@brainervirus/workit-cursor 0.8.1 → 0.8.2

package/dist/mcp-server.js

@@ -23209,14 +23209,23 @@ var init_hygiene = __esm(() => {
 });
 
 // packages/workit-core/src/core/docs-layout.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync5, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
 import path14 from "node:path";
 var SLUG_RE, LEGACY_SLUG = "superpowers", posix = (p) => p.split(path14.sep).join("/"), canonicalize = (base, candidate) => {
   const abs = path14.resolve(base, candidate);
   let ancestor = abs;
   while (!existsSync8(ancestor))
     ancestor = path14.dirname(ancestor);
-  const real = realpathSync2(ancestor);
+  let real;
+  try {
+    real = realpathSync2(ancestor);
+  } catch (error2) {
+    if (error2.code === "EACCES" && !lstatSync(ancestor).isSymbolicLink()) {
+      real = path14.join(realpathSync2(path14.dirname(ancestor)), path14.basename(ancestor));
+    } else {
+      throw error2;
+    }
+  }
   if (real !== base && !real.startsWith(base + path14.sep)) {
     throw new Error(`path must stay inside repository root: ${candidate}`);
   }
@@ -23256,14 +23265,8 @@ var SLUG_RE, LEGACY_SLUG = "superpowers", posix = (p) => p.split(path14.sep).joi
     if (path14.isAbsolute(candidate)) {
       return { ok: false, error: `absolute path not allowed: ${candidate}` };
     }
-    let abs;
-    try {
-      abs = canonicalize(workspace, candidate);
-    } catch (error2) {
-      return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
-    }
-    const rel = posix(path14.relative(workspace, abs));
-    const match = rel.match(/^docs\/([^/]+)\/(spec|plan)\.md$/);
+    const spelling = posix(candidate);
+    const match = spelling.match(/^docs\/([^/]+)\/(spec|plan)\.md$/);
     if (!match) {
       return {
         ok: false,
@@ -23290,6 +23293,18 @@ var SLUG_RE, LEGACY_SLUG = "superpowers", posix = (p) => p.split(path14.sep).joi
       };
     }
     derived = pathSlug;
+    let abs;
+    try {
+      abs = canonicalize(workspace, candidate);
+    } catch (error2) {
+      return { ok: false, error: error2 instanceof Error ? error2.message : String(error2) };
+    }
+    if (posix(path14.relative(workspace, abs)) !== spelling) {
+      return {
+        ok: false,
+        error: `path must resolve to ${JSON.stringify(spelling)}: ${candidate}`
+      };
+    }
   }
   let resolvedSlug = slug;
   if (resolvedSlug !== undefined) {
@@ -23798,6 +23813,9 @@ ${JSON.stringify({ ok: false, errors: validated.errors })}`
     return { error: "missing template templates/execution-contract.md" };
   }
   contract = contract.replace(/<SPEC_PATH>/g, spec).replace(/<PLAN_PATH>/g, plan).replace(/<BRANCH>/g, branch).replace(/<SLUG>/g, slug).replace(/<SDD_DIR>/g, sddDir).replace(/<TASK_LIST>/g, taskList);
+  if (!/^<workflow-handoff-destination>true<\/workflow-handoff-destination>$/m.test(contract)) {
+    return { error: "handoff destination contract missing its destination marker" };
+  }
   return { prompt: contract };
 };
 var init_handoff_context = __esm(() => {
@@ -23831,9 +23849,240 @@ var init_handoff_tools = __esm(() => {
   init_package_root();
 });
 
-// packages/workit-core/src/core/flow-state.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, renameSync, rmSync, writeFileSync as writeFileSync5, existsSync as existsSync11 } from "node:fs";
+// packages/workit-core/src/core/sdd.ts
+import {
+  appendFileSync as appendFileSync2,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync12,
+  statSync as statSync6,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import path19 from "node:path";
+function todosFromTasks(tasks, completedTaskIds = []) {
+  const done = new Set((completedTaskIds ?? []).map((id) => Number(id)));
+  const todos = (tasks ?? []).map((t) => {
+    const id = Number(t.id);
+    return {
+      id: `task-${id}`,
+      content: `Task ${id}: ${t.title ?? ""}`.trim(),
+      status: done.has(id) ? "completed" : "pending"
+    };
+  });
+  const firstPending = todos.find((t) => t.status === "pending");
+  if (firstPending)
+    firstPending.status = "in_progress";
+  return todos;
+}
+function ledgerCompletion(root, slug) {
+  let started = false;
+  const completed = [];
+  const absProgress = path19.join(root, "docs", slug, "sdd", "progress.md");
+  if (existsSync11(absProgress)) {
+    try {
+      for (const line of readFileSync12(absProgress, "utf8").split(`
+`)) {
+        const match = /^Task\s+(\d+):/i.exec(line);
+        if (match) {
+          started = true;
+          if (/^Task\s+\d+:\s*complete\b/i.test(line))
+            completed.push(Number(match[1]));
+        }
+      }
+    } catch {}
+  }
+  const required2 = [];
+  try {
+    const absPlan = path19.join(root, "docs", slug, "plan.md");
+    if (existsSync11(absPlan)) {
+      for (const task of parseTasksFromPlan(readFileSync12(absPlan, "utf8")))
+        required2.push(task.id);
+    }
+  } catch {}
+  const completedSet = new Set(completed);
+  const missing = required2.filter((id) => !completedSet.has(id));
+  return {
+    started,
+    complete: required2.length > 0 && missing.length === 0,
+    required: required2,
+    completed,
+    missing
+  };
+}
+function sddContext({
+  slug,
+  plan_path,
+  workspace_root
+}) {
+  const resolved = resolveCanonicalLayout({ workspace_root, slug, plan_path });
+  if (!resolved.ok)
+    return { error: resolved.error };
+  const cwd = resolved.layout.workspace;
+  const resolvedSlug = resolved.layout.slug;
+  if (!resolvedSlug)
+    return { error: "slug or plan_path required" };
+  const sdd_dir = path19.posix.join("docs", resolvedSlug, "sdd");
+  const progress_path = path19.posix.join(sdd_dir, "progress.md");
+  const manifest_path = path19.posix.join(sdd_dir, "manifest.json");
+  let progress_lines = [];
+  let completed_task_ids = [];
+  const absProgress = path19.join(resolved.layout.sdd, "progress.md");
+  if (existsSync11(absProgress)) {
+    progress_lines = readFileSync12(absProgress, "utf8").split(`
+`).map((ln) => ln.trim()).filter(Boolean);
+    const pat = /^Task\s+(\d+):\s+complete\b/i;
+    completed_task_ids = progress_lines.map((ln) => pat.exec(ln)?.[1]).filter(Boolean).map(Number);
+  }
+  let manifest = {};
+  const absManifest = path19.join(resolved.layout.sdd, "manifest.json");
+  if (existsSync11(absManifest)) {
+    try {
+      manifest = JSON.parse(readFileSync12(absManifest, "utf8"));
+    } catch {
+      manifest = {};
+    }
+  }
+  const legacy_path = path19.join(cwd, ".superpowers/sdd");
+  const legacy_exists = existsSync11(legacy_path);
+  let todos = [];
+  let task_count = 0;
+  if (plan_path) {
+    const planText = readFileSync12(resolved.layout.plan, "utf8");
+    const specMatch = planText.match(/^\*\*Spec:\*\*\s*(?:`([^`]+)`|(\S+))/m);
+    const spec_path = specMatch?.[1] ?? specMatch?.[2] ?? "";
+    if (spec_path) {
+      const validated = docsValidate({
+        spec_path,
+        plan_path: path19.relative(cwd, resolved.layout.plan),
+        workspace_root: cwd
+      });
+      if (validated.ok === false)
+        return { ok: false, errors: validated.errors, error: validated.error };
+    }
+    const tasks = parseTasksFromPlan(planText);
+    if (tasks.length > 0) {
+      task_count = tasks.length;
+      todos = todosFromTasks(tasks, completed_task_ids);
+    }
+  }
+  const flow = readFlowState(cwd, resolvedSlug);
+  return {
+    slug: resolvedSlug,
+    sdd_dir,
+    progress_path,
+    manifest_path,
+    progress_lines,
+    completed_task_ids,
+    manifest,
+    created: existsSync11(path19.join(cwd, sdd_dir)),
+    forbidden_legacy_path: ".superpowers/sdd",
+    legacy_sdd_exists: legacy_exists,
+    warning: legacy_exists ? "Ignore .superpowers/sdd — use sdd_dir from this tool only" : undefined,
+    todos,
+    task_count,
+    flow: { spec: flow.spec, plan: flow.plan, menu: flow.menu },
+    todowrite_required: true,
+    todowrite_hint: "REQUIRED: Call OpenCode todowrite with todos from this result so the native task list shows progress. Before each task set status in_progress; after workflow_sdd_append_progress set it completed."
+  };
+}
+function sddTaskBrief({
+  sdd_dir,
+  task_id,
+  section_text,
+  workspace_root
+}) {
+  const contained = resolveDocsPath({ workspace_root, path: sdd_dir });
+  if (!contained.ok)
+    return { error: contained.error };
+  const dir = contained.path;
+  mkdirSync6(dir, { recursive: true });
+  const out = path19.join(dir, `task-${task_id}-brief.md`);
+  writeFileSync5(out, `# Task ${task_id} brief
+
+${section_text}
+`, "utf8");
+  const rel = posix2(path19.relative(contained.base, out));
+  return { brief_path: rel, task_id };
+}
+function sddReviewPackage({
+  sdd_dir,
+  base_sha,
+  head_sha,
+  workspace_root
+}) {
+  const contained = resolveDocsPath({ workspace_root, path: sdd_dir });
+  if (!contained.ok)
+    return { error: contained.error };
+  const dir = contained.path;
+  mkdirSync6(dir, { recursive: true });
+  const base7 = base_sha.slice(0, 7);
+  const head7 = head_sha.slice(0, 7);
+  const diffPath = path19.join(dir, `review-${base7}..${head7}.diff`);
+  try {
+    const diff = execFileSync4("git", ["diff", base_sha, head_sha], {
+      cwd: contained.base,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    writeFileSync5(diffPath, diff, "utf8");
+    const rel = posix2(path19.relative(contained.base, diffPath));
+    return { diff_path: rel, base_sha, head_sha, base7, head7 };
+  } catch (error2) {
+    return { error: error2 instanceof Error ? error2.message : "git diff failed" };
+  }
+}
+function sddAppendProgress({
+  progress_path,
+  line,
+  workspace_root
+}) {
+  const contained = resolveDocsPath({ workspace_root, path: progress_path });
+  if (!contained.ok)
+    return { error: contained.error };
+  const path_ = contained.path;
+  const trimmed = line.trim();
+  if (!PROGRESS_RE.test(trimmed)) {
+    return { error: "invalid progress line format" };
+  }
+  if (existsSync11(path_) && statSync6(path_).isDirectory()) {
+    return { error: `progress path is a directory: ${progress_path}` };
+  }
+  mkdirSync6(path19.dirname(path_), { recursive: true });
+  appendFileSync2(path_, trimmed + `
+`, "utf8");
+  const rel = posix2(path19.relative(contained.base, path_));
+  return { ok: true, line: trimmed, progress_path: rel };
+}
+var posix2 = (p) => p.split(path19.sep).join("/"), PROGRESS_RE;
+var init_sdd = __esm(() => {
+  init_docs_validate();
+  init_docs_validate();
+  init_flow_state();
+  init_docs_layout();
+  PROGRESS_RE = /^Task\s+\d+:\s+complete\s+\(commits\s+[0-9a-f]{7,40}\.\.[0-9a-f]{7,40},/i;
+});
+
+// packages/workit-core/src/core/menu.ts
+var init_menu = () => {};
+
+// packages/workit-core/src/core/flow-state.ts
+import {
+  closeSync,
+  existsSync as existsSync12,
+  fstatSync,
+  fsyncSync,
+  mkdirSync as mkdirSync7,
+  openSync,
+  readFileSync as readFileSync13,
+  renameSync,
+  rmSync,
+  statSync as statSync7,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { createHash } from "node:crypto";
+import path20 from "node:path";
 
 class HostReceiptStore {
   #bySession = new Map;
@@ -23888,10 +24137,15 @@ class HostReceiptStore {
     return { ok: true, receipt };
   }
 }
-var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, err2 = (code, error2) => ({ ok: false, code, error: error2 }), SLUG_RE2, flowPath = (root, slug) => {
+var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, err2 = (code, error2, details) => ({
+  ok: false,
+  code,
+  error: error2,
+  ...details ? { details } : {}
+}), SLUG_RE2, flowPath = (root, slug) => {
   if (!SLUG_RE2.test(slug))
     throw new Error(`invalid slug: ${JSON.stringify(slug)}`);
-  return path19.join(root, "docs", slug, "sdd", "flow.json");
+  return path20.join(root, "docs", slug, "sdd", "flow.json");
 }, resolveDoc = (root, slug, docPath, kind) => {
   const resolved = resolveCanonicalLayout({
     workspace_root: root,
@@ -23906,60 +24160,233 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   const spec = p.spec ?? {};
   const plan = p.plan ?? {};
   const menu = p.menu ?? {};
+  const execution = p.execution ?? {};
   return {
     slug: p.slug ?? slug,
     activated: p.activated ?? true,
     spec: {
       path: spec.path ?? "",
       status: spec.status ?? "draft",
-      evidence: spec.evidence ?? null
+      evidence: spec.evidence ?? null,
+      approved_digest: spec.approved_digest ?? null
     },
     plan: {
       path: plan.path ?? "",
       status: plan.status ?? "draft",
-      evidence: plan.evidence ?? null
+      evidence: plan.evidence ?? null,
+      approved_digest: plan.approved_digest ?? null
     },
     menu: {
       presented: Boolean(menu.presented),
       chosen: menu.chosen ?? "",
       evidence: menu.evidence ?? null
     },
+    execution: {
+      status: execution.status ?? "pending",
+      mode: execution.mode ?? null,
+      evidence: execution.evidence ?? null
+    },
+    handoff_destination: p.handoff_destination ?? false,
     updated_at: p.updated_at ?? Date.now()
   };
 }, emptyState = (slug) => ({
   slug,
   activated: false,
-  spec: { path: "", status: "draft", evidence: null },
-  plan: { path: "", status: "draft", evidence: null },
