@askexenow/exe-os 0.9.65 → 0.9.66

package/dist/mcp/server.js

@@ -158,6 +158,11 @@ function normalizeAutoUpdate(raw) {
   const userAU = raw.autoUpdate ?? {};
   raw.autoUpdate = { ...defaultAU, ...userAU };
 }
+function normalizeOrchestration(raw) {
+  const defaultOrg = DEFAULT_CONFIG.orchestration;
+  const userOrg = raw.orchestration ?? {};
+  raw.orchestration = { ...defaultOrg, ...userOrg };
+}
 async function loadConfig() {
   const dir = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? EXE_AI_DIR;
   await ensurePrivateDir(dir);
@@ -182,6 +187,7 @@ async function loadConfig() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     const config2 = { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
     if (config2.dbPath.startsWith("~")) {
       config2.dbPath = config2.dbPath.replace(/^~/, os.homedir());
@@ -205,6 +211,7 @@ function loadConfigSync() {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db"), ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG, dbPath: path.join(dir, "memories.db") };
@@ -226,6 +233,7 @@ async function loadConfigFrom(configPath) {
     normalizeScalingRoadmap(migratedCfg);
     normalizeSessionLifecycle(migratedCfg);
     normalizeAutoUpdate(migratedCfg);
+    normalizeOrchestration(migratedCfg);
     return { ...DEFAULT_CONFIG, ...migratedCfg };
   } catch {
     return { ...DEFAULT_CONFIG };
@@ -297,6 +305,10 @@ var init_config = __esm({
         checkOnBoot: true,
         autoInstall: false,
         checkIntervalMs: 24 * 60 * 60 * 1e3
+      },
+      orchestration: {
+        phase: "phase_1_coo",
+        phaseSetBy: "default"
       }
     };
     CONFIG_MIGRATIONS = [
@@ -849,10 +861,10 @@ async function disposeEmbedder() {
 async function embedDirect(text3) {
   const llamaCpp = await import("node-llama-cpp");
   const { MODELS_DIR: MODELS_DIR2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  const { existsSync: existsSync37 } = await import("fs");
-  const path48 = await import("path");
-  const modelPath = path48.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
-  if (!existsSync37(modelPath)) {
+  const { existsSync: existsSync38 } = await import("fs");
+  const path49 = await import("path");
+  const modelPath = path49.join(MODELS_DIR2, "jina-embeddings-v5-small-q4_k_m.gguf");
+  if (!existsSync38(modelPath)) {
     throw new Error(`Embedding model not found at ${modelPath}. Run '/exe-setup' to download it.`);
   }
   const llama = await llamaCpp.getLlama();
@@ -1893,6 +1905,15 @@ var init_database_adapter = __esm({
 });
 
 // src/lib/daemon-protocol.ts
+var daemon_protocol_exports = {};
+__export(daemon_protocol_exports, {
+  deserializeArgs: () => deserializeArgs,
+  deserializeResultSet: () => deserializeResultSet,
+  deserializeValue: () => deserializeValue,
+  serializeArgs: () => serializeArgs,
+  serializeResultSet: () => serializeResultSet,
+  serializeValue: () => serializeValue
+});
 function serializeValue(v) {
   if (v === null || v === void 0) return null;
   if (typeof v === "bigint") return Number(v);
@@ -1917,6 +1938,32 @@ function deserializeValue(v) {
   }
   return v;
 }
+function serializeArgs(args) {
+  return args.map(serializeValue);
+}
+function deserializeArgs(args) {
+  return args.map(deserializeValue);
+}
+function serializeResultSet(rs) {
+  const rows = [];
+  for (const row of rs.rows) {
+    const obj = {};
+    for (let i = 0; i < rs.columns.length; i++) {
+      const col = rs.columns[i];
+      if (col !== void 0) {
+        obj[col] = serializeValue(row[i]);
+      }
+    }
+    rows.push(obj);
+  }
+  return {
+    columns: [...rs.columns],
+    columnTypes: [...rs.columnTypes ?? []],
+    rows,
+    rowsAffected: typeof rs.rowsAffected === "bigint" ? Number(rs.rowsAffected) : rs.rowsAffected ?? 0,
+    lastInsertRowid: rs.lastInsertRowid != null ? typeof rs.lastInsertRowid === "bigint" ? Number(rs.lastInsertRowid) : rs.lastInsertRowid : null
+  };
+}
 function deserializeResultSet(srs) {
   const rows = srs.rows.map((obj) => {
     const values = srs.columns.map(
@@ -3468,8 +3515,8 @@ function deriveMachineKey() {
 }
 function readMachineId() {
   try {
-    const { readFileSync: readFileSync30 } = __require("fs");
-    return readFileSync30("/etc/machine-id", "utf-8").trim();
+    const { readFileSync: readFileSync31 } = __require("fs");
+    return readFileSync31("/etc/machine-id", "utf-8").trim();
   } catch {
     return "";
   }
@@ -4369,6 +4416,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "Founder -> coordinator (the executive agent, internally routed as 'COO') -> CTO/CMO. CTO -> engineers. CMO -> content production. Never skip levels: the coordinator does not bypass managers for specialist work. Specialists report to their manager. If you need cross-team info, use ask_team_memory \u2014 don't read other agents' task folders. Each level owns dispatch downward and review upward."
       },
+      {
+        title: "Customer orchestration maturity \u2014 recommend, never trap",
+        domain: "workflow",
+        priority: "p1",
+        content: "New customers start best in Phase 1: founder \u2194 coordinator/Chief of Staff, building company context. Suggest Phase 2 executives when domain work repeats; suggest Phase 3 parallel execution only when review/permission gates are ready. This is guidance, not a blocker: users may jump phases anytime. Never overwrite their phase, role titles, identities, or custom org design."
+      },
       {
         title: "Single dispatch path \u2014 create_task only",
         domain: "workflow",
@@ -4427,6 +4480,12 @@ var init_platform_procedures = __esm({
         priority: "p0",
         content: "exe-build-adv is MANDATORY for ALL work touching 3+ files. Run /exe-build-adv --auto BEFORE implementation. Pipeline: Spec \u2192 AC \u2192 Tests \u2192 Evaluate \u2192 Fix. No multi-file feature ships without pipeline artifacts. No exceptions \u2014 managers reject work without them."
       },
+      {
+        title: "Commit discipline \u2014 never leave verified work floating",
+        domain: "workflow",
+        priority: "p1",
+        content: "After any code-change batch passes typecheck/tests/build, run git status, summarize changed files, and commit with a clear message before ending the session. If work must remain uncommitted for review/dogfood, explicitly say so, list the files, and state the blocker. Never imply work is complete while verified changes are still floating locally."
+      },
       {
         title: "Desktop and TUI are the same product",
         domain: "architecture",
@@ -6643,10 +6702,10 @@ async function hybridSearch(queryText, agentId, options) {
     };
     try {
       const fs = await import("fs");
-      const path48 = await import("path");
+      const path49 = await import("path");
       const os21 = await import("os");
-      const logPath = path48.join(os21.homedir(), ".exe-os", "search-quality.jsonl");
-      fs.mkdirSync(path48.dirname(logPath), { recursive: true });
+      const logPath = path49.join(os21.homedir(), ".exe-os", "search-quality.jsonl");
+      fs.mkdirSync(path49.dirname(logPath), { recursive: true });
       fs.appendFileSync(logPath, JSON.stringify(logEntry) + "\n");
     } catch {
     }
@@ -7938,8 +7997,8 @@ __export(wiki_client_exports, {
   listDocuments: () => listDocuments,
   listWorkspaces: () => listWorkspaces
 });
-async function wikiFetch(config2, path48, method = "GET", body) {
-  const url = `${config2.baseUrl}/api/v1${path48}`;
+async function wikiFetch(config2, path49, method = "GET", body) {
+  const url = `${config2.baseUrl}/api/v1${path49}`;
   const headers = {
     Authorization: `Bearer ${config2.apiKey}`,
     "Content-Type": "application/json"
@@ -7972,7 +8031,7 @@ async function wikiFetch(config2, path48, method = "GET", body) {
       }
     }
     if (!response.ok) {
-      throw new Error(`Wiki API ${method} ${path48}: ${response.status} ${response.statusText}`);
+      throw new Error(`Wiki API ${method} ${path49}: ${response.status} ${response.statusText}`);
     }
     return response.json();
   } finally {
@@ -12853,6 +12912,119 @@ var init_worker_gate = __esm({
   }
 });
 
+// src/lib/key-backup-status.ts
+var key_backup_status_exports = {};
+__export(key_backup_status_exports, {
+  getKeyBackupStatus: () => getKeyBackupStatus,
+  keyBackupMarkerPath: () => keyBackupMarkerPath,
+  markKeyBackupConfirmed: () => markKeyBackupConfirmed
+});
+import { existsSync as existsSync26, mkdirSync as mkdirSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync15 } from "fs";
+import path31 from "path";
+function keyBackupMarkerPath() {
+  return path31.join(EXE_AI_DIR, "key-backup-confirmed.json");
+}
+function getKeyBackupStatus() {
+  const marker = keyBackupMarkerPath();
+  if (!existsSync26(marker)) return { exists: false };
+  try {
+    const parsed = JSON.parse(readFileSync20(marker, "utf8"));
+    return {
+      exists: true,
+      confirmedAt: parsed.confirmedAt,
+      source: parsed.source
+    };
+  } catch {
+    return { exists: true };
+  }
+}
+function markKeyBackupConfirmed(source) {
+  mkdirSync12(EXE_AI_DIR, { recursive: true, mode: 448 });
+  writeFileSync15(
+    keyBackupMarkerPath(),
+    JSON.stringify({ confirmedAt: (/* @__PURE__ */ new Date()).toISOString(), source }, null, 2) + "\n",
+    { mode: 384 }
+  );
+}
+var init_key_backup_status = __esm({
+  "src/lib/key-backup-status.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+
+// src/bin/fast-db-init.ts
+var fast_db_init_exports = {};
+__export(fast_db_init_exports, {
+  fastDbInit: () => fastDbInit
+});
+async function fastDbInit() {
+  const { isInitialized: isInitialized2, getClient: getClient2, setExternalClient: setExternalClient2 } = await Promise.resolve().then(() => (init_database(), database_exports));
+  if (isInitialized2()) {
+    return getClient2();
+  }
+  try {
+    const { connectEmbedDaemon: connectEmbedDaemon2, sendDaemonRequest: sendDaemonRequest2, isClientConnected: isClientConnected2 } = await Promise.resolve().then(() => (init_exe_daemon_client(), exe_daemon_client_exports));
+    const { deserializeResultSet: deserializeResultSet2 } = await Promise.resolve().then(() => (init_daemon_protocol(), daemon_protocol_exports));
+    await connectEmbedDaemon2();
+    if (isClientConnected2()) {
+      const daemonClient = {
+        async execute(stmt) {
+          const sql = typeof stmt === "string" ? stmt : stmt.sql;
+          const args = typeof stmt === "string" ? [] : Array.isArray(stmt.args) ? stmt.args : [];
+          const resp = await sendDaemonRequest2({ type: "db-execute", sql, args });
+          if (resp.error) throw new Error(String(resp.error));
+          if (resp.db) return deserializeResultSet2(resp.db);
+          throw new Error("Unexpected daemon response");
+        },
+        async batch(stmts, mode) {
+          const statements = stmts.map((s) => {
+            const sql = typeof s === "string" ? s : s.sql;
+            const args = typeof s === "string" ? [] : Array.isArray(s.args) ? s.args : [];
+            return { sql, args };
+          });
+          const resp = await sendDaemonRequest2({ type: "db-batch", statements, mode: mode ?? "deferred" });
+          if (resp.error) throw new Error(String(resp.error));
+          const batchResults = resp["db-batch"];
+          if (batchResults) return batchResults.map(deserializeResultSet2);
+          throw new Error("Unexpected daemon batch response");
+        },
+        async transaction(_mode) {
+          throw new Error("Transactions not supported via daemon socket");
+        },
+        async executeMultiple(_sql) {
+          throw new Error("executeMultiple not supported via daemon socket");
+        },
+        async migrate(_stmts) {
+          throw new Error("migrate not supported via daemon socket");
+        },
+        sync() {
+          return Promise.resolve(void 0);
+        },
+        close() {
+        },
+        get closed() {
+          return false;
+        },
+        get protocol() {
+          return "file";
+        }
+      };
+      setExternalClient2(daemonClient);
+      return daemonClient;
+    }
+  } catch {
+  }
+  const { initStore: initStore2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+  await initStore2({ lightweight: true });
+  return getClient2();
+}
+var init_fast_db_init = __esm({
+  "src/bin/fast-db-init.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/db-backup.ts
 var db_backup_exports = {};
 __export(db_backup_exports, {
@@ -12864,33 +13036,33 @@ __export(db_backup_exports, {
   listBackups: () => listBackups,
   rotateBackups: () => rotateBackups
 });
-import { copyFileSync, existsSync as existsSync26, mkdirSync as mkdirSync12, readdirSync as readdirSync10, unlinkSync as unlinkSync9, statSync as statSync4 } from "fs";
-import path31 from "path";
+import { copyFileSync, existsSync as existsSync27, mkdirSync as mkdirSync13, readdirSync as readdirSync10, unlinkSync as unlinkSync9, statSync as statSync4 } from "fs";
+import path32 from "path";
 function findActiveDb() {
   for (const name of DB_NAMES) {
-    const p = path31.join(EXE_AI_DIR, name);
-    if (existsSync26(p)) return p;
+    const p = path32.join(EXE_AI_DIR, name);
+    if (existsSync27(p)) return p;
   }
   return null;
 }
 function createBackup(reason = "manual") {
   const dbPath = findActiveDb();
   if (!dbPath) return null;
-  mkdirSync12(BACKUP_DIR, { recursive: true });
-  const dbName = path31.basename(dbPath, ".db");
+  mkdirSync13(BACKUP_DIR, { recursive: true });
+  const dbName = path32.basename(dbPath, ".db");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const backupName = `${dbName}-${reason}-${timestamp}.db`;
-  const backupPath = path31.join(BACKUP_DIR, backupName);
+  const backupPath = path32.join(BACKUP_DIR, backupName);
   copyFileSync(dbPath, backupPath);
   const walPath = dbPath + "-wal";
-  if (existsSync26(walPath)) {
+  if (existsSync27(walPath)) {
     try {
       copyFileSync(walPath, backupPath + "-wal");
     } catch {
     }
   }
   const shmPath = dbPath + "-shm";
-  if (existsSync26(shmPath)) {
+  if (existsSync27(shmPath)) {
     try {
       copyFileSync(shmPath, backupPath + "-shm");
     } catch {
@@ -12899,14 +13071,14 @@ function createBackup(reason = "manual") {
   return backupPath;
 }
 function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
-  if (!existsSync26(BACKUP_DIR)) return 0;
+  if (!existsSync27(BACKUP_DIR)) return 0;
   const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
   let deleted = 0;
   try {
     const files = readdirSync10(BACKUP_DIR);
     for (const file of files) {
       if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
-      const filePath = path31.join(BACKUP_DIR, file);
+      const filePath = path32.join(BACKUP_DIR, file);
       try {
         const stat = statSync4(filePath);
         if (stat.mtimeMs < cutoff) {
@@ -12921,11 +13093,11 @@ function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
   return deleted;
 }
 function listBackups() {
-  if (!existsSync26(BACKUP_DIR)) return [];
+  if (!existsSync27(BACKUP_DIR)) return [];
   try {
     const files = readdirSync10(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm"));
     return files.map((name) => {
-      const p = path31.join(BACKUP_DIR, name);
+      const p = path32.join(BACKUP_DIR, name);
       const stat = statSync4(p);
       return { path: p, name, size: stat.size, date: stat.mtime };
     }).sort((a, b) => b.date.getTime() - a.date.getTime());
@@ -12950,7 +13122,7 @@ var init_db_backup = __esm({
   "src/lib/db-backup.ts"() {
     "use strict";
     init_config();
-    BACKUP_DIR = path31.join(EXE_AI_DIR, "backups");
+    BACKUP_DIR = path32.join(EXE_AI_DIR, "backups");
     DEFAULT_KEEP_DAYS = 3;
     DB_NAMES = ["memories.db", "exe-mem.db", "exe-os.db", "exe.db"];
   }
@@ -12975,8 +13147,8 @@ __export(crdt_sync_exports, {
   rebuildFromDb: () => rebuildFromDb
 });
 import * as Y from "yjs";
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync15, existsSync as existsSync28, mkdirSync as mkdirSync13, unlinkSync as unlinkSync10 } from "fs";
-import path33 from "path";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync16, existsSync as existsSync29, mkdirSync as mkdirSync14, unlinkSync as unlinkSync10 } from "fs";
+import path34 from "path";
 import { homedir as homedir5 } from "os";
 function getStatePath() {
   return _statePathOverride ?? DEFAULT_STATE_PATH;
@@ -12988,9 +13160,9 @@ function initCrdtDoc() {
   if (doc) return doc;
   doc = new Y.Doc();
   const sp = getStatePath();
-  if (existsSync28(sp)) {
+  if (existsSync29(sp)) {
     try {
-      const state = readFileSync21(sp);
+      const state = readFileSync22(sp);
       Y.applyUpdate(doc, new Uint8Array(state));
     } catch {
       console.warn("[crdt-sync] WARN: corrupted state file, rebuilding from DB");
@@ -13132,10 +13304,10 @@ function persistState() {
   if (!doc) return;
   try {
     const sp = getStatePath();
-    const dir = path33.dirname(sp);
-    if (!existsSync28(dir)) mkdirSync13(dir, { recursive: true });
+    const dir = path34.dirname(sp);
+    if (!existsSync29(dir)) mkdirSync14(dir, { recursive: true });
     const state = Y.encodeStateAsUpdate(doc);
-    writeFileSync15(sp, Buffer.from(state));
+    writeFileSync16(sp, Buffer.from(state));
   } catch {
   }
 }
@@ -13176,7 +13348,7 @@ var DEFAULT_STATE_PATH, _statePathOverride, doc;
 var init_crdt_sync = __esm({
   "src/lib/crdt-sync.ts"() {
     "use strict";
-    DEFAULT_STATE_PATH = path33.join(homedir5(), ".exe-os", "crdt-state.bin");
+    DEFAULT_STATE_PATH = path34.join(homedir5(), ".exe-os", "crdt-state.bin");
     _statePathOverride = null;
     doc = null;
   }
@@ -13189,8 +13361,8 @@ init_database();
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync36, openSync as openSync3, mkdirSync as mkdirSync19, closeSync as closeSync3, readFileSync as readFileSync29 } from "fs";
-import path47 from "path";
+import { existsSync as existsSync37, openSync as openSync3, mkdirSync as mkdirSync20, closeSync as closeSync3, readFileSync as readFileSync30 } from "fs";
+import path48 from "path";
 import os20 from "os";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
@@ -14576,10 +14748,10 @@ function registerCreateTask(server2) {
         skipDispatch: true
       });
       try {
-        const { existsSync: existsSync37, mkdirSync: mkdirSync20, writeFileSync: writeFileSync21 } = await import("fs");
+        const { existsSync: existsSync38, mkdirSync: mkdirSync21, writeFileSync: writeFileSync22 } = await import("fs");
         const { identityPath: identityPath2 } = await Promise.resolve().then(() => (init_identity(), identity_exports));
         const idPath = identityPath2(assigned_to);
-        if (!existsSync37(idPath)) {
+        if (!existsSync38(idPath)) {
           const { loadEmployees: loadEmployees2 } = await Promise.resolve().then(() => (init_employees(), employees_exports));
           const employees = await loadEmployees2();
           const emp = employees.find((e) => e.name === assigned_to);
@@ -14588,8 +14760,8 @@ function registerCreateTask(server2) {
             const template = getTemplateForTitle2(emp.role);
             if (template) {
               const dir = (await import("path")).dirname(idPath);
-              if (!existsSync37(dir)) mkdirSync20(dir, { recursive: true });
-              writeFileSync21(idPath, template.replace(/^agent_id: \w+/m, `agent_id: ${assigned_to}`), "utf-8");
+              if (!existsSync38(dir)) mkdirSync21(dir, { recursive: true });
+              writeFileSync22(idPath, template.replace(/^agent_id: \w+/m, `agent_id: ${assigned_to}`), "utf-8");
             }
           }
         }
@@ -17551,12 +17723,12 @@ function registerExportGraph(server2) {
         }
         const html = await exportGraphHTML(client);
         const fs = await import("fs");
-        const path48 = await import("path");
+        const path49 = await import("path");
         const os21 = await import("os");
-        const outDir = path48.join(os21.homedir(), ".exe-os", "exports");
+        const outDir = path49.join(os21.homedir(), ".exe-os", "exports");
         fs.mkdirSync(outDir, { recursive: true });
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
-        const filePath = path48.join(outDir, `graph-${timestamp}.html`);
+        const filePath = path49.join(outDir, `graph-${timestamp}.html`);
         fs.writeFileSync(filePath, html, "utf-8");
         return {
           content: [
@@ -17879,7 +18051,7 @@ function registerGraph(server2) {
 }
 
