts.ftsCount)})`);
+  const kh = report.keyHealth;
+  if (!kh.masterKeyPresent) {
+    lines.push("\u{1F534} Recovery key:    master key missing \u2014 import phrase or run setup before syncing");
+  } else if (!kh.recoveryBackupMarked) {
+    lines.push("\u{1F534} Recovery backup: not confirmed \u2014 run `exe-os link export --local-terminal-only` and save the 24-word phrase");
+  } else {
+    const suffix = kh.recoveryBackupConfirmedAt ? ` (${kh.recoveryBackupConfirmedAt.slice(0, 10)}${kh.recoveryBackupSource ? ` via ${kh.recoveryBackupSource}` : ""})` : "";
+    lines.push(`\u{1F7E2} Recovery backup: confirmed${suffix}`);
+  }
   if (report.orphanedProjects.length > 0) {
     const orphanList = report.orphanedProjects.map((o) => `${o.project_name} \u2014 ${o.count} memories`).join(", ");
     lines.push(`\u2139\uFE0F  Orphaned projects: ${report.orphanedProjects.length} (${orphanList})`);
@@ -21458,6 +21889,15 @@ function formatReport(report, flags) {
       lines.push(`                     ${p.count}x: ${p.pattern}`);
     }
   }
+  const ho = report.hookOwnership;
+  if (ho.issues.length === 0) {
+    lines.push(`\u{1F7E2} Hook ownership:  ${ho.checkedFiles.length > 0 ? "manifest clean" : "no local hook config found"}`);
+  } else {
+    lines.push(`\u{1F534} Hook ownership:  ${fmtNum(ho.issues.length)} issue(s)`);
+    for (const issue of ho.issues.slice(0, 5)) {
+      lines.push(`                     [${issue.runtime}/${issue.event}] ${issue.message}`);
+    }
+  }
   const sh = report.shards;
   if (sh.total > 0) {
     if (sh.unreadable === 0) {
@@ -21527,6 +21967,9 @@ function formatReport(report, flags) {
   if (report.conflicts.superseded > 0) {
     recs.push(`${fmtNum(report.conflicts.superseded)} superseded memories can be deactivated`);
   }
+  if (report.hookOwnership.issues.length > 0) {
+    recs.push(`Run exe-os install to refresh hook config; remove stale exe-os hook commands if they remain`);
+  }
   if (recs.length > 0) {
     lines.push("Recommendations:");
     for (const r of recs) {
@@ -21548,7 +21991,7 @@ async function fixNullVectors() {
     }
   }
   const npmRoot = (await import("child_process")).execSync("npm root -g", { encoding: "utf8" }).trim();
-  const backfillPath = path36.join(npmRoot, "exe-os", "dist", "bin", "backfill-vectors.js");
+  const backfillPath = path37.join(npmRoot, "exe-os", "dist", "bin", "backfill-vectors.js");
   return new Promise((resolve, reject) => {
     const child = spawn2("node", [backfillPath], { stdio: "inherit" });
     if (child.pid) registerWorkerPid2(child.pid);
@@ -21660,8 +22103,8 @@ function splitAtSentences(text3, maxChunkSize) {
 }
 async function main(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
-  await initStore();
-  const client = getClient();
+  const { fastDbInit: fastDbInit2 } = await Promise.resolve().then(() => (init_fast_db_init(), fast_db_init_exports));
+  const client = await fastDbInit2();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
   if (flags.fix || flags.dryRun) {
@@ -21721,10 +22164,9 @@ ${mode} Complete.`);
 var init_exe_doctor = __esm({
   "src/bin/exe-doctor.ts"() {
     "use strict";
-    init_store();
-    init_database();
     init_is_main();
     init_conflict_detector();
+    init_runtime_hook_manifest();
     if (isMainModule(import.meta.url) && (process.argv[1] ?? "").includes("exe-doctor")) {
       main().catch((err) => {
         console.error(err instanceof Error ? err.message : String(err));
@@ -21960,8 +22402,8 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync24, writeFileSync as writeFileSync16, existsSync as existsSync32, mkdirSync as mkdirSync13, unlinkSync as unlinkSync11 } from "fs";
-import path37 from "path";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync17, existsSync as existsSync33, mkdirSync as mkdirSync14, unlinkSync as unlinkSync11 } from "fs";
+import path38 from "path";
 import { homedir as homedir5 } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
@@ -21973,9 +22415,9 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync32(sp)) {
+  if (existsSync33(sp)) {
     try {
-      const state = readFileSync24(sp);
+      const state = readFileSync25(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
@@ -22117,10 +22559,10 @@ function persistState() {
   if (!doc) return;
   try {
     const sp = getStatePath();
-    const dir = path37.dirname(sp);
-    if (!existsSync32(dir)) mkdirSync13(dir, { recursive: true });
+    const dir = path38.dirname(sp);
+    if (!existsSync33(dir)) mkdirSync14(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
-    writeFileSync16(sp, Buffer.from(state));
+    writeFileSync17(sp, Buffer.from(state));
   } catch {
   }
 }
@@ -22161,7 +22603,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path37.join(homedir5(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path38.join(homedir5(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -22170,8 +22612,10 @@ var init_crdt_sync = __esm({
 // src/lib/cloud-sync.ts
 var cloud_sync_exports = {};
 __export(cloud_sync_exports, {
+  CLOUD_RELINK_REQUIRED_MESSAGE: () => CLOUD_RELINK_REQUIRED_MESSAGE,
   assertSecureEndpoint: () => assertSecureEndpoint,
   buildRosterBlob: () => buildRosterBlob,
+  clearCloudRelinkRequired: () => clearCloudRelinkRequired,
   cloudPull: () => cloudPull,
   cloudPullBehaviors: () => cloudPullBehaviors,
   cloudPullBlob: () => cloudPullBlob,
@@ -22191,21 +22635,22 @@ __export(cloud_sync_exports, {
   cloudPushRoster: () => cloudPushRoster,
   cloudPushTasks: () => cloudPushTasks,
   cloudSync: () => cloudSync,
+  getCloudRelinkRequired: () => getCloudRelinkRequired,
   mergeConfig: () => mergeConfig,
   mergeRosterFromRemote: () => mergeRosterFromRemote,
   pushToPostgres: () => pushToPostgres,
   recordRosterDeletion: () => recordRosterDeletion
 });
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync17, existsSync as existsSync33, readdirSync as readdirSync11, mkdirSync as mkdirSync14, appendFileSync as appendFileSync3, unlinkSync as unlinkSync12, openSync as openSync2, closeSync as closeSync2, statSync as statSync6 } from "fs";
+import { readFileSync as readFileSync26, writeFileSync as writeFileSync18, existsSync as existsSync34, readdirSync as readdirSync11, mkdirSync as mkdirSync15, appendFileSync as appendFileSync3, unlinkSync as unlinkSync12, openSync as openSync2, closeSync as closeSync2, statSync as statSync6 } from "fs";
 import crypto16 from "crypto";
-import path38 from "path";
+import path39 from "path";
 import { homedir as homedir6 } from "os";
 function sqlSafe(v) {
   return v === void 0 ? null : v;
 }
 function logError(msg) {
   try {
-    const logPath = path38.join(homedir6(), ".exe-os", "workers.log");
+    const logPath = path39.join(homedir6(), ".exe-os", "workers.log");
     appendFileSync3(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -22216,12 +22661,12 @@ function isTruthyEnv2(value) {
 }
 function loadPgClient() {
   if (_pgFailed) return null;
-  const configPath = path38.join(EXE_AI_DIR, "config.json");
+  const configPath = path39.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
   let configEnabled = false;
   try {
-    if (existsSync33(configPath)) {
-      const cfg = JSON.parse(readFileSync25(configPath, "utf8"));
+    if (existsSync34(configPath)) {
+      const cfg = JSON.parse(readFileSync26(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
       configEnabled = cfg.cloud?.syncToPostgres === true;
     }
@@ -22248,8 +22693,8 @@ function loadPgClient() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path38.join(homedir6(), "exe-db");
-      const req = createRequire7(path38.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path39.join(homedir6(), "exe-db");
+      const req = createRequire7(path39.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL7(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -22294,18 +22739,18 @@ async function withRosterLock(fn) {
   try {
     const fd = openSync2(ROSTER_LOCK_PATH, "wx");
     closeSync2(fd);
-    writeFileSync17(ROSTER_LOCK_PATH, String(Date.now()));
+    writeFileSync18(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
-        const ts2 = parseInt(readFileSync25(ROSTER_LOCK_PATH, "utf-8"), 10);
+        const ts2 = parseInt(readFileSync26(ROSTER_LOCK_PATH, "utf-8"), 10);
         if (Date.now() - ts2 < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
         unlinkSync12(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
-        writeFileSync17(ROSTER_LOCK_PATH, String(Date.now()));
+        writeFileSync18(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
         throw new Error("Roster merge already in progress \u2014 another sync is running");
@@ -22424,6 +22869,24 @@ async function cloudPull(sinceVersion, config2) {
     return { records: [], maxVersion: sinceVersion };
   }
 }
+async function getCloudRelinkRequired(client = getClient()) {
+  try {
+    await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    return String(relink.rows[0]?.value ?? "") === "1";
+  } catch {
+    return false;
+  }
+}
+async function clearCloudRelinkRequired(client = getClient()) {
+  await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  await client.execute("INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relink_required', '0')");
+  await client.execute({
+    sql: "INSERT OR REPLACE INTO sync_meta (key, value) VALUES ('cloud_relinked_at', ?)",
+    args: [(/* @__PURE__ */ new Date()).toISOString()]
+  });
+  await client.execute("DELETE FROM sync_meta WHERE key IN ('last_cloud_pull_version', 'last_cloud_push_version')");
+}
 async function cloudSync(config2) {
   if (!isSyncCryptoInitialized()) {
     try {
@@ -22445,10 +22908,7 @@ async function cloudSync(config2) {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
   try {
-    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
-    if (String(relink.rows[0]?.value ?? "") === "1") {
-      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
-    }
+    if (await getCloudRelinkRequired(client)) throw new Error(CLOUD_RELINK_REQUIRED_MESSAGE);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("Paused after key rotation")) throw err;
@@ -22698,8 +23158,8 @@ async function cloudSync(config2) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path38.join(EXE_AI_DIR, "identity");
-    if (existsSync33(idDir)) {
+    const idDir = path39.join(EXE_AI_DIR, "identity");
+    if (existsSync34(idDir)) {
       rosterResult.identities = readdirSync11(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
@@ -22712,7 +23172,7 @@ async function cloudSync(config2) {
       const backupSize = statSync6(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
-        const backupData = readFileSync25(latestBackup);
+        const backupData = readFileSync26(latestBackup);
         const deviceId = loadDeviceId() ?? "unknown";
         const encrypted = encryptSyncBlob(backupData);
         const backupRes = await fetchWithRetry(`${config2.endpoint}/sync/push-db-backup`, {
@@ -22720,7 +23180,7 @@ async function cloudSync(config2) {
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${config2.apiKey}` },
           body: JSON.stringify({
             device_id: deviceId,
-            filename: path38.basename(latestBackup),
+            filename: path39.basename(latestBackup),
             blob: encrypted,
             size: backupData.length
           })
@@ -22748,56 +23208,56 @@ async function cloudSync(config2) {
 function recordRosterDeletion(name) {
   let deletions = [];
   try {
-    if (existsSync33(ROSTER_DELETIONS_PATH)) {
-      deletions = JSON.parse(readFileSync25(ROSTER_DELETIONS_PATH, "utf-8"));
+    if (existsSync34(ROSTER_DELETIONS_PATH)) {
+      deletions = JSON.parse(readFileSync26(ROSTER_DELETIONS_PATH, "utf-8"));
     }
   } catch {
   }
   if (!deletions.includes(name)) deletions.push(name);
-  writeFileSync17(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
+  writeFileSync18(ROSTER_DELETIONS_PATH, JSON.stringify(deletions));
 }
 function consumeRosterDeletions() {
   try {
-    if (!existsSync33(ROSTER_DELETIONS_PATH)) return [];
-    const deletions = JSON.parse(readFileSync25(ROSTER_DELETIONS_PATH, "utf-8"));
-    writeFileSync17(ROSTER_DELETIONS_PATH, "[]");
+    if (!existsSync34(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync26(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync18(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
   } catch {
     return [];
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path38.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path38.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path38.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path39.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path39.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path39.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync33(rosterPath)) {
+  if (existsSync34(rosterPath)) {
     try {
-      roster = JSON.parse(readFileSync25(rosterPath, "utf-8"));
+      roster = JSON.parse(readFileSync26(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync33(identityDir)) {
+  if (existsSync34(identityDir)) {
     for (const file of readdirSync11(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync25(path38.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync26(path39.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config2;
-  if (existsSync33(configPath)) {
+  if (existsSync34(configPath)) {
     try {
-      config2 = JSON.parse(readFileSync25(configPath, "utf-8"));
+      config2 = JSON.parse(readFileSync26(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path38.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync33(agentConfigPath)) {
+  const agentConfigPath = path39.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync34(agentConfigPath)) {
     try {
-      agentConfig = JSON.parse(readFileSync25(agentConfigPath, "utf-8"));
+      agentConfig = JSON.parse(readFileSync26(agentConfigPath, "utf-8"));
     } catch {
     }
   }
@@ -22873,24 +23333,24 @@ async function cloudPullRoster(config2) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path38.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path39.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync33(cfgPath)) {
+  if (existsSync34(cfgPath)) {
     try {
-      local = JSON.parse(readFileSync25(cfgPath, "utf-8"));
+      local = JSON.parse(readFileSync26(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path38.dirname(cfgPath);
+  const dir = path39.dirname(cfgPath);
   ensurePrivateDirSync(dir);
-  writeFileSync17(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  writeFileSync18(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
   enforcePrivateFileSync(cfgPath);
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path38.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path39.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -22911,15 +23371,15 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync33(identityDir)) mkdirSync14(identityDir, { recursive: true });
-        const idPath = path38.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync34(identityDir)) mkdirSync15(identityDir, { recursive: true });
+        const idPath = path39.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync33(idPath) ? readFileSync25(idPath, "utf-8") : null;
+          localIdentity = existsSync34(idPath) ? readFileSync26(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
-          writeFileSync17(idPath, remoteIdentity, "utf-8");
+          writeFileSync18(idPath, remoteIdentity, "utf-8");
           identitiesUpdated++;
         }
       }
@@ -22945,17 +23405,17 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path38.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path39.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync33(agentConfigPath)) {
+        if (existsSync34(agentConfigPath)) {
           try {
-            local = JSON.parse(readFileSync25(agentConfigPath, "utf-8"));
+            local = JSON.parse(readFileSync26(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        ensurePrivateDirSync(path38.dirname(agentConfigPath));
-        writeFileSync17(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        ensurePrivateDirSync(path39.dirname(agentConfigPath));
+        writeFileSync18(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
         enforcePrivateFileSync(agentConfigPath);
       } catch {
       }
@@ -23380,7 +23840,7 @@ async function cloudPullDocuments(config2) {
   }
   return { pulled };
 }
-var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS2, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, ROSTER_DELETIONS_PATH;
+var LOCALHOST_PATTERNS, FETCH_TIMEOUT_MS2, PUSH_BATCH_SIZE, ROSTER_LOCK_PATH, LOCK_STALE_MS, _pgPromise, _pgFailed, CLOUD_RELINK_REQUIRED_MESSAGE, ROSTER_DELETIONS_PATH;
 var init_cloud_sync = __esm({
   "src/lib/cloud-sync.ts"() {
     "use strict";
@@ -23395,11 +23855,12 @@ var init_cloud_sync = __esm({
     LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
     FETCH_TIMEOUT_MS2 = 3e4;
     PUSH_BATCH_SIZE = 5e3;
-    ROSTER_LOCK_PATH = path38.join(EXE_AI_DIR, "roster-merge.lock");
+    ROSTER_LOCK_PATH = path39.join(EXE_AI_DIR, "roster-merge.lock");
     LOCK_STALE_MS = 3e4;
     _pgPromise = null;
     _pgFailed = false;
-    ROSTER_DELETIONS_PATH = path38.join(EXE_AI_DIR, "roster-deletions.json");
+    CLOUD_RELINK_REQUIRED_MESSAGE = "[cloud-sync] Paused after key rotation. Run `exe-os cloud relink --dry-run` for the safe relink checklist.";
+    ROSTER_DELETIONS_PATH = path39.join(EXE_AI_DIR, "roster-deletions.json");
   }
 });
 