+  spec: { path: "", status: "draft", evidence: null, approved_digest: null },
+  plan: { path: "", status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
+  execution: { status: "pending", mode: null, evidence: null },
+  handoff_destination: false,
   updated_at: Date.now()
 }), readFlowState = (root, slug) => {
   const file = flowPath(root, slug);
-  if (!existsSync11(file))
+  if (!existsSync12(file))
     return emptyState(slug);
   try {
-    return normalizeState(JSON.parse(readFileSync12(file, "utf8")), slug);
+    return normalizeState(JSON.parse(readFileSync13(file, "utf8")), slug);
   } catch {
     return emptyState(slug);
   }
+}, HEX64_RE, FLOW_STATUSES, EXECUTION_STATUSES, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), validateEvidenceValue = (v, allowCli) => {
+  if (v === null)
+    return true;
+  if (!isRecord(v))
+    return false;
+  if (v.host === "opencode") {
+    return v.attested === true && typeof v.callID === "string" && typeof v.selectedLabel === "string" && typeof v.recordedAt === "number";
+  }
+  if (v.host === "cursor")
+    return v.attested === false && v.confirmation === "contract";
+  if (allowCli && v.host === "cli") {
+    return v.attested === false && (v.confirmation === "flag" || v.confirmation === "tty");
+  }
+  return false;
+}, validateState = (parsed, slug) => {
+  if (!isRecord(parsed))
+    return { ok: false, error: "flow state must be a JSON object" };
+  if (parsed.slug !== undefined && (typeof parsed.slug !== "string" || parsed.slug !== slug)) {
+    return { ok: false, error: `flow state slug must be ${JSON.stringify(slug)}` };
+  }
+  if (parsed.activated !== undefined && typeof parsed.activated !== "boolean") {
+    return { ok: false, error: "flow state activated must be a boolean" };
+  }
+  if (parsed.handoff_destination !== undefined && typeof parsed.handoff_destination !== "boolean") {
+    return { ok: false, error: "flow state handoff_destination must be a boolean" };
+  }
+  if (parsed.updated_at !== undefined && (typeof parsed.updated_at !== "number" || !Number.isFinite(parsed.updated_at))) {
+    return { ok: false, error: "flow state updated_at must be a finite number" };
+  }
+  const doc2 = (value, name) => {
+    const p = isRecord(value) ? value : {};
+    if (!isRecord(value) && value !== undefined) {
+      return `flow state ${name} must be an object`;
+    }
+    if (p.status !== undefined && !FLOW_STATUSES.includes(p.status)) {
+      return `flow state ${name}.status must be draft, self_reviewed, or approved`;
+    }
+    if (p.path !== undefined && typeof p.path !== "string") {
+      return `flow state ${name}.path must be a string`;
+    }
+    if (p.approved_digest !== undefined && p.approved_digest !== null && (typeof p.approved_digest !== "string" || !HEX64_RE.test(p.approved_digest))) {
+      return `flow state ${name}.approved_digest must be 64-char lowercase hex or null`;
+    }
+    if (p.evidence !== undefined && !validateEvidenceValue(p.evidence, false)) {
+      return `flow state ${name}.evidence has an unsupported shape`;
+    }
+    return {
+      path: p.path ?? "",
+      status: p.status ?? "draft",
+      evidence: p.evidence ?? null,
+      approved_digest: p.approved_digest ?? null
+    };
+  };
+  const spec = doc2(parsed.spec, "spec");
+  if (typeof spec === "string")
+    return { ok: false, error: spec };
+  const plan = doc2(parsed.plan, "plan");
+  if (typeof plan === "string")
+    return { ok: false, error: plan };
+  const menuRaw = isRecord(parsed.menu) ? parsed.menu : undefined;
+  if (parsed.menu !== undefined && !isRecord(parsed.menu)) {
+    return { ok: false, error: "flow state menu must be an object" };
+  }
+  if (menuRaw?.presented !== undefined && typeof menuRaw.presented !== "boolean") {
+    return { ok: false, error: "flow state menu.presented must be a boolean" };
+  }
+  if (menuRaw?.chosen !== undefined && typeof menuRaw.chosen !== "string") {
+    return { ok: false, error: "flow state menu.chosen must be a string" };
+  }
+  if (menuRaw?.chosen !== undefined && menuRaw.chosen !== "" && !MENU_CHOICES.includes(menuRaw.chosen)) {
+    return {
+      ok: false,
+      error: `flow state menu.chosen must be one of: ${MENU_CHOICES.join(", ")} (or an empty string when the menu is unpresented)`
+    };
+  }
+  if (menuRaw?.evidence !== undefined && !validateEvidenceValue(menuRaw.evidence, false)) {
+    return { ok: false, error: "flow state menu.evidence has an unsupported shape" };
+  }
+  const execRaw = isRecord(parsed.execution) ? parsed.execution : undefined;
+  if (parsed.execution !== undefined && !isRecord(parsed.execution)) {
+    return { ok: false, error: "flow state execution must be an object" };
+  }
+  if (execRaw?.status !== undefined && !EXECUTION_STATUSES.includes(execRaw.status)) {
+    return {
+      ok: false,
+      error: "flow state execution.status must be pending, active, paused, or completed"
+    };
+  }
+  if (execRaw?.mode !== undefined && execRaw.mode !== null && execRaw.mode !== "subagent-driven" && execRaw.mode !== "inline") {
+    return {
+      ok: false,
+      error: "flow state execution.mode must be subagent-driven, inline, or null"
+    };
+  }
+  if (execRaw?.evidence !== undefined && !validateEvidenceValue(execRaw.evidence, true)) {
+    return { ok: false, error: "flow state execution.evidence has an unsupported shape" };
+  }
+  return {
+    ok: true,
+    state: {
+      slug,
+      activated: parsed.activated ?? true,
+      spec,
+      plan,
+      menu: {
+        presented: menuRaw?.presented ?? false,
+        chosen: menuRaw?.chosen ?? "",
+        evidence: menuRaw?.evidence ?? null
+      },
+      execution: {
+        status: execRaw?.status ?? "pending",
+        mode: execRaw?.mode ?? null,
+        evidence: execRaw?.evidence ?? null
+      },
+      handoff_destination: parsed.handoff_destination ?? false,
+      updated_at: parsed.updated_at ?? Date.now()
+    }
+  };
 }, readFlowStrict = (root, slug) => {
   const file = flowPath(root, slug);
-  if (!existsSync11(file)) {
+  const rel = path20.posix.join("docs", slug, "sdd", "flow.json");
+  if (!existsSync12(file)) {
     return err2("flow_not_activated", `flow not activated for ${slug} — run workflow_flow_status first`);
   }
+  let text;
   try {
-    return { ok: true, state: normalizeState(JSON.parse(readFileSync12(file, "utf8")), slug) };
+    text = readFileSync13(file, "utf8");
   } catch (error2) {
-    return err2("flow_corrupt", `corrupt flow state at ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+    return err2("flow_io_error", `cannot read flow state at ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`);
   }
-}, uniqueTempPath = (file) => `${file}.${process.pid}-${Math.random().toString(36).slice(2)}.tmp`, writeFlowState = (root, state) => {
-  const file = flowPath(root, state.slug);
-  mkdirSync6(path19.dirname(file), { recursive: true });
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error2) {
+    return err2("flow_state_invalid", `invalid flow state at ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`, { path: rel, original_bytes_preserved: true });
+  }
+  const validated = validateState(parsed, slug);
+  if (!validated.ok) {
+    return err2("flow_state_invalid", `invalid flow state at ${file}: ${validated.error}`, {
+      path: rel,
+      original_bytes_preserved: true
+    });
+  }
+  return { ok: true, state: validated.state, raw: parsed };
+}, uniqueTempPath = (file) => `${file}.${process.pid}-${Math.random().toString(36).slice(2)}.tmp`, writeFlowFileAtomic = (file, state) => {
+  const text = JSON.stringify(state, null, 2) + `
+`;
   const tmp = uniqueTempPath(file);
-  writeFileSync5(tmp, JSON.stringify(state, null, 2) + `
-`, "utf8");
-  renameSync(tmp, file);
-}, MAX_WRITE_ATTEMPTS = 5, writeFlowStateIfCurrent = (root, expected, next) => {
+  mkdirSync7(path20.dirname(file), { recursive: true });
+  let fd = null;
+  try {
+    fd = openSync(tmp, "w");
+    writeFileSync6(fd, text, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync(tmp, file);
+  } finally {
+    try {
+      if (fd !== null)
+        closeSync(fd);
+    } catch {}
+    try {
+      if (existsSync12(tmp))
+        rmSync(tmp, { force: true });
+    } catch {}
+  }
+}, MAX_WRITE_ATTEMPTS = 5, STALE_LOCK_MS = 1000, lockMtimeMs = (lock) => {
+  try {
+    return statSync7(lock).mtimeMs;
+  } catch {
+    return null;
+  }
+}, lockOwnedBy = (fd, lock) => {
+  try {
+    return fstatSync(fd).ino === statSync7(lock).ino;
+  } catch {
+    return false;
+  }
+}, writeFlowStateIfCurrent = (root, expected, next) => {
   const file = flowPath(root, next.slug);
   const expectedText = JSON.stringify(expected, null, 2) + `
 `;
@@ -23968,13 +24395,18 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   if (expectedText === nextText)
     return { ok: true };
   const tmp = uniqueTempPath(file);
+  let fd = null;
   try {
-    const currentText = existsSync11(file) ? readFileSync12(file, "utf8") : null;
+    const currentText = existsSync12(file) ? readFileSync13(file, "utf8") : null;
     if (currentText !== expectedText)
       return { ok: false, conflict: true };
-    mkdirSync6(path19.dirname(file), { recursive: true });
-    writeFileSync5(tmp, nextText, "utf8");
-    const reRead = existsSync11(file) ? readFileSync12(file, "utf8") : null;
+    mkdirSync7(path20.dirname(file), { recursive: true });
+    fd = openSync(tmp, "w");
+    writeFileSync6(fd, nextText, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    const reRead = existsSync12(file) ? readFileSync13(file, "utf8") : null;
     if (reRead !== expectedText)
       return { ok: false, conflict: true };
     renameSync(tmp, file);
@@ -23983,45 +24415,226 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     return { ok: false, io_error: error2 instanceof Error ? error2.message : String(error2) };
   } finally {
     try {
-      if (existsSync11(tmp))
+      if (fd !== null)
+        closeSync(fd);
+    } catch {}
+    try {
+      if (existsSync12(tmp))
         rmSync(tmp, { force: true });
     } catch {}
   }
-}, readModifyWrite = (root, slug, mutate) => {
+}, readCanonicalDigest = (root, rel) => {
+  const abs = path20.join(root, ...rel.split("/"));
+  let bytes;
+  try {
+    bytes = readFileSync13(abs);
+  } catch (error2) {
+    if (error2.code === "ENOENT") {
+      return { ok: false, code: "document_missing" };
+    }
+    return { ok: false, code: "document_unreadable" };
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return { ok: false, code: "document_unreadable" };
+  }
+  return { ok: true, text, digest: createHash("sha256").update(bytes).digest("hex") };
+}, resetForSpecDrift = (state) => ({
+  ...state,
+  spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
+  plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
+  menu: { presented: false, chosen: "", evidence: null },
+  execution: { status: "pending", mode: null, evidence: null },
+  handoff_destination: false,
+  updated_at: Date.now()
+}), resetForPlanDrift = (state) => ({
+  ...state,
+  plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
+  menu: { presented: false, chosen: "", evidence: null },
+  execution: { status: "pending", mode: null, evidence: null },
+  handoff_destination: false,
+  updated_at: Date.now()
+}), driftCodeFor = (root, relPath, storedDigest) => {
+  if (storedDigest === null)
+    return "digest_missing";
+  const current = readCanonicalDigest(root, relPath);
+  if (!current.ok)
+    return current.code;
+  return current.digest !== storedDigest ? "digest_mismatch" : null;
+}, reconcileState = (root, slug, state) => {
+  const specPath = path20.posix.join("docs", slug, "spec.md");
+  const planPath = path20.posix.join("docs", slug, "plan.md");
+  if (state.spec.status === "approved") {
+    const code = driftCodeFor(root, specPath, state.spec.approved_digest);
+    if (code) {
+      return {
+        state: resetForSpecDrift(state),
+        drift: [{ document: "spec", code, path: specPath }]
+      };
+    }
+  }
+  if (state.plan.status === "approved") {
+    const code = driftCodeFor(root, planPath, state.plan.approved_digest);
+    if (code) {
+      return {
+        state: resetForPlanDrift(state),
+        drift: [{ document: "plan", code, path: planPath }]
+      };
+    }
+  }
+  return { state, drift: [] };
+}, deriveLegacyExecution = (root, slug, state) => {
+  const ledger = ledgerCompletion(root, slug);
+  if (state.plan.status === "approved" && state.menu.chosen === "subagent-driven" && ledger.started && !ledger.complete) {
+    return { status: "active", mode: "subagent-driven", evidence: null };
+  }
+  return { status: "pending", mode: null, evidence: null };
+}, normalizeCompatibility = (root, slug, parsed, state) => {
+  if (!isRecord(parsed) || !("execution" in parsed)) {
+    const derived = deriveLegacyExecution(root, slug, state);
+    const current = state.execution;
+    if (derived.status !== current.status || derived.mode !== current.mode) {
+      return { state: { ...state, execution: derived, updated_at: Date.now() }, changed: true };
+    }
+  }
+  return { state, changed: false };
+}, withFlowLock = (file, fn) => {
+  const lock = `${file}.lock`;