 // src/mcp/tools/config.ts
-import { z as z72 } from "zod";
+import { z as z73 } from "zod";
 
 // src/mcp/tools/set-agent-config.ts
 init_active_agent();
@@ -18685,8 +18857,6 @@ init_database();
 import { z as z56 } from "zod";
 
 // src/bin/exe-doctor.ts
-init_store();
-init_database();
 import os14 from "os";
 
 // src/lib/is-main.ts
@@ -18705,9 +18875,9 @@ function isMainModule(importMetaUrl) {
 }
 
 // src/bin/exe-doctor.ts
-import { existsSync as existsSync27, readFileSync as readFileSync20 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync21 } from "fs";
 import { spawn as spawn2 } from "child_process";
-import path32 from "path";
+import path33 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 
 // src/lib/conflict-detector.ts
@@ -18970,6 +19140,140 @@ async function detectConflicts(client, projectFilter, agentFilter2) {
   };
 }
 
+// src/adapters/runtime-hook-manifest.ts
+var EXE_HOOKS = {
+  postToolCombined: "dist/hooks/post-tool-combined.js",
+  sessionStart: "dist/hooks/session-start.js",
+  promptSubmit: "dist/hooks/prompt-submit.js",
+  heartbeat: "dist/hooks/exe-heartbeat-hook.js",
+  stop: "dist/hooks/stop.js",
+  preToolUse: "dist/hooks/pre-tool-use.js",
+  subagentStop: "dist/hooks/subagent-stop.js",
+  preCompact: "dist/hooks/pre-compact.js",
+  postCompact: "dist/hooks/post-compact.js",
+  sessionEnd: "dist/hooks/session-end.js",
+  notification: "dist/hooks/notification.js",
+  instructionsLoaded: "dist/hooks/instructions-loaded.js"
+};
+var EXE_HOOK_MANIFEST = [
+  {
+    key: "postToolCombined",
+    event: "PostToolUse",
+    commandMarker: EXE_HOOKS.postToolCombined,
+    owner: "exe-os",
+    purpose: "Single PostToolUse entrypoint for ingestion, error recall, summaries, and bug detection.",
+    runtimes: ["claude", "codex", "opencode"],
+    checkpointRole: "none"
+  },
+  {
+    key: "sessionStart",
+    event: "SessionStart",
+    commandMarker: EXE_HOOKS.sessionStart,
+    owner: "exe-os",
+    purpose: "Loads agent identity, procedures, and boot context.",
+    runtimes: ["claude", "codex", "opencode"],
+    checkpointRole: "none"
+  },
+  {
+    key: "promptSubmit",
+    event: "UserPromptSubmit",
+    commandMarker: EXE_HOOKS.promptSubmit,
+    owner: "exe-os",
+    purpose: "Injects current tasks, pending reviews, and local context before each prompt.",
+    runtimes: ["claude", "codex", "opencode"],
+    checkpointRole: "none"
+  },
+  {
+    key: "heartbeat",
+    event: "UserPromptSubmit",
+    commandMarker: EXE_HOOKS.heartbeat,
+    owner: "exe-os",
+    purpose: "Lightweight heartbeat/status sidecar for Claude Code sessions.",
+    runtimes: ["claude"],
+    checkpointRole: "none"
+  },
+  {
+    key: "stop",
+    event: "Stop",
+    commandMarker: EXE_HOOKS.stop,
+    owner: "exe-os",
+    purpose: "Finalizes task state, capacity signals, and emergency checkpointing.",
+    runtimes: ["claude", "codex", "opencode"],
+    checkpointRole: "capacity_checkpoint"
+  },
+  {
+    key: "preToolUse",
+    event: "PreToolUse",
+    commandMarker: EXE_HOOKS.preToolUse,
+    owner: "exe-os",
+    purpose: "Preflight guardrails before shell/tool execution.",
+    runtimes: ["claude", "codex", "opencode"],
+    checkpointRole: "none"
+  },
+  {
+    key: "subagentStop",
+    event: "SubagentStop",
+    commandMarker: EXE_HOOKS.subagentStop,
+    owner: "exe-os",
+    purpose: "Captures subagent completion context.",
+    runtimes: ["claude"],
+    checkpointRole: "none"
+  },
+  {
+    key: "preCompact",
+    event: "PreCompact",
+    commandMarker: EXE_HOOKS.preCompact,
+    owner: "exe-os",
+    purpose: "Writes active-task snapshot and compaction recovery context.",
+    runtimes: ["claude"],
+    checkpointRole: "recovery_context"
+  },
+  {
+    key: "postCompact",
+    event: "PostCompact",
+    commandMarker: EXE_HOOKS.postCompact,
+    owner: "exe-os",
+    purpose: "Rehydrates recovery context after compaction.",
+    runtimes: ["claude"],
+    checkpointRole: "recovery_context"
+  },
+  {
+    key: "sessionEnd",
+    event: "SessionEnd",
+    commandMarker: EXE_HOOKS.sessionEnd,
+    owner: "exe-os",
+    purpose: "Stores session-end checkpoint and triages orphaned in-progress tasks.",
+    runtimes: ["claude"],
+    checkpointRole: "session_summary"
+  },
+  {
+    key: "notification",
+    event: "Notification",
+    commandMarker: EXE_HOOKS.notification,
+    owner: "exe-os",
+    purpose: "Captures runtime notifications and nudges.",
+    runtimes: ["claude"],
+    checkpointRole: "none"
+  },
+  {
+    key: "instructionsLoaded",
+    event: "InstructionsLoaded",
+    commandMarker: EXE_HOOKS.instructionsLoaded,
+    owner: "exe-os",
+    purpose: "Applies runtime instruction post-processing.",
+    runtimes: ["claude"],
+    checkpointRole: "none"
+  }
+];
+var LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS = [
+  "dist/hooks/ingest.js",
+  "dist/hooks/error-recall.js",
+  "dist/hooks/ingest-worker.js"
+];
+function manifestEntryForCommand(command) {
+  return EXE_HOOK_MANIFEST.find((entry) => command.includes(entry.commandMarker));
+}
+
 // src/bin/exe-doctor.ts
 function parseFlags(argv) {
   const flags = { fix: false, dryRun: false, verbose: false, conflicts: false };
@@ -19121,7 +19425,7 @@ async function auditOrphanedProjects(client) {
   for (const row of result.rows) {
     const name = row.project_name;
     const count = Number(row.cnt);
-    const exists = existsSync27(path32.join(home, name)) || existsSync27(path32.join(home, "..", name)) || existsSync27(path32.join(process.cwd(), "..", name));
+    const exists = existsSync28(path33.join(home, name)) || existsSync28(path33.join(home, "..", name)) || existsSync28(path33.join(process.cwd(), "..", name));
     if (!exists) {
       orphans.push({ project_name: name, count });
     }
@@ -19129,18 +19433,18 @@ async function auditOrphanedProjects(client) {
   return orphans;
 }
 function auditHookHealth() {
-  const logPath = path32.join(
+  const logPath = path33.join(
     process.env.HOME ?? process.env.USERPROFILE ?? "",
     ".exe-os",
     "logs",
     "hooks.log"
   );
-  if (!existsSync27(logPath)) {
+  if (!existsSync28(logPath)) {
     return { logExists: false, totalLines: 0, errorsLastHour: 0, topPatterns: [] };
   }
   let content;
   try {
-    content = readFileSync20(logPath, "utf-8");
+    content = readFileSync21(logPath, "utf-8");
   } catch {
     return { logExists: false, totalLines: 0, errorsLastHour: 0, topPatterns: [] };
   }
@@ -19168,6 +19472,121 @@ function auditHookHealth() {
   const topPatterns = [...patternCounts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([pattern, count]) => ({ pattern, count }));
   return { logExists: true, totalLines, errorsLastHour, topPatterns };
 }
+function safeReadJson(filePath) {
+  if (!existsSync28(filePath)) return null;
+  try {
+    return JSON.parse(readFileSync21(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function collectHookCommandsFromClaudeSettings(settings) {
+  const hooks = settings?.hooks;
+  if (!hooks || typeof hooks !== "object") return [];
+  const commands = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      const hooksForGroup = group?.hooks;
+      if (!Array.isArray(hooksForGroup)) continue;
+      for (const hook of hooksForGroup) {
+        const command = hook?.command;
+        if (typeof command === "string") commands.push({ event, command });
+      }
+    }
+  }
+  return commands;
+}
+function collectHookCommandsFromCodexHooks(config2) {
+  const commands = [];
+  if (!config2 || typeof config2 !== "object") return commands;
+  const root = config2;
+  for (const [event, value] of Object.entries(root)) {
+    const entries = Array.isArray(value) ? value : value && typeof value === "object" ? Object.values(value) : [];
+    for (const entry of entries) {
+      if (typeof entry === "string") commands.push({ event, command: entry });
+      const command = entry?.command;
+      if (typeof command === "string") commands.push({ event, command });
+    }
+  }
+  return commands;
+}
+function buildHookOwnershipIssues(runtime, commands) {
+  const issues = [];
+  for (const marker of LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS) {
+    const count = commands.filter((cmd) => cmd.command.includes(marker)).length;
+    if (count > 0) {
+      issues.push({
+        runtime,
+        event: "PostToolUse",
+        marker,
+        count,
+        message: `Legacy split PostToolUse hook still installed: ${marker}`
+      });
+    }
+  }
+  for (const entry of EXE_HOOK_MANIFEST.filter((hook) => hook.runtimes.includes(runtime))) {
+    const matching = commands.filter((cmd) => cmd.command.includes(entry.commandMarker));
+    if (matching.length > 1) {
+      issues.push({
+        runtime,
+        event: entry.event,
+        marker: entry.commandMarker,
+        count: matching.length,
+        message: `Duplicate exe-os hook owner for ${entry.event}: ${entry.commandMarker}`
+      });
+    }
+    for (const cmd of matching) {
+      if (cmd.event !== entry.event) {
+        issues.push({
+          runtime,
+          event: cmd.event,
+          marker: entry.commandMarker,
+          count: 1,
+          message: `exe-os hook ${entry.commandMarker} is registered under ${cmd.event}, expected ${entry.event}`
+        });
+      }
+    }
+  }
+  for (const cmd of commands) {
+    if (!cmd.command.includes("dist/hooks/")) continue;
+    if (!cmd.command.includes("exe-os")) continue;
+    const entry = manifestEntryForCommand(cmd.command);
+    const isLegacy = LEGACY_SPLIT_POST_TOOL_HOOK_MARKERS.some((marker) => cmd.command.includes(marker));
+    if (!entry && !isLegacy) {
+      issues.push({
+        runtime,
+        event: cmd.event,
+        marker: "dist/hooks/",
+        count: 1,
+        message: `Unknown exe-os hook command not present in ownership manifest: ${cmd.command.slice(0, 160)}`
+      });
+    }
+  }
+  return issues;
+}
+function auditHookOwnership() {
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  const checkedFiles = [];
+  const issues = [];
+  const claudeSettingsPath = path33.join(home, ".claude", "settings.json");
+  const claudeSettings = safeReadJson(claudeSettingsPath);
+  if (claudeSettings) {
+    checkedFiles.push(claudeSettingsPath);
+    issues.push(...buildHookOwnershipIssues("claude", collectHookCommandsFromClaudeSettings(claudeSettings)));
+  }
+  const codexHooksPath = path33.join(home, ".codex", "hooks.json");
+  const codexHooks = safeReadJson(codexHooksPath);
+  if (codexHooks) {
+    checkedFiles.push(codexHooksPath);
+    issues.push(...buildHookOwnershipIssues("codex", collectHookCommandsFromCodexHooks(codexHooks)));
+  }
+  return {
+    checkedFiles,
+    issues,
+    staleLegacyHooks: issues.filter((issue) => issue.message.includes("Legacy split"))
+  };
+}
 async function auditShards() {
   try {
     const { auditShardHealth: auditShardHealth2 } = await Promise.resolve().then(() => (init_shard_manager(), shard_manager_exports));
@@ -19183,16 +19602,33 @@ async function auditShards() {
     return { total: 0, ok: 0, unreadable: 0, archived: 0, unreadableNames: [] };
   }
 }
+async function auditKeyHealth() {
+  try {
+    const { getMasterKey: getMasterKey2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
+    const { getKeyBackupStatus: getKeyBackupStatus2 } = await Promise.resolve().then(() => (init_key_backup_status(), key_backup_status_exports));
+    const key = await getMasterKey2();
+    const backup = getKeyBackupStatus2();
+    return {
+      masterKeyPresent: Boolean(key),
+      recoveryBackupMarked: backup.exists,
+      recoveryBackupConfirmedAt: backup.confirmedAt,
+      recoveryBackupSource: backup.source
+    };
+  } catch {
+    return { masterKeyPresent: false, recoveryBackupMarked: false };
+  }
+}
 async function runAudit(client, flags) {
   const runConflicts = flags.conflicts || process.env.EXE_AUDIT_CONFLICTS === "1";
-  const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards] = await Promise.all([
+  const [stats, nullVectors, duplicates, bloated, fts, orphanedProjects, shards, keyHealth] = await Promise.all([
     auditStats(client, flags),
     auditNullVectors(client, flags),
     auditDuplicates(client, flags),
     auditBloated(client, flags),
     auditFts(client),
     auditOrphanedProjects(client),
-    auditShards()
+    auditShards(),
+    auditKeyHealth()
   ]);
   let conflicts;
   if (runConflicts) {
@@ -19212,7 +19648,8 @@ async function runAudit(client, flags) {
   }
   const duplicateCount = duplicates.reduce((sum, d) => sum + d.delete_ids.length, 0);
   const hookHealth = auditHookHealth();
-  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, shards };
+  const hookOwnership = auditHookOwnership();
+  return { stats, nullVectors, duplicates, duplicateCount, bloated, fts, orphanedProjects, conflicts, hookHealth, hookOwnership, shards, keyHealth };
 }
 function indicator(value, warn) {
   if (value === 0) return "\u{1F7E2}";
@@ -19260,6 +19697,15 @@ function formatReport(report, flags) {
   lines.push(`${indicator(report.bloated.length, 20)} Bloated (>5KB):   ${fmtNum(report.bloated.length)} / ${fmtNum(s.total)} (${pct(report.bloated.length, s.total)})`);
   const ftsIndicator = report.fts.inSync ? "\u{1F7E2}" : "\u{1F534}";
   lines.push(`${ftsIndicator} FTS index:        ${report.fts.inSync ? "in sync" : "OUT OF SYNC"} (${fmtNum(report.fts.memoryCount)} / ${fmtNum(report.fts.ftsCount)})`);
+  const kh = report.keyHealth;
+  if (!kh.masterKeyPresent) {
+    lines.push("\u{1F534} Recovery key:    master key missing \u2014 import phrase or run setup before syncing");
+  } else if (!kh.recoveryBackupMarked) {
+    lines.push("\u{1F534} Recovery backup: not confirmed \u2014 run `exe-os link export --local-terminal-only` and save the 24-word phrase");
+  } else {
+    const suffix = kh.recoveryBackupConfirmedAt ? ` (${kh.recoveryBackupConfirmedAt.slice(0, 10)}${kh.recoveryBackupSource ? ` via ${kh.recoveryBackupSource}` : ""})` : "";
+    lines.push(`\u{1F7E2} Recovery backup: confirmed${suffix}`);
+  }
   if (report.orphanedProjects.length > 0) {
     const orphanList = report.orphanedProjects.map((o) => `${o.project_name} \u2014 ${o.count} memories`).join(", ");
     lines.push(`\u2139\uFE0F  Orphaned projects: ${report.orphanedProjects.length} (${orphanList})`);
@@ -19291,6 +19737,15 @@ function formatReport(report, flags) {
       lines.push(`                     ${p.count}x: ${p.pattern}`);
     }
   }
+  const ho = report.hookOwnership;
+  if (ho.issues.length === 0) {
+    lines.push(`\u{1F7E2} Hook ownership:  ${ho.checkedFiles.length > 0 ? "manifest clean" : "no local hook config found"}`);
+  } else {
+    lines.push(`\u{1F534} Hook ownership:  ${fmtNum(ho.issues.length)} issue(s)`);
+    for (const issue of ho.issues.slice(0, 5)) {
+      lines.push(`                     [${issue.runtime}/${issue.event}] ${issue.message}`);
+    }
+  }
   const sh = report.shards;
   if (sh.total > 0) {
     if (sh.unreadable === 0) {
@@ -19360,6 +19815,9 @@ function formatReport(report, flags) {
   if (report.conflicts.superseded > 0) {
     recs.push(`${fmtNum(report.conflicts.superseded)} superseded memories can be deactivated`);
   }
+  if (report.hookOwnership.issues.length > 0) {
+    recs.push(`Run exe-os install to refresh hook config; remove stale exe-os hook commands if they remain`);
+  }
   if (recs.length > 0) {
     lines.push("Recommendations:");
     for (const r of recs) {
@@ -19381,7 +19839,7 @@ async function fixNullVectors() {
     }
   }
   const npmRoot = (await import("child_process")).execSync("npm root -g", { encoding: "utf8" }).trim();
-  const backfillPath = path32.join(npmRoot, "exe-os", "dist", "bin", "backfill-vectors.js");
+  const backfillPath = path33.join(npmRoot, "exe-os", "dist", "bin", "backfill-vectors.js");
   return new Promise((resolve, reject) => {
     const child = spawn2("node", [backfillPath], { stdio: "inherit" });
     if (child.pid) registerWorkerPid2(child.pid);
@@ -19493,8 +19951,8 @@ function splitAtSentences(text3, maxChunkSize) {
 }
 async function main(argv = process.argv.slice(2)) {
   const flags = parseFlags(argv);
-  await initStore();
-  const client = getClient();
+  const { fastDbInit: fastDbInit2 } = await Promise.resolve().then(() => (init_fast_db_init(), fast_db_init_exports));
+  const client = await fastDbInit2();
   const report = await runAudit(client, flags);
   console.log(formatReport(report, flags));
   if (flags.fix || flags.dryRun) {
@@ -19685,9 +20143,9 @@ import { z as z58 } from "zod";
 