@@ -23470,6 +23931,143 @@ var init_cloud_sync2 = __esm({
   }
 });
 
+// src/lib/orchestration-phase.ts
+function normalizeOrchestrationPhase(input) {
+  if (typeof input !== "string") return "phase_1_coo";
+  const normalized = input.trim().toLowerCase().replace(/\s+/g, "_");
+  if (["1", "phase1", "phase_1", "coo", "coo_mode", "chief_of_staff", "phase_1_coo"].includes(normalized)) {
+    return "phase_1_coo";
+  }
+  if (["2", "phase2", "phase_2", "executives", "executive", "executive_bench", "phase_2_executives"].includes(normalized)) {
+    return "phase_2_executives";
+  }
+  if (["3", "phase3", "phase_3", "parallel", "parallel_org", "parallel_execution", "phase_3_parallel_org"].includes(normalized)) {
+    return "phase_3_parallel_org";
+  }
+  if (ORCHESTRATION_PHASES.includes(normalized)) return normalized;
+  return "phase_1_coo";
+}
+function getOrchestrationPhaseInfo(phase) {
+  return PHASE_INFO[normalizeOrchestrationPhase(phase)];
+}
+async function loadOrchestrationPhase() {
+  const config2 = await loadConfig();
+  return getOrchestrationPhaseInfo(config2.orchestration?.phase);
+}
+async function setOrchestrationPhase(phaseInput, setBy = "user") {
+  const config2 = await loadConfig();
+  const phase = normalizeOrchestrationPhase(phaseInput);
+  config2.orchestration = {
+    ...config2.orchestration ?? {},
+    phase,
+    phaseSetAt: (/* @__PURE__ */ new Date()).toISOString(),
+    phaseSetBy: setBy
+  };
+  await saveConfig(config2);
+  return getOrchestrationPhaseInfo(phase);
+}
+var ORCHESTRATION_PHASES, PHASE_INFO;
+var init_orchestration_phase = __esm({
+  "src/lib/orchestration-phase.ts"() {
+    "use strict";
+    init_config();
+    ORCHESTRATION_PHASES = [
+      "phase_1_coo",
+      "phase_2_executives",
+      "phase_3_parallel_org"
+    ];
+    PHASE_INFO = {
+      phase_1_coo: {
+        phase: "phase_1_coo",
+        shortLabel: "Phase 1 \u2014 COO mode",
+        label: "Phase 1 \u2014 COO / Chief of Staff mode",
+        focus: "building company context before delegation",
+        nextSuggestion: "Unlock executives when technical, marketing, ops, legal, or finance work repeats."
+      },
+      phase_2_executives: {
+        phase: "phase_2_executives",
+        shortLabel: "Phase 2 \u2014 Executive bench",
+        label: "Phase 2 \u2014 Executive bench",
+        focus: "COO works with domain executives like CTO/CMO before specialist fan-out",
+        nextSuggestion: "Unlock parallel execution when review gates, permissions, and workflows are ready."
+      },
+      phase_3_parallel_org: {
+        phase: "phase_3_parallel_org",
+        shortLabel: "Phase 3 \u2014 Parallel org",
+        label: "Phase 3 \u2014 Parallel execution org",
+        focus: "executives can delegate to specialists in parallel with review gates",
+        nextSuggestion: "Keep review/CI/permission gates healthy; downgrade anytime if you want simpler COO-only mode."
+      }
+    };
+  }
+});
+
+// src/mcp/tools/orchestration-phase.ts
+import { z as z59 } from "zod";
+function render(info, prefix) {
+  return [
+    prefix,
+    `## ${info.label}`,
+    "",
+    `- **Focus:** ${info.focus}`,
+    `- **Suggestion:** ${info.nextSuggestion}`,
+    "",
+    "This is guidance, not a blocker. The user can switch phases anytime. Changing phase never overwrites role titles, identities, memories, tasks, or custom org design."
+  ].filter(Boolean).join("\n");
+}
+function registerOrchestrationPhase(server) {
+  server.registerTool(
+    "orchestration_phase",
+    {
+      title: "Orchestration Phase",
+      description: "View or change the customer-owned orchestration maturity phase. MCP parity for `exe-os org phase`, `exe-os org unlock executives`, and `exe-os org unlock parallel`. This is a recommendation layer, not a blocker; it never exposes recovery phrases or secrets.",
+      inputSchema: {
+        action: z59.enum(["status", "set", "unlock_executives", "unlock_parallel"]).default("status"),
+        phase: z59.enum(["phase_1_coo", "phase_2_executives", "phase_3_parallel_org", "1", "2", "3"]).optional().describe("Phase to set when action='set'.")
+      }
+    },
+    async ({ action = "status", phase }) => {
+      try {
+        if (action === "status") {
+          const info2 = await loadOrchestrationPhase();
+          return { content: [{ type: "text", text: render(info2) }] };
+        }
+        if (action === "unlock_executives") {
+          const info2 = await setOrchestrationPhase("phase_2_executives", "mcp");
+          return {
+            content: [{ type: "text", text: render(info2, "Phase 2 enabled. Your COO can now lean on the executive bench when useful.") }]
+          };
+        }
+        if (action === "unlock_parallel") {
+          const info2 = await setOrchestrationPhase("phase_3_parallel_org", "mcp");
+          return {
+            content: [{ type: "text", text: render(info2, "Phase 3 enabled. Parallel execution is available with review/permission gates.") }]
+          };
+        }
+        if (!phase) {
+          return {
+            content: [{ type: "text", text: "action='set' requires phase: 1, 2, 3, phase_1_coo, phase_2_executives, or phase_3_parallel_org." }],
+            isError: true
+          };
+        }
+        const info = await setOrchestrationPhase(phase, "mcp");
+        return { content: [{ type: "text", text: render(info, "Updated orchestration phase.") }] };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `Failed to update orchestration phase: ${err instanceof Error ? err.message : String(err)}` }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+var init_orchestration_phase2 = __esm({
+  "src/mcp/tools/orchestration-phase.ts"() {
+    "use strict";
+    init_orchestration_phase();
+  }
+});
+
 // src/lib/vps-backup.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
 import { Readable } from "stream";
@@ -23793,50 +24391,50 @@ var init_vps_backup = __esm({
 });
 
 // src/mcp/tools/backup-vps.ts
-import { z as z59 } from "zod";
+import { z as z60 } from "zod";
 function registerBackupVps(server) {
   server.registerTool(
     "backup_vps",
     {
       title: "VPS Backup",
       description: "Run VPS Postgres backup/restore workflows and check status.",
-      inputSchema: z59.discriminatedUnion("action", [
-        z59.object({
-          action: z59.literal("backup"),
-          databaseUrl: z59.string().min(1).describe("Postgres DATABASE_URL to dump from"),
-          encryptionKeyB64: z59.string().min(1).max(4096).optional().describe(
+      inputSchema: z60.discriminatedUnion("action", [
+        z60.object({
+          action: z60.literal("backup"),
+          databaseUrl: z60.string().min(1).describe("Postgres DATABASE_URL to dump from"),
+          encryptionKeyB64: z60.string().min(1).max(4096).optional().describe(
             "Base64 AES-256 key (defaults to local master key if omitted)"
           ),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         }),
-        z59.object({
-          action: z59.literal("restore"),
-          databaseUrl: z59.string().min(1).describe("Target Postgres DATABASE_URL for restore"),
-          backupKey: z59.string().min(1).describe("R2 object key to restore from"),
-          encryptionKeyB64: z59.string().min(1).max(4096).optional().describe(
+        z60.object({
+          action: z60.literal("restore"),
+          databaseUrl: z60.string().min(1).describe("Target Postgres DATABASE_URL for restore"),
+          backupKey: z60.string().min(1).describe("R2 object key to restore from"),
+          encryptionKeyB64: z60.string().min(1).max(4096).optional().describe(
             "Base64 AES-256 key (defaults to local master key if omitted)"
           ),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         }),
-        z59.object({
-          action: z59.literal("list"),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+        z60.object({
+          action: z60.literal("list"),
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         }),
-        z59.object({
-          action: z59.literal("health"),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+        z60.object({
+          action: z60.literal("health"),
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         })
       ])
     },
@@ -24030,9 +24628,9 @@ var init_hostinger_api = __esm({
         }
         this.lastRequestTime = Date.now();
       }
-      async request(method, path55, body) {
+      async request(method, path56, body) {
         await this.rateLimit();
-        const url = `${this.baseUrl}${path55}`;
+        const url = `${this.baseUrl}${path56}`;
         const headers = {
           Authorization: `Bearer ${this.apiKey}`,
           "Content-Type": "application/json",
@@ -24101,8 +24699,8 @@ async function requestCloudflare(cfApiToken, zoneId, options) {
   }
   return envelope.result;
 }
-function buildUrl(zoneId, path55 = "/dns_records", query) {
-  const normalizedPath = path55.startsWith("/") ? path55 : `/${path55}`;
+function buildUrl(zoneId, path56 = "/dns_records", query) {
+  const normalizedPath = path56.startsWith("/") ? path56 : `/${path56}`;
   const url = new URL(
     `${CLOUDFLARE_API_BASE_URL}/zones/${zoneId}${normalizedPath}`
   );
@@ -24173,11 +24771,11 @@ var init_cloudflare_dns = __esm({
 });
 