+  if (!existsSync12(path20.dirname(file)))
+    return { locked: true, value: fn() };
+  try {
+    if (existsSync12(`${lock}.stale`))
+      rmSync(`${lock}.stale`, { force: true });
+  } catch {}
+  const wait = new Int32Array(new SharedArrayBuffer(4));
+  let fd = null;
   for (let attempt = 0;attempt < MAX_WRITE_ATTEMPTS; attempt++) {
+    try {
+      fd = openSync(lock, "wx");
+      break;
+    } catch (error2) {
+      const code = error2.code;
+      if (code !== "EEXIST") {
+        return {
+          locked: false,
+          error: err2("flow_io_error", `flow lock failed for ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`)
+        };
+      }
+      const mtime = lockMtimeMs(lock);
+      if (mtime !== null && Date.now() - mtime > STALE_LOCK_MS) {
+        try {
+          renameSync(lock, `${lock}.stale`);
+          unlinkSync3(`${lock}.stale`);
+        } catch {}
+        try {
+          fd = openSync(lock, "wx");
+          break;
+        } catch (innerError) {
+          const innerCode = innerError.code;
+          if (innerCode !== "EEXIST") {
+            return {
+              locked: false,
+              error: err2("flow_io_error", `flow lock failed for ${file}: ${innerError instanceof Error ? innerError.message : String(innerError)}`)
+            };
+          }
+        }
+      }
+      if (attempt === MAX_WRITE_ATTEMPTS - 1) {
+        return {
+          locked: false,
+          error: err2("flow_concurrent_conflict", `concurrent flow update detected for ${path20.dirname(file)}: re-read the flow state and retry the transition`)
+        };
+      }
+      Atomics.wait(wait, 0, 0, 10);
+    }
+  }
+  if (fd === null) {
+    return {
+      locked: false,
+      error: err2("flow_concurrent_conflict", `concurrent flow update detected for ${path20.dirname(file)}: re-read the flow state and retry the transition`)
+    };
+  }
+  try {
+    return { locked: true, value: fn() };
+  } finally {
+    try {
+      if (fd !== null && lockOwnedBy(fd, lock))
+        rmSync(lock, { force: true });
+    } catch {}
+    try {
+      if (fd !== null)
+        closeSync(fd);
+    } catch {}
+  }
+}, readEffectiveFlowState = (root, slug) => {
+  const file = flowPath(root, slug);
+  const rel = path20.posix.join("docs", slug, "sdd", "flow.json");
+  const locked = withFlowLock(file, () => {
     const strict = readFlowStrict(root, slug);
     if (!strict.ok)
       return strict;
-    const result = mutate(strict.state);
-    if (!result.ok)
-      return result;
-    const commit = writeFlowStateIfCurrent(root, strict.state, result.next);
-    if (commit.ok)
-      return { ok: true };
-    if ("io_error" in commit) {
-      return err2("flow_io_error", `flow state write failed for ${slug}: ${commit.io_error}`);
+    const normalized = normalizeCompatibility(root, slug, strict.raw, strict.state);
+    const { state, drift } = reconcileState(root, slug, normalized.state);
+    if (normalized.changed || drift.length > 0) {
+      try {
+        writeFlowFileAtomic(file, state);
+      } catch (error2) {
+        return err2("flow_io_error", `cannot persist reconciled flow state at ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`, { path: rel, original_bytes_preserved: true });
+      }
     }
-  }
-  return err2("flow_concurrent_conflict", `concurrent flow update detected for ${slug}: re-read the flow state and retry the transition`);
+    return { ok: true, state, drift };
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
+}, readModifyWrite = (root, slug, mutate) => {
+  const file = flowPath(root, slug);
+  const locked = withFlowLock(file, () => {
+    for (let attempt = 0;attempt < MAX_WRITE_ATTEMPTS; attempt++) {
+      const strict = readFlowStrict(root, slug);
+      if (!strict.ok)
+        return strict;
+      const normalized = normalizeCompatibility(root, slug, strict.raw, strict.state);
+      const reconciled = reconcileState(root, slug, normalized.state);
+      const result = mutate(reconciled.state);
+      if (!result.ok)
+        return result;
+      let baseline = strict.state;
+      if (normalized.changed) {
+        try {
+          writeFlowFileAtomic(file, normalized.state);
+        } catch (error2) {
+          return err2("flow_io_error", `cannot persist normalized flow state at ${file}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+        }
+        baseline = normalized.state;
+      }
+      const commit = writeFlowStateIfCurrent(root, baseline, result.next);
+      if (commit.ok)
+        return { ok: true };
+      if ("io_error" in commit) {
+        return err2("flow_io_error", `flow state write failed for ${slug}: ${commit.io_error}`);
+      }
+    }
+    return err2("flow_concurrent_conflict", `concurrent flow update detected for ${slug}: re-read the flow state and retry the transition`);
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
 }, assertMutationWorkspace = (root, ctx) => {
   if (ctx && ctx.hostWorkspace !== root) {
     return err2("workspace_mismatch", `mutation context workspace ${JSON.stringify(ctx.hostWorkspace)} does not match flow workspace ${JSON.stringify(root)}`);
   }
   return { ok: true };
-}, assertCoordinatorBoundary = (ctx, menu) => {
-  if (ctx?.role === "coordinator" && menu.chosen === "subagent-driven") {
+}, assertCoordinatorBoundary = (ctx, state) => {
+  if (ctx?.role === "coordinator" && state.execution.status === "active" && state.execution.mode === "subagent-driven") {
     return err2("coordinator_blocked", COORDINATOR_RECOVERY_TEXT);
   }
   if (ctx?.role === "delegated" && !ctx.taskIdentity) {
     return err2("delegated_unauthenticated", "delegated mutations require an authenticated task identity (taskIdentity) — re-run inside the delegated worker session");
   }
   return { ok: true };
-}, nextFlowStatus = (current) => {
-  if (current === "draft")
-    return { ok: true, next: "approved" };
-  if (current === "self_reviewed")
-    return { ok: true, next: "approved" };
-  return err2("flow_already_approved", "already approved; no further transitions");
 }, MAX_CLOCK_SKEW_MS = 60000, MAX_RECEIPTS_PER_SESSION = 10, RECEIPT_FRESHNESS_MS, EVIDENCE_WINDOW_MS, NEGATIVE_ANSWER_LABELS, isNegativeLabel = (label) => {
   const normalized = label.trim().toLowerCase();
   return NEGATIVE_ANSWER_LABELS.some((entry) => {
@@ -24125,24 +24738,38 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   });
   if (!resolved.ok)
     return err2("flow_prepare_failed", resolved.error);
-  const specPath = path19.posix.join("docs", slug, "spec.md");
-  const planPath = path19.posix.join("docs", slug, "plan.md");
-  const current = readFlowState(root, slug);
-  const state = current.activated ? {
-    ...current,
-    spec: { ...current.spec, path: specPath },
-    plan: { ...current.plan, path: planPath },
-    updated_at: Date.now()
-  } : {
-    slug,
-    activated: true,
-    spec: { path: specPath, status: "draft", evidence: null },
-    plan: { path: planPath, status: "draft", evidence: null },
-    menu: { presented: false, chosen: "", evidence: null },
-    updated_at: Date.now()
-  };
-  writeFlowState(root, state);
-  return { ok: true };
+  const specPath = path20.posix.join("docs", slug, "spec.md");
+  const planPath = path20.posix.join("docs", slug, "plan.md");
+  const file = flowPath(root, slug);
+  const locked = withFlowLock(file, () => {
+    if (!existsSync12(file)) {
+      writeFlowFileAtomic(file, {
+        slug,
+        activated: true,
+        spec: { path: specPath, status: "draft", evidence: null, approved_digest: null },
+        plan: { path: planPath, status: "draft", evidence: null, approved_digest: null },
+        menu: { presented: false, chosen: "", evidence: null },
+        execution: { status: "pending", mode: null, evidence: null },
+        handoff_destination: false,
+        updated_at: Date.now()
+      });
+      return { ok: true };
+    }
+    const strict = readFlowStrict(root, slug);
+    if (!strict.ok)
+      return strict;
+    const reconciled = reconcileState(root, slug, strict.state);
+    writeFlowFileAtomic(file, {
+      ...reconciled.state,
+      spec: { ...reconciled.state.spec, path: specPath },
+      plan: { ...reconciled.state.plan, path: planPath },
+      updated_at: Date.now()
+    });
+    return { ok: true };
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
 }, transitionSpec = (root, slug, specPath, evidence, ctx) => {
   const bound = assertMutationWorkspace(root, ctx);
   if (!bound.ok)
@@ -24153,39 +24780,39 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   const doc2 = resolveDoc(root, slug, specPath, "spec");
   if (!doc2.ok)
     return err2("path_invalid", doc2.error);
+  const relPath = path20.posix.join("docs", slug, "spec.md");
   return readModifyWrite(root, slug, (state) => {
-    if (!existsSync11(doc2.path))
+    if (!existsSync12(doc2.path))
       return err2("spec_missing", `spec not found: ${specPath}`);
-    if (state.spec.status === "draft") {
-      let text;
-      try {
-        text = readFileSync12(doc2.path, "utf8");
-      } catch (error2) {
-        return err2("spec_self_review_failed", `spec self-review failed: unreadable spec: ${error2 instanceof Error ? error2.message : String(error2)}`);
-      }
-      const hard = qualitySpec(text).filter((f) => f.severity === "hard");
-      const missing = [];
-      if (!/^\s*\*+Branch:\*+/im.test(stripFences(text)))
-        missing.push("**Branch:** header missing");
-      if (hard.length > 0 || missing.length > 0) {
-        return err2("spec_self_review_failed", "spec self-review failed: " + hard.map((f) => `${f.code} — ${f.message}`).concat(missing).join("; ") + " — see templates/spec-template.md for the required structure");
+    if (state.spec.status === "draft" || state.spec.status === "self_reviewed") {
+      const digest = readCanonicalDigest(root, relPath);
+      if (!digest.ok) {
+        return err2("spec_self_review_failed", `spec self-review failed: unreadable or invalid UTF-8 canonical spec: ${specPath}`);
+      }
+      if (state.spec.status === "draft") {
+        const hard = qualitySpec(digest.text).filter((f) => f.severity === "hard");
+        const missing = [];
+        if (!/^\s*\*+Branch:\*+/im.test(stripFences(digest.text)))
+          missing.push("**Branch:** header missing");
+        if (hard.length > 0 || missing.length > 0) {
+          return err2("spec_self_review_failed", "spec self-review failed: " + hard.map((f) => `${f.code} — ${f.message}`).concat(missing).join("; ") + " — see templates/spec-template.md for the required structure");
+        }
       }
+      return {
+        ok: true,
+        next: {
+          ...state,
+          spec: {
+            path: relPath,
+            status: "approved",
+            evidence: recorded.evidence,
+            approved_digest: digest.digest
+          },
+          updated_at: Date.now()
+        }
+      };
     }
-    const step = nextFlowStatus(state.spec.status);
-    if (!step.ok)
-      return step;
-    return {
-      ok: true,
-      next: {
-        ...state,
-        spec: {
-          path: path19.posix.join("docs", slug, "spec.md"),
-          status: step.next,
-          evidence: recorded.evidence
-        },
-        updated_at: Date.now()
-      }
-    };
+    return err2("flow_already_approved", "already approved; no further transitions");
   });
 }, transitionPlan = (root, slug, planPath, evidence, ctx) => {
   const bound = assertMutationWorkspace(root, ctx);
@@ -24197,91 +24824,236 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   const doc2 = resolveDoc(root, slug, planPath, "plan");
   if (!doc2.ok)
     return err2("path_invalid", doc2.error);
+  const relPath = path20.posix.join("docs", slug, "plan.md");
   return readModifyWrite(root, slug, (state) => {
-    if (!existsSync11(doc2.path))
+    if (!existsSync12(doc2.path))
       return err2("plan_missing", `plan not found: ${planPath}`);
     if (state.spec.status !== "approved") {
       return err2("spec_not_approved", "spec must be approved before the plan can be approved");
     }
-    if (state.plan.status === "draft") {
-      let text;
-      try {
-        text = readFileSync12(doc2.path, "utf8");
-      } catch (error2) {
-        return err2("plan_self_review_failed", `plan self-review failed: unreadable plan: ${error2 instanceof Error ? error2.message : String(error2)}`);
-      }
-      const missing = [];
-      const stripped = stripFences(text);
-      if (parseTasksFromPlan(text).length === 0)
-        missing.push("no ### Task N: sections outside fences");
-      if (!/^\s*\*+Spec:\*+/im.test(stripped))
-        missing.push("**Spec:** header missing");
-      if (!/^\s*\*+Branch:\*+/im.test(stripped))
-        missing.push("**Branch:** header missing");
-      if (missing.length > 0)
-        return err2("plan_self_review_failed", "plan self-review failed: " + missing.join("; "));
-    }
-    const step = nextFlowStatus(state.plan.status);
-    if (!step.ok)
-      return step;
+    if (state.plan.status === "draft" || state.plan.status === "self_reviewed") {
+      const digest = readCanonicalDigest(root, relPath);
+      if (!digest.ok) {