 // src/lib/cloud-sync.ts
 init_database();
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync16, existsSync as existsSync29, readdirSync as readdirSync11, mkdirSync as mkdirSync14, appendFileSync as appendFileSync2, unlinkSync as unlinkSync11, openSync as openSync2, closeSync as closeSync2, statSync as statSync5 } from "fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync17, existsSync as existsSync30, readdirSync as readdirSync11, mkdirSync as mkdirSync15, appendFileSync as appendFileSync2, unlinkSync as unlinkSync11, openSync as openSync2, closeSync as closeSync2, statSync as statSync5 } from "fs";
 import crypto15 from "crypto";
-import path34 from "path";
+import path35 from "path";
 import { homedir as homedir6 } from "os";
 
 // src/lib/crypto.ts
@@ -19762,7 +20220,7 @@ function sqlSafe(v) {
 }
 function logError(msg) {
   try {
-    const logPath = path34.join(homedir6(), ".exe-os", "workers.log");
+    const logPath = path35.join(homedir6(), ".exe-os", "workers.log");
     appendFileSync2(logPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
@@ -19771,7 +20229,7 @@ function logError(msg) {
 var LOCALHOST_PATTERNS = /^(localhost|127\.0\.0\.1|\[::1\])$/i;
 var FETCH_TIMEOUT_MS2 = 3e4;
 var PUSH_BATCH_SIZE = 5e3;
-var ROSTER_LOCK_PATH = path34.join(EXE_AI_DIR, "roster-merge.lock");
+var ROSTER_LOCK_PATH = path35.join(EXE_AI_DIR, "roster-merge.lock");
 var LOCK_STALE_MS = 3e4;
 var _pgPromise = null;
 var _pgFailed = false;
@@ -19780,12 +20238,12 @@ function isTruthyEnv(value) {
 }
 function loadPgClient() {
   if (_pgFailed) return null;
-  const configPath = path34.join(EXE_AI_DIR, "config.json");
+  const configPath = path35.join(EXE_AI_DIR, "config.json");
   let cloudPostgresUrl;
   let configEnabled = false;
   try {
-    if (existsSync29(configPath)) {
-      const cfg = JSON.parse(readFileSync22(configPath, "utf8"));
+    if (existsSync30(configPath)) {
+      const cfg = JSON.parse(readFileSync23(configPath, "utf8"));
       cloudPostgresUrl = cfg.cloud?.postgresUrl;
       configEnabled = cfg.cloud?.syncToPostgres === true;
     }
@@ -19812,8 +20270,8 @@ function loadPgClient() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path34.join(homedir6(), "exe-db");
-      const req = createRequire6(path34.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path35.join(homedir6(), "exe-db");
+      const req = createRequire6(path35.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL6(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -19858,18 +20316,18 @@ async function withRosterLock(fn) {
   try {
     const fd = openSync2(ROSTER_LOCK_PATH, "wx");
     closeSync2(fd);
-    writeFileSync16(ROSTER_LOCK_PATH, String(Date.now()));
+    writeFileSync17(ROSTER_LOCK_PATH, String(Date.now()));
   } catch (err) {
     if (err.code === "EEXIST") {
       try {
-        const ts2 = parseInt(readFileSync22(ROSTER_LOCK_PATH, "utf-8"), 10);
+        const ts2 = parseInt(readFileSync23(ROSTER_LOCK_PATH, "utf-8"), 10);
         if (Date.now() - ts2 < LOCK_STALE_MS) {
           throw new Error("Roster merge already in progress \u2014 another sync is running");
         }
         unlinkSync11(ROSTER_LOCK_PATH);
         const fd = openSync2(ROSTER_LOCK_PATH, "wx");
         closeSync2(fd);
-        writeFileSync16(ROSTER_LOCK_PATH, String(Date.now()));
+        writeFileSync17(ROSTER_LOCK_PATH, String(Date.now()));
       } catch (retryErr) {
         if (retryErr instanceof Error && retryErr.message.includes("already in progress")) throw retryErr;
         throw new Error("Roster merge already in progress \u2014 another sync is running");
@@ -19988,6 +20446,16 @@ async function cloudPull(sinceVersion, config2) {
     return { records: [], maxVersion: sinceVersion };
   }
 }
+var CLOUD_RELINK_REQUIRED_MESSAGE = "[cloud-sync] Paused after key rotation. Run `exe-os cloud relink --dry-run` for the safe relink checklist.";
+async function getCloudRelinkRequired(client = getClient()) {
+  try {
+    await client.execute("CREATE TABLE IF NOT EXISTS sync_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
+    return String(relink.rows[0]?.value ?? "") === "1";
+  } catch {
+    return false;
+  }
+}
 async function cloudSync(config2) {
   if (!isSyncCryptoInitialized()) {
     try {
@@ -20009,10 +20477,7 @@ async function cloudSync(config2) {
     throw new Error("[cloud-sync] Database not initialized. Call initStore() before cloudSync().");
   }
   try {
-    const relink = await client.execute("SELECT value FROM sync_meta WHERE key = 'cloud_relink_required' LIMIT 1");
-    if (String(relink.rows[0]?.value ?? "") === "1") {
-      throw new Error("[cloud-sync] Paused after key rotation. Re-link/reupload cloud sync with the new recovery phrase before syncing.");
-    }
+    if (await getCloudRelinkRequired(client)) throw new Error(CLOUD_RELINK_REQUIRED_MESSAGE);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("Paused after key rotation")) throw err;
@@ -20262,8 +20727,8 @@ async function cloudSync(config2) {
   try {
     const employees = await loadEmployees();
     rosterResult.employees = employees.length;
-    const idDir = path34.join(EXE_AI_DIR, "identity");
-    if (existsSync29(idDir)) {
+    const idDir = path35.join(EXE_AI_DIR, "identity");
+    if (existsSync30(idDir)) {
       rosterResult.identities = readdirSync11(idDir).filter((f) => f.endsWith(".md")).length;
     }
   } catch {
@@ -20276,7 +20741,7 @@ async function cloudSync(config2) {
       const backupSize = statSync5(latestBackup).size;
       const MAX_CLOUD_BACKUP_BYTES = 50 * 1024 * 1024;
       if (backupSize <= MAX_CLOUD_BACKUP_BYTES) {
-        const backupData = readFileSync22(latestBackup);
+        const backupData = readFileSync23(latestBackup);
         const deviceId = loadDeviceId() ?? "unknown";
         const encrypted = encryptSyncBlob(backupData);
         const backupRes = await fetchWithRetry(`${config2.endpoint}/sync/push-db-backup`, {
@@ -20284,7 +20749,7 @@ async function cloudSync(config2) {
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${config2.apiKey}` },
           body: JSON.stringify({
             device_id: deviceId,
-            filename: path34.basename(latestBackup),
+            filename: path35.basename(latestBackup),
             blob: encrypted,
             size: backupData.length
           })
@@ -20309,49 +20774,49 @@ async function cloudSync(config2) {
     roster: rosterResult
   };
 }
-var ROSTER_DELETIONS_PATH = path34.join(EXE_AI_DIR, "roster-deletions.json");
+var ROSTER_DELETIONS_PATH = path35.join(EXE_AI_DIR, "roster-deletions.json");
 function consumeRosterDeletions() {
   try {
-    if (!existsSync29(ROSTER_DELETIONS_PATH)) return [];
-    const deletions = JSON.parse(readFileSync22(ROSTER_DELETIONS_PATH, "utf-8"));
-    writeFileSync16(ROSTER_DELETIONS_PATH, "[]");
+    if (!existsSync30(ROSTER_DELETIONS_PATH)) return [];
+    const deletions = JSON.parse(readFileSync23(ROSTER_DELETIONS_PATH, "utf-8"));
+    writeFileSync17(ROSTER_DELETIONS_PATH, "[]");
     return deletions;
   } catch {
     return [];
   }
 }
 function buildRosterBlob(paths) {
-  const rosterPath = paths?.rosterPath ?? path34.join(EXE_AI_DIR, "exe-employees.json");
-  const identityDir = paths?.identityDir ?? path34.join(EXE_AI_DIR, "identity");
-  const configPath = paths?.configPath ?? path34.join(EXE_AI_DIR, "config.json");
+  const rosterPath = paths?.rosterPath ?? path35.join(EXE_AI_DIR, "exe-employees.json");
+  const identityDir = paths?.identityDir ?? path35.join(EXE_AI_DIR, "identity");
+  const configPath = paths?.configPath ?? path35.join(EXE_AI_DIR, "config.json");
   let roster = [];
-  if (existsSync29(rosterPath)) {
+  if (existsSync30(rosterPath)) {
     try {
-      roster = JSON.parse(readFileSync22(rosterPath, "utf-8"));
+      roster = JSON.parse(readFileSync23(rosterPath, "utf-8"));
     } catch {
     }
   }
   const identities = {};
-  if (existsSync29(identityDir)) {
+  if (existsSync30(identityDir)) {
     for (const file of readdirSync11(identityDir).filter((f) => f.endsWith(".md"))) {
       try {
-        identities[file] = readFileSync22(path34.join(identityDir, file), "utf-8");
+        identities[file] = readFileSync23(path35.join(identityDir, file), "utf-8");
       } catch {
       }
     }
   }
   let config2;
-  if (existsSync29(configPath)) {
+  if (existsSync30(configPath)) {
     try {
-      config2 = JSON.parse(readFileSync22(configPath, "utf-8"));
+      config2 = JSON.parse(readFileSync23(configPath, "utf-8"));
     } catch {
     }
   }
   let agentConfig;
-  const agentConfigPath = path34.join(EXE_AI_DIR, "agent-config.json");
-  if (existsSync29(agentConfigPath)) {
+  const agentConfigPath = path35.join(EXE_AI_DIR, "agent-config.json");
+  if (existsSync30(agentConfigPath)) {
     try {
-      agentConfig = JSON.parse(readFileSync22(agentConfigPath, "utf-8"));
+      agentConfig = JSON.parse(readFileSync23(agentConfigPath, "utf-8"));
     } catch {
     }
   }
@@ -20427,24 +20892,24 @@ async function cloudPullRoster(config2) {
   }
 }
 function mergeConfig(remoteConfig, configPath) {
-  const cfgPath = configPath ?? path34.join(EXE_AI_DIR, "config.json");
+  const cfgPath = configPath ?? path35.join(EXE_AI_DIR, "config.json");
   let local = {};
-  if (existsSync29(cfgPath)) {
+  if (existsSync30(cfgPath)) {
     try {
-      local = JSON.parse(readFileSync22(cfgPath, "utf-8"));
+      local = JSON.parse(readFileSync23(cfgPath, "utf-8"));
     } catch {
     }
   }
   const merged = { ...remoteConfig, ...local };
-  const dir = path34.dirname(cfgPath);
+  const dir = path35.dirname(cfgPath);
   ensurePrivateDirSync(dir);
-  writeFileSync16(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
+  writeFileSync17(cfgPath, JSON.stringify(merged, null, 2), "utf-8");
   enforcePrivateFileSync(cfgPath);
 }
 async function mergeRosterFromRemote(remote, paths) {
   return withRosterLock(async () => {
     const rosterPath = paths?.rosterPath ?? void 0;
-    const identityDir = paths?.identityDir ?? path34.join(EXE_AI_DIR, "identity");
+    const identityDir = paths?.identityDir ?? path35.join(EXE_AI_DIR, "identity");
     const localEmployees = await loadEmployees(rosterPath);
     const localNames = new Set(localEmployees.map((e) => e.name));
     let added = 0;
@@ -20465,15 +20930,15 @@ async function mergeRosterFromRemote(remote, paths) {
       ) ?? lookupKey;
       const remoteIdentity = remote.identities[matchedKey];
       if (remoteIdentity) {
-        if (!existsSync29(identityDir)) mkdirSync14(identityDir, { recursive: true });
-        const idPath = path34.join(identityDir, `${remoteEmp.name}.md`);
+        if (!existsSync30(identityDir)) mkdirSync15(identityDir, { recursive: true });
+        const idPath = path35.join(identityDir, `${remoteEmp.name}.md`);
         let localIdentity = null;
         try {
-          localIdentity = existsSync29(idPath) ? readFileSync22(idPath, "utf-8") : null;
+          localIdentity = existsSync30(idPath) ? readFileSync23(idPath, "utf-8") : null;
         } catch {
         }
         if (localIdentity !== remoteIdentity) {
-          writeFileSync16(idPath, remoteIdentity, "utf-8");
+          writeFileSync17(idPath, remoteIdentity, "utf-8");
           identitiesUpdated++;
         }
       }
@@ -20499,17 +20964,17 @@ async function mergeRosterFromRemote(remote, paths) {
     }
     if (remote.agentConfig && Object.keys(remote.agentConfig).length > 0) {
       try {
-        const agentConfigPath = path34.join(EXE_AI_DIR, "agent-config.json");
+        const agentConfigPath = path35.join(EXE_AI_DIR, "agent-config.json");
         let local = {};
-        if (existsSync29(agentConfigPath)) {
+        if (existsSync30(agentConfigPath)) {
           try {
-            local = JSON.parse(readFileSync22(agentConfigPath, "utf-8"));
+            local = JSON.parse(readFileSync23(agentConfigPath, "utf-8"));
           } catch {
           }
         }
         const merged = { ...remote.agentConfig, ...local };
-        ensurePrivateDirSync(path34.dirname(agentConfigPath));
-        writeFileSync16(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        ensurePrivateDirSync(path35.dirname(agentConfigPath));
+        writeFileSync17(agentConfigPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
         enforcePrivateFileSync(agentConfigPath);
       } catch {
       }
@@ -20995,9 +21460,136 @@ function registerCloudSync(server2) {
   );
 }
 