 // src/mcp/tools/deploy-client.ts
-import { z as z60 } from "zod";
+import { z as z61 } from "zod";
 import { execFile } from "child_process";
 import { promisify } from "util";
-import path39 from "path";
-import { existsSync as existsSync34 } from "fs";
+import path40 from "path";
+import { existsSync as existsSync35 } from "fs";
 async function executeDeployment(params, client) {
   const {
     client_name,
@@ -24249,12 +24847,12 @@ function registerDeployClient(server) {
       title: "Deploy Client",
       description: "Provision a Hostinger VPS and deploy exe-os for a client. Creates VPS, waits for ready state, runs Ansible playbook, verifies health.",
       inputSchema: {
-        client_name: z60.string().min(1).describe("Client name (used for hostname and identification)"),
-        domain: z60.string().min(1).describe("Domain name for the deployment (e.g., client.exe.ai)"),
-        region: z60.string().default("jakarta").describe("VPS region (default: jakarta)"),
-        plan: z60.string().default("kvm-2").describe("Hostinger VPS plan (default: kvm-2)"),
-        ssl_email: z60.string().email().describe("Email for Let's Encrypt SSL certificate"),
-        user_id: z60.string().min(1).describe("User/customer ID for inventory tracking")
+        client_name: z61.string().min(1).describe("Client name (used for hostname and identification)"),
+        domain: z61.string().min(1).describe("Domain name for the deployment (e.g., client.exe.ai)"),
+        region: z61.string().default("jakarta").describe("VPS region (default: jakarta)"),
+        plan: z61.string().default("kvm-2").describe("Hostinger VPS plan (default: kvm-2)"),
+        ssl_email: z61.string().email().describe("Email for Let's Encrypt SSL certificate"),
+        user_id: z61.string().min(1).describe("User/customer ID for inventory tracking")
       }
     },
     async ({ client_name, domain, region, plan, ssl_email, user_id }) => {
@@ -24322,12 +24920,12 @@ async function waitForReady(client, vpsId) {
 }
 async function runAnsiblePlaybook(vpsIp, domain, sslEmail, clientName) {
   const safeClientName = clientName.replace(/[^a-zA-Z0-9_-]/g, "-");
-  const playbookDir = path39.resolve(process.cwd(), "infrastructure", "ansible");
-  const playbookPath = path39.join(playbookDir, "deploy.yml");
-  const inventoryPath = path39.join(playbookDir, "inventory", "hosts.yml");
-  const clientVarsPath = path39.join(playbookDir, "vars", `${safeClientName}.yml`);
-  const varsDir = path39.join(playbookDir, "vars");
-  if (!path39.resolve(clientVarsPath).startsWith(path39.resolve(varsDir))) {
+  const playbookDir = path40.resolve(process.cwd(), "infrastructure", "ansible");
+  const playbookPath = path40.join(playbookDir, "deploy.yml");
+  const inventoryPath = path40.join(playbookDir, "inventory", "hosts.yml");
+  const clientVarsPath = path40.join(playbookDir, "vars", `${safeClientName}.yml`);
+  const varsDir = path40.join(playbookDir, "vars");
+  if (!path40.resolve(clientVarsPath).startsWith(path40.resolve(varsDir))) {
     throw new Error(`Invalid client name for vars path: ${clientName}`);
   }
   const args = [
@@ -24343,7 +24941,7 @@ async function runAnsiblePlaybook(vpsIp, domain, sslEmail, clientName) {
     "-e",
     `client_name=${safeClientName}`
   ];
-  if (existsSync34(clientVarsPath)) {
+  if (existsSync35(clientVarsPath)) {
     args.push("-e", `@${clientVarsPath}`);
   }
   try {
@@ -24433,7 +25031,7 @@ var init_deploy_client = __esm({
 });
 
 // src/mcp/tools/get-license-status.ts
-import { z as z61 } from "zod";
+import { z as z62 } from "zod";
 function registerGetLicenseStatus(server) {
   server.registerTool(
     "get_license_status",
@@ -24441,7 +25039,7 @@ function registerGetLicenseStatus(server) {
       title: "Get License Status",
       description: "Get current license status: plan, validity, feature gates, limits, and expiry.",
       inputSchema: {
-        _dummy: z61.string().optional().describe("Unused \u2014 no input required")
+        _dummy: z62.string().optional().describe("Unused \u2014 no input required")
       }
     },
     async () => {
@@ -24507,11 +25105,11 @@ var init_get_license_status = __esm({
 
 // src/mcp/tools/create-license.ts
 import os17 from "os";
-import path40 from "path";
+import path41 from "path";
 import { randomBytes as randomBytes2, randomUUID as randomUUID6 } from "crypto";
 import { createRequire as createRequire4 } from "module";
 import { pathToFileURL as pathToFileURL4 } from "url";
-import { z as z62 } from "zod";
+import { z as z63 } from "zod";
 function loadPrisma2() {
   if (!prismaPromise2) {
     prismaPromise2 = (async () => {
@@ -24522,8 +25120,8 @@ function loadPrisma2() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path40.join(os17.homedir(), "exe-db");
-      const req = createRequire4(path40.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path41.join(os17.homedir(), "exe-db");
+      const req = createRequire4(path41.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL4(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -24543,10 +25141,10 @@ function registerCreateLicense(server) {
       title: "Create License",
       description: "Generate an exe_sk_* license key for a user. Stores in billing.licenses. Returns the key to give to the customer.",
       inputSchema: {
-        email: z62.string().email().describe("Customer email address"),
-        name: z62.string().optional().describe("Customer name"),
-        plan: z62.enum(["free", "pro", "team", "agency", "enterprise"]).default("pro").describe("License plan tier"),
-        expires_in_days: z62.number().int().positive().default(365).describe("Days until expiration (default 365)")
+        email: z63.string().email().describe("Customer email address"),
+        name: z63.string().optional().describe("Customer name"),
+        plan: z63.enum(["free", "pro", "team", "agency", "enterprise"]).default("pro").describe("License plan tier"),
+        expires_in_days: z63.number().int().positive().default(365).describe("Days until expiration (default 365)")
       }
     },
     async ({ email, name, plan, expires_in_days }) => {
@@ -24606,10 +25204,10 @@ var init_create_license = __esm({
 
 // src/mcp/tools/list-licenses.ts
 import os18 from "os";
-import path41 from "path";
+import path42 from "path";
 import { createRequire as createRequire5 } from "module";
 import { pathToFileURL as pathToFileURL5 } from "url";
-import { z as z63 } from "zod";
+import { z as z64 } from "zod";
 function loadPrisma3() {
   if (!prismaPromise3) {
     prismaPromise3 = (async () => {
@@ -24620,8 +25218,8 @@ function loadPrisma3() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path41.join(os18.homedir(), "exe-db");
-      const req = createRequire5(path41.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path42.join(os18.homedir(), "exe-db");
+      const req = createRequire5(path42.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL5(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -24638,7 +25236,7 @@ function registerListLicenses(server) {
       title: "List Licenses",
       description: "List all issued licenses with status (active/expired/revoked). Optionally filter by plan.",
       inputSchema: {
-        plan: z63.enum(["free", "pro", "team", "agency", "enterprise"]).optional().describe("Filter by plan tier (omit for all)")
+        plan: z64.enum(["free", "pro", "team", "agency", "enterprise"]).optional().describe("Filter by plan tier (omit for all)")
       }
     },
     async ({ plan }) => {
@@ -24695,7 +25293,7 @@ var init_list_licenses = __esm({
 });
 
 // src/mcp/tools/activate-license.ts
-import { z as z64 } from "zod";
+import { z as z65 } from "zod";
 function registerActivateLicense(server) {
   server.registerTool(
     "activate_license",
@@ -24703,7 +25301,7 @@ function registerActivateLicense(server) {
       title: "Activate License",
       description: "Activate an exe_sk_* license key on this device. Writes to ~/.exe-os/license.key, validates against Postgres, and caches the result.",
       inputSchema: {
-        key: z64.string().startsWith("exe_sk_").describe("License key (exe_sk_*)")
+        key: z65.string().startsWith("exe_sk_").describe("License key (exe_sk_*)")
       }
     },
     async ({ key }) => {
@@ -24755,14 +25353,14 @@ var init_activate_license = __esm({
 });
 
 // src/automation/trigger-engine.ts
-import { readFileSync as readFileSync26, writeFileSync as writeFileSync18, existsSync as existsSync35, mkdirSync as mkdirSync15 } from "fs";
+import { readFileSync as readFileSync27, writeFileSync as writeFileSync19, existsSync as existsSync36, mkdirSync as mkdirSync16 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
-import path42 from "path";
+import path43 from "path";
 import os19 from "os";
 function loadTriggers(project) {
-  if (!existsSync35(TRIGGERS_PATH)) return [];
+  if (!existsSync36(TRIGGERS_PATH)) return [];
   try {
-    const raw = readFileSync26(TRIGGERS_PATH, "utf-8");
+    const raw = readFileSync27(TRIGGERS_PATH, "utf-8");
     const all = JSON.parse(raw);
     if (!Array.isArray(all)) return [];
     if (project) {
@@ -24774,9 +25372,9 @@ function loadTriggers(project) {
   }
 }
 function saveTriggers(triggers) {
-  const dir = path42.dirname(TRIGGERS_PATH);
-  if (!existsSync35(dir)) mkdirSync15(dir, { recursive: true });
-  writeFileSync18(TRIGGERS_PATH, JSON.stringify(triggers, null, 2), "utf-8");
+  const dir = path43.dirname(TRIGGERS_PATH);
+  if (!existsSync36(dir)) mkdirSync16(dir, { recursive: true });
+  writeFileSync19(TRIGGERS_PATH, JSON.stringify(triggers, null, 2), "utf-8");
 }
 function createNewTrigger(input) {
   const triggers = loadTriggers();
@@ -24795,7 +25393,7 @@ var TRIGGERS_PATH;
 var init_trigger_engine = __esm({
   "src/automation/trigger-engine.ts"() {
     "use strict";
-    TRIGGERS_PATH = path42.join(os19.homedir(), ".exe-os", "triggers.json");
+    TRIGGERS_PATH = path43.join(os19.homedir(), ".exe-os", "triggers.json");
   }
 });
 
@@ -24945,7 +25543,7 @@ var init_schedules = __esm({
 });
 