+        return err2("plan_self_review_failed", `plan self-review failed: unreadable or invalid UTF-8 canonical plan: ${planPath}`);
+      }
+      if (state.plan.status === "draft") {
+        const missing = [];
+        const stripped = stripFences(digest.text);
+        if (parseTasksFromPlan(digest.text).length === 0)
+          missing.push("no ### Task N: sections outside fences");
+        if (!/^\s*\*+Spec:\*+/im.test(stripped))
+          missing.push("**Spec:** header missing");
+        if (!/^\s*\*+Branch:\*+/im.test(stripped))
+          missing.push("**Branch:** header missing");
+        if (missing.length > 0)
+          return err2("plan_self_review_failed", "plan self-review failed: " + missing.join("; "));
+      }
+      return {
+        ok: true,
+        next: {
+          ...state,
+          plan: {
+            path: relPath,
+            status: "approved",
+            evidence: recorded.evidence,
+            approved_digest: digest.digest
+          },
+          updated_at: Date.now()
+        }
+      };
+    }
+    return err2("flow_already_approved", "already approved; no further transitions");
+  });
+}, recordMenuChoice = (root, slug, planPath, choice, evidence, ctx) => {
+  const bound = assertMutationWorkspace(root, ctx);
+  if (!bound.ok)
+    return bound;
+  const recorded = assertEvidenceShape(evidence);
+  if (!recorded.ok)
+    return err2("evidence_invalid", recorded.error);
+  if (typeof choice !== "string" || !MENU_CHOICES.includes(choice)) {
+    return err2("menu_choice_invalid", `invalid menu choice: ${JSON.stringify(choice)}`);
+  }
+  if (recorded.evidence.host === "cursor" && choice === "subagent-driven") {
+    return err2("unsupported_mode", CURSOR_SUBAGENT_UNSUPPORTED_TEXT);
+  }
+  if (recorded.evidence.host === "opencode" && !sameChoiceLabel(recorded.evidence.selectedLabel, choice)) {
+    return err2("evidence_mismatch", `evidence selectedLabel ${JSON.stringify(recorded.evidence.selectedLabel)} does not match choice ${JSON.stringify(choice)}`);
+  }
+  const doc2 = resolveDoc(root, slug, planPath, "plan");
+  if (!doc2.ok)
+    return err2("path_invalid", doc2.error);
+  return readModifyWrite(root, slug, (state) => {
+    if (state.spec.status !== "approved")
+      return err2("spec_not_approved", "spec must be approved before the execution menu");
+    if (state.plan.status !== "approved")
+      return err2("plan_not_approved", "plan must be approved before the execution menu");
+    if (state.handoff_destination && choice === "handoff") {
+      return err2("recursive_handoff", "this flow is already a handoff destination — a second handoff is rejected");
+    }
+    const executing = choice === "subagent-driven" || choice === "inline";
     return {
       ok: true,
       next: {
         ...state,
-        plan: {
-          path: path19.posix.join("docs", slug, "plan.md"),
-          status: step.next,
-          evidence: recorded.evidence
-        },
+        plan: { ...state.plan, path: state.plan.path || `docs/${slug}/plan.md` },
+        menu: { presented: true, chosen: choice, evidence: recorded.evidence },
+        execution: executing ? { status: "active", mode: choice, evidence: recorded.evidence } : { status: "pending", mode: null, evidence: recorded.evidence },
+        updated_at: Date.now()
+      }
+    };
+  });
+}, markHandoffDestination = (root, slug, planPath) => {
+  const doc2 = resolveDoc(root, slug, planPath, "plan");
+  if (!doc2.ok)
+    return err2("path_invalid", doc2.error);
+  return readModifyWrite(root, slug, (state) => {
+    if (state.spec.status !== "approved")
+      return err2("spec_not_approved", "spec must be approved before marking a handoff destination");
+    if (state.plan.status !== "approved")
+      return err2("plan_not_approved", "plan must be approved before marking a handoff destination");
+    if (state.handoff_destination) {
+      return err2("recursive_handoff", "this flow is already a handoff destination — a second handoff is rejected");
+    }
+    if (state.menu.chosen !== "handoff") {
+      return err2("handoff_not_chosen", `source menu choice must be "handoff" to mark a handoff destination (chosen: ${JSON.stringify(state.menu.chosen)})`);
+    }
+    return {
+      ok: true,
+      next: {
+        ...state,
+        handoff_destination: true,
+        menu: { presented: false, chosen: "", evidence: null },
         updated_at: Date.now()
       }
     };
   });
-}, recordMenuChoice = (root, slug, planPath, choice, evidence, ctx) => {
+}, CLI_CONFIRMATION_KEYS, validateLifecycleEvidence = (input) => {
+  if (typeof input !== "object" || input === null) {
+    return {
+      ok: false,
+      error: "lifecycle evidence required — native choice evidence or an exact CLI confirmation"
+    };
+  }
+  const record3 = input;
+  if (record3.host === "cli") {
+    const validValue = record3.attested === false && (record3.confirmation === "flag" || record3.confirmation === "tty");
+    const keys = Object.keys(record3).sort();
+    const exactShape = keys.length === CLI_CONFIRMATION_KEYS.length && CLI_CONFIRMATION_KEYS.every((key) => keys.includes(key));
+    if (validValue && exactShape) {
+      return {
+        ok: true,
+        evidence: {
+          host: "cli",
+          attested: false,
+          confirmation: record3.confirmation
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: 'cli confirmations accept only the exact { host: "cli", attested: false, confirmation: "flag" | "tty" } shape'
+    };
+  }
+  return assertEvidenceShape(input);
+}, errPendingFlow = (action) => err2("flow_not_active", `cannot ${action} a pending flow — the execution menu has not started it`), errCompletedFlow = (action) => err2("flow_already_completed", `cannot ${action} a completed flow`), completeExecution = (root, slug, deps) => {
+  const file = flowPath(root, slug);
+  const captured = readEffectiveFlowState(root, slug);
+  if (!captured.ok)
+    return captured;
+  const exec = captured.state.execution;
+  if (exec.status === "pending")
+    return errPendingFlow("complete");
+  if (exec.status === "completed")
+    return errCompletedFlow("complete");
+  const ledger = ledgerCompletion(root, slug);
+  if (!ledger.complete) {
+    return err2("execution_incomplete", `execution ledger incomplete for ${slug}: missing tasks ${ledger.missing.join(", ")}`, { required: ledger.required, completed: ledger.completed, missing: ledger.missing });
+  }
+  const verifier = deps?.verifyProject ?? runVerifyProject;
+  const verify = verifier(root, false);
+  if (verify.exitCode !== 0) {
+    return err2("verification_failed", `repository verification failed for ${slug} (exit ${verify.exitCode}) — see the verification output`, { exitCode: verify.exitCode });
+  }
+  const locked = withFlowLock(file, () => {
+    const strict = readFlowStrict(root, slug);
+    if (!strict.ok)
+      return strict;
+    const reconciled = reconcileState(root, slug, strict.state);
+    const currentExec = reconciled.state.execution;
+    if (currentExec.status !== exec.status || currentExec.mode !== exec.mode) {
+      return err2("flow_concurrent_conflict", `concurrent execution state change detected for ${slug}: re-read the flow state and retry completion`);
+    }
+    const next = {
+      ...reconciled.state,
+      execution: { ...exec, status: "completed" },
+      handoff_destination: false,
+      updated_at: Date.now()
+    };
+    const commit = writeFlowStateIfCurrent(root, captured.state, next);
+    if (commit.ok)
+      return { ok: true };
+    if ("io_error" in commit) {
+      return err2("flow_io_error", `flow state write failed for ${slug}: ${commit.io_error}`);
+    }
+    return err2("flow_concurrent_conflict", `concurrent flow update detected for ${slug}: re-read the flow state and retry completion`);
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
+}, transitionExecution = (root, slug, planPath, action, evidence, ctx, deps) => {
   const bound = assertMutationWorkspace(root, ctx);
   if (!bound.ok)
     return bound;
-  const recorded = assertEvidenceShape(evidence);
-  if (!recorded.ok)
-    return err2("evidence_invalid", recorded.error);
-  if (typeof choice !== "string" || !MENU_CHOICES.includes(choice)) {
-    return err2("menu_choice_invalid", `invalid menu choice: ${JSON.stringify(choice)}`);
-  }
-  if (recorded.evidence.host === "cursor" && choice === "subagent-driven") {
-    return err2("unsupported_mode", CURSOR_SUBAGENT_UNSUPPORTED_TEXT);
-  }
-  if (recorded.evidence.host === "opencode" && !sameChoiceLabel(recorded.evidence.selectedLabel, choice)) {
-    return err2("evidence_mismatch", `evidence selectedLabel ${JSON.stringify(recorded.evidence.selectedLabel)} does not match choice ${JSON.stringify(choice)}`);
-  }
+  const validated = validateLifecycleEvidence(evidence);
+  if (!validated.ok)
+    return err2("evidence_invalid", validated.error);
   const doc2 = resolveDoc(root, slug, planPath, "plan");
   if (!doc2.ok)
     return err2("path_invalid", doc2.error);
+  if (action === "complete")
+    return completeExecution(root, slug, deps);
+  if (action === "pause") {
+    return readModifyWrite(root, slug, (state) => {
+      const exec = state.execution;
+      if (exec.status === "pending")
+        return errPendingFlow("pause");
+      if (exec.status === "completed")
+        return errCompletedFlow("pause");
+      if (exec.status === "paused")
+        return err2("flow_already_paused", "flow is already paused");
+      return {
+        ok: true,
+        next: { ...state, execution: { ...exec, status: "paused" }, updated_at: Date.now() }
+      };
+    });
+  }
   return readModifyWrite(root, slug, (state) => {
-    if (state.spec.status !== "approved")
-      return err2("spec_not_approved", "spec must be approved before the execution menu");
-    if (state.plan.status !== "approved")
-      return err2("plan_not_approved", "plan must be approved before the execution menu");
+    const exec = state.execution;
+    if (exec.status === "completed")
+      return errCompletedFlow("resume");
+    if (exec.status !== "paused") {
+      return err2("flow_not_paused", exec.status === "active" ? "flow is already active — cannot resume" : "cannot resume a pending flow — the execution menu has not started it");
+    }
     return {
       ok: true,
-      next: {
-        ...state,
-        plan: state.plan.path ? state.plan : { path: planPath, status: state.plan.status },
-        menu: { presented: true, chosen: choice, evidence: recorded.evidence },
-        updated_at: Date.now()
-      }
+      next: { ...state, execution: { ...exec, status: "active" }, updated_at: Date.now() }
     };
   });
+}, slugFromPath = (p) => {
+  const dirName = path20.basename(path20.dirname(p));
+  return dirName === "." || dirName === "/" || dirName === "" ? "" : dirName;
 }, slugFromSddPath = (p) => {
-  const match = p.split(path19.sep).join("/").match(/^docs\/([^/]+)\/sdd(\/|$|['"])/);
+  const match = p.split(path20.sep).join("/").match(/^docs\/([^/]+)\/sdd(\/|$|['"])/);
   return match?.[1] ?? "";
 }, assertProductGates = (root, slug, opts = {}, ctx) => {
   const bound = assertMutationWorkspace(root, ctx);
   if (!bound.ok)
     return bound;
-  const strict = readFlowStrict(root, slug);
-  if (!strict.ok)
-    return strict;
-  const state = strict.state;
+  const effective = readEffectiveFlowState(root, slug);
+  if (!effective.ok)
+    return effective;
+  const state = effective.state;
   if (state.spec.status !== "approved") {
     return err2("spec_not_approved", `spec not approved (status: ${state.spec.status}). Run workflow_spec_approve after the user's approval.`);
   }
@@ -24293,18 +25065,21 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   }
   if (opts.requireDocs) {
     const validated = docsValidate({
-      spec_path: path19.posix.join("docs", slug, "spec.md"),
-      plan_path: path19.posix.join("docs", slug, "plan.md"),
+      spec_path: path20.posix.join("docs", slug, "spec.md"),
+      plan_path: path20.posix.join("docs", slug, "plan.md"),
       workspace_root: root
     });
     if (validated.ok === false)
       return err2("docs_invalid", validated.error);
   }
-  return assertCoordinatorBoundary(ctx, state.menu);
+  return assertCoordinatorBoundary(ctx, state);
 }, BASH_READ_TOKENS, BASH_GIT_READ_SUBCOMMANDS, BASH_GIT_MUTABLE_SUBCOMMANDS, BASH_GIT_READ_FLAGS, BASH_FIND_DENIED_FLAGS, BASH_TEST_VERBS, BASH_DENIED_HEADS, BASH_OUTPUT_FLAG_VERBS, BASH_PAREN_EXEMPT_HEADS, BASH_GIT_VALUE_FLAGS, COORDINATOR_SHELL_DENIED_TEXT;
 var init_flow_state = __esm(() => {
   init_docs_validate();
   init_docs_layout();
+  init_sdd();
+  init_verify_project();
+  init_menu();
   COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations (task briefs, progress, review packages) to an " + "authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
   CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
   MENU_CHOICES = [
@@ -24315,6 +25090,9 @@ var init_flow_state = __esm(() => {
     "review-plan"
   ];
   SLUG_RE2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  HEX64_RE = /^[0-9a-f]{64}$/;
+  FLOW_STATUSES = ["draft", "self_reviewed", "approved"];