+// src/mcp/tools/orchestration-phase.ts
+import { z as z59 } from "zod";
+
+// src/lib/orchestration-phase.ts
+init_config();
+var ORCHESTRATION_PHASES = [
+  "phase_1_coo",
+  "phase_2_executives",
+  "phase_3_parallel_org"
+];
+var PHASE_INFO = {
+  phase_1_coo: {
+    phase: "phase_1_coo",
+    shortLabel: "Phase 1 \u2014 COO mode",
+    label: "Phase 1 \u2014 COO / Chief of Staff mode",
+    focus: "building company context before delegation",
+    nextSuggestion: "Unlock executives when technical, marketing, ops, legal, or finance work repeats."
+  },
+  phase_2_executives: {
+    phase: "phase_2_executives",
+    shortLabel: "Phase 2 \u2014 Executive bench",
+    label: "Phase 2 \u2014 Executive bench",
+    focus: "COO works with domain executives like CTO/CMO before specialist fan-out",
+    nextSuggestion: "Unlock parallel execution when review gates, permissions, and workflows are ready."
+  },
+  phase_3_parallel_org: {
+    phase: "phase_3_parallel_org",
+    shortLabel: "Phase 3 \u2014 Parallel org",
+    label: "Phase 3 \u2014 Parallel execution org",
+    focus: "executives can delegate to specialists in parallel with review gates",
+    nextSuggestion: "Keep review/CI/permission gates healthy; downgrade anytime if you want simpler COO-only mode."
+  }
+};
+function normalizeOrchestrationPhase(input) {
+  if (typeof input !== "string") return "phase_1_coo";
+  const normalized = input.trim().toLowerCase().replace(/\s+/g, "_");
+  if (["1", "phase1", "phase_1", "coo", "coo_mode", "chief_of_staff", "phase_1_coo"].includes(normalized)) {
+    return "phase_1_coo";
+  }
+  if (["2", "phase2", "phase_2", "executives", "executive", "executive_bench", "phase_2_executives"].includes(normalized)) {
+    return "phase_2_executives";
+  }
+  if (["3", "phase3", "phase_3", "parallel", "parallel_org", "parallel_execution", "phase_3_parallel_org"].includes(normalized)) {
+    return "phase_3_parallel_org";
+  }
+  if (ORCHESTRATION_PHASES.includes(normalized)) return normalized;
+  return "phase_1_coo";
+}
+function getOrchestrationPhaseInfo(phase) {
+  return PHASE_INFO[normalizeOrchestrationPhase(phase)];
+}
+async function loadOrchestrationPhase() {
+  const config2 = await loadConfig();
+  return getOrchestrationPhaseInfo(config2.orchestration?.phase);
+}
+async function setOrchestrationPhase(phaseInput, setBy = "user") {
+  const config2 = await loadConfig();
+  const phase = normalizeOrchestrationPhase(phaseInput);
+  config2.orchestration = {
+    ...config2.orchestration ?? {},
+    phase,
+    phaseSetAt: (/* @__PURE__ */ new Date()).toISOString(),
+    phaseSetBy: setBy
+  };
+  await saveConfig(config2);
+  return getOrchestrationPhaseInfo(phase);
+}
+
+// src/mcp/tools/orchestration-phase.ts
+function render(info, prefix) {
+  return [
+    prefix,
+    `## ${info.label}`,
+    "",
+    `- **Focus:** ${info.focus}`,
+    `- **Suggestion:** ${info.nextSuggestion}`,
+    "",
+    "This is guidance, not a blocker. The user can switch phases anytime. Changing phase never overwrites role titles, identities, memories, tasks, or custom org design."
+  ].filter(Boolean).join("\n");
+}
+function registerOrchestrationPhase(server2) {
+  server2.registerTool(
+    "orchestration_phase",
+    {
+      title: "Orchestration Phase",
+      description: "View or change the customer-owned orchestration maturity phase. MCP parity for `exe-os org phase`, `exe-os org unlock executives`, and `exe-os org unlock parallel`. This is a recommendation layer, not a blocker; it never exposes recovery phrases or secrets.",
+      inputSchema: {
+        action: z59.enum(["status", "set", "unlock_executives", "unlock_parallel"]).default("status"),
+        phase: z59.enum(["phase_1_coo", "phase_2_executives", "phase_3_parallel_org", "1", "2", "3"]).optional().describe("Phase to set when action='set'.")
+      }
+    },
+    async ({ action = "status", phase }) => {
+      try {
+        if (action === "status") {
+          const info2 = await loadOrchestrationPhase();
+          return { content: [{ type: "text", text: render(info2) }] };
+        }
+        if (action === "unlock_executives") {
+          const info2 = await setOrchestrationPhase("phase_2_executives", "mcp");
+          return {
+            content: [{ type: "text", text: render(info2, "Phase 2 enabled. Your COO can now lean on the executive bench when useful.") }]
+          };
+        }
+        if (action === "unlock_parallel") {
+          const info2 = await setOrchestrationPhase("phase_3_parallel_org", "mcp");
+          return {
+            content: [{ type: "text", text: render(info2, "Phase 3 enabled. Parallel execution is available with review/permission gates.") }]
+          };
+        }
+        if (!phase) {
+          return {
+            content: [{ type: "text", text: "action='set' requires phase: 1, 2, 3, phase_1_coo, phase_2_executives, or phase_3_parallel_org." }],
+            isError: true
+          };
+        }
+        const info = await setOrchestrationPhase(phase, "mcp");
+        return { content: [{ type: "text", text: render(info, "Updated orchestration phase.") }] };
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `Failed to update orchestration phase: ${err instanceof Error ? err.message : String(err)}` }],
+          isError: true
+        };
+      }
+    }
+  );
+}
+
 // src/mcp/tools/backup-vps.ts
 init_keychain();
-import { z as z59 } from "zod";
+import { z as z60 } from "zod";
 
 // src/lib/vps-backup.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -21322,43 +21914,43 @@ function registerBackupVps(server2) {
     {
       title: "VPS Backup",
       description: "Run VPS Postgres backup/restore workflows and check status.",
-      inputSchema: z59.discriminatedUnion("action", [
-        z59.object({
-          action: z59.literal("backup"),
-          databaseUrl: z59.string().min(1).describe("Postgres DATABASE_URL to dump from"),
-          encryptionKeyB64: z59.string().min(1).max(4096).optional().describe(
+      inputSchema: z60.discriminatedUnion("action", [
+        z60.object({
+          action: z60.literal("backup"),
+          databaseUrl: z60.string().min(1).describe("Postgres DATABASE_URL to dump from"),
+          encryptionKeyB64: z60.string().min(1).max(4096).optional().describe(
             "Base64 AES-256 key (defaults to local master key if omitted)"
           ),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         }),
-        z59.object({
-          action: z59.literal("restore"),
-          databaseUrl: z59.string().min(1).describe("Target Postgres DATABASE_URL for restore"),
-          backupKey: z59.string().min(1).describe("R2 object key to restore from"),
-          encryptionKeyB64: z59.string().min(1).max(4096).optional().describe(
+        z60.object({
+          action: z60.literal("restore"),
+          databaseUrl: z60.string().min(1).describe("Target Postgres DATABASE_URL for restore"),
+          backupKey: z60.string().min(1).describe("R2 object key to restore from"),
+          encryptionKeyB64: z60.string().min(1).max(4096).optional().describe(
             "Base64 AES-256 key (defaults to local master key if omitted)"
           ),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         }),
-        z59.object({
-          action: z59.literal("list"),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+        z60.object({
+          action: z60.literal("list"),
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         }),
-        z59.object({
-          action: z59.literal("health"),
-          r2Bucket: z59.string().min(1).describe("R2 bucket name"),
-          r2Endpoint: z59.string().min(1).describe("R2 endpoint URL"),
-          r2AccessKeyId: z59.string().min(1).describe("R2 access key ID"),
-          r2SecretAccessKey: z59.string().min(1).describe("R2 secret access key")
+        z60.object({
+          action: z60.literal("health"),
+          r2Bucket: z60.string().min(1).describe("R2 bucket name"),
+          r2Endpoint: z60.string().min(1).describe("R2 endpoint URL"),
+          r2AccessKeyId: z60.string().min(1).describe("R2 access key ID"),
+          r2SecretAccessKey: z60.string().min(1).describe("R2 secret access key")
         })
       ])
     },
@@ -21496,11 +22088,11 @@ async function resolveEncryptionKey(providedB64) {
 }
 
 // src/mcp/tools/deploy-client.ts
-import { z as z60 } from "zod";
+import { z as z61 } from "zod";
 import { execFile } from "child_process";
 import { promisify } from "util";
-import path35 from "path";
-import { existsSync as existsSync30 } from "fs";
+import path36 from "path";
+import { existsSync as existsSync31 } from "fs";
 
 // src/lib/hostinger-api.ts
 var DEFAULT_BASE_URL = "https://developers.hostinger.com/api/vps/v1";
@@ -21548,9 +22140,9 @@ var HostingerApiClient = class {
     }
     this.lastRequestTime = Date.now();
   }
-  async request(method, path48, body) {
+  async request(method, path49, body) {
     await this.rateLimit();
-    const url = `${this.baseUrl}${path48}`;
+    const url = `${this.baseUrl}${path49}`;
     const headers = {
       Authorization: `Bearer ${this.apiKey}`,
       "Content-Type": "application/json",
@@ -21623,8 +22215,8 @@ async function requestCloudflare(cfApiToken, zoneId, options) {
   }
   return envelope.result;
 }
-function buildUrl(zoneId, path48 = "/dns_records", query) {
-  const normalizedPath = path48.startsWith("/") ? path48 : `/${path48}`;
+function buildUrl(zoneId, path49 = "/dns_records", query) {
+  const normalizedPath = path49.startsWith("/") ? path49 : `/${path49}`;
   const url = new URL(
     `${CLOUDFLARE_API_BASE_URL}/zones/${zoneId}${normalizedPath}`
   );
@@ -21764,12 +22356,12 @@ function registerDeployClient(server2) {
       title: "Deploy Client",
       description: "Provision a Hostinger VPS and deploy exe-os for a client. Creates VPS, waits for ready state, runs Ansible playbook, verifies health.",
       inputSchema: {
-        client_name: z60.string().min(1).describe("Client name (used for hostname and identification)"),
-        domain: z60.string().min(1).describe("Domain name for the deployment (e.g., client.exe.ai)"),
-        region: z60.string().default("jakarta").describe("VPS region (default: jakarta)"),
-        plan: z60.string().default("kvm-2").describe("Hostinger VPS plan (default: kvm-2)"),
-        ssl_email: z60.string().email().describe("Email for Let's Encrypt SSL certificate"),
-        user_id: z60.string().min(1).describe("User/customer ID for inventory tracking")
+        client_name: z61.string().min(1).describe("Client name (used for hostname and identification)"),
+        domain: z61.string().min(1).describe("Domain name for the deployment (e.g., client.exe.ai)"),
+        region: z61.string().default("jakarta").describe("VPS region (default: jakarta)"),
+        plan: z61.string().default("kvm-2").describe("Hostinger VPS plan (default: kvm-2)"),
+        ssl_email: z61.string().email().describe("Email for Let's Encrypt SSL certificate"),
+        user_id: z61.string().min(1).describe("User/customer ID for inventory tracking")
       }
     },
     async ({ client_name, domain, region, plan, ssl_email, user_id }) => {
@@ -21837,12 +22429,12 @@ async function waitForReady(client, vpsId) {
 }
 async function runAnsiblePlaybook(vpsIp, domain, sslEmail, clientName) {
   const safeClientName = clientName.replace(/[^a-zA-Z0-9_-]/g, "-");
-  const playbookDir = path35.resolve(process.cwd(), "infrastructure", "ansible");
-  const playbookPath = path35.join(playbookDir, "deploy.yml");
-  const inventoryPath = path35.join(playbookDir, "inventory", "hosts.yml");
-  const clientVarsPath = path35.join(playbookDir, "vars", `${safeClientName}.yml`);
-  const varsDir = path35.join(playbookDir, "vars");
-  if (!path35.resolve(clientVarsPath).startsWith(path35.resolve(varsDir))) {
+  const playbookDir = path36.resolve(process.cwd(), "infrastructure", "ansible");
+  const playbookPath = path36.join(playbookDir, "deploy.yml");
+  const inventoryPath = path36.join(playbookDir, "inventory", "hosts.yml");
+  const clientVarsPath = path36.join(playbookDir, "vars", `${safeClientName}.yml`);
+  const varsDir = path36.join(playbookDir, "vars");
+  if (!path36.resolve(clientVarsPath).startsWith(path36.resolve(varsDir))) {
     throw new Error(`Invalid client name for vars path: ${clientName}`);
   }
   const args = [
@@ -21858,7 +22450,7 @@ async function runAnsiblePlaybook(vpsIp, domain, sslEmail, clientName) {
     "-e",
     `client_name=${safeClientName}`
   ];
-  if (existsSync30(clientVarsPath)) {
+  if (existsSync31(clientVarsPath)) {
     args.push("-e", `@${clientVarsPath}`);
   }
   try {
@@ -21931,7 +22523,7 @@ function buildInventoryRecord(params) {
 