 // src/mcp/tools/create-trigger.ts
-import { z as z65 } from "zod";
+import { z as z66 } from "zod";
 function registerCreateTrigger(server) {
   server.registerTool(
     "create_trigger",
@@ -24953,18 +25551,18 @@ function registerCreateTrigger(server) {
       title: "Create Trigger",
       description: "Create a CRM event trigger or scheduled automation. When matching events occur (e.g., Deal.updated with stage=won), configured actions fire automatically (send_whatsapp, create_task, etc.).",
       inputSchema: {
-        name: z65.string().describe("Human-readable trigger name"),
-        event: z65.string().describe(
+        name: z66.string().describe("Human-readable trigger name"),
+        event: z66.string().describe(
           'CRM event to match, e.g., "Deal.updated", "Order.created", "*" for all'
         ),
-        conditions: z65.array(conditionSchema).default([]).describe("Conditions that must all match (AND logic)"),
-        actions: z65.array(actionSchema).min(1).describe("Actions to execute when trigger fires"),
-        project: z65.string().optional().describe("Scope trigger to a specific project"),
-        enabled: z65.boolean().default(true).describe("Whether trigger is active"),
-        schedule: z65.string().optional().describe(
+        conditions: z66.array(conditionSchema).default([]).describe("Conditions that must all match (AND logic)"),
+        actions: z66.array(actionSchema).min(1).describe("Actions to execute when trigger fires"),
+        project: z66.string().optional().describe("Scope trigger to a specific project"),
+        enabled: z66.boolean().default(true).describe("Whether trigger is active"),
+        schedule: z66.string().optional().describe(
           'Cron schedule for time-based triggers, e.g., "0 9 * * *" or "Monday 9am"'
         ),
-        query: z65.string().optional().describe(
+        query: z66.string().optional().describe(
           "CRM GraphQL query to run on schedule (required if schedule is set)"
         )
       }
@@ -25041,14 +25639,14 @@ var init_create_trigger = __esm({
     "use strict";
     init_trigger_engine();
     init_schedules();
-    conditionSchema = z65.object({
-      field: z65.string().describe("Dot-path field to evaluate, e.g., 'stage' or 'amount'"),
-      op: z65.enum(["eq", "neq", "gt", "lt", "gte", "lte", "contains", "not_contains"]).describe("Comparison operator"),
-      value: z65.string().or(z65.number()).or(z65.boolean()).describe("Value to compare against")
+    conditionSchema = z66.object({
+      field: z66.string().describe("Dot-path field to evaluate, e.g., 'stage' or 'amount'"),
+      op: z66.enum(["eq", "neq", "gt", "lt", "gte", "lte", "contains", "not_contains"]).describe("Comparison operator"),
+      value: z66.string().or(z66.number()).or(z66.boolean()).describe("Value to compare against")
     });
-    actionSchema = z65.object({
-      type: z65.enum(["send_whatsapp", "send_message", "create_task", "mcp_tool"]).describe("Action type to execute"),
-      params: z65.record(z65.string(), z65.string()).describe(
+    actionSchema = z66.object({
+      type: z66.enum(["send_whatsapp", "send_message", "create_task", "mcp_tool"]).describe("Action type to execute"),
+      params: z66.record(z66.string(), z66.string()).describe(
         "Action parameters. Supports {{record.field}} templates for dynamic values."
       )
     });
@@ -25056,7 +25654,7 @@ var init_create_trigger = __esm({
 });
 
 // src/mcp/tools/list-triggers.ts
-import { z as z66 } from "zod";
+import { z as z67 } from "zod";
 function registerListTriggers(server) {
   server.registerTool(
     "list_triggers",
@@ -25064,7 +25662,7 @@ function registerListTriggers(server) {
       title: "List Triggers",
       description: "List configured CRM event triggers and scheduled automations.",
       inputSchema: {
-        project: z66.string().optional().describe("Filter triggers by project name")
+        project: z67.string().optional().describe("Filter triggers by project name")
       }
     },
     async ({ project }) => {
@@ -25105,47 +25703,47 @@ var init_list_triggers = __esm({
 });
 
 // src/automation/starter-packs/index.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync12, existsSync as existsSync36 } from "fs";
-import path43 from "path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync12, existsSync as existsSync37 } from "fs";
+import path44 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function listPacks() {
-  const packsDir = path43.join(__dirname, ".");
-  if (!existsSync36(packsDir)) return [];
+  const packsDir = path44.join(__dirname, ".");
+  if (!existsSync37(packsDir)) return [];
   return readdirSync12(packsDir, { withFileTypes: true }).filter(
-    (d) => d.isDirectory() && existsSync36(path43.join(packsDir, d.name, "custom-objects.json"))
+    (d) => d.isDirectory() && existsSync37(path44.join(packsDir, d.name, "custom-objects.json"))
   ).map((d) => d.name);
 }
 function loadPack(industry) {
-  const packDir = path43.join(__dirname, industry);
-  const objectsPath = path43.join(packDir, "custom-objects.json");
-  const triggersPath = path43.join(packDir, "triggers.json");
-  const wikiDir = path43.join(packDir, "wiki-seeds");
-  const manifestPath = path43.join(packDir, "pack.json");
-  const identityContextPath = path43.join(packDir, "identity-context.md");
-  if (!existsSync36(objectsPath)) return null;
+  const packDir = path44.join(__dirname, industry);
+  const objectsPath = path44.join(packDir, "custom-objects.json");
+  const triggersPath = path44.join(packDir, "triggers.json");
+  const wikiDir = path44.join(packDir, "wiki-seeds");
+  const manifestPath = path44.join(packDir, "pack.json");
+  const identityContextPath = path44.join(packDir, "identity-context.md");
+  if (!existsSync37(objectsPath)) return null;
   let customObjects = [];
   try {
     customObjects = JSON.parse(
-      readFileSync27(objectsPath, "utf-8")
+      readFileSync28(objectsPath, "utf-8")
     );
   } catch {
     customObjects = [];
   }
   let triggers = [];
-  if (existsSync36(triggersPath)) {
+  if (existsSync37(triggersPath)) {
     try {
       triggers = JSON.parse(
-        readFileSync27(triggersPath, "utf-8")
+        readFileSync28(triggersPath, "utf-8")
       );
     } catch {
       triggers = [];
     }
   }
   const wikiSeeds = [];
-  if (existsSync36(wikiDir)) {
+  if (existsSync37(wikiDir)) {
     const files = readdirSync12(wikiDir).filter((f) => f.endsWith(".md"));
     for (const file of files) {
-      const content = readFileSync27(path43.join(wikiDir, file), "utf-8");
+      const content = readFileSync28(path44.join(wikiDir, file), "utf-8");
       const titleMatch = content.match(/^#\s+(.+)/m);
       wikiSeeds.push({
         filename: file,
@@ -25155,17 +25753,17 @@ function loadPack(industry) {
     }
   }
   let manifest = {};
-  if (existsSync36(manifestPath)) {
+  if (existsSync37(manifestPath)) {
     try {
-      manifest = JSON.parse(readFileSync27(manifestPath, "utf-8"));
+      manifest = JSON.parse(readFileSync28(manifestPath, "utf-8"));
     } catch {
       manifest = {};
     }
   }
   let identityContext = null;
-  if (existsSync36(identityContextPath)) {
+  if (existsSync37(identityContextPath)) {
     try {
-      identityContext = readFileSync27(identityContextPath, "utf-8");
+      identityContext = readFileSync28(identityContextPath, "utf-8");
     } catch {
       identityContext = null;
     }
@@ -25224,7 +25822,7 @@ var init_starter_packs = __esm({
   "src/automation/starter-packs/index.ts"() {
     "use strict";
     init_trigger_engine();
-    __dirname = path43.dirname(fileURLToPath4(import.meta.url));
+    __dirname = path44.dirname(fileURLToPath4(import.meta.url));
   }
 });
 
@@ -25356,21 +25954,21 @@ All memory, tasks, behaviors, documents, and wiki content belonging to {{company
 });
 
 // src/lib/client-coo.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync16, writeFileSync as writeFileSync19 } from "fs";
-import path44 from "path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync17, writeFileSync as writeFileSync20 } from "fs";
+import path45 from "path";
 async function provisionClientCOO(vars, opts = {}) {
-  const identityDir = opts.identityDir ?? path44.join(EXE_AI_DIR, "identity");
+  const identityDir = opts.identityDir ?? path45.join(EXE_AI_DIR, "identity");
   const rosterPath = opts.employeesPath ?? EMPLOYEES_PATH;
   const storeFeedbackBehavior = opts.storeFeedbackBehavior ?? true;
-  const identityPath2 = path44.join(identityDir, `${vars.agent_name}.md`);
-  if (existsSync37(identityPath2)) {
+  const identityPath2 = path45.join(identityDir, `${vars.agent_name}.md`);
+  if (existsSync38(identityPath2)) {
     throw new ClientCOOClobberError(vars.agent_name, identityPath2);
   }
   const body = renderClientCOOTemplate(vars);
-  if (!existsSync37(identityDir)) {
-    mkdirSync16(identityDir, { recursive: true });
+  if (!existsSync38(identityDir)) {
+    mkdirSync17(identityDir, { recursive: true });
   }
-  writeFileSync19(identityPath2, body, "utf-8");
+  writeFileSync20(identityPath2, body, "utf-8");
   const employees = await loadEmployees(rosterPath);
   const existing = employees.find((e) => e.name === vars.agent_name);
   let addedToRoster = false;
@@ -25422,7 +26020,7 @@ var init_client_coo = __esm({
 });
 
 // src/mcp/tools/apply-starter-pack.ts
-import { z as z67 } from "zod";
+import { z as z68 } from "zod";
 function registerApplyStarterPack(server) {
   server.registerTool(
     "apply_starter_pack",
@@ -25430,17 +26028,17 @@ function registerApplyStarterPack(server) {
       title: "Apply Starter Pack",
       description: "Apply an industry starter pack to a project. Sets up CRM custom objects, pre-wired automation triggers, and wiki seed content. When the pack creates a Client COO (e.g. distribution) and agent_name, company_name, founder_name are all provided, also provisions the COO identity, roster entry, and feedback-loop behavior. Available packs: distribution. More coming.",
       inputSchema: {
-        industry: z67.string().describe(
+        industry: z68.string().describe(
           'Industry pack to apply (e.g., "distribution"). Use without args to list available packs.'
         ),
-        project: z67.string().describe("Project name to scope the triggers to"),
-        agent_name: z67.string().optional().describe(
+        project: z68.string().describe("Project name to scope the triggers to"),
+        agent_name: z68.string().optional().describe(
           "Optional. Lowercase alphanumeric name for the Client COO agent. Required (alongside company_name and founder_name) to provision a COO."
         ),
-        company_name: z67.string().optional().describe(
+        company_name: z68.string().optional().describe(
           "Optional. The client company the COO serves. Required to provision a COO."
         ),
-        founder_name: z67.string().optional().describe(
+        founder_name: z68.string().optional().describe(
           "Optional. The founder the COO reports to. Required to provision a COO."
         )
       }
@@ -25592,18 +26190,18 @@ var init_apply_starter_pack = __esm({
 });
 
 // src/mcp/tools/load-skill.ts
-import { z as z68 } from "zod";
-import { readFileSync as readFileSync28, readdirSync as readdirSync13, statSync as statSync7 } from "fs";
-import path45 from "path";
+import { z as z69 } from "zod";
+import { readFileSync as readFileSync29, readdirSync as readdirSync13, statSync as statSync7 } from "fs";
+import path46 from "path";
 import { homedir as homedir7 } from "os";
 function listAvailableSkills() {
   try {
     const entries = readdirSync13(SKILLS_DIR);
     return entries.filter((entry) => {
       try {
-        const entryPath = path45.join(SKILLS_DIR, entry);
+        const entryPath = path46.join(SKILLS_DIR, entry);
         if (!statSync7(entryPath).isDirectory()) return false;
-        const skillFile = path45.join(entryPath, "SKILL.md");
+        const skillFile = path46.join(entryPath, "SKILL.md");
         statSync7(skillFile);
         return true;
       } catch {
@@ -25621,7 +26219,7 @@ function registerLoadSkill(server) {
       title: "Load Skill",
       description: "Load domain-specific guidance into your context. Use when you need specialized knowledge for a task (e.g., load_skill('seo') before doing SEO work, load_skill('code-reviewer') before reviewing code). Pass skill_name='list' to see all available skills.",
       inputSchema: {
-        skill_name: z68.string().describe(
+        skill_name: z69.string().describe(
           "Skill to load (e.g. 'seo', 'code-reviewer', 'frontend-design'). Pass 'list' to see all available skills."
         )
       }
@@ -25646,10 +26244,10 @@ ${skills.map((s) => `- ${s}`).join("\n")}`
           }]
         };
       }
-      const sanitized = path45.basename(skill_name);
-      const skillFile = path45.join(SKILLS_DIR, sanitized, "SKILL.md");
+      const sanitized = path46.basename(skill_name);
+      const skillFile = path46.join(SKILLS_DIR, sanitized, "SKILL.md");
       try {
-        const content = readFileSync28(skillFile, "utf-8");
+        const content = readFileSync29(skillFile, "utf-8");
         return {
           content: [{
             type: "text",
@@ -25678,15 +26276,15 @@ var SKILLS_DIR;
 var init_load_skill = __esm({
   "src/mcp/tools/load-skill.ts"() {
     "use strict";
-    SKILLS_DIR = path45.join(homedir7(), ".claude", "skills");
+    SKILLS_DIR = path46.join(homedir7(), ".claude", "skills");
   }
 });
 