+  EXECUTION_STATUSES = ["pending", "active", "paused", "completed"];
   RECEIPT_FRESHNESS_MS = 10 * 60 * 1000;
   EVIDENCE_WINDOW_MS = 24 * 60 * 60 * 1000;
   NEGATIVE_ANSWER_LABELS = [
@@ -24331,6 +25109,7 @@ var init_flow_state = __esm(() => {
     "deny"
   ];
   CURSOR_KEYS = ["attested", "confirmation", "host"];
+  CLI_CONFIRMATION_KEYS = ["attested", "confirmation", "host"];
   BASH_READ_TOKENS = new Set([
     "cat",
     "head",
@@ -24467,34 +25246,34 @@ var init_flow_evidence = __esm(() => {
 });
 
 // packages/workit-core/src/core/docs-migration.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import {
-  existsSync as existsSync12,
-  lstatSync,
-  mkdirSync as mkdirSync7,
+  existsSync as existsSync13,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync8,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   realpathSync as realpathSync3,
   renameSync as renameSync2,
   rmSync as rmSync2,
-  statSync as statSync6,
-  writeFileSync as writeFileSync6
+  statSync as statSync8,
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import path20 from "node:path";
-var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG = "superpowers", SPEC_LINK_RE2, posix2 = (p) => p.split(path20.sep).join("/"), legacyRoot = (workspace) => path20.join(workspace, "docs", "superpowers"), readFileSafe = (p) => {
+import path21 from "node:path";
+var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG = "superpowers", SPEC_LINK_RE2, posix3 = (p) => p.split(path21.sep).join("/"), legacyRoot = (workspace) => path21.join(workspace, "docs", "superpowers"), readFileSafe = (p) => {
   try {
-    return readFileSync13(p, "utf8");
+    return readFileSync14(p, "utf8");
   } catch {
     return null;
   }
 }, sddIgnoreActive = (cwd, slug) => {
   try {
-    execFileSync4("git", ["-C", cwd, "rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
+    execFileSync5("git", ["-C", cwd, "rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
   } catch {
     return false;
   }
   try {
-    execFileSync4("git", ["-C", cwd, "check-ignore", path20.posix.join("docs", slug, "sdd", "progress.md")], { stdio: "pipe" });
+    execFileSync5("git", ["-C", cwd, "check-ignore", path21.posix.join("docs", slug, "sdd", "progress.md")], { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -24516,22 +25295,22 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
 }, detectLegacyDocs = (workspace_root) => {
   const root = legacyRoot(workspace_root);
   const raw = [];
-  if (existsSync12(root)) {
+  if (existsSync13(root)) {
     for (const entry of readdirSync6(root, { withFileTypes: true })) {
-      const abs = path20.join(root, entry.name);
-      const rel = posix2(path20.relative(workspace_root, abs));
+      const abs = path21.join(root, entry.name);
+      const rel = posix3(path21.relative(workspace_root, abs));
       if (entry.isDirectory()) {
-        const hasSpec = existsSync12(path20.join(abs, "spec.md"));
-        const hasPlan = existsSync12(path20.join(abs, "plan.md"));
-        if (!hasSpec && !hasPlan && !existsSync12(path20.join(abs, "sdd")))
+        const hasSpec = existsSync13(path21.join(abs, "spec.md"));
+        const hasPlan = existsSync13(path21.join(abs, "plan.md"));
+        if (!hasSpec && !hasPlan && !existsSync13(path21.join(abs, "sdd")))
           continue;
-        const explicit = explicitTargetSlug(hasPlan ? readFileSafe(path20.join(abs, "plan.md")) : null);
+        const explicit = explicitTargetSlug(hasPlan ? readFileSafe(path21.join(abs, "plan.md")) : null);
         raw.push({
           slug: explicit ?? entry.name,
           legacy_dir: rel,
-          spec: hasSpec ? posix2(path20.join(rel, "spec.md")) : null,
-          plan: hasPlan ? posix2(path20.join(rel, "plan.md")) : null,
-          sdd: existsSync12(path20.join(abs, "sdd")),
+          spec: hasSpec ? posix3(path21.join(rel, "spec.md")) : null,
+          plan: hasPlan ? posix3(path21.join(rel, "plan.md")) : null,
+          sdd: existsSync13(path21.join(abs, "sdd")),
           explicit: explicit !== null
         });
       } else if (entry.name === "spec.md" || entry.name === "plan.md") {
@@ -24599,7 +25378,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   return { ok: true, out, changed: out !== text };
 }, isPlanMalformed = (text) => !/^\s*\*+Spec:\*+/im.test(text), readBufferSafe = (p) => {
   try {
-    return readFileSync13(p);
+    return readFileSync14(p);
   } catch {
     return null;
   }
@@ -24622,7 +25401,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   const raw = readBufferSafe(fromAbs);
   if (raw === null)
     return { ok: false, error: `unreadable source ${fromAbs}` };
-  if (path20.basename(toRel) !== "flow.json")
+  if (path21.basename(toRel) !== "flow.json")
     return { ok: true, bytes: raw, status: "copied" };
   const flow = flowRewrite(raw.toString("utf8"), legacyName, slug);
   if (!flow.ok)
@@ -24645,18 +25424,18 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   } catch {
     return { ok: false, error: `dangling symlink refused: ${legacyRel}` };
   }
-  if (real !== workspaceReal && !real.startsWith(workspaceReal + path20.sep)) {
+  if (real !== workspaceReal && !real.startsWith(workspaceReal + path21.sep)) {
     return { ok: false, error: `symlink escape refused: ${legacyRel}` };
   }
   if (visits.has(real))
     return { ok: true };
   visits.add(real);
   for (const entry of readdirSync6(real, { withFileTypes: true })) {
-    const fromAbs = path20.join(real, entry.name);
-    const fromRel = posix2(path20.join(legacyRel, entry.name));
-    const toRel = posix2(path20.join(destRelRoot, entry.name));
+    const fromAbs = path21.join(real, entry.name);
+    const fromRel = posix3(path21.join(legacyRel, entry.name));
+    const toRel = posix3(path21.join(destRelRoot, entry.name));
     if (entry.isDirectory()) {
-      const sub = planTree(workspace, fromAbs, fromRel, toRel, path20.join(destAbsRoot, entry.name), legacyName, slug, plan, visits);
+      const sub = planTree(workspace, fromAbs, fromRel, toRel, path21.join(destAbsRoot, entry.name), legacyName, slug, plan, visits);
       if (!sub.ok)
         return sub;
     } else if (entry.isFile() || entry.isSymbolicLink()) {
@@ -24668,11 +25447,11 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
         } catch {
           return { ok: false, error: `dangling symlink refused: ${fromRel}` };
         }
-        if (target !== workspaceReal && !target.startsWith(workspaceReal + path20.sep)) {
+        if (target !== workspaceReal && !target.startsWith(workspaceReal + path21.sep)) {
           return { ok: false, error: `symlink escape refused: ${fromRel}` };
         }
-        if (statSync6(target).isDirectory()) {
-          const sub = planTree(workspace, fromAbs, fromRel, toRel, path20.join(destAbsRoot, entry.name), legacyName, slug, plan, visits);
+        if (statSync8(target).isDirectory()) {
+          const sub = planTree(workspace, fromAbs, fromRel, toRel, path21.join(destAbsRoot, entry.name), legacyName, slug, plan, visits);
           if (!sub.ok)
             return sub;
           continue;
@@ -24689,7 +25468,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
         fromAbs,
         fromRel,
         toRel,
-        destAbs: path20.join(destAbsRoot, entry.name),
+        destAbs: path21.join(destAbsRoot, entry.name),
         bytes: classified.bytes,
         status: classified.status
       });
@@ -24702,36 +25481,36 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
     kind,
     legacyName,
     slug: entry.slug,
-    toRel: posix2(path20.join("docs", entry.slug, `${kind}.md`)),
-    destAbs: path20.join(destDirAbs, `${kind}.md`)
+    toRel: posix3(path21.join("docs", entry.slug, `${kind}.md`)),
+    destAbs: path21.join(destDirAbs, `${kind}.md`)
   });
   if (entry.spec) {
-    const classified = classifyDoc("spec", legacyName, entry.slug, path20.join(workspace, entry.spec));
+    const classified = classifyDoc("spec", legacyName, entry.slug, path21.join(workspace, entry.spec));
     if (!classified.ok)
       return classified;
     plan.push({
       ...base("spec"),
-      fromAbs: path20.join(workspace, entry.spec),
+      fromAbs: path21.join(workspace, entry.spec),
       fromRel: entry.spec,
       bytes: classified.bytes,
       status: classified.status
     });
   }
   if (entry.plan) {
-    const classified = classifyDoc("plan", legacyName, entry.slug, path20.join(workspace, entry.plan));
+    const classified = classifyDoc("plan", legacyName, entry.slug, path21.join(workspace, entry.plan));
     if (!classified.ok)
       return classified;
     plan.push({
       ...base("plan"),
-      fromAbs: path20.join(workspace, entry.plan),
+      fromAbs: path21.join(workspace, entry.plan),
       fromRel: entry.plan,
       bytes: classified.bytes,
       status: classified.status
     });
   }
   if (entry.sdd) {
-    const legacySdd = posix2(path20.join(entry.legacy_dir, "sdd"));
-    return planTree(workspace, path20.join(workspace, legacySdd), legacySdd, posix2(path20.join("docs", entry.slug, "sdd")), path20.join(destDirAbs, "sdd"), legacyName, entry.slug, plan, visits);
+    const legacySdd = posix3(path21.join(entry.legacy_dir, "sdd"));
+    return planTree(workspace, path21.join(workspace, legacySdd), legacySdd, posix3(path21.join("docs", entry.slug, "sdd")), path21.join(destDirAbs, "sdd"), legacyName, entry.slug, plan, visits);
   }
   return { ok: true };
 }, abort = (error2, collisions) => ({
@@ -24774,11 +25553,11 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   }
   const collisions = [];
   for (const item of plan) {
-    if (!existsSync12(item.destAbs))
+    if (!existsSync13(item.destAbs))
       continue;
     let identical = false;
     try {
-      identical = !lstatSync(item.destAbs).isDirectory() && readFileSync13(item.destAbs).equals(item.bytes);
+      identical = !lstatSync2(item.destAbs).isDirectory() && readFileSync14(item.destAbs).equals(item.bytes);
     } catch {
       identical = false;
     }
@@ -24813,8 +25592,8 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
     }
     const tmp = `${item.destAbs}.workit-tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
     try {
-      mkdirSync7(path20.dirname(item.destAbs), { recursive: true });
-      writeFileSync6(tmp, item.bytes);
+      mkdirSync8(path21.dirname(item.destAbs), { recursive: true });
+      writeFileSync7(tmp, item.bytes);
       renameSync2(tmp, item.destAbs);
     } catch (error2) {
       try {
@@ -24840,32 +25619,32 @@ var init_docs_migration = __esm(() => {
 });
 
 // packages/workit-core/src/core/docs-repo.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync7, readdirSync as readdirSync7 } from "node:fs";
-import { execFileSync as execFileSync5 } from "node:child_process";
-import path21 from "node:path";
-var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path21.join(configDir(), "docs-repo.json"), readDocsRepoConfig = () => {
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8, readdirSync as readdirSync7 } from "node:fs";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import path22 from "node:path";
+var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(configDir(), "docs-repo.json"), readDocsRepoConfig = () => {
   try {
-    const parsed = JSON.parse(readFileSync14(configPath(), "utf8"));
+    const parsed = JSON.parse(readFileSync15(configPath(), "utf8"));
     return parsed.path ? { path: parsed.path } : null;
   } catch {
     return null;
   }
 }, writeDocsRepoConfig = (docsPath) => {
   const file = configPath();
-  mkdirSync8(path21.dirname(file), { recursive: true });
-  writeFileSync7(file, JSON.stringify({ path: docsPath }, null, 2) + `
+  mkdirSync9(path22.dirname(file), { recursive: true });
+  writeFileSync8(file, JSON.stringify({ path: docsPath }, null, 2) + `
 `, "utf8");
 }, docsRepoPath = () => readDocsRepoConfig()?.path ?? null, validateDocsRepo = (docsPath) => {
-  if (!existsSync13(docsPath))
+  if (!existsSync14(docsPath))
     return { ok: false, error: `docs repo path does not exist: ${docsPath}` };
   try {
-    execFileSync5("git", ["-C", docsPath, "rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
+    execFileSync6("git", ["-C", docsPath, "rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
   } catch {
     return { ok: false, error: `docs repo is not a git repository: ${docsPath}` };
   }
-  const featuresDir = path21.join(docsPath, "features");
-  if (!existsSync13(featuresDir))
-    mkdirSync8(featuresDir, { recursive: true });
+  const featuresDir = path22.join(docsPath, "features");
+  if (!existsSync14(featuresDir))
+    mkdirSync9(featuresDir, { recursive: true });
   return { ok: true };
 }, linkDocsRepo = (docsPath, confirmed) => {
   if (!confirmed)
@@ -24878,23 +25657,23 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path21.join(conf
 }, listSpecs = (workspaceRoot) => {
   const repoPath = docsRepoPath();
   const specs = [];
-  const docsDir = path21.join(workspaceRoot, "docs");
-  if (existsSync13(docsDir)) {
+  const docsDir = path22.join(workspaceRoot, "docs");
+  if (existsSync14(docsDir)) {
     for (const slug of readdirSync7(docsDir)) {
       if (slug.startsWith("."))