 // src/mcp/tools/get-license-status.ts
 init_license();
-import { z as z61 } from "zod";
+import { z as z62 } from "zod";
 var FEATURES = [
   "cloud_sync",
   "external_agents",
@@ -21945,7 +22537,7 @@ function registerGetLicenseStatus(server2) {
       title: "Get License Status",
       description: "Get current license status: plan, validity, feature gates, limits, and expiry.",
       inputSchema: {
-        _dummy: z61.string().optional().describe("Unused \u2014 no input required")
+        _dummy: z62.string().optional().describe("Unused \u2014 no input required")
       }
     },
     async () => {
@@ -21999,11 +22591,11 @@ function registerGetLicenseStatus(server2) {
 // src/mcp/tools/create-license.ts
 init_license();
 import os15 from "os";
-import path36 from "path";
+import path37 from "path";
 import { randomBytes as randomBytes2, randomUUID as randomUUID6 } from "crypto";
 import { createRequire as createRequire3 } from "module";
 import { pathToFileURL as pathToFileURL3 } from "url";
-import { z as z62 } from "zod";
+import { z as z63 } from "zod";
 var prismaPromise = null;
 function loadPrisma() {
   if (!prismaPromise) {
@@ -22015,8 +22607,8 @@ function loadPrisma() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path36.join(os15.homedir(), "exe-db");
-      const req = createRequire3(path36.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path37.join(os15.homedir(), "exe-db");
+      const req = createRequire3(path37.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL3(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -22036,10 +22628,10 @@ function registerCreateLicense(server2) {
       title: "Create License",
       description: "Generate an exe_sk_* license key for a user. Stores in billing.licenses. Returns the key to give to the customer.",
       inputSchema: {
-        email: z62.string().email().describe("Customer email address"),
-        name: z62.string().optional().describe("Customer name"),
-        plan: z62.enum(["free", "pro", "team", "agency", "enterprise"]).default("pro").describe("License plan tier"),
-        expires_in_days: z62.number().int().positive().default(365).describe("Days until expiration (default 365)")
+        email: z63.string().email().describe("Customer email address"),
+        name: z63.string().optional().describe("Customer name"),
+        plan: z63.enum(["free", "pro", "team", "agency", "enterprise"]).default("pro").describe("License plan tier"),
+        expires_in_days: z63.number().int().positive().default(365).describe("Days until expiration (default 365)")
       }
     },
     async ({ email, name, plan, expires_in_days }) => {
@@ -22091,10 +22683,10 @@ Give this key to the customer. They paste it during \`exe-os setup\`.`);
 
 // src/mcp/tools/list-licenses.ts
 import os16 from "os";
-import path37 from "path";
+import path38 from "path";
 import { createRequire as createRequire4 } from "module";
 import { pathToFileURL as pathToFileURL4 } from "url";
-import { z as z63 } from "zod";
+import { z as z64 } from "zod";
 var prismaPromise2 = null;
 function loadPrisma2() {
   if (!prismaPromise2) {
@@ -22106,8 +22698,8 @@ function loadPrisma2() {
         if (!Ctor2) throw new Error(`No PrismaClient at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path37.join(os16.homedir(), "exe-db");
-      const req = createRequire4(path37.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path38.join(os16.homedir(), "exe-db");
+      const req = createRequire4(path38.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL4(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -22124,7 +22716,7 @@ function registerListLicenses(server2) {
       title: "List Licenses",
       description: "List all issued licenses with status (active/expired/revoked). Optionally filter by plan.",
       inputSchema: {
-        plan: z63.enum(["free", "pro", "team", "agency", "enterprise"]).optional().describe("Filter by plan tier (omit for all)")
+        plan: z64.enum(["free", "pro", "team", "agency", "enterprise"]).optional().describe("Filter by plan tier (omit for all)")
       }
     },
     async ({ plan }) => {
@@ -22175,7 +22767,7 @@ function registerListLicenses(server2) {
 
 // src/mcp/tools/activate-license.ts
 init_license();
-import { z as z64 } from "zod";
+import { z as z65 } from "zod";
 function registerActivateLicense(server2) {
   server2.registerTool(
     "activate_license",
@@ -22183,7 +22775,7 @@ function registerActivateLicense(server2) {
       title: "Activate License",
       description: "Activate an exe_sk_* license key on this device. Writes to ~/.exe-os/license.key, validates against Postgres, and caches the result.",
       inputSchema: {
-        key: z64.string().startsWith("exe_sk_").describe("License key (exe_sk_*)")
+        key: z65.string().startsWith("exe_sk_").describe("License key (exe_sk_*)")
       }
     },
     async ({ key }) => {
@@ -22229,18 +22821,18 @@ Key saved to ~/.exe-os/license.key. Device ID: ${deviceId}`);
 }
 
 // src/mcp/tools/create-trigger.ts
-import { z as z65 } from "zod";
+import { z as z66 } from "zod";
 
 // src/automation/trigger-engine.ts
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync17, existsSync as existsSync31, mkdirSync as mkdirSync15 } from "fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync18, existsSync as existsSync32, mkdirSync as mkdirSync16 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
-import path38 from "path";
+import path39 from "path";
 import os17 from "os";
-var TRIGGERS_PATH = path38.join(os17.homedir(), ".exe-os", "triggers.json");
+var TRIGGERS_PATH = path39.join(os17.homedir(), ".exe-os", "triggers.json");
 function loadTriggers(project) {
-  if (!existsSync31(TRIGGERS_PATH)) return [];
+  if (!existsSync32(TRIGGERS_PATH)) return [];
   try {
-    const raw = readFileSync23(TRIGGERS_PATH, "utf-8");
+    const raw = readFileSync24(TRIGGERS_PATH, "utf-8");
     const all = JSON.parse(raw);
     if (!Array.isArray(all)) return [];
     if (project) {
@@ -22252,9 +22844,9 @@ function loadTriggers(project) {
   }
 }
 function saveTriggers(triggers) {
-  const dir = path38.dirname(TRIGGERS_PATH);
-  if (!existsSync31(dir)) mkdirSync15(dir, { recursive: true });
-  writeFileSync17(TRIGGERS_PATH, JSON.stringify(triggers, null, 2), "utf-8");
+  const dir = path39.dirname(TRIGGERS_PATH);
+  if (!existsSync32(dir)) mkdirSync16(dir, { recursive: true });
+  writeFileSync18(TRIGGERS_PATH, JSON.stringify(triggers, null, 2), "utf-8");
 }
 function createNewTrigger(input) {
   const triggers = loadTriggers();
@@ -22410,14 +23002,14 @@ function addToCrontab(id, cron, prompt, projectDir) {
 }
 
 // src/mcp/tools/create-trigger.ts
-var conditionSchema = z65.object({
-  field: z65.string().describe("Dot-path field to evaluate, e.g., 'stage' or 'amount'"),
-  op: z65.enum(["eq", "neq", "gt", "lt", "gte", "lte", "contains", "not_contains"]).describe("Comparison operator"),
-  value: z65.string().or(z65.number()).or(z65.boolean()).describe("Value to compare against")
+var conditionSchema = z66.object({
+  field: z66.string().describe("Dot-path field to evaluate, e.g., 'stage' or 'amount'"),
+  op: z66.enum(["eq", "neq", "gt", "lt", "gte", "lte", "contains", "not_contains"]).describe("Comparison operator"),
+  value: z66.string().or(z66.number()).or(z66.boolean()).describe("Value to compare against")
 });
-var actionSchema = z65.object({
-  type: z65.enum(["send_whatsapp", "send_message", "create_task", "mcp_tool"]).describe("Action type to execute"),
-  params: z65.record(z65.string(), z65.string()).describe(
+var actionSchema = z66.object({
+  type: z66.enum(["send_whatsapp", "send_message", "create_task", "mcp_tool"]).describe("Action type to execute"),
+  params: z66.record(z66.string(), z66.string()).describe(
     "Action parameters. Supports {{record.field}} templates for dynamic values."
   )
 });
@@ -22428,18 +23020,18 @@ function registerCreateTrigger(server2) {
       title: "Create Trigger",
       description: "Create a CRM event trigger or scheduled automation. When matching events occur (e.g., Deal.updated with stage=won), configured actions fire automatically (send_whatsapp, create_task, etc.).",
       inputSchema: {
-        name: z65.string().describe("Human-readable trigger name"),
-        event: z65.string().describe(
+        name: z66.string().describe("Human-readable trigger name"),
+        event: z66.string().describe(
           'CRM event to match, e.g., "Deal.updated", "Order.created", "*" for all'
         ),
-        conditions: z65.array(conditionSchema).default([]).describe("Conditions that must all match (AND logic)"),
-        actions: z65.array(actionSchema).min(1).describe("Actions to execute when trigger fires"),
-        project: z65.string().optional().describe("Scope trigger to a specific project"),
-        enabled: z65.boolean().default(true).describe("Whether trigger is active"),
-        schedule: z65.string().optional().describe(
+        conditions: z66.array(conditionSchema).default([]).describe("Conditions that must all match (AND logic)"),
+        actions: z66.array(actionSchema).min(1).describe("Actions to execute when trigger fires"),
+        project: z66.string().optional().describe("Scope trigger to a specific project"),
+        enabled: z66.boolean().default(true).describe("Whether trigger is active"),
+        schedule: z66.string().optional().describe(
           'Cron schedule for time-based triggers, e.g., "0 9 * * *" or "Monday 9am"'
         ),
-        query: z65.string().optional().describe(
+        query: z66.string().optional().describe(
           "CRM GraphQL query to run on schedule (required if schedule is set)"
         )
       }
@@ -22512,7 +23104,7 @@ Enabled: ${trigger.enabled}` + scheduleInfo;
 }
 
 // src/mcp/tools/list-triggers.ts
-import { z as z66 } from "zod";
+import { z as z67 } from "zod";
 function registerListTriggers(server2) {
   server2.registerTool(
     "list_triggers",
@@ -22520,7 +23112,7 @@ function registerListTriggers(server2) {
       title: "List Triggers",
       description: "List configured CRM event triggers and scheduled automations.",
       inputSchema: {
-        project: z66.string().optional().describe("Filter triggers by project name")
+        project: z67.string().optional().describe("Filter triggers by project name")
       }
     },
     async ({ project }) => {
@@ -22555,51 +23147,51 @@ function registerListTriggers(server2) {
 }
 
 // src/mcp/tools/apply-starter-pack.ts
-import { z as z67 } from "zod";
+import { z as z68 } from "zod";
 
 // src/automation/starter-packs/index.ts
-import { readFileSync as readFileSync24, readdirSync as readdirSync12, existsSync as existsSync32 } from "fs";
-import path39 from "path";
+import { readFileSync as readFileSync25, readdirSync as readdirSync12, existsSync as existsSync33 } from "fs";
+import path40 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
-var __dirname = path39.dirname(fileURLToPath4(import.meta.url));
+var __dirname = path40.dirname(fileURLToPath4(import.meta.url));
 function listPacks() {
-  const packsDir = path39.join(__dirname, ".");
-  if (!existsSync32(packsDir)) return [];
+  const packsDir = path40.join(__dirname, ".");
+  if (!existsSync33(packsDir)) return [];
   return readdirSync12(packsDir, { withFileTypes: true }).filter(
-    (d) => d.isDirectory() && existsSync32(path39.join(packsDir, d.name, "custom-objects.json"))
+    (d) => d.isDirectory() && existsSync33(path40.join(packsDir, d.name, "custom-objects.json"))
   ).map((d) => d.name);
 }
 function loadPack(industry) {
-  const packDir = path39.join(__dirname, industry);
-  const objectsPath = path39.join(packDir, "custom-objects.json");
-  const triggersPath = path39.join(packDir, "triggers.json");
-  const wikiDir = path39.join(packDir, "wiki-seeds");
-  const manifestPath = path39.join(packDir, "pack.json");
-  const identityContextPath = path39.join(packDir, "identity-context.md");
-  if (!existsSync32(objectsPath)) return null;
+  const packDir = path40.join(__dirname, industry);
+  const objectsPath = path40.join(packDir, "custom-objects.json");
+  const triggersPath = path40.join(packDir, "triggers.json");
+  const wikiDir = path40.join(packDir, "wiki-seeds");
+  const manifestPath = path40.join(packDir, "pack.json");
+  const identityContextPath = path40.join(packDir, "identity-context.md");
+  if (!existsSync33(objectsPath)) return null;
   let customObjects = [];
   try {
     customObjects = JSON.parse(
-      readFileSync24(objectsPath, "utf-8")
+      readFileSync25(objectsPath, "utf-8")
     );
   } catch {
     customObjects = [];
   }
   let triggers = [];
-  if (existsSync32(triggersPath)) {
+  if (existsSync33(triggersPath)) {
     try {
       triggers = JSON.parse(
-        readFileSync24(triggersPath, "utf-8")
+        readFileSync25(triggersPath, "utf-8")
       );
     } catch {
       triggers = [];
     }
   }
   const wikiSeeds = [];
-  if (existsSync32(wikiDir)) {
+  if (existsSync33(wikiDir)) {
     const files = readdirSync12(wikiDir).filter((f) => f.endsWith(".md"));
     for (const file of files) {
-      const content = readFileSync24(path39.join(wikiDir, file), "utf-8");
+      const content = readFileSync25(path40.join(wikiDir, file), "utf-8");
       const titleMatch = content.match(/^#\s+(.+)/m);
       wikiSeeds.push({
         filename: file,
@@ -22609,17 +23201,17 @@ function loadPack(industry) {
     }
   }
   let manifest = {};
-  if (existsSync32(manifestPath)) {
+  if (existsSync33(manifestPath)) {
     try {
-      manifest = JSON.parse(readFileSync24(manifestPath, "utf-8"));
+      manifest = JSON.parse(readFileSync25(manifestPath, "utf-8"));
     } catch {
       manifest = {};
     }
   }
   let identityContext = null;
-  if (existsSync32(identityContextPath)) {
+  if (existsSync33(identityContextPath)) {
     try {
-      identityContext = readFileSync24(identityContextPath, "utf-8");
+      identityContext = readFileSync25(identityContextPath, "utf-8");
     } catch {
       identityContext = null;
     }
@@ -22676,8 +23268,8 @@ function applyPack(industry, project) {
 