 // src/lib/orchestration-package.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync38, mkdirSync as mkdirSync17, readFileSync as readFileSync29, writeFileSync as writeFileSync20 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync39, mkdirSync as mkdirSync18, readFileSync as readFileSync30, writeFileSync as writeFileSync21 } from "fs";
 import os20 from "os";
-import path46 from "path";
+import path47 from "path";
 function ensureObject(value, label) {
   if (value == null || Array.isArray(value) || typeof value !== "object") {
     throw new Error(`${label} must be an object`);
@@ -25745,15 +26343,15 @@ function validateProcedureEntry(value, index) {
   };
 }
 function getRosterPath() {
-  return path46.join(os20.homedir(), EXE_OS_DIRNAME, ROSTER_FILENAME);
+  return path47.join(os20.homedir(), EXE_OS_DIRNAME, ROSTER_FILENAME);
 }
 function getBackupPath() {
-  return path46.join(os20.homedir(), EXE_OS_DIRNAME, ROSTER_BACKUP_FILENAME);
+  return path47.join(os20.homedir(), EXE_OS_DIRNAME, ROSTER_BACKUP_FILENAME);
 }
 function readRosterFile() {
   const rosterPath = getRosterPath();
-  if (!existsSync38(rosterPath)) return [];
-  const raw = readFileSync29(rosterPath, "utf-8");
+  if (!existsSync39(rosterPath)) return [];
+  const raw = readFileSync30(rosterPath, "utf-8");
   const parsed = JSON.parse(raw);
   if (!Array.isArray(parsed)) {
     throw new Error("Roster file must contain a JSON array");
@@ -25765,8 +26363,8 @@ function writeRosterFile(roster) {
     throw new Error("Refusing to write empty roster \u2014 this would delete all employees");
   }
   const rosterPath = getRosterPath();
-  mkdirSync17(path46.dirname(rosterPath), { recursive: true });
-  if (existsSync38(rosterPath)) {
+  mkdirSync18(path47.dirname(rosterPath), { recursive: true });
+  if (existsSync39(rosterPath)) {
     const currentRoster = readRosterFile();
     if (roster.length < currentRoster.length) {
       throw new Error(
@@ -25775,7 +26373,7 @@ function writeRosterFile(roster) {
     }
     copyFileSync2(rosterPath, getBackupPath());
   }
-  writeFileSync20(rosterPath, `${JSON.stringify(roster, null, 2)}
+  writeFileSync21(rosterPath, `${JSON.stringify(roster, null, 2)}
 `, "utf-8");
 }
 function buildImportedRosterEntries(roster, timestamp) {
@@ -26038,9 +26636,9 @@ var init_orchestration_package = __esm({
 });
 
 // src/mcp/tools/export-orchestration.ts
-import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync21 } from "fs";
-import path47 from "path";
-import { z as z69 } from "zod";
+import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync22 } from "fs";
+import path48 from "path";
+import { z as z70 } from "zod";
 function registerExportOrchestration(server) {
   server.registerTool(
     "export_orchestration",
@@ -26048,15 +26646,15 @@ function registerExportOrchestration(server) {
       title: "Export Orchestration",
       description: "Export roster, identities, behaviors, and customer procedures to a JSON package.",
       inputSchema: {
-        output_path: z69.string().describe("File path to write the JSON package")
+        output_path: z70.string().describe("File path to write the JSON package")
       }
     },
     async ({ output_path }) => {
       try {
         await initStore();
         const pkg = await exportOrchestration(getActiveAgent().agentId);
-        mkdirSync18(path47.dirname(output_path), { recursive: true });
-        writeFileSync21(output_path, `${JSON.stringify(pkg, null, 2)}
+        mkdirSync19(path48.dirname(output_path), { recursive: true });
+        writeFileSync22(output_path, `${JSON.stringify(pkg, null, 2)}
 `, "utf-8");
         return {
           content: [{
@@ -26086,8 +26684,8 @@ var init_export_orchestration = __esm({
 });
 
 // src/mcp/tools/import-orchestration.ts
-import { readFileSync as readFileSync30 } from "fs";
-import { z as z70 } from "zod";
+import { readFileSync as readFileSync31 } from "fs";
+import { z as z71 } from "zod";
 function registerImportOrchestration(server) {
   server.registerTool(
     "import_orchestration",
@@ -26095,8 +26693,8 @@ function registerImportOrchestration(server) {
       title: "Import Orchestration",
       description: "Import roster, identities, behaviors, and procedures from an orchestration package. Restricted to coordinator/founder.",
       inputSchema: {
-        package_path: z70.string().describe("Path to the orchestration package JSON file"),
-        merge_strategy: z70.enum(["replace", "merge"]).default("merge").describe("How to apply the package: both strategies are additive-only \u2014 existing data is never deleted or overwritten")
+        package_path: z71.string().describe("Path to the orchestration package JSON file"),
+        merge_strategy: z71.enum(["replace", "merge"]).default("merge").describe("How to apply the package: both strategies are additive-only \u2014 existing data is never deleted or overwritten")
       }
     },
     async ({ package_path, merge_strategy }) => {
@@ -26113,7 +26711,7 @@ function registerImportOrchestration(server) {
           };
         }
         await initStore();
-        const raw = readFileSync30(package_path, "utf-8");
+        const raw = readFileSync31(package_path, "utf-8");
         const pkg = validatePackage(JSON.parse(raw));
         const result = await importOrchestration(pkg, merge_strategy);
         return {
@@ -26145,7 +26743,7 @@ var init_import_orchestration = __esm({
 });
 
 // src/mcp/tools/global-procedure.ts
-import { z as z71 } from "zod";
+import { z as z72 } from "zod";
 function registerCompanyProcedureTool(server, toolName) {
   server.registerTool(
     toolName,
@@ -26153,12 +26751,12 @@ function registerCompanyProcedureTool(server, toolName) {
       title: "Company Procedure",
       description: "Manage company procedures (customer-owned Layer 0 rules) that supersede identity, expertise, and experience. Actions: store (create new, restricted), list (view all, open), deactivate (soft-delete, restricted).",
       inputSchema: {
-        action: z71.enum(["store", "list", "deactivate"]).describe("Action to perform"),
-        title: z71.string().optional().describe("Short title for the procedure (store)"),
-        content: z71.string().max(500).optional().describe("The procedure content \u2014 clear, actionable instruction (store)"),
-        priority: z71.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default). p1 = standard. p2 = nice-to-have."),
-        domain: z71.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security"),
-        procedure_id: z71.string().optional().describe("UUID of the company procedure (deactivate)")
+        action: z72.enum(["store", "list", "deactivate"]).describe("Action to perform"),
+        title: z72.string().optional().describe("Short title for the procedure (store)"),
+        content: z72.string().max(500).optional().describe("The procedure content \u2014 clear, actionable instruction (store)"),
+        priority: z72.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default). p1 = standard. p2 = nice-to-have."),
+        domain: z72.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security"),
+        procedure_id: z72.string().optional().describe("UUID of the company procedure (deactivate)")
       }
     },
     async ({ action, title, content, priority, domain, procedure_id }) => {
@@ -26289,7 +26887,7 @@ var init_global_procedure = __esm({
 });
 
 // src/mcp/tools/config.ts
-import { z as z72 } from "zod";
+import { z as z73 } from "zod";
 function errorResult8(text3) {
   return { content: [{ type: "text", text: text3 }], isError: true };
 }
@@ -26311,6 +26909,7 @@ function buildHandlers5() {
   registerRunMemoryAudit(localServer);
   registerRunConsolidation(localServer);
   registerCloudSync(localServer);
+  registerOrchestrationPhase(localServer);
   registerBackupVps(localServer);
   registerDeployClient(localServer);
   registerGetLicenseStatus(localServer);
@@ -26333,41 +26932,42 @@ function registerConfig(server) {
     title: "Config",
     description: "Consolidated COO/admin tool for runtime config, system health, licensing, triggers, orchestration import/export, and company procedures.",
     inputSchema: {
-      action: z72.enum(Object.keys(ACTION_TO_TOOL2)).describe("Admin/config operation"),
-      agent_id: z72.string().optional().describe("Agent id for set_agent_config/agent_spend/session queries"),
-      runtime: z72.string().optional().describe("Runtime for set_agent_config"),
-      model: z72.string().optional().describe("Model for set_agent_config"),
-      reasoning_effort: z72.string().optional().describe("Reasoning effort for Codex agents"),
-      dry_run: z72.boolean().optional().describe("Preview without applying where supported"),
-      fix: z72.boolean().optional().describe("Apply fixes for memory_audit where supported"),
-      verbose: z72.boolean().optional().describe("Verbose output where supported"),
-      project_name: z72.string().optional().describe("Project filter/name"),
-      since: z72.string().optional().describe("ISO lower-bound timestamp"),
-      limit: z72.coerce.number().optional().describe("Result limit"),
-      output_path: z72.string().optional().describe("Output path for export/backup"),
-      input_path: z72.string().optional().describe("Input path for import_orchestration"),
-      strategy: z72.enum(["merge", "replace"]).optional().describe("Import strategy; replace must still be additive-only per platform rules"),
-      license_key: z72.string().optional().describe("License key for activation/status"),
-      email: z72.string().optional().describe("Customer email for license creation"),
-      plan: z72.string().optional().describe("License plan"),
-      name: z72.string().optional().describe("Trigger/starter pack/procedure/client name"),
-      event: z72.string().optional().describe("Trigger event"),
-      conditions: z72.array(z72.record(z72.string(), z72.unknown())).optional().describe("Trigger conditions"),
-      actions: z72.array(z72.record(z72.string(), z72.unknown())).optional().describe("Trigger actions"),
-      enabled: z72.boolean().optional().describe("Trigger enabled flag"),
-      schedule: z72.string().optional().describe("Trigger schedule"),
-      query: z72.string().optional().describe("Trigger query or filter"),
-      skill_name: z72.string().optional().describe("Skill name for load_skill"),
-      pack_name: z72.string().optional().describe("Starter pack name"),
-      title: z72.string().optional().describe("Procedure title"),
-      content: z72.string().optional().describe("Procedure content"),
-      priority: z72.enum(["p0", "p1", "p2"]).optional().describe("Procedure priority"),
-      domain: z72.string().optional().describe("Procedure domain"),
-      procedure_id: z72.string().optional().describe("Procedure id for deactivate"),
-      subaction: z72.enum(["store", "list", "deactivate"]).optional().describe("Nested action for company_procedure/global_procedure"),
-      max_clusters: z72.coerce.number().optional().describe("Consolidation max clusters"),
-      force: z72.boolean().optional().describe("Force operation where supported"),
-      domain_name: z72.string().optional().describe("Client deployment domain")
+      action: z73.enum(Object.keys(ACTION_TO_TOOL2)).describe("Admin/config operation"),
+      agent_id: z73.string().optional().describe("Agent id for set_agent_config/agent_spend/session queries"),
+      runtime: z73.string().optional().describe("Runtime for set_agent_config"),
+      model: z73.string().optional().describe("Model for set_agent_config"),
+      reasoning_effort: z73.string().optional().describe("Reasoning effort for Codex agents"),
+      dry_run: z73.boolean().optional().describe("Preview without applying where supported"),
+      fix: z73.boolean().optional().describe("Apply fixes for memory_audit where supported"),
+      verbose: z73.boolean().optional().describe("Verbose output where supported"),
+      project_name: z73.string().optional().describe("Project filter/name"),
+      since: z73.string().optional().describe("ISO lower-bound timestamp"),
+      limit: z73.coerce.number().optional().describe("Result limit"),
+      output_path: z73.string().optional().describe("Output path for export/backup"),
+      input_path: z73.string().optional().describe("Input path for import_orchestration"),
+      strategy: z73.enum(["merge", "replace"]).optional().describe("Import strategy; replace must still be additive-only per platform rules"),
+      license_key: z73.string().optional().describe("License key for activation/status"),
+      email: z73.string().optional().describe("Customer email for license creation"),
+      plan: z73.string().optional().describe("License plan"),
+      name: z73.string().optional().describe("Trigger/starter pack/procedure/client name"),
+      event: z73.string().optional().describe("Trigger event"),
+      conditions: z73.array(z73.record(z73.string(), z73.unknown())).optional().describe("Trigger conditions"),
+      actions: z73.array(z73.record(z73.string(), z73.unknown())).optional().describe("Trigger actions"),
+      enabled: z73.boolean().optional().describe("Trigger enabled flag"),
+      schedule: z73.string().optional().describe("Trigger schedule"),
+      query: z73.string().optional().describe("Trigger query or filter"),
+      skill_name: z73.string().optional().describe("Skill name for load_skill"),
+      pack_name: z73.string().optional().describe("Starter pack name"),
+      title: z73.string().optional().describe("Procedure title"),
+      content: z73.string().optional().describe("Procedure content"),
+      priority: z73.enum(["p0", "p1", "p2"]).optional().describe("Procedure priority"),
+      domain: z73.string().optional().describe("Procedure domain"),
+      procedure_id: z73.string().optional().describe("Procedure id for deactivate"),
+      subaction: z73.enum(["store", "list", "deactivate"]).optional().describe("Nested action for company_procedure/global_procedure"),
+      max_clusters: z73.coerce.number().optional().describe("Consolidation max clusters"),
+      force: z73.boolean().optional().describe("Force operation where supported"),
+      domain_name: z73.string().optional().describe("Client deployment domain"),
+      phase: z73.enum(["phase_1_coo", "phase_2_executives", "phase_3_parallel_org", "1", "2", "3"]).optional().describe("Orchestration phase for orchestration_phase action")
     }
   }, async (input, extra) => {
     const action = input.action;
@@ -26401,6 +27001,7 @@ var init_config2 = __esm({
     init_run_memory_audit();
     init_run_consolidation();
     init_cloud_sync2();
+    init_orchestration_phase2();
     init_backup_vps();
     init_deploy_client();
     init_get_license_status();
@@ -26426,6 +27027,7 @@ var init_config2 = __esm({
       memory_audit: "run_memory_audit",
       run_consolidation: "run_consolidation",
       cloud_sync: "cloud_sync",
+      orchestration_phase: "orchestration_phase",
       backup_vps: "backup_vps",
       deploy_client: "deploy_client",
       license_status: "get_license_status",
@@ -26445,7 +27047,7 @@ var init_config2 = __esm({
 });
 