         continue;
-      const spec = path21.posix.join("docs", slug, "spec.md");
-      if (!existsSync13(path21.join(workspaceRoot, spec)))
+      const spec = path22.posix.join("docs", slug, "spec.md");
+      if (!existsSync14(path22.join(workspaceRoot, spec)))
         continue;
       let promoted = false;
       let target = null;
       if (repoPath) {
-        const featuresDir = path21.join(repoPath, "features");
-        if (existsSync13(featuresDir)) {
+        const featuresDir = path22.join(repoPath, "features");
+        if (existsSync14(featuresDir)) {
           const match = readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d));
           if (match) {
             promoted = true;
-            target = path21.join(repoPath, "features", match);
+            target = path22.join(repoPath, "features", match);
           }
         }
       }
@@ -24907,7 +25686,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path21.join(conf
   return `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}`;
 }, readSafe4 = (p) => {
   try {
-    return readFileSync14(p, "utf8");
+    return readFileSync15(p, "utf8");
   } catch {
     return null;
   }
@@ -24934,8 +25713,8 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path21.join(conf
   const repoValid = validateDocsRepo(repoPath);
   if (!repoValid.ok)
     return { ok: false, error: repoValid.error };
-  const specRel = path21.posix.join("docs", slug, "spec.md");
-  const planRel = path21.posix.join("docs", slug, "plan.md");
+  const specRel = path22.posix.join("docs", slug, "spec.md");
+  const planRel = path22.posix.join("docs", slug, "plan.md");
   const specText = readSafe4(resolved.layout.spec);
   if (specText === null)
     return { ok: false, error: `docs/${slug}/spec.md not found` };
@@ -24959,14 +25738,14 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path21.join(conf
     };
   }
   if (!opts.force) {
-    const sddDir = path21.join(workspaceRootCanonical, "docs", slug, "sdd");
-    if (existsSync13(sddDir)) {
+    const sddDir = path22.join(workspaceRootCanonical, "docs", slug, "sdd");
+    if (existsSync14(sddDir)) {
       try {
-        execFileSync5("git", [
+        execFileSync6("git", [
           "-C",
           workspaceRootCanonical,
           "check-ignore",
-          path21.posix.join("docs", slug, "sdd", "progress.md")
+          path22.posix.join("docs", slug, "sdd", "progress.md")
         ], { stdio: "pipe" });
       } catch {
         return {
@@ -24977,14 +25756,14 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path21.join(conf
     }
   }
   const prefix = monthPrefix();
-  const featuresDir = path21.join(repoPath, "features");
-  const existing = existsSync13(featuresDir) ? readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d)) : undefined;
-  const targetDir = path21.join(featuresDir, existing ?? `${prefix}-${slug}`);
-  mkdirSync8(targetDir, { recursive: true });
+  const featuresDir = path22.join(repoPath, "features");
+  const existing = existsSync14(featuresDir) ? readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d)) : undefined;
+  const targetDir = path22.join(featuresDir, existing ?? `${prefix}-${slug}`);
+  mkdirSync9(targetDir, { recursive: true });
   const files = ["spec.md"];
-  writeFileSync7(path21.join(targetDir, "spec.md"), specText, "utf8");
+  writeFileSync8(path22.join(targetDir, "spec.md"), specText, "utf8");
   if (planText !== null) {
-    writeFileSync7(path21.join(targetDir, "plan.md"), planText, "utf8");
+    writeFileSync8(path22.join(targetDir, "plan.md"), planText, "utf8");
     files.push("plan.md");
   }
   const title = specText.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? slug;
@@ -25005,9 +25784,9 @@ ${specSummary(specText)}
 | [spec.md](./spec.md) | Especificación completa |
 ${planText !== null ? `| [plan.md](./plan.md) | Plan de implementación |
 ` : ""}`;
-  writeFileSync7(path21.join(targetDir, "README.md"), readme, "utf8");
+  writeFileSync8(path22.join(targetDir, "README.md"), readme, "utf8");
   files.push("README.md");
-  const indexPath = path21.join(repoPath, "features", "README.md");
+  const indexPath = path22.join(repoPath, "features", "README.md");
   const indexText = readSafe4(indexPath) ?? `# Features
 
 Especificaciones y planes por feature.
@@ -25030,7 +25809,7 @@ Especificaciones y planes por feature.
 ${row}
 `;
   }
-  writeFileSync7(indexPath, newIndex, "utf8");
+  writeFileSync8(indexPath, newIndex, "utf8");
   return { ok: true, target_dir: targetDir, files, index_updated: true };
 };
 var init_docs_repo = __esm(() => {
@@ -25040,13 +25819,13 @@ var init_docs_repo = __esm(() => {
 });
 
 // packages/workit-core/src/core/gitignore.ts
-import { existsSync as existsSync14, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
-import path22 from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
+import path23 from "node:path";
 var GITIGNORE_ENTRIES, ensureProjectGitignore = (workspaceRoot, confirmed) => {
   if (!confirmed)
     return { ok: false, error: "confirmed: true required" };
-  const file = path22.join(workspaceRoot, ".gitignore");
-  const existing = existsSync14(file) ? readFileSync15(file, "utf8") : "";
+  const file = path23.join(workspaceRoot, ".gitignore");
+  const existing = existsSync15(file) ? readFileSync16(file, "utf8") : "";
   const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
   const added = [];
@@ -25061,12 +25840,12 @@ var GITIGNORE_ENTRIES, ensureProjectGitignore = (workspaceRoot, confirmed) => {
     const separator = existing && !existing.endsWith(`
 `) ? `
 ` : "";
-    writeFileSync8(file, existing + separator + (existing ? `
+    writeFileSync9(file, existing + separator + (existing ? `
 ` : "") + append.join(`
 `) + `
 `, "utf8");
-  } else if (!existsSync14(file)) {
-    writeFileSync8(file, "", "utf8");
+  } else if (!existsSync15(file)) {
+    writeFileSync9(file, "", "utf8");
   }
   return { ok: true, path: file, added };
 };
@@ -25090,29 +25869,29 @@ var init_gitignore = __esm(() => {
 });
 
 // packages/workit-core/src/core/templates.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "node:fs";
-import path23 from "node:path";
-var repoRoot4, templatePath = (name) => path23.join(configDir(), "templates", `${name}.md`), readTemplate = (name) => {
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "node:fs";
+import path24 from "node:path";
+var repoRoot4, templatePath = (name) => path24.join(configDir(), "templates", `${name}.md`), readTemplate = (name) => {
   const cfg = templatePath(name);
-  if (existsSync15(cfg))
-    return { source: "config", content: readFileSync16(cfg, "utf8") };
+  if (existsSync16(cfg))
+    return { source: "config", content: readFileSync17(cfg, "utf8") };
   return {
     source: "repo",
-    content: readFileSync16(path23.join(repoRoot4, "templates", `${name}.md`), "utf8")
+    content: readFileSync17(path24.join(repoRoot4, "templates", `${name}.md`), "utf8")
   };
 }, writeTemplate = (name, content, confirmed) => {
   if (!confirmed)
     return { ok: false, error: "confirmed: true required" };
   const file = templatePath(name);
-  mkdirSync9(path23.dirname(file), { recursive: true });
-  writeFileSync9(file, content, "utf8");
+  mkdirSync10(path24.dirname(file), { recursive: true });
+  writeFileSync10(file, content, "utf8");
   return { ok: true, path: file };
 }, listTemplates = () => ["issue-update", "greeting", "headers"].map((name) => {
   const cfg = templatePath(name);
-  const repoFile = path23.join(repoRoot4, "templates", `${name}.md`);
-  if (existsSync15(cfg))
+  const repoFile = path24.join(repoRoot4, "templates", `${name}.md`);
+  if (existsSync16(cfg))
     return { name, source: "config", path: cfg };
-  if (existsSync15(repoFile))
+  if (existsSync16(repoFile))
     return { name, source: "repo", path: repoFile };
   return { name, source: "missing", path: cfg };
 });
@@ -25123,9 +25902,9 @@ var init_templates = __esm(() => {
 });
 
 // packages/workit-core/src/core/rules.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync17, readdirSync as readdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import path24 from "node:path";
-var rulesDir = () => path24.join(configDir(), "rules"), parseRule = (markdown) => {
+import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import path25 from "node:path";
+var rulesDir = () => path25.join(configDir(), "rules"), parseRule = (markdown) => {
   const fm = markdown.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
   if (!fm)
     return { error: "rule must start with frontmatter (--- name/description/platforms ---)" };
@@ -25152,12 +25931,12 @@ var rulesDir = () => path24.join(configDir(), "rules"), parseRule = (markdown) =
 }, listRules = () => {
   const result = [];
   const dir = rulesDir();
-  if (existsSync16(dir)) {
+  if (existsSync17(dir)) {
     for (const entry of readdirSync8(dir)) {
-      const file = path24.join(dir, entry, "rule.md");
-      if (!existsSync16(file))
+      const file = path25.join(dir, entry, "rule.md");
+      if (!existsSync17(file))
         continue;
-      const parsed = parseRule(readFileSync17(file, "utf8"));
+      const parsed = parseRule(readFileSync18(file, "utf8"));
       if ("error" in parsed)
         continue;
       result.push({ name: parsed.name, platforms: parsed.platforms, source: "config" });
@@ -25169,16 +25948,16 @@ var rulesDir = () => path24.join(configDir(), "rules"), parseRule = (markdown) =
     return { ok: false, error: "confirmed: true required" };
   if (!RULE_NAME_RE.test(rule.name))
     return { ok: false, error: `invalid rule name: ${JSON.stringify(rule.name)}` };
-  const dir = path24.join(rulesDir(), rule.name);
-  mkdirSync10(dir, { recursive: true });
-  const file = path24.join(dir, "rule.md");
+  const dir = path25.join(rulesDir(), rule.name);
+  mkdirSync11(dir, { recursive: true });
+  const file = path25.join(dir, "rule.md");
   const md = `---
 name: ${rule.name}
 description: ${rule.description}
 platforms: [${rule.platforms.join(", ")}]
 ---
 ${rule.body}`;
-  writeFileSync10(file, md, "utf8");
+  writeFileSync11(file, md, "utf8");
   return { ok: true, path: file };
 };
 var init_rules = __esm(() => {
@@ -25187,10 +25966,10 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-core/src/core/safe-write.ts
-import { writeFileSync as writeFileSync11 } from "node:fs";
+import { writeFileSync as writeFileSync12 } from "node:fs";
 function writeFileExclusive(file, content, mode) {
   try {
-    writeFileSync11(file, content, { encoding: "utf8", flag: "wx", mode });
+    writeFileSync12(file, content, { encoding: "utf8", flag: "wx", mode });
     return "created";
   } catch (err3) {
     if (err3.code === "EEXIST")
@@ -25272,26 +26051,26 @@ var init_setup_state = __esm(() => {
 import {
   copyFileSync as copyFileSync2,
   cpSync as cpSync2,
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync11,
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync12,
   mkdtempSync,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync9,
   renameSync as renameSync3,
   rmSync as rmSync3,
-  statSync as statSync7,
-  writeFileSync as writeFileSync12
+  statSync as statSync9,
+  writeFileSync as writeFileSync13
 } from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path25.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path26.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const { status, path: wsPath, entries } = readWorkspacesResult(dir);
   if (status === "malformed")
     return { ok: false, error: `malformed workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path25.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path26.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy2 = {
     preset: detection.preset,
@@ -25316,8 +26095,8 @@ function applyWorkspaceBranchPolicy(opts) {
     };
   }
   const next = existing ? entries.map((w, i) => i === idx ? { ...w, branchPolicy: policy2 } : w) : [...entries, { name, glob, branchPolicy: policy2 }];
-  mkdirSync11(path25.dirname(wsPath), { recursive: true });
-  writeFileSync12(wsPath, JSON.stringify({ workspaces: next }, null, 2) + `
+  mkdirSync12(path26.dirname(wsPath), { recursive: true });
+  writeFileSync13(wsPath, JSON.stringify({ workspaces: next }, null, 2) + `
 `, "utf8");
   return {
     ok: true,
@@ -25359,7 +26138,7 @@ var init_setup = __esm(() => {
 
 // packages/workit-core/src/core/youtrack.ts
 import fs4 from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 function readYouTrackConfig(required2) {
   const cfgPath = youTrackConfigPath();
   if (!fs4.existsSync(cfgPath)) {
@@ -25383,7 +26162,7 @@ function youTrackConfigLoad() {
   }
   const cfgPath = loaded.path;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path26.isAbsolute(tokenFile) ? path26.resolve(tokenFile) : path26.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path27.isAbsolute(tokenFile) ? path27.resolve(tokenFile) : path27.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs4.existsSync(tokenPath)) {
     return { error: "missing youtrack.token" };
   }
@@ -25397,8 +26176,8 @@ function youTrackConfigLoad() {