 // src/lib/client-coo.ts
 init_config();
-import { existsSync as existsSync33, mkdirSync as mkdirSync16, writeFileSync as writeFileSync18 } from "fs";
-import path40 from "path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync17, writeFileSync as writeFileSync19 } from "fs";
+import path41 from "path";
 
 // src/lib/employee-templates.ts
 init_global_procedures();
@@ -22817,18 +23409,18 @@ var ClientCOOClobberError = class extends Error {
 var COO_ROLE = "Chief Operating Officer";
 var FEEDBACK_BEHAVIOR_CONTENT = "Tag exe-os issues with needs_improvement \u2014 this is the feedback loop that surfaces bugs, gaps, and friction to the founder each Monday.";
 async function provisionClientCOO(vars, opts = {}) {
-  const identityDir = opts.identityDir ?? path40.join(EXE_AI_DIR, "identity");
+  const identityDir = opts.identityDir ?? path41.join(EXE_AI_DIR, "identity");
   const rosterPath = opts.employeesPath ?? EMPLOYEES_PATH;
   const storeFeedbackBehavior = opts.storeFeedbackBehavior ?? true;
-  const identityPath2 = path40.join(identityDir, `${vars.agent_name}.md`);
-  if (existsSync33(identityPath2)) {
+  const identityPath2 = path41.join(identityDir, `${vars.agent_name}.md`);
+  if (existsSync34(identityPath2)) {
     throw new ClientCOOClobberError(vars.agent_name, identityPath2);
   }
   const body = renderClientCOOTemplate(vars);
-  if (!existsSync33(identityDir)) {
-    mkdirSync16(identityDir, { recursive: true });
+  if (!existsSync34(identityDir)) {
+    mkdirSync17(identityDir, { recursive: true });
   }
-  writeFileSync18(identityPath2, body, "utf-8");
+  writeFileSync19(identityPath2, body, "utf-8");
   const employees = await loadEmployees(rosterPath);
   const existing = employees.find((e) => e.name === vars.agent_name);
   let addedToRoster = false;
@@ -22864,17 +23456,17 @@ function registerApplyStarterPack(server2) {
       title: "Apply Starter Pack",
       description: "Apply an industry starter pack to a project. Sets up CRM custom objects, pre-wired automation triggers, and wiki seed content. When the pack creates a Client COO (e.g. distribution) and agent_name, company_name, founder_name are all provided, also provisions the COO identity, roster entry, and feedback-loop behavior. Available packs: distribution. More coming.",
       inputSchema: {
-        industry: z67.string().describe(
+        industry: z68.string().describe(
           'Industry pack to apply (e.g., "distribution"). Use without args to list available packs.'
         ),
-        project: z67.string().describe("Project name to scope the triggers to"),
-        agent_name: z67.string().optional().describe(
+        project: z68.string().describe("Project name to scope the triggers to"),
+        agent_name: z68.string().optional().describe(
           "Optional. Lowercase alphanumeric name for the Client COO agent. Required (alongside company_name and founder_name) to provision a COO."
         ),
-        company_name: z67.string().optional().describe(
+        company_name: z68.string().optional().describe(
           "Optional. The client company the COO serves. Required to provision a COO."
         ),
-        founder_name: z67.string().optional().describe(
+        founder_name: z68.string().optional().describe(
           "Optional. The founder the COO reports to. Required to provision a COO."
         )
       }
@@ -23019,19 +23611,19 @@ ${err.message}`
 }
 
 // src/mcp/tools/load-skill.ts
-import { z as z68 } from "zod";
-import { readFileSync as readFileSync25, readdirSync as readdirSync13, statSync as statSync6 } from "fs";
-import path41 from "path";
+import { z as z69 } from "zod";
+import { readFileSync as readFileSync26, readdirSync as readdirSync13, statSync as statSync6 } from "fs";
+import path42 from "path";
 import { homedir as homedir7 } from "os";
-var SKILLS_DIR = path41.join(homedir7(), ".claude", "skills");
+var SKILLS_DIR = path42.join(homedir7(), ".claude", "skills");
 function listAvailableSkills() {
   try {
     const entries = readdirSync13(SKILLS_DIR);
     return entries.filter((entry) => {
       try {
-        const entryPath = path41.join(SKILLS_DIR, entry);
+        const entryPath = path42.join(SKILLS_DIR, entry);
         if (!statSync6(entryPath).isDirectory()) return false;
-        const skillFile = path41.join(entryPath, "SKILL.md");
+        const skillFile = path42.join(entryPath, "SKILL.md");
         statSync6(skillFile);
         return true;
       } catch {
@@ -23049,7 +23641,7 @@ function registerLoadSkill(server2) {
       title: "Load Skill",
       description: "Load domain-specific guidance into your context. Use when you need specialized knowledge for a task (e.g., load_skill('seo') before doing SEO work, load_skill('code-reviewer') before reviewing code). Pass skill_name='list' to see all available skills.",
       inputSchema: {
-        skill_name: z68.string().describe(
+        skill_name: z69.string().describe(
           "Skill to load (e.g. 'seo', 'code-reviewer', 'frontend-design'). Pass 'list' to see all available skills."
         )
       }
@@ -23074,10 +23666,10 @@ ${skills.map((s) => `- ${s}`).join("\n")}`
           }]
         };
       }
-      const sanitized = path41.basename(skill_name);
-      const skillFile = path41.join(SKILLS_DIR, sanitized, "SKILL.md");
+      const sanitized = path42.basename(skill_name);
+      const skillFile = path42.join(SKILLS_DIR, sanitized, "SKILL.md");
       try {
-        const content = readFileSync25(skillFile, "utf-8");
+        const content = readFileSync26(skillFile, "utf-8");
         return {
           content: [{
             type: "text",
@@ -23105,18 +23697,18 @@ ${available.map((s) => `- ${s}`).join("\n")}` : "\n\nNo skills found in ~/.claud
 
 // src/mcp/tools/export-orchestration.ts
 init_active_agent();
-import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync20 } from "fs";
-import path43 from "path";
-import { z as z69 } from "zod";
+import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync21 } from "fs";
+import path44 from "path";
+import { z as z70 } from "zod";
 
 // src/lib/orchestration-package.ts
 init_database();
 init_identity();
 init_platform_procedures();
 import { randomUUID as randomUUID8 } from "crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync34, mkdirSync as mkdirSync17, readFileSync as readFileSync26, writeFileSync as writeFileSync19 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync35, mkdirSync as mkdirSync18, readFileSync as readFileSync27, writeFileSync as writeFileSync20 } from "fs";
 import os18 from "os";
-import path42 from "path";
+import path43 from "path";
 var PACKAGE_VERSION = "1.0";
 var ROSTER_FILENAME = "exe-employees.json";
 var ROSTER_BACKUP_FILENAME = "exe-employees.json.bak";
@@ -23182,15 +23774,15 @@ function validateProcedureEntry(value, index) {
   };
 }
 function getRosterPath() {
-  return path42.join(os18.homedir(), EXE_OS_DIRNAME, ROSTER_FILENAME);
+  return path43.join(os18.homedir(), EXE_OS_DIRNAME, ROSTER_FILENAME);
 }
 function getBackupPath() {
-  return path42.join(os18.homedir(), EXE_OS_DIRNAME, ROSTER_BACKUP_FILENAME);
+  return path43.join(os18.homedir(), EXE_OS_DIRNAME, ROSTER_BACKUP_FILENAME);
 }
 function readRosterFile() {
   const rosterPath = getRosterPath();
-  if (!existsSync34(rosterPath)) return [];
-  const raw = readFileSync26(rosterPath, "utf-8");
+  if (!existsSync35(rosterPath)) return [];
+  const raw = readFileSync27(rosterPath, "utf-8");
   const parsed = JSON.parse(raw);
   if (!Array.isArray(parsed)) {
     throw new Error("Roster file must contain a JSON array");
@@ -23202,8 +23794,8 @@ function writeRosterFile(roster) {
     throw new Error("Refusing to write empty roster \u2014 this would delete all employees");
   }
   const rosterPath = getRosterPath();
-  mkdirSync17(path42.dirname(rosterPath), { recursive: true });
-  if (existsSync34(rosterPath)) {
+  mkdirSync18(path43.dirname(rosterPath), { recursive: true });
+  if (existsSync35(rosterPath)) {
     const currentRoster = readRosterFile();
     if (roster.length < currentRoster.length) {
       throw new Error(
@@ -23212,7 +23804,7 @@ function writeRosterFile(roster) {
     }
     copyFileSync2(rosterPath, getBackupPath());
   }
-  writeFileSync19(rosterPath, `${JSON.stringify(roster, null, 2)}
+  writeFileSync20(rosterPath, `${JSON.stringify(roster, null, 2)}
 `, "utf-8");
 }
 function buildImportedRosterEntries(roster, timestamp) {
@@ -23467,15 +24059,15 @@ function registerExportOrchestration(server2) {
       title: "Export Orchestration",
       description: "Export roster, identities, behaviors, and customer procedures to a JSON package.",
       inputSchema: {
-        output_path: z69.string().describe("File path to write the JSON package")
+        output_path: z70.string().describe("File path to write the JSON package")
       }
     },
     async ({ output_path }) => {
       try {
         await initStore();
         const pkg = await exportOrchestration(getActiveAgent().agentId);
-        mkdirSync18(path43.dirname(output_path), { recursive: true });
-        writeFileSync20(output_path, `${JSON.stringify(pkg, null, 2)}
+        mkdirSync19(path44.dirname(output_path), { recursive: true });
+        writeFileSync21(output_path, `${JSON.stringify(pkg, null, 2)}
 `, "utf-8");
         return {
           content: [{
@@ -23497,8 +24089,8 @@ function registerExportOrchestration(server2) {
 }
 
 // src/mcp/tools/import-orchestration.ts
-import { readFileSync as readFileSync27 } from "fs";
-import { z as z70 } from "zod";
+import { readFileSync as readFileSync28 } from "fs";
+import { z as z71 } from "zod";
 init_store();
 init_active_agent();
 init_employees();
@@ -23509,8 +24101,8 @@ function registerImportOrchestration(server2) {
       title: "Import Orchestration",
       description: "Import roster, identities, behaviors, and procedures from an orchestration package. Restricted to coordinator/founder.",
       inputSchema: {
-        package_path: z70.string().describe("Path to the orchestration package JSON file"),
-        merge_strategy: z70.enum(["replace", "merge"]).default("merge").describe("How to apply the package: both strategies are additive-only \u2014 existing data is never deleted or overwritten")
+        package_path: z71.string().describe("Path to the orchestration package JSON file"),
+        merge_strategy: z71.enum(["replace", "merge"]).default("merge").describe("How to apply the package: both strategies are additive-only \u2014 existing data is never deleted or overwritten")
       }
     },
     async ({ package_path, merge_strategy }) => {
@@ -23527,7 +24119,7 @@ function registerImportOrchestration(server2) {
           };
         }
         await initStore();
-        const raw = readFileSync27(package_path, "utf-8");
+        const raw = readFileSync28(package_path, "utf-8");
         const pkg = validatePackage(JSON.parse(raw));
         const result = await importOrchestration(pkg, merge_strategy);
         return {
@@ -23555,7 +24147,7 @@ init_platform_procedures();
 init_active_agent();
 init_database();
 init_employees();
-import { z as z71 } from "zod";
+import { z as z72 } from "zod";
 function registerCompanyProcedureTool(server2, toolName) {
   server2.registerTool(
     toolName,
@@ -23563,12 +24155,12 @@ function registerCompanyProcedureTool(server2, toolName) {
       title: "Company Procedure",
       description: "Manage company procedures (customer-owned Layer 0 rules) that supersede identity, expertise, and experience. Actions: store (create new, restricted), list (view all, open), deactivate (soft-delete, restricted).",
       inputSchema: {
-        action: z71.enum(["store", "list", "deactivate"]).describe("Action to perform"),
-        title: z71.string().optional().describe("Short title for the procedure (store)"),
-        content: z71.string().max(500).optional().describe("The procedure content \u2014 clear, actionable instruction (store)"),
-        priority: z71.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default). p1 = standard. p2 = nice-to-have."),
-        domain: z71.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security"),
-        procedure_id: z71.string().optional().describe("UUID of the company procedure (deactivate)")
+        action: z72.enum(["store", "list", "deactivate"]).describe("Action to perform"),
+        title: z72.string().optional().describe("Short title for the procedure (store)"),
+        content: z72.string().max(500).optional().describe("The procedure content \u2014 clear, actionable instruction (store)"),
+        priority: z72.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default). p1 = standard. p2 = nice-to-have."),
+        domain: z72.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security"),
+        procedure_id: z72.string().optional().describe("UUID of the company procedure (deactivate)")
       }
     },
     async ({ action, title, content, priority, domain, procedure_id }) => {
@@ -23701,6 +24293,7 @@ var ACTION_TO_TOOL2 = {
   memory_audit: "run_memory_audit",
   run_consolidation: "run_consolidation",
   cloud_sync: "cloud_sync",
+  orchestration_phase: "orchestration_phase",
   backup_vps: "backup_vps",
   deploy_client: "deploy_client",
   license_status: "get_license_status",
@@ -23737,6 +24330,7 @@ function buildHandlers5() {
   registerRunMemoryAudit(localServer);
   registerRunConsolidation(localServer);
   registerCloudSync(localServer);
+  registerOrchestrationPhase(localServer);
   registerBackupVps(localServer);
   registerDeployClient(localServer);
   registerGetLicenseStatus(localServer);
@@ -23759,41 +24353,42 @@ function registerConfig(server2) {
     title: "Config",
     description: "Consolidated COO/admin tool for runtime config, system health, licensing, triggers, orchestration import/export, and company procedures.",
     inputSchema: {
-      action: z72.enum(Object.keys(ACTION_TO_TOOL2)).describe("Admin/config operation"),
-      agent_id: z72.string().optional().describe("Agent id for set_agent_config/agent_spend/session queries"),
-      runtime: z72.string().optional().describe("Runtime for set_agent_config"),
-      model: z72.string().optional().describe("Model for set_agent_config"),
-      reasoning_effort: z72.string().optional().describe("Reasoning effort for Codex agents"),
-      dry_run: z72.boolean().optional().describe("Preview without applying where supported"),
-      fix: z72.boolean().optional().describe("Apply fixes for memory_audit where supported"),
-      verbose: z72.boolean().optional().describe("Verbose output where supported"),
-      project_name: z72.string().optional().describe("Project filter/name"),
-      since: z72.string().optional().describe("ISO lower-bound timestamp"),
-      limit: z72.coerce.number().optional().describe("Result limit"),
-      output_path: z72.string().optional().describe("Output path for export/backup"),
-      input_path: z72.string().optional().describe("Input path for import_orchestration"),
-      strategy: z72.enum(["merge", "replace"]).optional().describe("Import strategy; replace must still be additive-only per platform rules"),
-      license_key: z72.string().optional().describe("License key for activation/status"),
-      email: z72.string().optional().describe("Customer email for license creation"),
-      plan: z72.string().optional().describe("License plan"),
-      name: z72.string().optional().describe("Trigger/starter pack/procedure/client name"),
-      event: z72.string().optional().describe("Trigger event"),
-      conditions: z72.array(z72.record(z72.string(), z72.unknown())).optional().describe("Trigger conditions"),
-      actions: z72.array(z72.record(z72.string(), z72.unknown())).optional().describe("Trigger actions"),
-      enabled: z72.boolean().optional().describe("Trigger enabled flag"),
-      schedule: z72.string().optional().describe("Trigger schedule"),
-      query: z72.string().optional().describe("Trigger query or filter"),
-      skill_name: z72.string().optional().describe("Skill name for load_skill"),
-      pack_name: z72.string().optional().describe("Starter pack name"),
-      title: z72.string().optional().describe("Procedure title"),
-      content: z72.string().optional().describe("Procedure content"),
-      priority: z72.enum(["p0", "p1", "p2"]).optional().describe("Procedure priority"),
-      domain: z72.string().optional().describe("Procedure domain"),
-      procedure_id: z72.string().optional().describe("Procedure id for deactivate"),
-      subaction: z72.enum(["store", "list", "deactivate"]).optional().describe("Nested action for company_procedure/global_procedure"),
-      max_clusters: z72.coerce.number().optional().describe("Consolidation max clusters"),
-      force: z72.boolean().optional().describe("Force operation where supported"),
-      domain_name: z72.string().optional().describe("Client deployment domain")
+      action: z73.enum(Object.keys(ACTION_TO_TOOL2)).describe("Admin/config operation"),
+      agent_id: z73.string().optional().describe("Agent id for set_agent_config/agent_spend/session queries"),
+      runtime: z73.string().optional().describe("Runtime for set_agent_config"),
+      model: z73.string().optional().describe("Model for set_agent_config"),
+      reasoning_effort: z73.string().optional().describe("Reasoning effort for Codex agents"),
+      dry_run: z73.boolean().optional().describe("Preview without applying where supported"),
+      fix: z73.boolean().optional().describe("Apply fixes for memory_audit where supported"),
+      verbose: z73.boolean().optional().describe("Verbose output where supported"),
+      project_name: z73.string().optional().describe("Project filter/name"),
+      since: z73.string().optional().describe("ISO lower-bound timestamp"),
+      limit: z73.coerce.number().optional().describe("Result limit"),
+      output_path: z73.string().optional().describe("Output path for export/backup"),
+      input_path: z73.string().optional().describe("Input path for import_orchestration"),
+      strategy: z73.enum(["merge", "replace"]).optional().describe("Import strategy; replace must still be additive-only per platform rules"),
+      license_key: z73.string().optional().describe("License key for activation/status"),
+      email: z73.string().optional().describe("Customer email for license creation"),
+      plan: z73.string().optional().describe("License plan"),
+      name: z73.string().optional().describe("Trigger/starter pack/procedure/client name"),
+      event: z73.string().optional().describe("Trigger event"),
+      conditions: z73.array(z73.record(z73.string(), z73.unknown())).optional().describe("Trigger conditions"),
+      actions: z73.array(z73.record(z73.string(), z73.unknown())).optional().describe("Trigger actions"),
+      enabled: z73.boolean().optional().describe("Trigger enabled flag"),
+      schedule: z73.string().optional().describe("Trigger schedule"),
+      query: z73.string().optional().describe("Trigger query or filter"),
+      skill_name: z73.string().optional().describe("Skill name for load_skill"),
+      pack_name: z73.string().optional().describe("Starter pack name"),
+      title: z73.string().optional().describe("Procedure title"),
+      content: z73.string().optional().describe("Procedure content"),
+      priority: z73.enum(["p0", "p1", "p2"]).optional().describe("Procedure priority"),
+      domain: z73.string().optional().describe("Procedure domain"),
+      procedure_id: z73.string().optional().describe("Procedure id for deactivate"),
+      subaction: z73.enum(["store", "list", "deactivate"]).optional().describe("Nested action for company_procedure/global_procedure"),
+      max_clusters: z73.coerce.number().optional().describe("Consolidation max clusters"),
+      force: z73.boolean().optional().describe("Force operation where supported"),
+      domain_name: z73.string().optional().describe("Client deployment domain"),
+      phase: z73.enum(["phase_1_coo", "phase_2_executives", "phase_3_parallel_org", "1", "2", "3"]).optional().describe("Orchestration phase for orchestration_phase action")
     }
   }, async (input, extra) => {
     const action = input.action;
@@ -23814,10 +24409,10 @@ function registerConfig(server2) {
 }
 