 // src/mcp/tools/list-wiki-pages.ts
-import { z as z73 } from "zod";
+import { z as z74 } from "zod";
 function registerListWikiPages(server) {
   server.registerTool(
     "list_wiki_pages",
@@ -26453,8 +27055,8 @@ function registerListWikiPages(server) {
       title: "List Wiki Pages",
       description: "List documents in an exe-wiki workspace. Optionally filter by folder.",
       inputSchema: {
-        workspace: z73.string().describe('Wiki workspace slug (e.g., "hygo")'),
-        folder: z73.string().optional().describe("Filter by folder path")
+        workspace: z74.string().describe('Wiki workspace slug (e.g., "hygo")'),
+        folder: z74.string().optional().describe("Filter by folder path")
       }
     },
     async ({ workspace, folder }) => {
@@ -26550,7 +27152,7 @@ var init_list_wiki_pages = __esm({
 });
 
 // src/mcp/tools/get-wiki-page.ts
-import { z as z74 } from "zod";
+import { z as z75 } from "zod";
 function registerGetWikiPage(server) {
   server.registerTool(
     "get_wiki_page",
@@ -26558,9 +27160,9 @@ function registerGetWikiPage(server) {
       title: "Get Wiki Page",
       description: "Read a wiki page by document ID or title. Returns content, metadata, and folder path. Use title search when you know the page name but not the ID.",
       inputSchema: {
-        workspace: z74.string().describe('Wiki workspace slug (e.g., "hygo")'),
-        document_id: z74.string().optional().describe("Specific document ID (exact lookup)"),
-        title: z74.string().optional().describe("Search by title (fuzzy match)")
+        workspace: z75.string().describe('Wiki workspace slug (e.g., "hygo")'),
+        document_id: z75.string().optional().describe("Specific document ID (exact lookup)"),
+        title: z75.string().optional().describe("Search by title (fuzzy match)")
       }
     },
     async ({ workspace, document_id, title }) => {
@@ -26716,7 +27318,7 @@ var init_get_wiki_page = __esm({
 });
 
 // src/mcp/tools/wiki.ts
-import { z as z75 } from "zod";
+import { z as z76 } from "zod";
 function errorResult9(text3) {
   return { content: [{ type: "text", text: text3 }], isError: true };
 }
@@ -26742,14 +27344,14 @@ function registerWiki(server) {
       title: "Wiki",
       description: "Consolidated wiki domain tool. Actions: list, get. Wiki writes flow through raw data ingestion/projection into the curated wiki store; direct create/update MCP tools have been removed.",
       inputSchema: {
-        action: z75.enum(["list", "get"]).describe("Wiki read operation. Writes use raw-data ingestion/projection, not direct MCP writes."),
-        workspace: z75.string().optional().describe("Wiki workspace slug"),
-        title: z75.string().optional().describe("Fuzzy page title lookup for get"),
-        content: z75.string().optional().describe("Reserved; wiki writes use raw-data ingestion/projection"),
-        folder: z75.string().optional().describe("Optional folder path for list"),
-        document_id: z75.string().optional().describe("Document ID for get"),
-        mode: z75.enum(["replace", "append"]).optional().describe("Reserved; direct wiki updates are removed"),
-        section: z75.string().optional().describe("Reserved; direct wiki updates are removed")
+        action: z76.enum(["list", "get"]).describe("Wiki read operation. Writes use raw-data ingestion/projection, not direct MCP writes."),
+        workspace: z76.string().optional().describe("Wiki workspace slug"),
+        title: z76.string().optional().describe("Fuzzy page title lookup for get"),
+        content: z76.string().optional().describe("Reserved; wiki writes use raw-data ingestion/projection"),
+        folder: z76.string().optional().describe("Optional folder path for list"),
+        document_id: z76.string().optional().describe("Document ID for get"),
+        mode: z76.enum(["replace", "append"]).optional().describe("Reserved; direct wiki updates are removed"),
+        section: z76.string().optional().describe("Reserved; direct wiki updates are removed")
       }
     },
     async (input, extra) => {
@@ -26788,7 +27390,7 @@ var init_wiki = __esm({
 });
 
 // src/mcp/tools/behavior.ts
-import { z as z76 } from "zod";
+import { z as z77 } from "zod";
 function rowToBehavior2(r) {
   return {
     id: String(r.id),
@@ -26810,13 +27412,13 @@ function registerBehavior(server) {
       title: "Behavior",
       description: "Manage behavioral patterns, corrections, and reusable procedures for employees. Actions: store (create new), list (query existing), deactivate (soft-delete, restricted).",
       inputSchema: {
-        action: z76.enum(["store", "list", "deactivate"]).describe("Action to perform"),
-        content: z76.string().max(500).optional().describe("The behavioral instruction \u2014 one clear sentence (store)"),
-        domain: z76.string().optional().describe("Category: workflow, code-style, tool-use, communication, architecture, testing"),
-        priority: z76.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always included. p1 = standard (default). p2 = nice-to-have."),
-        agent_id: z76.string().optional().describe("Employee name. Defaults to current agent. Pass 'all' to list everyone's (list only)."),
-        project_name: z76.string().optional().describe("Defaults to current project. Pass 'global' for a behavior that applies everywhere (store)."),
-        behavior_id: z76.string().optional().describe("UUID of the behavior (deactivate)")
+        action: z77.enum(["store", "list", "deactivate"]).describe("Action to perform"),
+        content: z77.string().max(500).optional().describe("The behavioral instruction \u2014 one clear sentence (store)"),
+        domain: z77.string().optional().describe("Category: workflow, code-style, tool-use, communication, architecture, testing"),
+        priority: z77.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always included. p1 = standard (default). p2 = nice-to-have."),
+        agent_id: z77.string().optional().describe("Employee name. Defaults to current agent. Pass 'all' to list everyone's (list only)."),
+        project_name: z77.string().optional().describe("Defaults to current project. Pass 'global' for a behavior that applies everywhere (store)."),
+        behavior_id: z77.string().optional().describe("UUID of the behavior (deactivate)")
       }
     },
     async ({ action, content, domain, priority, agent_id, project_name, behavior_id }) => {
@@ -26997,7 +27599,7 @@ var init_behavior = __esm({
 });
 
 // src/mcp/tools/reminder.ts
-import { z as z77 } from "zod";
+import { z as z78 } from "zod";
 function registerReminder(server) {
   server.registerTool(
     "reminder",
@@ -27005,11 +27607,11 @@ function registerReminder(server) {
       title: "Reminder",
       description: "Manage reminders for the founder. Shown in the boot brief every session. Actions: create (set new), list (view active), complete (mark done).",
       inputSchema: {
-        action: z77.enum(["create", "list", "complete"]).describe("Action to perform"),
-        text: z77.string().optional().describe("What to remind about (create)"),
-        due_date: z77.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (create)"),
-        reminder_id: z77.string().optional().describe("Reminder UUID or text substring to match (complete)"),
-        include_completed: z77.boolean().optional().default(false).describe("Include completed reminders (list)")
+        action: z78.enum(["create", "list", "complete"]).describe("Action to perform"),
+        text: z78.string().optional().describe("What to remind about (create)"),
+        due_date: z78.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (create)"),
+        reminder_id: z78.string().optional().describe("Reminder UUID or text substring to match (complete)"),
+        include_completed: z78.boolean().optional().default(false).describe("Include completed reminders (list)")
       }
     },
     async ({ action, text: text3, due_date, reminder_id, include_completed }) => {
@@ -27068,7 +27670,7 @@ var init_reminder = __esm({
 });
 
 // src/mcp/tools/store-global-procedure.ts
-import { z as z78 } from "zod";
+import { z as z79 } from "zod";
 function registerStoreGlobalProcedure(server) {
   server.registerTool(
     "store_global_procedure",
@@ -27076,10 +27678,10 @@ function registerStoreGlobalProcedure(server) {
       title: "Store Company Procedure (use global_procedure instead)",
       description: "DEPRECATED \u2014 use global_procedure with action='store'. Create a company procedure (customer-owned Layer 0 rule). RESTRICTED: only coordinator or founder sessions.",
       inputSchema: {
-        title: z78.string().describe("Short title for the procedure"),
-        content: z78.string().max(500).describe("The procedure content \u2014 clear, actionable instruction"),
-        priority: z78.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default)."),
-        domain: z78.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security")
+        title: z79.string().describe("Short title for the procedure"),
+        content: z79.string().max(500).describe("The procedure content \u2014 clear, actionable instruction"),
+        priority: z79.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default)."),
+        domain: z79.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security")
       }
     },
     async ({ title, content, priority, domain }) => {
@@ -27166,7 +27768,7 @@ var init_list_global_procedures = __esm({
 });
 
 // src/mcp/tools/deactivate-global-procedure.ts
-import { z as z79 } from "zod";
+import { z as z80 } from "zod";
 function registerDeactivateGlobalProcedure(server) {
   server.registerTool(
     "deactivate_global_procedure",
@@ -27174,7 +27776,7 @@ function registerDeactivateGlobalProcedure(server) {
       title: "Deactivate Company Procedure (use global_procedure instead)",
       description: "DEPRECATED \u2014 use global_procedure with action='deactivate'. Soft-delete a company procedure. RESTRICTED: only coordinator or founder sessions.",
       inputSchema: {
-        procedure_id: z79.string().describe("UUID of the company procedure to deactivate")
+        procedure_id: z80.string().describe("UUID of the company procedure to deactivate")
       }
     },
     async ({ procedure_id }) => {
@@ -27238,7 +27840,7 @@ var init_deactivate_global_procedure = __esm({
 });
 
 // src/mcp/tools/store-decision.ts
-import { z as z80 } from "zod";
+import { z as z81 } from "zod";
 import crypto18 from "crypto";
 function registerStoreDecision(server) {
   server.registerTool(
@@ -27247,13 +27849,13 @@ function registerStoreDecision(server) {
       title: "Store Decision",
       description: "Store an authoritative decision keyed by domain. Use this when a decision is made that should be canonical \u2014 future lookups via get_decision return the latest decision for that domain. Supports supersession chains.",
       inputSchema: {
-        domain: z80.string().describe(
+        domain: z81.string().describe(
           "Domain key, e.g. 'auth-strategy', 'db-migration-approach', 'api-versioning'"
         ),
-        decision: z80.string().describe("The decision text \u2014 what was decided"),
-        rationale: z80.string().optional().describe("Why this decision was made \u2014 constraints, trade-offs, context"),
-        supersedes: z80.string().optional().describe("UUID of the decision this supersedes (previous decision for this domain)"),
-        project_name: z80.string().optional().describe("Project name")
+        decision: z81.string().describe("The decision text \u2014 what was decided"),
+        rationale: z81.string().optional().describe("Why this decision was made \u2014 constraints, trade-offs, context"),
+        supersedes: z81.string().optional().describe("UUID of the decision this supersedes (previous decision for this domain)"),
+        project_name: z81.string().optional().describe("Project name")
       }
     },
     async ({ domain, decision, rationale, supersedes, project_name }) => {
@@ -27330,7 +27932,7 @@ var init_store_decision = __esm({
 });
 