   const redacted = { ...loaded.config };
   delete redacted.tokenFile;
   redacted.tokenPresent = true;
-  redacted.configPath = path26.resolve(cfgPath);
-  redacted.tokenPath = path26.resolve(tokenPath);
+  redacted.configPath = path27.resolve(cfgPath);
+  redacted.tokenPath = path27.resolve(tokenPath);
   return { data: redacted };
 }
 function tzParts(date4, tz) {
@@ -25643,7 +26422,7 @@ function youTrackTokenCreateUrl() {
   const desc = String(defaults.description ?? "OpenCode workit — /wk-issue-update and /wk-meetings");
   const scopes = Array.isArray(defaults.scopes) ? defaults.scopes : ["YouTrack"];
   const base = String(config2.baseUrl ?? "https://enghouseamg.youtrack.cloud").replace(/\/+$/, "");
-  const tokenFile = String(config2.tokenFile ?? path26.join(path26.dirname(loaded.path), "youtrack.token"));
+  const tokenFile = String(config2.tokenFile ?? path27.join(path27.dirname(loaded.path), "youtrack.token"));
   const tab = String(defaults.profileTab ?? "account-security");
   const createUrl = `${base}/users/me?${new URLSearchParams({ tab })}`;
   const docsUrl = "https://www.jetbrains.com/help/youtrack/cloud/manage-permanent-token.html";
@@ -25652,7 +26431,7 @@ function youTrackTokenCreateUrl() {
       tokenName: name,
       tokenDescription: desc,
       scopes,
-      tokenFile: path26.resolve(tokenFile),
+      tokenFile: path27.resolve(tokenFile),
       createUrl,
       docsUrl,
       prefillSupported: false,
@@ -25689,7 +26468,7 @@ function verifyYouTrackToken(scripts = defaultScripts) {
 function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
   const root = resolveWorkspaceRoot(workspace_root);
   for (const rel of [spec_path, plan_path].filter(Boolean)) {
-    const full = path26.isAbsolute(rel) ? rel : path26.join(root, rel);
+    const full = path27.isAbsolute(rel) ? rel : path27.join(root, rel);
     if (!fs4.existsSync(full))
       continue;
     const text = fs4.readFileSync(full, "utf8");
@@ -25868,7 +26647,7 @@ async function postUpdate({
   }
   return { ok: true, issueId, postedComment: true };
 }
-var ISSUE_RE, TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path26.join(configDir(), "youtrack.json"), youTrackTokenModeOk = (p) => {
+var ISSUE_RE, TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path27.join(configDir(), "youtrack.json"), youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
   const mode = fs4.statSync(p).mode & 511;
@@ -25878,7 +26657,7 @@ var ISSUE_RE, TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", youTrackConfigPath = () =>
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path26.isAbsolute(tokenFile) ? path26.resolve(tokenFile) : path26.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path27.isAbsolute(tokenFile) ? path27.resolve(tokenFile) : path27.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs4.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
@@ -25911,10 +26690,10 @@ var init_youtrack = __esm(() => {
 
 // packages/workit-core/src/core/init.ts
 import fs5 from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 function initStatusData(configDirPath = configDir()) {
-  const ytJson = path27.join(configDirPath, "youtrack.json");
-  const vcsJson = path27.join(configDirPath, "vcs.json");
+  const ytJson = path28.join(configDirPath, "youtrack.json");
+  const vcsJson = path28.join(configDirPath, "vcs.json");
   const items = [];
   let youtrackConfig = null;
   let youtrackTokenCreate = null;
@@ -25937,8 +26716,8 @@ function initStatusData(configDirPath = configDir()) {
         });
       }
     }
-    const expanded = tokenFile ? path27.resolve(tokenFile) : null;
-    const resolvedTokenFile = expanded && fs5.existsSync(expanded) ? resolvePath(expanded) : expanded ? path27.isAbsolute(expanded) ? expanded : path27.resolve(configDirPath, expanded) : null;
+    const expanded = tokenFile ? path28.resolve(tokenFile) : null;
+    const resolvedTokenFile = expanded && fs5.existsSync(expanded) ? resolvePath(expanded) : expanded ? path28.isAbsolute(expanded) ? expanded : path28.resolve(configDirPath, expanded) : null;
     youtrackConfig = {
       config_edit_path: resolvePath(ytJson),
       baseUrl: base,
@@ -25985,11 +26764,11 @@ function initStatusData(configDirPath = configDir()) {
     id: "youtrack_json",
     label: "YouTrack config",
     ok: fs5.existsSync(ytJson) && youtrackConfig !== null && !("error" in youtrackConfig),
-    path: fs5.existsSync(ytJson) ? resolvePath(ytJson) : path27.resolve(ytJson),
+    path: fs5.existsSync(ytJson) ? resolvePath(ytJson) : path28.resolve(ytJson),
     config_edit_path: resolvePath(ytJson),
     fix: "workflow_toolkit_init_apply action=youtrack_scaffold"
   });
-  const ytTokenPath = youtrackConfig?.tokenFile ?? path27.join(configDirPath, "youtrack.token");
+  const ytTokenPath = youtrackConfig?.tokenFile ?? path28.join(configDirPath, "youtrack.token");
   const tokenText = fs5.existsSync(ytTokenPath) ? fs5.readFileSync(ytTokenPath, "utf8").trim() : "";
   const placeholder = fs5.existsSync(ytTokenPath) && isPlaceholder2(tokenText);
   const tokenOk = fs5.existsSync(ytTokenPath) && modeOk(ytTokenPath) && Boolean(tokenText) && !isPlaceholder2(tokenText);
@@ -25997,8 +26776,8 @@ function initStatusData(configDirPath = configDir()) {
     id: "youtrack_token",
     label: "YouTrack API token (mode 600, not placeholder)",
     ok: tokenOk,
-    path: fs5.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path27.resolve(ytTokenPath),
-    token_edit_path: fs5.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path27.resolve(ytTokenPath),
+    path: fs5.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path28.resolve(ytTokenPath),
+    token_edit_path: fs5.existsSync(ytTokenPath) ? resolvePath(ytTokenPath) : path28.resolve(ytTokenPath),
     placeholder,
     fix: `Open ${resolvePath(ytTokenPath)} — replace ${TOKEN_PLACEHOLDER4} with your permanent token, save, then /wk-status`
   };
@@ -26023,7 +26802,7 @@ function initStatusData(configDirPath = configDir()) {
     const provider = String(vcsParsed.provider ?? "gitlab").toLowerCase();
     const tokenFiles = {};
     for (const k of ["gitlab", "github"]) {
-      tokenFiles[k] = String(vcsParsed[k]?.tokenFile ?? path27.join(configDirPath, `${k}.token`));
+      tokenFiles[k] = String(vcsParsed[k]?.tokenFile ?? path28.join(configDirPath, `${k}.token`));
     }
     vcsCfg = {
       config_edit_path: resolvePath(vcsJson),
@@ -26048,14 +26827,14 @@ function initStatusData(configDirPath = configDir()) {
     id: "vcs_json",
     label: "VCS config (GitLab / GitHub)",
     ok: fs5.existsSync(vcsJson) && vcsCfg !== null && !("error" in vcsCfg),
-    path: fs5.existsSync(vcsJson) ? resolvePath(vcsJson) : path27.resolve(vcsJson),
+    path: fs5.existsSync(vcsJson) ? resolvePath(vcsJson) : path28.resolve(vcsJson),
     config_edit_path: resolvePath(vcsJson),
     fix: "workflow_toolkit_init_apply action=vcs_scaffold"
   });
   const provActive = vcsCfg && !("error" in vcsCfg) ? vcsCfg.provider : null;
   const tokenItem = (tid, label, rawPath, providerKey) => {
-    const t = path27.isAbsolute(rawPath) ? rawPath : path27.resolve(configDirPath, rawPath);
-    const abs = fs5.existsSync(t) ? resolvePath(t) : path27.resolve(t);
+    const t = path28.isAbsolute(rawPath) ? rawPath : path28.resolve(configDirPath, rawPath);
+    const abs = fs5.existsSync(t) ? resolvePath(t) : path28.resolve(t);
     const text = fs5.existsSync(t) ? fs5.readFileSync(t, "utf8").trim() : "";
     const ph = isPlaceholder2(text);
     const ok2 = fs5.existsSync(t) && modeOk(t) && Boolean(text) && !ph;
@@ -26086,7 +26865,7 @@ function initStatusData(configDirPath = configDir()) {
   };
   const vcsTokenFiles = {};
   for (const k of ["gitlab", "github"]) {
-    vcsTokenFiles[k] = String(vcsParsed?.[k]?.tokenFile ?? path27.join(configDirPath, `${k}.token`));
+    vcsTokenFiles[k] = String(vcsParsed?.[k]?.tokenFile ?? path28.join(configDirPath, `${k}.token`));
   }
   items.push(tokenItem("gitlab_token", "GitLab token (mode 600, not placeholder)", vcsTokenFiles.gitlab, "gitlab"));
   items.push(tokenItem("github_token", "GitHub token (mode 600, not placeholder)", vcsTokenFiles.github, "github"));
@@ -26143,16 +26922,16 @@ function initApplyData(action, env = process.env) {
   fs5.mkdirSync(dir, { recursive: true });
   switch (action) {
     case "youtrack_json": {
-      const out = path27.join(dir, "youtrack.json");
+      const out = path28.join(dir, "youtrack.json");
       fs5.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       return { action, ok: true, path: out };
     }
     case "youtrack_token_placeholder": {
-      const p = path27.join(dir, "youtrack.token");
+      const p = path28.join(dir, "youtrack.token");
       const preserved = writeFileExclusive(p, TOKEN_PLACEHOLDER4 + `
 `, 384) === "preserved";
-      const abs = path27.resolve(p);
+      const abs = path28.resolve(p);
       return {
         action,
         ok: true,
@@ -26164,14 +26943,14 @@ function initApplyData(action, env = process.env) {
       };
     }
     case "youtrack_scaffold": {
-      const jsonOut = path27.join(dir, "youtrack.json");
-      const tokenOut = path27.join(dir, "youtrack.token");
+      const jsonOut = path28.join(dir, "youtrack.json");
+      const tokenOut = path28.join(dir, "youtrack.token");
       fs5.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER4 + `
 `, 384) === "preserved";
-      const configPath2 = path27.resolve(jsonOut);
-      const tokenPath = path27.resolve(tokenOut);
+      const configPath2 = path28.resolve(jsonOut);
+      const tokenPath = path28.resolve(tokenOut);
       const prev = process.env.WORKFLOW_YOUTRACK_CONFIG;
       process.env.WORKFLOW_YOUTRACK_CONFIG = configPath2;
       let tokenCreate = {};
@@ -26225,19 +27004,19 @@ function initApplyData(action, env = process.env) {
       }
     }
     case "vcs_scaffold": {
-      const jsonOut = path27.join(dir, "vcs.json");
+      const jsonOut = path28.join(dir, "vcs.json");
       fs5.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(dir), null, 2) + `
 `, "utf8");
-      const glPath = path27.join(dir, "gitlab.token");
-      const ghPath = path27.join(dir, "github.token");
+      const glPath = path28.join(dir, "gitlab.token");
+      const ghPath = path28.join(dir, "github.token");
       const preservedTokens = [];
       for (const p of [glPath, ghPath]) {
         if (writeFileExclusive(p, TOKEN_PLACEHOLDER4 + `
 `, 384) === "preserved") {
-          preservedTokens.push(path27.resolve(p));
+          preservedTokens.push(path28.resolve(p));
         }
       }
-      const configPath2 = path27.resolve(jsonOut);
+      const configPath2 = path28.resolve(jsonOut);
       const prev = process.env.WORKFLOW_VCS_CONFIG;
       process.env.WORKFLOW_VCS_CONFIG = configPath2;
       try {
@@ -26245,14 +27024,14 @@ function initApplyData(action, env = process.env) {
         const provider = String(cfg.provider ?? "gitlab");
         const tokenUrls = vcsTokenCreateUrls();
         const active = tokenUrls.active ?? {};
-        const activePath = provider === "gitlab" ? path27.resolve(glPath) : path27.resolve(ghPath);
+        const activePath = provider === "gitlab" ? path28.resolve(glPath) : path28.resolve(ghPath);
         return {
           action,
           ok: true,
           vcs_json: configPath2,
           config_edit_path: configPath2,
-          gitlab_token: path27.resolve(glPath),
-          github_token: path27.resolve(ghPath),
+          gitlab_token: path28.resolve(glPath),
+          github_token: path28.resolve(ghPath),
           token_edit_path: activePath,
           token_create_url: active.createUrl,
           token_create_urls: tokenUrls,
@@ -26317,11 +27096,11 @@ var TOKEN_PLACEHOLDER4 = "YOUR_TOKEN_HERE", readJson2 = (p) => {
   try {
     return fs5.realpathSync(p);
   } catch {
-    return path27.resolve(p);
+    return path28.resolve(p);
   }
 }, youtrackJsonContent = (dir) => ({
   baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://enghouseamg.youtrack.cloud",
-  tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path27.join(dir, "youtrack.token"),
+  tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path28.join(dir, "youtrack.token"),
   timezone: process.env.WORKFLOW_YT_TIMEZONE ?? "America/Santiago",
   locale: "es-CL",
   defaultMention: process.env.WORKFLOW_YT_MENTION ?? "Alejandra.Flores",
@@ -26357,11 +27136,11 @@ var TOKEN_PLACEHOLDER4 = "YOUR_TOKEN_HERE", readJson2 = (p) => {
   gitlab: {
     host: process.env.WORKFLOW_GITLAB_HOST ?? "gitlab.com",
     apiUrl: process.env.WORKFLOW_GITLAB_API_URL ?? "https://gitlab.com/api/v4",
-    tokenFile: path27.join(dir, "gitlab.token")
+    tokenFile: path28.join(dir, "gitlab.token")
   },
   github: {
     host: process.env.WORKFLOW_GITHUB_HOST ?? "github.com",
-    tokenFile: path27.join(dir, "github.token")
+    tokenFile: path28.join(dir, "github.token")
   },
   pr: { squashOnMerge: true, removeSourceBranch: true, pushBranch: true, confirmSkip: true },
   tokenDefaults: {
@@ -26382,185 +27161,6 @@ var init_init = __esm(() => {
   init_youtrack();