 // src/mcp/tools/wiki.ts
-import { z as z75 } from "zod";
+import { z as z76 } from "zod";
 
 // src/mcp/tools/list-wiki-pages.ts
-import { z as z73 } from "zod";
+import { z as z74 } from "zod";
 var FETCH_TIMEOUT_MS3 = 1e4;
 function registerListWikiPages(server2) {
   server2.registerTool(
@@ -23826,8 +24421,8 @@ function registerListWikiPages(server2) {
       title: "List Wiki Pages",
       description: "List documents in an exe-wiki workspace. Optionally filter by folder.",
       inputSchema: {
-        workspace: z73.string().describe('Wiki workspace slug (e.g., "hygo")'),
-        folder: z73.string().optional().describe("Filter by folder path")
+        workspace: z74.string().describe('Wiki workspace slug (e.g., "hygo")'),
+        folder: z74.string().optional().describe("Filter by folder path")
       }
     },
     async ({ workspace, folder }) => {
@@ -23916,7 +24511,7 @@ function registerListWikiPages(server2) {
 }
 
 // src/mcp/tools/get-wiki-page.ts
-import { z as z74 } from "zod";
+import { z as z75 } from "zod";
 var FETCH_TIMEOUT_MS4 = 1e4;
 function registerGetWikiPage(server2) {
   server2.registerTool(
@@ -23925,9 +24520,9 @@ function registerGetWikiPage(server2) {
       title: "Get Wiki Page",
       description: "Read a wiki page by document ID or title. Returns content, metadata, and folder path. Use title search when you know the page name but not the ID.",
       inputSchema: {
-        workspace: z74.string().describe('Wiki workspace slug (e.g., "hygo")'),
-        document_id: z74.string().optional().describe("Specific document ID (exact lookup)"),
-        title: z74.string().optional().describe("Search by title (fuzzy match)")
+        workspace: z75.string().describe('Wiki workspace slug (e.g., "hygo")'),
+        document_id: z75.string().optional().describe("Specific document ID (exact lookup)"),
+        title: z75.string().optional().describe("Search by title (fuzzy match)")
       }
     },
     async ({ workspace, document_id, title }) => {
@@ -24109,14 +24704,14 @@ function registerWiki(server2) {
       title: "Wiki",
       description: "Consolidated wiki domain tool. Actions: list, get. Wiki writes flow through raw data ingestion/projection into the curated wiki store; direct create/update MCP tools have been removed.",
       inputSchema: {
-        action: z75.enum(["list", "get"]).describe("Wiki read operation. Writes use raw-data ingestion/projection, not direct MCP writes."),
-        workspace: z75.string().optional().describe("Wiki workspace slug"),
-        title: z75.string().optional().describe("Fuzzy page title lookup for get"),
-        content: z75.string().optional().describe("Reserved; wiki writes use raw-data ingestion/projection"),
-        folder: z75.string().optional().describe("Optional folder path for list"),
-        document_id: z75.string().optional().describe("Document ID for get"),
-        mode: z75.enum(["replace", "append"]).optional().describe("Reserved; direct wiki updates are removed"),
-        section: z75.string().optional().describe("Reserved; direct wiki updates are removed")
+        action: z76.enum(["list", "get"]).describe("Wiki read operation. Writes use raw-data ingestion/projection, not direct MCP writes."),
+        workspace: z76.string().optional().describe("Wiki workspace slug"),
+        title: z76.string().optional().describe("Fuzzy page title lookup for get"),
+        content: z76.string().optional().describe("Reserved; wiki writes use raw-data ingestion/projection"),
+        folder: z76.string().optional().describe("Optional folder path for list"),
+        document_id: z76.string().optional().describe("Document ID for get"),
+        mode: z76.enum(["replace", "append"]).optional().describe("Reserved; direct wiki updates are removed"),
+        section: z76.string().optional().describe("Reserved; direct wiki updates are removed")
       }
     },
     async (input, extra) => {
@@ -24144,7 +24739,7 @@ init_active_agent();
 init_project_name();
 init_database();
 init_employees();
-import { z as z76 } from "zod";
+import { z as z77 } from "zod";
 function rowToBehavior2(r) {
   return {
     id: String(r.id),
@@ -24166,13 +24761,13 @@ function registerBehavior(server2) {
       title: "Behavior",
       description: "Manage behavioral patterns, corrections, and reusable procedures for employees. Actions: store (create new), list (query existing), deactivate (soft-delete, restricted).",
       inputSchema: {
-        action: z76.enum(["store", "list", "deactivate"]).describe("Action to perform"),
-        content: z76.string().max(500).optional().describe("The behavioral instruction \u2014 one clear sentence (store)"),
-        domain: z76.string().optional().describe("Category: workflow, code-style, tool-use, communication, architecture, testing"),
-        priority: z76.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always included. p1 = standard (default). p2 = nice-to-have."),
-        agent_id: z76.string().optional().describe("Employee name. Defaults to current agent. Pass 'all' to list everyone's (list only)."),
-        project_name: z76.string().optional().describe("Defaults to current project. Pass 'global' for a behavior that applies everywhere (store)."),
-        behavior_id: z76.string().optional().describe("UUID of the behavior (deactivate)")
+        action: z77.enum(["store", "list", "deactivate"]).describe("Action to perform"),
+        content: z77.string().max(500).optional().describe("The behavioral instruction \u2014 one clear sentence (store)"),
+        domain: z77.string().optional().describe("Category: workflow, code-style, tool-use, communication, architecture, testing"),
+        priority: z77.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always included. p1 = standard (default). p2 = nice-to-have."),
+        agent_id: z77.string().optional().describe("Employee name. Defaults to current agent. Pass 'all' to list everyone's (list only)."),
+        project_name: z77.string().optional().describe("Defaults to current project. Pass 'global' for a behavior that applies everywhere (store)."),
+        behavior_id: z77.string().optional().describe("UUID of the behavior (deactivate)")
       }
     },
     async ({ action, content, domain, priority, agent_id, project_name, behavior_id }) => {
@@ -24343,7 +24938,7 @@ Content: ${row.content}`
 }
 
 // src/mcp/tools/reminder.ts
-import { z as z77 } from "zod";
+import { z as z78 } from "zod";
 function registerReminder(server2) {
   server2.registerTool(
     "reminder",
@@ -24351,11 +24946,11 @@ function registerReminder(server2) {
       title: "Reminder",
       description: "Manage reminders for the founder. Shown in the boot brief every session. Actions: create (set new), list (view active), complete (mark done).",
       inputSchema: {
-        action: z77.enum(["create", "list", "complete"]).describe("Action to perform"),
-        text: z77.string().optional().describe("What to remind about (create)"),
-        due_date: z77.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (create)"),
-        reminder_id: z77.string().optional().describe("Reminder UUID or text substring to match (complete)"),
-        include_completed: z77.boolean().optional().default(false).describe("Include completed reminders (list)")
+        action: z78.enum(["create", "list", "complete"]).describe("Action to perform"),
+        text: z78.string().optional().describe("What to remind about (create)"),
+        due_date: z78.string().optional().describe("Optional due date \u2014 ISO date (2026-04-01) or null for persistent (create)"),
+        reminder_id: z78.string().optional().describe("Reminder UUID or text substring to match (complete)"),
+        include_completed: z78.boolean().optional().default(false).describe("Include completed reminders (list)")
       }
     },
     async ({ action, text: text3, due_date, reminder_id, include_completed }) => {
@@ -24411,7 +25006,7 @@ function registerReminder(server2) {
 init_global_procedures();
 init_active_agent();
 init_employees();
-import { z as z78 } from "zod";
+import { z as z79 } from "zod";
 function registerStoreGlobalProcedure(server2) {
   server2.registerTool(
     "store_global_procedure",
@@ -24419,10 +25014,10 @@ function registerStoreGlobalProcedure(server2) {
       title: "Store Company Procedure (use global_procedure instead)",
       description: "DEPRECATED \u2014 use global_procedure with action='store'. Create a company procedure (customer-owned Layer 0 rule). RESTRICTED: only coordinator or founder sessions.",
       inputSchema: {
-        title: z78.string().describe("Short title for the procedure"),
-        content: z78.string().max(500).describe("The procedure content \u2014 clear, actionable instruction"),
-        priority: z78.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default)."),
-        domain: z78.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security")
+        title: z79.string().describe("Short title for the procedure"),
+        content: z79.string().max(500).describe("The procedure content \u2014 clear, actionable instruction"),
+        priority: z79.enum(["p0", "p1", "p2"]).optional().describe("Priority tier. p0 = always (default)."),
+        domain: z79.string().optional().describe("Category: workflow, code-style, communication, architecture, testing, security")
       }
     },
     async ({ title, content, priority, domain }) => {
@@ -24500,7 +25095,7 @@ init_global_procedures();
 init_active_agent();
 init_database();
 init_employees();
-import { z as z79 } from "zod";
+import { z as z80 } from "zod";
 function registerDeactivateGlobalProcedure(server2) {
   server2.registerTool(
     "deactivate_global_procedure",
@@ -24508,7 +25103,7 @@ function registerDeactivateGlobalProcedure(server2) {
       title: "Deactivate Company Procedure (use global_procedure instead)",
       description: "DEPRECATED \u2014 use global_procedure with action='deactivate'. Soft-delete a company procedure. RESTRICTED: only coordinator or founder sessions.",
       inputSchema: {
-        procedure_id: z79.string().describe("UUID of the company procedure to deactivate")
+        procedure_id: z80.string().describe("UUID of the company procedure to deactivate")
       }
     },
     async ({ procedure_id }) => {
@@ -24568,7 +25163,7 @@ init_store();
 init_active_agent();
 init_database();
 init_plan_limits();
-import { z as z80 } from "zod";
+import { z as z81 } from "zod";
 import crypto17 from "crypto";
 function registerStoreDecision(server2) {
   server2.registerTool(
@@ -24577,13 +25172,13 @@ function registerStoreDecision(server2) {
       title: "Store Decision",
       description: "Store an authoritative decision keyed by domain. Use this when a decision is made that should be canonical \u2014 future lookups via get_decision return the latest decision for that domain. Supports supersession chains.",
       inputSchema: {
-        domain: z80.string().describe(
+        domain: z81.string().describe(
           "Domain key, e.g. 'auth-strategy', 'db-migration-approach', 'api-versioning'"
         ),
-        decision: z80.string().describe("The decision text \u2014 what was decided"),
-        rationale: z80.string().optional().describe("Why this decision was made \u2014 constraints, trade-offs, context"),
-        supersedes: z80.string().optional().describe("UUID of the decision this supersedes (previous decision for this domain)"),
-        project_name: z80.string().optional().describe("Project name")
+        decision: z81.string().describe("The decision text \u2014 what was decided"),
+        rationale: z81.string().optional().describe("Why this decision was made \u2014 constraints, trade-offs, context"),
+        supersedes: z81.string().optional().describe("UUID of the decision this supersedes (previous decision for this domain)"),
+        project_name: z81.string().optional().describe("Project name")
       }
     },
     async ({ domain, decision, rationale, supersedes, project_name }) => {
@@ -24651,7 +25246,7 @@ Supersedes: ${supersedes}` : ""}`
 
 // src/mcp/tools/get-decision.ts
 init_database();
-import { z as z81 } from "zod";
+import { z as z82 } from "zod";
 function registerGetDecision(server2) {
   server2.registerTool(
     "get_decision",
@@ -24659,7 +25254,7 @@ function registerGetDecision(server2) {
       title: "Get Decision",
       description: "Retrieve the latest authoritative decision for a domain. Returns the current active decision and the supersession history.",
       inputSchema: {
-        domain: z81.string().describe(
+        domain: z82.string().describe(
           "Domain key to look up, e.g. 'auth-strategy', 'db-migration-approach'"
         )
       }
@@ -24722,16 +25317,16 @@ function registerGetDecision(server2) {
 }
 
 // src/mcp/tools/people-roster.ts
-import { z as z82 } from "zod";
+import { z as z83 } from "zod";
 