 // src/mcp/tools/get-decision.ts
-import { z as z81 } from "zod";
+import { z as z82 } from "zod";
 function registerGetDecision(server) {
   server.registerTool(
     "get_decision",
@@ -27338,7 +27940,7 @@ function registerGetDecision(server) {
       title: "Get Decision",
       description: "Retrieve the latest authoritative decision for a domain. Returns the current active decision and the supersession history.",
       inputSchema: {
-        domain: z81.string().describe(
+        domain: z82.string().describe(
           "Domain key to look up, e.g. 'auth-strategy', 'db-migration-approach'"
         )
       }
@@ -27408,10 +28010,10 @@ var init_get_decision = __esm({
 
 // src/lib/people.ts
 import { readFile as readFile5, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { existsSync as existsSync39, readFileSync as readFileSync31 } from "fs";
-import path48 from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync32 } from "fs";
+import path49 from "path";
 async function loadPeople() {
-  if (!existsSync39(PEOPLE_PATH)) return [];
+  if (!existsSync40(PEOPLE_PATH)) return [];
   try {
     const raw = await readFile5(PEOPLE_PATH, "utf-8");
     return JSON.parse(raw);
@@ -27420,7 +28022,7 @@ async function loadPeople() {
   }
 }
 async function savePeople(people) {
-  await mkdir5(path48.dirname(PEOPLE_PATH), { recursive: true });
+  await mkdir5(path49.dirname(PEOPLE_PATH), { recursive: true });
   await writeFile6(PEOPLE_PATH, JSON.stringify(people, null, 2) + "\n", "utf-8");
 }
 async function addPerson(person) {
@@ -27446,12 +28048,12 @@ var init_people = __esm({
   "src/lib/people.ts"() {
     "use strict";
     init_config();
-    PEOPLE_PATH = path48.join(EXE_AI_DIR, "people.json");
+    PEOPLE_PATH = path49.join(EXE_AI_DIR, "people.json");
   }
 });
 
 // src/mcp/tools/people-roster.ts
-import { z as z82 } from "zod";
+import { z as z83 } from "zod";
 function registerAddPerson(server) {
   server.registerTool(
     "add_person",
@@ -27459,10 +28061,10 @@ function registerAddPerson(server) {
       title: "Add Person",
       description: "Add or update a key human in the people roster. Used for co-founders, partners, customers \u2014 anyone agents need to know about.",
       inputSchema: {
-        name: z82.string().describe("Person's name"),
-        role: z82.string().describe("Their role (e.g. co-founder, customer, partner)"),
-        relationship: z82.string().describe("Relationship to the organization (e.g. co-founder, early adopter, investor)"),
-        notes: z82.string().optional().describe("Additional context about this person")
+        name: z83.string().describe("Person's name"),
+        role: z83.string().describe("Their role (e.g. co-founder, customer, partner)"),
+        relationship: z83.string().describe("Relationship to the organization (e.g. co-founder, early adopter, investor)"),
+        notes: z83.string().optional().describe("Additional context about this person")
       }
     },
     async ({ name, role, relationship, notes }) => {
@@ -27508,7 +28110,7 @@ function registerGetPerson(server) {
       title: "Get Person",
       description: "Look up a specific person by name from the people roster.",
       inputSchema: {
-        name: z82.string().describe("Person's name to look up")
+        name: z83.string().describe("Person's name to look up")
       }
     },
     async ({ name }) => {
@@ -27538,7 +28140,7 @@ var init_people_roster = __esm({
 });
 
 // src/lib/exe-db-read.ts
-import path49 from "path";
+import path50 from "path";
 import os21 from "os";
 import { createRequire as createRequire6 } from "module";
 import { pathToFileURL as pathToFileURL6 } from "url";
@@ -27555,8 +28157,8 @@ async function getExeDbReadClient() {
         if (!Ctor2) throw new Error(`No PrismaClient export found at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path49.join(os21.homedir(), "exe-db");
-      const req = createRequire6(path49.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path50.join(os21.homedir(), "exe-db");
+      const req = createRequire6(path50.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL6(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -27583,7 +28185,7 @@ var init_exe_db_read = __esm({
 });
 
 // src/mcp/tools/crm.ts
-import { z as z83 } from "zod";
+import { z as z84 } from "zod";
 function text(content, isError = false) {
   return { content: [{ type: "text", text: content }], ...isError ? { isError: true } : {} };
 }
@@ -27597,12 +28199,12 @@ function registerCrm(server) {
     title: "CRM",
     description: "Read-only CRM access from exe-db crm schema. Actions: list_people, get_person, list_tables, describe_table.",
     inputSchema: {
-      action: z83.enum(["list_people", "get_person", "list_tables", "describe_table"]).describe("CRM read operation"),
-      id: z83.string().optional().describe("CRM row/person id for get_person"),
-      query: z83.string().optional().describe("Text search for list_people/get_person"),
-      table: z83.string().optional().describe("crm schema table name for describe_table"),
-      limit: z83.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
-      offset: z83.coerce.number().int().min(0).optional().describe("Rows to skip")
+      action: z84.enum(["list_people", "get_person", "list_tables", "describe_table"]).describe("CRM read operation"),
+      id: z84.string().optional().describe("CRM row/person id for get_person"),
+      query: z84.string().optional().describe("Text search for list_people/get_person"),
+      table: z84.string().optional().describe("crm schema table name for describe_table"),
+      limit: z84.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
+      offset: z84.coerce.number().int().min(0).optional().describe("Rows to skip")
     }
   }, async ({ action, id, query, table, limit, offset }) => {
     try {
@@ -27667,7 +28269,7 @@ var init_crm = __esm({
 });
 
 // src/mcp/tools/raw-data.ts
-import { z as z84 } from "zod";
+import { z as z85 } from "zod";
 function text2(content, isError = false) {
   return { content: [{ type: "text", text: content }], ...isError ? { isError: true } : {} };
 }
@@ -27676,15 +28278,15 @@ function registerRawData(server) {
     title: "Raw Data",
     description: "Read-only access to exe-db raw.raw_events landing pad. Actions: list_sources, query, get. Results are capped because raw payloads can consume many tokens.",
     inputSchema: {
-      action: z84.enum(["list_sources", "query", "get"]).describe("Raw data read operation"),
-      id: z84.string().optional().describe("raw.raw_events id for action=get"),
-      source: z84.string().optional().describe("Filter by raw source"),
-      event_type: z84.string().optional().describe("Filter by event_type"),
-      query: z84.string().optional().describe("Search payload/metadata text"),
-      processed: z84.boolean().optional().describe("Filter processed_at IS NULL/NOT NULL"),
-      limit: z84.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
-      offset: z84.coerce.number().int().min(0).optional().describe("Rows to skip"),
-      include_payload: z84.boolean().optional().describe("Include full payload JSON. Default false to save tokens.")
+      action: z85.enum(["list_sources", "query", "get"]).describe("Raw data read operation"),
+      id: z85.string().optional().describe("raw.raw_events id for action=get"),
+      source: z85.string().optional().describe("Filter by raw source"),
+      event_type: z85.string().optional().describe("Filter by event_type"),
+      query: z85.string().optional().describe("Search payload/metadata text"),
+      processed: z85.boolean().optional().describe("Filter processed_at IS NULL/NOT NULL"),
+      limit: z85.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
+      offset: z85.coerce.number().int().min(0).optional().describe("Rows to skip"),
+      include_payload: z85.boolean().optional().describe("Include full payload JSON. Default false to save tokens.")
     }
   }, async ({ action, id, source, event_type, query, processed, limit, offset, include_payload }) => {
     try {
@@ -27752,10 +28354,10 @@ var init_raw_data = __esm({
 });
 
 // src/mcp/tools/create-bug-report.ts
-import { z as z85 } from "zod";
+import { z as z86 } from "zod";
 import crypto19 from "crypto";
 import { mkdir as mkdir6, writeFile as writeFile7 } from "fs/promises";
-import path50 from "path";
+import path51 from "path";
 function slugify2(input) {
   return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "bug-report";
 }
@@ -27833,22 +28435,22 @@ function registerCreateBugReport(server) {
       title: "Create Bug Report",
       description: "Classify and file an exe-os issue as upstream_bug, customer_customization, emergency_hotfix, or unclear. Writes a local report, stores memory, and optionally sends to AskExe support when a support endpoint is configured.",
       inputSchema: {
-        title: z85.string().min(3).describe("Short descriptive title"),
+        title: z86.string().min(3).describe("Short descriptive title"),
         classification: CLASSIFICATION.describe(
           "upstream_bug = platform defect; customer_customization = local preference; emergency_hotfix = temporary local patch; unclear = needs maintainer triage"
         ),
         severity: SEVERITY.default("p2").describe("p0 critical \u2192 p3 low"),
-        summary: z85.string().min(10).describe("What happened and why it matters"),
-        customer_impact: z85.string().optional().describe("How this affects the customer/founder"),
-        reproduction_steps: z85.array(z85.string()).optional().describe("Steps to reproduce"),
-        expected: z85.string().optional().describe("Expected behavior"),
-        actual: z85.string().optional().describe("Actual behavior"),
-        files_changed: z85.array(z85.string()).optional().describe("Files changed or suspected"),
-        workaround: z85.string().optional().describe("Temporary local workaround/hotfix, if any"),
-        local_patch_diff: z85.string().optional().describe("Small local diff or patch summary"),
-        package_version: z85.string().optional().describe("Installed @askexenow/exe-os version"),
-        project_name: z85.string().optional().describe("Project/customer context"),
-        send_upstream: z85.boolean().default(true).describe("Attempt to POST to configured AskExe support endpoint")
+        summary: z86.string().min(10).describe("What happened and why it matters"),
+        customer_impact: z86.string().optional().describe("How this affects the customer/founder"),
+        reproduction_steps: z86.array(z86.string()).optional().describe("Steps to reproduce"),
+        expected: z86.string().optional().describe("Expected behavior"),
+        actual: z86.string().optional().describe("Actual behavior"),
+        files_changed: z86.array(z86.string()).optional().describe("Files changed or suspected"),
+        workaround: z86.string().optional().describe("Temporary local workaround/hotfix, if any"),
+        local_patch_diff: z86.string().optional().describe("Small local diff or patch summary"),
+        package_version: z86.string().optional().describe("Installed @askexenow/exe-os version"),
+        project_name: z86.string().optional().describe("Project/customer context"),
+        send_upstream: z86.boolean().default(true).describe("Attempt to POST to configured AskExe support endpoint")
       }
     },
     async ({
@@ -27888,9 +28490,9 @@ function registerCreateBugReport(server) {
         filesChanged: files_changed,
         projectName: project_name
       });
-      const outDir = path50.join(EXE_AI_DIR, "bug-reports");
+      const outDir = path51.join(EXE_AI_DIR, "bug-reports");
       await mkdir6(outDir, { recursive: true });
-      const reportPath = path50.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(title)}-${id.slice(0, 8)}.md`);
+      const reportPath = path51.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(title)}-${id.slice(0, 8)}.md`);
       await writeFile7(reportPath, markdown, "utf-8");
       let vector = null;
       try {
@@ -27964,18 +28566,18 @@ var init_create_bug_report = __esm({
     init_config();
     init_license();
     init_store();
-    CLASSIFICATION = z85.enum([
+    CLASSIFICATION = z86.enum([
       "upstream_bug",
       "customer_customization",
       "emergency_hotfix",
       "unclear"
     ]);
-    SEVERITY = z85.enum(["p0", "p1", "p2", "p3"]);
+    SEVERITY = z86.enum(["p0", "p1", "p2", "p3"]);
   }
 });
 