 });
 
-// packages/workit-core/src/core/sdd.ts
-import {
-  appendFileSync as appendFileSync2,
-  existsSync as existsSync18,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync19,
-  statSync as statSync8,
-  writeFileSync as writeFileSync13
-} from "node:fs";
-import { execFileSync as execFileSync6 } from "node:child_process";
-import path28 from "node:path";
-function todosFromTasks(tasks, completedTaskIds = []) {
-  const done = new Set((completedTaskIds ?? []).map((id) => Number(id)));
-  const todos = (tasks ?? []).map((t) => {
-    const id = Number(t.id);
-    return {
-      id: `task-${id}`,
-      content: `Task ${id}: ${t.title ?? ""}`.trim(),
-      status: done.has(id) ? "completed" : "pending"
-    };
-  });
-  const firstPending = todos.find((t) => t.status === "pending");
-  if (firstPending)
-    firstPending.status = "in_progress";
-  return todos;
-}
-function sddContext({
-  slug,
-  plan_path,
-  workspace_root
-}) {
-  const resolved = resolveCanonicalLayout({ workspace_root, slug, plan_path });
-  if (!resolved.ok)
-    return { error: resolved.error };
-  const cwd = resolved.layout.workspace;
-  const resolvedSlug = resolved.layout.slug;
-  if (!resolvedSlug)
-    return { error: "slug or plan_path required" };
-  const sdd_dir = path28.posix.join("docs", resolvedSlug, "sdd");
-  const progress_path = path28.posix.join(sdd_dir, "progress.md");
-  const manifest_path = path28.posix.join(sdd_dir, "manifest.json");
-  let progress_lines = [];
-  let completed_task_ids = [];
-  const absProgress = path28.join(resolved.layout.sdd, "progress.md");
-  if (existsSync18(absProgress)) {
-    progress_lines = readFileSync19(absProgress, "utf8").split(`
-`).map((ln) => ln.trim()).filter(Boolean);
-    const pat = /^Task\s+(\d+):\s+complete\b/i;
-    completed_task_ids = progress_lines.map((ln) => pat.exec(ln)?.[1]).filter(Boolean).map(Number);
-  }
-  let manifest = {};
-  const absManifest = path28.join(resolved.layout.sdd, "manifest.json");
-  if (existsSync18(absManifest)) {
-    try {
-      manifest = JSON.parse(readFileSync19(absManifest, "utf8"));
-    } catch {
-      manifest = {};
-    }
-  }
-  const legacy_path = path28.join(cwd, ".superpowers/sdd");
-  const legacy_exists = existsSync18(legacy_path);
-  let todos = [];
-  let task_count = 0;
-  if (plan_path) {
-    const planText = readFileSync19(resolved.layout.plan, "utf8");
-    const specMatch = planText.match(/^\*\*Spec:\*\*\s*(?:`([^`]+)`|(\S+))/m);
-    const spec_path = specMatch?.[1] ?? specMatch?.[2] ?? "";
-    if (spec_path) {
-      const validated = docsValidate({
-        spec_path,
-        plan_path: path28.relative(cwd, resolved.layout.plan),
-        workspace_root: cwd
-      });
-      if (validated.ok === false)
-        return { ok: false, errors: validated.errors, error: validated.error };
-    }
-    const tasks = parseTasksFromPlan(planText);
-    if (tasks.length > 0) {
-      task_count = tasks.length;
-      todos = todosFromTasks(tasks, completed_task_ids);
-    }
-  }
-  const flow = readFlowState(cwd, resolvedSlug);
-  return {
-    slug: resolvedSlug,
-    sdd_dir,
-    progress_path,
-    manifest_path,
-    progress_lines,
-    completed_task_ids,
-    manifest,
-    created: existsSync18(path28.join(cwd, sdd_dir)),
-    forbidden_legacy_path: ".superpowers/sdd",
-    legacy_sdd_exists: legacy_exists,
-    warning: legacy_exists ? "Ignore .superpowers/sdd — use sdd_dir from this tool only" : undefined,
-    todos,
-    task_count,
-    flow: { spec: flow.spec, plan: flow.plan, menu: flow.menu },
-    todowrite_required: true,
-    todowrite_hint: "REQUIRED: Call OpenCode todowrite with todos from this result so the native task list shows progress. Before each task set status in_progress; after workflow_sdd_append_progress set it completed."
-  };
-}
-function sddTaskBrief({
-  sdd_dir,
-  task_id,
-  section_text,
-  workspace_root
-}) {
-  const contained = resolveDocsPath({ workspace_root, path: sdd_dir });
-  if (!contained.ok)
-    return { error: contained.error };
-  const dir = contained.path;
-  mkdirSync12(dir, { recursive: true });
-  const out = path28.join(dir, `task-${task_id}-brief.md`);
-  writeFileSync13(out, `# Task ${task_id} brief
-
-${section_text}
-`, "utf8");
-  const rel = posix3(path28.relative(contained.base, out));
-  return { brief_path: rel, task_id };
-}
-function sddReviewPackage({
-  sdd_dir,
-  base_sha,
-  head_sha,
-  workspace_root
-}) {
-  const contained = resolveDocsPath({ workspace_root, path: sdd_dir });
-  if (!contained.ok)
-    return { error: contained.error };
-  const dir = contained.path;
-  mkdirSync12(dir, { recursive: true });
-  const base7 = base_sha.slice(0, 7);
-  const head7 = head_sha.slice(0, 7);
-  const diffPath = path28.join(dir, `review-${base7}..${head7}.diff`);
-  try {
-    const diff = execFileSync6("git", ["diff", base_sha, head_sha], {
-      cwd: contained.base,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    writeFileSync13(diffPath, diff, "utf8");
-    const rel = posix3(path28.relative(contained.base, diffPath));
-    return { diff_path: rel, base_sha, head_sha, base7, head7 };
-  } catch (error2) {
-    return { error: error2 instanceof Error ? error2.message : "git diff failed" };
-  }
-}
-function sddAppendProgress({
-  progress_path,
-  line,
-  workspace_root
-}) {
-  const contained = resolveDocsPath({ workspace_root, path: progress_path });
-  if (!contained.ok)
-    return { error: contained.error };
-  const path_ = contained.path;
-  const trimmed = line.trim();
-  if (!PROGRESS_RE.test(trimmed)) {
-    return { error: "invalid progress line format" };
-  }
-  if (existsSync18(path_) && statSync8(path_).isDirectory()) {
-    return { error: `progress path is a directory: ${progress_path}` };
-  }
-  mkdirSync12(path28.dirname(path_), { recursive: true });
-  appendFileSync2(path_, trimmed + `
-`, "utf8");
-  const rel = posix3(path28.relative(contained.base, path_));
-  return { ok: true, line: trimmed, progress_path: rel };
-}
-var posix3 = (p) => p.split(path28.sep).join("/"), PROGRESS_RE;
-var init_sdd = __esm(() => {
-  init_docs_validate();
-  init_docs_validate();
-  init_flow_state();
-  init_docs_layout();
-  PROGRESS_RE = /^Task\s+\d+:\s+complete\s+\(commits\s+[0-9a-f]{7,40}\.\.[0-9a-f]{7,40},/i;
-});
-
 // packages/workit-core/src/core/present.ts
 function boxLine(text, width) {
   const inner = width - 4;
@@ -26713,7 +27313,38 @@ var logger, readServerVersion = () => {
       };
     }
   });
-}, changelogCategorySchema, transport;
+}, changelogCategorySchema, lifecycleTool = (action, description) => {
+  registerTool(`workflow_plan_${action}`, {
+    description,
+    inputSchema: {
+      plan_path: exports_external.string(),
+      workspace_root: workspaceRootSchema
+    }
+  }, async ({ plan_path, workspace_root }) => {
+    const resolved = resolveCanonicalLayout({ workspace_root, plan_path });
+    if (!resolved.ok) {
+      return jsonResult(withWorkspace(workspace_root, { error: resolved.error }));
+    }
+    const { workspace, slug } = resolved.layout;
+    const result = transitionExecution(workspace, slug, plan_path, action, cursorConfirmation(), cursorMutationContext(workspace));
+    if (result.ok === false) {
+      return jsonResult(withWorkspace(workspace_root, {
+        error: result.error,
+        code: result.code,
+        ...result.details ? { details: result.details } : {}
+      }));
+    }
+    const effective = readEffectiveFlowState(workspace, slug);
+    if (!effective.ok) {
+      return jsonResult(withWorkspace(workspace_root, { error: effective.error, code: effective.code }));
+    }
+    return jsonResult(withWorkspace(workspace_root, {
+      plan: plan_path,
+      execution: effective.state.execution,
+      drift: effective.drift
+    }));
+  });
+}, transport;
 var init_server3 = __esm(async () => {
   init_mcp();
   init_stdio2();
@@ -27217,40 +27848,54 @@ var init_server3 = __esm(async () => {
       return jsonResult(withWorkspace(workspace_root, { error: built.error }));
     }
     const { prompt, spec: specPath, plan: planPath } = built;
-    if (planPath) {
-      const tasksData = parsePlanTasks(planPath, root);
-      if ("error" in tasksData) {
-        return jsonResult(withWorkspace(workspace_root, {
-          prompt,
-          error: tasksData.error
-        }));
-      }
-      const payload = {
+    if (!planPath) {
+      return jsonResult(withWorkspace(workspace_root, {
+        error: "Could not resolve spec and plan for handoff"
+      }));
+    }
+    const tasksData = parsePlanTasks(planPath, root);
+    if ("error" in tasksData) {
+      return jsonResult(withWorkspace(workspace_root, {
         prompt,
-        tasks: tasksData.tasks,
-        task_count: tasksData.task_count,
-        workspace_root: root
-      };
-      if (specPath) {
-        const branchData = resolveHandoffBranch(specPath, planPath, root);
-        if (!("error" in branchData)) {
-          payload.branch = branchData.branch;
-        }
-      }
-      const sdd = sddContext({ plan_path: planPath, workspace_root: root });
-      if (!sdd.error) {
-        payload.slug = sdd.slug;
-        payload.sdd_dir = sdd.sdd_dir;
-        payload.progress_path = sdd.progress_path;
-        payload.completed_task_ids = sdd.completed_task_ids;
-        payload.todos = sdd.todos;
-        payload.todo_write_required = true;
+        error: tasksData.error
+      }));
+    }
+    const slug = slugFromPath(planPath);
+    const marked = markHandoffDestination(root, slug, planPath);
+    if (marked.ok === false) {
+      return jsonResult(withWorkspace(workspace_root, {
+        error: marked.error,
+        code: marked.code,
+        ...marked.details ? { details: marked.details } : {}
+      }));
+    }
+    const payload = {
+      prompt,
+      tasks: tasksData.tasks,
+      task_count: tasksData.task_count,
+      workspace_root: root
+    };
+    if (specPath) {
+      const branchData = resolveHandoffBranch(specPath, planPath, root);
+      if (!("error" in branchData)) {
+        payload.branch = branchData.branch;
       }
-      return jsonResult(withWorkspace(workspace_root, payload));
     }
-    return jsonResult(withWorkspace(workspace_root, {
-      error: "Could not resolve spec and plan for handoff"
-    }));
+    const sdd = sddContext({ plan_path: planPath, workspace_root: root });
+    if (!sdd.error) {
+      payload.slug = sdd.slug;
+      payload.sdd_dir = sdd.sdd_dir;
+      payload.progress_path = sdd.progress_path;
+      payload.completed_task_ids = sdd.completed_task_ids;
+      payload.todos = sdd.todos;
+      payload.todo_write_required = true;
+    }
+    const effective = readEffectiveFlowState(root, slug);
+    if (effective.ok) {
+      payload.handoff_destination = effective.state.handoff_destination;
+      payload.menu = effective.state.menu;
+    }
+    return jsonResult(withWorkspace(workspace_root, payload));
   });
   registerTool("workflow_toolkit_init_status", {
     description: "Check workit setup (MCP deps, YouTrack config, token)",
@@ -27547,18 +28192,23 @@ var init_server3 = __esm(async () => {
     if (!resolved.ok)
       return jsonResult(withWorkspace(workspace_root, { error: resolved.error }));
     const { workspace, slug } = resolved.layout;
-    let state = readFlowState(workspace, slug);
-    if (!state.activated) {
+    let effective = readEffectiveFlowState(workspace, slug);
+    if (!effective.ok && effective.code === "flow_not_activated") {
       const prepared = prepareFlowState(workspace, slug, { spec_path, plan_path }, cursorMutationContext(workspace));
       if (!prepared.ok)
         return jsonResult({ error: prepared.error, code: prepared.code });
-      state = readFlowState(workspace, slug);
+      effective = readEffectiveFlowState(workspace, slug);
     }
+    if (!effective.ok)
+      return jsonResult({ error: effective.error, code: effective.code });
+    const { state, drift } = effective;
     return jsonResult({
       slug,
       spec: state.spec,
       plan: state.plan,
       menu: state.menu,
+      execution: state.execution,
+      drift,
       flow_path: `docs/${slug}/sdd/flow.json`
     });
   });
@@ -27611,6 +28261,9 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: result.error, code: result.code });
     return jsonResult({ menu: { presented: true, chosen: choice } });
   });
+  lifecycleTool("pause", "Pause a running plan with the Cursor policy-only confirmation: active -> paused. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
+  lifecycleTool("resume", "Resume a paused plan with the Cursor policy-only confirmation: paused -> active. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
+  lifecycleTool("complete", "Complete a running plan with the Cursor policy-only confirmation: active/paused -> completed, after the SDD ledger is complete and repository verification passes. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
   registerTool("workflow_docs_repo_link", {
     description: "Link the component docs repo in the toolkit config",
     inputSchema: {