 // src/lib/people.ts
 init_config();
 import { readFile as readFile5, writeFile as writeFile6, mkdir as mkdir5 } from "fs/promises";
-import { existsSync as existsSync35, readFileSync as readFileSync28 } from "fs";
-import path44 from "path";
-var PEOPLE_PATH = path44.join(EXE_AI_DIR, "people.json");
+import { existsSync as existsSync36, readFileSync as readFileSync29 } from "fs";
+import path45 from "path";
+var PEOPLE_PATH = path45.join(EXE_AI_DIR, "people.json");
 async function loadPeople() {
-  if (!existsSync35(PEOPLE_PATH)) return [];
+  if (!existsSync36(PEOPLE_PATH)) return [];
   try {
     const raw = await readFile5(PEOPLE_PATH, "utf-8");
     return JSON.parse(raw);
@@ -24740,7 +25335,7 @@ async function loadPeople() {
   }
 }
 async function savePeople(people) {
-  await mkdir5(path44.dirname(PEOPLE_PATH), { recursive: true });
+  await mkdir5(path45.dirname(PEOPLE_PATH), { recursive: true });
   await writeFile6(PEOPLE_PATH, JSON.stringify(people, null, 2) + "\n", "utf-8");
 }
 async function addPerson(person) {
@@ -24770,10 +25365,10 @@ function registerAddPerson(server2) {
       title: "Add Person",
       description: "Add or update a key human in the people roster. Used for co-founders, partners, customers \u2014 anyone agents need to know about.",
       inputSchema: {
-        name: z82.string().describe("Person's name"),
-        role: z82.string().describe("Their role (e.g. co-founder, customer, partner)"),
-        relationship: z82.string().describe("Relationship to the organization (e.g. co-founder, early adopter, investor)"),
-        notes: z82.string().optional().describe("Additional context about this person")
+        name: z83.string().describe("Person's name"),
+        role: z83.string().describe("Their role (e.g. co-founder, customer, partner)"),
+        relationship: z83.string().describe("Relationship to the organization (e.g. co-founder, early adopter, investor)"),
+        notes: z83.string().optional().describe("Additional context about this person")
       }
     },
     async ({ name, role, relationship, notes }) => {
@@ -24819,7 +25414,7 @@ function registerGetPerson(server2) {
       title: "Get Person",
       description: "Look up a specific person by name from the people roster.",
       inputSchema: {
-        name: z82.string().describe("Person's name to look up")
+        name: z83.string().describe("Person's name to look up")
       }
     },
     async ({ name }) => {
@@ -24843,10 +25438,10 @@ Notes: ${person.notes}` : ""}`
 }
 
 // src/mcp/tools/crm.ts
-import { z as z83 } from "zod";
+import { z as z84 } from "zod";
 
 // src/lib/exe-db-read.ts
-import path45 from "path";
+import path46 from "path";
 import os19 from "os";
 import { createRequire as createRequire5 } from "module";
 import { pathToFileURL as pathToFileURL5 } from "url";
@@ -24864,8 +25459,8 @@ async function getExeDbReadClient() {
         if (!Ctor2) throw new Error(`No PrismaClient export found at ${explicitPath}`);
         return new Ctor2();
       }
-      const exeDbRoot = process.env.EXE_DB_ROOT ?? path45.join(os19.homedir(), "exe-db");
-      const req = createRequire5(path45.join(exeDbRoot, "package.json"));
+      const exeDbRoot = process.env.EXE_DB_ROOT ?? path46.join(os19.homedir(), "exe-db");
+      const req = createRequire5(path46.join(exeDbRoot, "package.json"));
       const entry = req.resolve("@prisma/client");
       const mod = await import(pathToFileURL5(entry).href);
       const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;
@@ -24898,12 +25493,12 @@ function registerCrm(server2) {
     title: "CRM",
     description: "Read-only CRM access from exe-db crm schema. Actions: list_people, get_person, list_tables, describe_table.",
     inputSchema: {
-      action: z83.enum(["list_people", "get_person", "list_tables", "describe_table"]).describe("CRM read operation"),
-      id: z83.string().optional().describe("CRM row/person id for get_person"),
-      query: z83.string().optional().describe("Text search for list_people/get_person"),
-      table: z83.string().optional().describe("crm schema table name for describe_table"),
-      limit: z83.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
-      offset: z83.coerce.number().int().min(0).optional().describe("Rows to skip")
+      action: z84.enum(["list_people", "get_person", "list_tables", "describe_table"]).describe("CRM read operation"),
+      id: z84.string().optional().describe("CRM row/person id for get_person"),
+      query: z84.string().optional().describe("Text search for list_people/get_person"),
+      table: z84.string().optional().describe("crm schema table name for describe_table"),
+      limit: z84.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
+      offset: z84.coerce.number().int().min(0).optional().describe("Rows to skip")
     }
   }, async ({ action, id, query, table, limit, offset }) => {
     try {
@@ -24962,7 +25557,7 @@ function registerCrm(server2) {
 }
 
 // src/mcp/tools/raw-data.ts
-import { z as z84 } from "zod";
+import { z as z85 } from "zod";
 function text2(content, isError = false) {
   return { content: [{ type: "text", text: content }], ...isError ? { isError: true } : {} };
 }
@@ -24971,15 +25566,15 @@ function registerRawData(server2) {
     title: "Raw Data",
     description: "Read-only access to exe-db raw.raw_events landing pad. Actions: list_sources, query, get. Results are capped because raw payloads can consume many tokens.",
     inputSchema: {
-      action: z84.enum(["list_sources", "query", "get"]).describe("Raw data read operation"),
-      id: z84.string().optional().describe("raw.raw_events id for action=get"),
-      source: z84.string().optional().describe("Filter by raw source"),
-      event_type: z84.string().optional().describe("Filter by event_type"),
-      query: z84.string().optional().describe("Search payload/metadata text"),
-      processed: z84.boolean().optional().describe("Filter processed_at IS NULL/NOT NULL"),
-      limit: z84.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
-      offset: z84.coerce.number().int().min(0).optional().describe("Rows to skip"),
-      include_payload: z84.boolean().optional().describe("Include full payload JSON. Default false to save tokens.")
+      action: z85.enum(["list_sources", "query", "get"]).describe("Raw data read operation"),
+      id: z85.string().optional().describe("raw.raw_events id for action=get"),
+      source: z85.string().optional().describe("Filter by raw source"),
+      event_type: z85.string().optional().describe("Filter by event_type"),
+      query: z85.string().optional().describe("Search payload/metadata text"),
+      processed: z85.boolean().optional().describe("Filter processed_at IS NULL/NOT NULL"),
+      limit: z85.coerce.number().int().min(1).max(50).optional().describe("Max rows, capped at 50"),
+      offset: z85.coerce.number().int().min(0).optional().describe("Rows to skip"),
+      include_payload: z85.boolean().optional().describe("Include full payload JSON. Default false to save tokens.")
     }
   }, async ({ action, id, source, event_type, query, processed, limit, offset, include_payload }) => {
     try {
@@ -25046,17 +25641,17 @@ init_active_agent();
 init_config();
 init_license();
 init_store();
-import { z as z85 } from "zod";
+import { z as z86 } from "zod";
 import crypto18 from "crypto";
 import { mkdir as mkdir6, writeFile as writeFile7 } from "fs/promises";
-import path46 from "path";
-var CLASSIFICATION = z85.enum([
+import path47 from "path";
+var CLASSIFICATION = z86.enum([
   "upstream_bug",
   "customer_customization",
   "emergency_hotfix",
   "unclear"
 ]);
-var SEVERITY = z85.enum(["p0", "p1", "p2", "p3"]);
+var SEVERITY = z86.enum(["p0", "p1", "p2", "p3"]);
 function slugify2(input) {
   return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "bug-report";
 }
@@ -25134,22 +25729,22 @@ function registerCreateBugReport(server2) {
       title: "Create Bug Report",
       description: "Classify and file an exe-os issue as upstream_bug, customer_customization, emergency_hotfix, or unclear. Writes a local report, stores memory, and optionally sends to AskExe support when a support endpoint is configured.",
       inputSchema: {
-        title: z85.string().min(3).describe("Short descriptive title"),
+        title: z86.string().min(3).describe("Short descriptive title"),
         classification: CLASSIFICATION.describe(
           "upstream_bug = platform defect; customer_customization = local preference; emergency_hotfix = temporary local patch; unclear = needs maintainer triage"
         ),
         severity: SEVERITY.default("p2").describe("p0 critical \u2192 p3 low"),
-        summary: z85.string().min(10).describe("What happened and why it matters"),
-        customer_impact: z85.string().optional().describe("How this affects the customer/founder"),
-        reproduction_steps: z85.array(z85.string()).optional().describe("Steps to reproduce"),
-        expected: z85.string().optional().describe("Expected behavior"),
-        actual: z85.string().optional().describe("Actual behavior"),
-        files_changed: z85.array(z85.string()).optional().describe("Files changed or suspected"),
-        workaround: z85.string().optional().describe("Temporary local workaround/hotfix, if any"),
-        local_patch_diff: z85.string().optional().describe("Small local diff or patch summary"),
-        package_version: z85.string().optional().describe("Installed @askexenow/exe-os version"),
-        project_name: z85.string().optional().describe("Project/customer context"),
-        send_upstream: z85.boolean().default(true).describe("Attempt to POST to configured AskExe support endpoint")
+        summary: z86.string().min(10).describe("What happened and why it matters"),
+        customer_impact: z86.string().optional().describe("How this affects the customer/founder"),
+        reproduction_steps: z86.array(z86.string()).optional().describe("Steps to reproduce"),
+        expected: z86.string().optional().describe("Expected behavior"),
+        actual: z86.string().optional().describe("Actual behavior"),
+        files_changed: z86.array(z86.string()).optional().describe("Files changed or suspected"),
+        workaround: z86.string().optional().describe("Temporary local workaround/hotfix, if any"),
+        local_patch_diff: z86.string().optional().describe("Small local diff or patch summary"),
+        package_version: z86.string().optional().describe("Installed @askexenow/exe-os version"),
+        project_name: z86.string().optional().describe("Project/customer context"),
+        send_upstream: z86.boolean().default(true).describe("Attempt to POST to configured AskExe support endpoint")
       }
     },
     async ({
@@ -25189,9 +25784,9 @@ function registerCreateBugReport(server2) {
         filesChanged: files_changed,
         projectName: project_name
       });
-      const outDir = path46.join(EXE_AI_DIR, "bug-reports");
+      const outDir = path47.join(EXE_AI_DIR, "bug-reports");
       await mkdir6(outDir, { recursive: true });
-      const reportPath = path46.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(title)}-${id.slice(0, 8)}.md`);
+      const reportPath = path47.join(outDir, `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}-${slugify2(title)}-${id.slice(0, 8)}.md`);
       await writeFile7(reportPath, markdown, "utf-8");
       let vector = null;
       try {
@@ -25258,9 +25853,9 @@ Upstream status: ${upstreamStatus}`
 }
 
 // src/mcp/tools/support-inbox.ts
-import { z as z86 } from "zod";
+import { z as z87 } from "zod";
 var DEFAULT_ENDPOINT = "https://askexe.com/admin/support/bug-reports";
-var STATUS = z86.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
+var STATUS = z87.enum(["open", "triaged", "fixed", "closed", "wontfix"]);
 function adminToken() {
   return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN || process.env.EXE_SUPPORT_ADMIN_TOKEN;
 }
@@ -25299,9 +25894,9 @@ function registerListBugReports(server2) {
       title: "List Bug Reports",
       description: "AskExe-internal only: list incoming customer bug reports from the support inbox.",
       inputSchema: {
-        status: z86.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
-        severity: z86.enum(["p0", "p1", "p2", "p3"]).optional(),
-        limit: z86.number().int().min(1).max(100).default(25)
+        status: z87.enum(["all", "open", "triaged", "fixed", "closed", "wontfix"]).default("open"),
+        severity: z87.enum(["p0", "p1", "p2", "p3"]).optional(),
+        limit: z87.number().int().min(1).max(100).default(25)
       }
     },
     async ({ status, severity, limit }) => {
@@ -25320,7 +25915,7 @@ function registerGetBugReport(server2) {
     {
       title: "Get Bug Report",
       description: "AskExe-internal only: fetch one customer bug report with full markdown payload.",
-      inputSchema: { id: z86.string().min(8) }
+      inputSchema: { id: z87.string().min(8) }
     },
     async ({ id }) => {
       const data = await requestJson(`${endpoint()}/${encodeURIComponent(id)}`);
@@ -25335,12 +25930,12 @@ function registerTriageBugReport(server2) {
       title: "Triage Bug Report",
       description: "AskExe-internal only: update bug report status and link task/commit/release metadata.",
       inputSchema: {
-        id: z86.string().min(8),
+        id: z87.string().min(8),
         status: STATUS.optional(),
-        triage_notes: z86.string().optional(),
-        linked_task_id: z86.string().optional(),
-        linked_commit: z86.string().optional(),
-        fixed_version: z86.string().optional()
+        triage_notes: z87.string().optional(),
+        linked_task_id: z87.string().optional(),
+        linked_commit: z87.string().optional(),
+        fixed_version: z87.string().optional()
       }
     },
     async ({ id, status, triage_notes, linked_task_id, linked_commit, fixed_version }) => {
@@ -25470,6 +26065,7 @@ var TOOL_CATEGORIES = {
   registerRunMemoryAudit: "admin",
   registerRunConsolidation: "admin",
   registerCloudSync: "admin",
+  registerOrchestrationPhase: "admin",
   registerSetAgentConfig: "admin",
   registerListEmployees: "admin",
   registerGetAgentSpend: "admin",
@@ -25688,6 +26284,7 @@ function registerAllTools(server2) {
     gate("registerRunMemoryAudit", registerRunMemoryAudit);
     gate("registerCloudSync", registerCloudSync);
     gate("registerBackupVps", registerBackupVps);
+    gate("registerOrchestrationPhase", registerOrchestrationPhase);
   }
   if (exposeLegacyMemory) {
     gate("registerGetMemoryCardinality", registerGetMemoryCardinality);
@@ -25832,16 +26429,16 @@ try {
     }
   }, 3e4);
   _ppidWatchdog.unref();
-  const MCP_VERSION_PATH = path47.join(os20.homedir(), ".exe-os", "mcp-version");
+  const MCP_VERSION_PATH = path48.join(os20.homedir(), ".exe-os", "mcp-version");
   let _currentMcpVersion = null;
   try {
-    _currentMcpVersion = existsSync36(MCP_VERSION_PATH) ? readFileSync29(MCP_VERSION_PATH, "utf8").trim() : null;
+    _currentMcpVersion = existsSync37(MCP_VERSION_PATH) ? readFileSync30(MCP_VERSION_PATH, "utf8").trim() : null;
   } catch {
   }
   const _versionWatchdog = setInterval(() => {
     try {
-      if (!existsSync36(MCP_VERSION_PATH)) return;
-      const diskVersion = readFileSync29(MCP_VERSION_PATH, "utf8").trim();
+      if (!existsSync37(MCP_VERSION_PATH)) return;
+      const diskVersion = readFileSync30(MCP_VERSION_PATH, "utf8").trim();
       if (_currentMcpVersion && diskVersion !== _currentMcpVersion) {
         process.stderr.write(
           `[exe-os] MCP version changed (${_currentMcpVersion} \u2192 ${diskVersion}). Hot-reloading...
@@ -25874,14 +26471,14 @@ try {
 `
       );
       const thisFile = fileURLToPath5(import.meta.url);
-      const backfillPath = path47.resolve(
-        path47.dirname(thisFile),
+      const backfillPath = path48.resolve(
+        path48.dirname(thisFile),
         "../bin/backfill-vectors.js"
       );
-      if (existsSync36(backfillPath)) {
+      if (existsSync37(backfillPath)) {
         const { EXE_AI_DIR: exeDir } = await Promise.resolve().then(() => (init_config(), config_exports));
-        const logPath = path47.join(exeDir, "workers.log");
-        mkdirSync19(path47.dirname(logPath), { recursive: true });
+        const logPath = path48.join(exeDir, "workers.log");
+        mkdirSync20(path48.dirname(logPath), { recursive: true });
         let logFd = "ignore";
         try {
           logFd = openSync3(logPath, "a");