 // src/mcp/tools/support-inbox.ts
-import { z as z86 } from "zod";
+import { z as z87 } from "zod";
 function adminToken() {
   return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN;
 }
@@ -28014,9 +28616,9 @@ function registerListBugReports(server) {
       title: "List Bug Reports",
       description: "AskExe-internal only: list incoming customer bug reports from the support inbox.",
       inputSchema: {
-        status: z86.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
-        severity: z86.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z86.number().int().min(1).max(100).default(25)
+        status: z87.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
+        severity: z87.enum(["p0", "p1", "p2", "p3"]).optional(),
+        limit: z87.number().int().min(1).max(100).default(25)
       }
     },
     async ({ status, severity, limit }) => {
@@ -28035,7 +28637,7 @@ function registerGetBugReport(server) {
     {
       title: "Get Bug Report",
       description: "AskExe-internal only: fetch one customer bug report with full markdown payload.",
-      inputSchema: { id: z86.string().min(8) }
+      inputSchema: { id: z87.string().min(8) }
     },
     async ({ id }) => {
       const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`);
@@ -28050,12 +28652,12 @@ function registerTriageBugReport(server) {
       title: "Triage Bug Report",
       description: "AskExe-internal only: update bug report status and link task/commit/release metadata.",
       inputSchema: {
-        id: z86.string().min(8),
+        id: z87.string().min(8),
         status: STATUS.optional(),
-        triage_notes: z86.string().optional(),
-        linked_task_id: z86.string().optional(),
-        linked_commit: z86.string().optional(),
-        fixed_version: z86.string().optional()
+        triage_notes: z87.string().optional(),
+        linked_task_id: z87.string().optional(),
+        linked_commit: z87.string().optional(),
+        fixed_version: z87.string().optional()
       }
     },
     async ({ id, status, triage_notes, linked_task_id, linked_commit, fixed_version }) => {
@@ -28072,7 +28674,7 @@ var init_support_inbox = __esm({
   "src/mcp/tools/support-inbox.ts"() {
     "use strict";
     DEFAULT_ENDPOINT = "https://askexe.com/admin/support/bug-reports";
-    STATUS = z86.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
+    STATUS = z87.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
   }
 });
 
@@ -28213,6 +28815,7 @@ var init_tool_gates = __esm({
       registerRunMemoryAudit: "admin",
       registerRunConsolidation: "admin",
       registerCloudSync: "admin",
+      registerOrchestrationPhase: "admin",
       registerSetAgentConfig: "admin",
       registerListEmployees: "admin",
       registerGetAgentSpend: "admin",
@@ -28421,6 +29024,7 @@ function registerAllTools(server) {
     gate("registerRunMemoryAudit", registerRunMemoryAudit);
     gate("registerCloudSync", registerCloudSync);
     gate("registerBackupVps", registerBackupVps);
+    gate("registerOrchestrationPhase", registerOrchestrationPhase);
   }
   if (exposeLegacyMemory) {
     gate("registerGetMemoryCardinality", registerGetMemoryCardinality);
@@ -28532,6 +29136,7 @@ var init_register_tools = __esm({
     init_raw_data();
     init_set_agent_config();
     init_list_employees();
+    init_orchestration_phase2();
     init_create_license();
     init_list_licenses();
     init_activate_license();
@@ -28762,12 +29367,12 @@ __export(task_enforcement_exports, {
   runTaskEnforcementTick: () => runTaskEnforcementTick,
   sendNudge: () => sendNudge
 });
-import { writeFileSync as writeFileSync22 } from "fs";
-import path51 from "path";
+import { writeFileSync as writeFileSync23 } from "fs";
+import path52 from "path";
 function writeAuditEntry(entry) {
   try {
     const line = JSON.stringify(entry) + "\n";
-    writeFileSync22(AUDIT_LOG_PATH, line, { flag: "a" });
+    writeFileSync23(AUDIT_LOG_PATH, line, { flag: "a" });
   } catch {
   }
 }
@@ -28938,7 +29543,7 @@ var init_task_enforcement = __esm({
       "What do you need?"
     ];
     MANAGER_ROLES = ["COO", "CTO"];
-    AUDIT_LOG_PATH = path51.join(
+    AUDIT_LOG_PATH = path52.join(
       process.env.HOME ?? process.env.USERPROFILE ?? "/tmp",
       ".exe-os",
       "enforcement-audit.jsonl"
@@ -28955,11 +29560,11 @@ __export(update_check_exports, {
   getRemoteVersion: () => getRemoteVersion
 });
 import { execSync as execSync15 } from "child_process";
-import { readFileSync as readFileSync32 } from "fs";
-import path52 from "path";
+import { readFileSync as readFileSync33 } from "fs";
+import path53 from "path";
 function getLocalVersion(packageRoot) {
-  const pkgPath = path52.join(packageRoot, "package.json");
-  const pkg = JSON.parse(readFileSync32(pkgPath, "utf-8"));
+  const pkgPath = path53.join(packageRoot, "package.json");
+  const pkg = JSON.parse(readFileSync33(pkgPath, "utf-8"));
   return pkg.version;
 }
 function getRemoteVersion() {
@@ -29031,12 +29636,12 @@ __export(device_registry_exports, {
 });
 import crypto21 from "crypto";
 import os22 from "os";
-import { readFileSync as readFileSync33, writeFileSync as writeFileSync23, mkdirSync as mkdirSync19, existsSync as existsSync40 } from "fs";
-import path53 from "path";
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync24, mkdirSync as mkdirSync20, existsSync as existsSync41 } from "fs";
+import path54 from "path";
 function getDeviceInfo() {
-  if (existsSync40(DEVICE_JSON_PATH)) {
+  if (existsSync41(DEVICE_JSON_PATH)) {
     try {
-      const raw = readFileSync33(DEVICE_JSON_PATH, "utf8");
+      const raw = readFileSync34(DEVICE_JSON_PATH, "utf8");
       const data = JSON.parse(raw);
       if (data.deviceId && data.friendlyName && data.hostname) {
         return data;
@@ -29050,14 +29655,14 @@ function getDeviceInfo() {
     friendlyName: hostname.replace(/\./g, "-").toLowerCase(),
     hostname
   };
-  mkdirSync19(path53.dirname(DEVICE_JSON_PATH), { recursive: true });
-  writeFileSync23(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
+  mkdirSync20(path54.dirname(DEVICE_JSON_PATH), { recursive: true });
+  writeFileSync24(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
   return info;
 }
 function setFriendlyName(name) {
   const info = getDeviceInfo();
   info.friendlyName = name;
-  writeFileSync23(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
+  writeFileSync24(DEVICE_JSON_PATH, JSON.stringify(info, null, 2));
 }
 async function resolveTargetDevice(targetAgent, targetProject) {
   const { getClient: getClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
@@ -29091,7 +29696,7 @@ var init_device_registry = __esm({
   "src/lib/device-registry.ts"() {
     "use strict";
     init_config();
-    DEVICE_JSON_PATH = path53.join(EXE_AI_DIR, "device.json");
+    DEVICE_JSON_PATH = path54.join(EXE_AI_DIR, "device.json");
   }
 });
 
@@ -29307,8 +29912,8 @@ import os23 from "os";
 import net2 from "net";
 import { createServer as createHttpServer } from "http";
 import { randomUUID as randomUUID9 } from "crypto";
-import { writeFileSync as writeFileSync24, unlinkSync as unlinkSync13, mkdirSync as mkdirSync20, existsSync as existsSync41, readFileSync as readFileSync34, chmodSync as chmodSync2 } from "fs";
-import path54 from "path";
+import { writeFileSync as writeFileSync25, unlinkSync as unlinkSync13, mkdirSync as mkdirSync21, existsSync as existsSync42, readFileSync as readFileSync35, chmodSync as chmodSync2 } from "fs";
+import path55 from "path";
 
 // src/lib/orchestration-metrics.ts
 init_config();
@@ -29380,8 +29985,8 @@ function initMetrics() {
 
 // src/lib/exe-daemon.ts
 init_memory_write_governor();
-var SOCKET_PATH2 = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path54.join(EXE_AI_DIR, "exed.sock");
-var PID_PATH3 = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path54.join(EXE_AI_DIR, "exed.pid");
+var SOCKET_PATH2 = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path55.join(EXE_AI_DIR, "exed.sock");
+var PID_PATH3 = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path55.join(EXE_AI_DIR, "exed.pid");
 var MODEL_FILE = "jina-embeddings-v5-small-q4_k_m.gguf";
 var IDLE_TIMEOUT_MS2 = 15 * 60 * 1e3;
 var REVIEW_POLL_INTERVAL_MS = 60 * 1e3;
@@ -29409,8 +30014,8 @@ function enqueue(queue, entry) {
   queue.push(entry);
 }
 async function loadModel() {
-  const modelPath = path54.join(MODELS_DIR, MODEL_FILE);
-  if (!existsSync41(modelPath)) {
+  const modelPath = path55.join(MODELS_DIR, MODEL_FILE);
+  if (!existsSync42(modelPath)) {
     process.stderr.write(`[exed] No model at ${modelPath} \u2014 running without embeddings (VPS mode).
 `);
     return;
@@ -29808,17 +30413,17 @@ function startMemoryQueueDrain() {
 `);
 }
 function startServer() {
-  mkdirSync20(path54.dirname(SOCKET_PATH2), { recursive: true });
+  mkdirSync21(path55.dirname(SOCKET_PATH2), { recursive: true });
   try {
-    chmodSync2(path54.dirname(SOCKET_PATH2), 448);
+    chmodSync2(path55.dirname(SOCKET_PATH2), 448);
   } catch {
   }
   _daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV2] ?? null);
   for (const oldFile of ["embed.sock", "embed.pid"]) {
-    const oldPath = path54.join(path54.dirname(SOCKET_PATH2), oldFile);
+    const oldPath = path55.join(path55.dirname(SOCKET_PATH2), oldFile);
     try {
       if (oldFile.endsWith(".pid")) {
-        const pid = parseInt(readFileSync34(oldPath, "utf8").trim(), 10);
+        const pid = parseInt(readFileSync35(oldPath, "utf8").trim(), 10);
         if (pid > 0) try {
           process.kill(pid, "SIGKILL");
         } catch {
@@ -30291,7 +30896,7 @@ function startGraphExtraction() {
 `);
 }
 var AGENT_STATS_INTERVAL_MS = 60 * 1e3;
-var AGENT_STATS_PATH = path54.join(EXE_AI_DIR, "agent-stats.json");
+var AGENT_STATS_PATH = path55.join(EXE_AI_DIR, "agent-stats.json");
 async function writeAgentStats() {
   fired("agent_stats");
   if (!await ensureStoreForPolling()) return;
@@ -30351,7 +30956,7 @@ async function writeAgentStats() {
         pid: process.pid
       }
     };
-    writeFileSync24(AGENT_STATS_PATH, JSON.stringify(stats, null, 2), "utf8");
+    writeFileSync25(AGENT_STATS_PATH, JSON.stringify(stats, null, 2), "utf8");
   } catch (err) {
     process.stderr.write(`[exed] Agent stats error: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -30468,12 +31073,12 @@ function startIntercomQueueDrain() {
       const hasInProgressTask = (session) => {
         try {
           const { baseAgentName: ban } = (init_employees(), __toCommonJS(employees_exports));
-          const path55 = __require("path");
-          const { existsSync: existsSync42 } = __require("fs");
+          const path56 = __require("path");
+          const { existsSync: existsSync43 } = __require("fs");
           const os24 = __require("os");
           const agent = ban(session.split("-")[0] ?? session);
-          const markerPath = path55.join(os24.homedir(), ".exe-os", "session-cache", `current-task-${agent}.json`);
-          return existsSync42(markerPath);
+          const markerPath = path56.join(os24.homedir(), ".exe-os", "session-cache", `current-task-${agent}.json`);
+          return existsSync43(markerPath);
         } catch {
           return false;
         }
@@ -30637,8 +31242,8 @@ process.on("SIGINT", () => void shutdown());
 process.on("SIGTERM", () => void shutdown());
 function checkExistingDaemon() {
   try {
-    if (!existsSync41(PID_PATH3)) return false;
-    const pid = parseInt(readFileSync34(PID_PATH3, "utf8").trim(), 10);
+    if (!existsSync42(PID_PATH3)) return false;
+    const pid = parseInt(readFileSync35(PID_PATH3, "utf8").trim(), 10);
     if (!pid || isNaN(pid)) return false;
     process.kill(pid, 0);
     process.stderr.write(`[exed] Another daemon is already running (PID ${pid}). Exiting.
@@ -30708,7 +31313,7 @@ function startAutoUpdateCheck() {
 if (checkExistingDaemon()) {
   process.exit(0);
 }
-writeFileSync24(PID_PATH3, String(process.pid));
+writeFileSync25(PID_PATH3, String(process.pid));
 try {
   chmodSync2(PID_PATH3, 384);
 } catch {