@brainervirus/workit-cursor 0.8.8 → 0.8.10

package/dist/mcp-server.js

@@ -20868,7 +20868,7 @@ var resolveBranchPolicyFor = (workspaceRoot) => resolveBranchPolicy(readConfig()
     if (dirty) {
       if (stash !== "yes") {
         return {
-          error: "dirty working tree — ask with native question, then call workflow_branch_setup with stash=yes"
+          error: "dirty working tree — ask with native question, then call workit_branch_setup with stash=yes"
         };
       }
       try {
@@ -21621,7 +21621,7 @@ var runGit = (cwd, args) => {
 - Entries should be human-readable and user-facing.
 - Do not use raw commit messages as changelog bullets.
 - MERGE into existing ### Category under [Unreleased] — never append a second ### Added / ### Fixed block.
-- Apply with the native workflow_changelog_apply tool only (not hand-edits under Unreleased).
+- Apply with the native workit_changelog_apply tool only (not hand-edits under Unreleased).
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 var init_repo_context = __esm(() => {
   init_vcs_config();
@@ -24182,7 +24182,7 @@ function sddContext({
     task_count,
     flow: { spec: flow.spec, plan: flow.plan, menu: flow.menu },
     todowrite_required: true,
-    todowrite_hint: "REQUIRED: Call OpenCode todowrite with todos from this result so the native task list shows progress. Before each task set status in_progress; after workflow_sdd_append_progress set it completed."
+    todowrite_hint: "REQUIRED: Call OpenCode todowrite with todos from this result so the native task list shows progress. Before each task set status in_progress; after workit_sdd_append_progress set it completed."
   };
 }
 function sddTaskBrief({
@@ -24266,6 +24266,58 @@ function sddAppendProgress({
   const rel = posix2(path19.relative(contained.base, path_));
   return { ok: true, line: trimmed, progress_path: rel };
 }
+function sddAppendAdvisory({
+  advisories_path,
+  task_id,
+  text,
+  workspace_root
+}) {
+  if (typeof task_id !== "number" || !Number.isSafeInteger(task_id) || task_id <= 0) {
+    return { error: "task_id must be a positive safe integer", code: "advisory_task_invalid" };
+  }
+  if (typeof text !== "string") {
+    return {
+      error: "advisory text must be a string of 1-1000 characters after normalization",
+      code: "advisory_text_invalid"
+    };
+  }
+  if (text.includes("\r") || text.includes(`
+`)) {
+    return {
+      error: "advisory text must be a single line (no CR/LF)",
+      code: "advisory_text_invalid"
+    };
+  }
+  const collapsed = text.trim().replace(/[ \t]+/g, " ");
+  if (collapsed.length === 0 || collapsed.length > 1000) {
+    return {
+      error: "advisory text must be 1-1000 characters after trim and horizontal-space collapse",
+      code: "advisory_text_invalid"
+    };
+  }
+  if (!/^docs\/[^/]+\/sdd\/advisories\.md$/.test(advisories_path)) {
+    return {
+      error: `advisories_path must be docs/<slug>/sdd/advisories.md: ${advisories_path}`,
+      code: "advisory_path_invalid"
+    };
+  }
+  const contained = resolveDocsPath({ workspace_root, path: advisories_path });
+  if (!contained.ok)
+    return { error: contained.error, code: "advisory_path_invalid" };
+  const abs = contained.path;
+  if (existsSync11(abs) && statSync6(abs).isDirectory()) {
+    return {
+      error: `advisory target is a directory: ${advisories_path}`,
+      code: "advisory_target_invalid"
+    };
+  }
+  mkdirSync6(path19.dirname(abs), { recursive: true });
+  const line = `- Task ${task_id}: ${collapsed}
+`;
+  appendFileSync2(abs, line, "utf8");
+  const rel = posix2(path19.relative(contained.base, abs));
+  return { ok: true, advisory: collapsed, advisories_path: rel };
+}
 var posix2 = (p) => p.split(path19.sep).join("/"), PROGRESS_RE;
 var init_sdd = __esm(() => {
   init_docs_validate();
@@ -24286,6 +24338,7 @@ import {
   fsyncSync,
   mkdirSync as mkdirSync7,
   openSync,
+  readdirSync as readdirSync6,
   readFileSync as readFileSync13,
   renameSync,
   rmSync,
@@ -24298,16 +24351,20 @@ import path20 from "node:path";
 
 class HostReceiptStore {
   #bySession = new Map;
-  record(sessionId, callID, selectedLabel, recordedAt = Date.now(), question) {
-    const label = selectedLabel.trim();
-    if (!label)
+  record(sessionId, callID, selectedLabel, recordedAt = Date.now(), question = "", purpose) {
+    const trimmed = selectedLabel.trim();
+    if (!trimmed)
       return;
     if (recordedAt > Date.now() + MAX_CLOCK_SKEW_MS)
       return;
+    const derived = purpose ?? receiptPurposeForLabel(selectedLabel);
+    if (derived === undefined)
+      return;
+    const q = question ?? "";
     const queue = this.#bySession.get(sessionId) ?? [];
     if (queue.length >= MAX_RECEIPTS_PER_SESSION)
       queue.shift();
-    queue.push({ sessionId, callID, selectedLabel: label, recordedAt, question });
+    queue.push({ sessionId, callID, selectedLabel, recordedAt, question: q, purpose: derived });
     this.#bySession.set(sessionId, queue);
   }
   count(sessionId) {
@@ -24324,10 +24381,40 @@ class HostReceiptStore {
     if (!queue || queue.length === 0) {
       return err2("receipt_missing", "no host-observed native-question receipt for this session — ask the native " + "`question` tool and have the user answer before calling this tool");
     }
-    const index = queue.length - 1;
+    let index = -1;
+    if (opts.purpose !== undefined) {
+      const top = queue[queue.length - 1];
+      if (top && top.purpose === opts.purpose && isNegativeLabel(top.selectedLabel)) {
+        const filtered = queue.filter((r) => r.purpose !== opts.purpose);
+        if (filtered.length === 0)
+          this.#bySession.delete(sessionId);
+        else
+          this.#bySession.set(sessionId, filtered);
+        return err2("receipt_rejected", `the user's most recent answer (${JSON.stringify(top.selectedLabel)}) is a ` + "negative answer — it cannot authorize an approval; ask the native question again");
+      }
+      for (let i = queue.length - 1;i >= 0; i--) {
+        if (queue[i].purpose === opts.purpose) {
+          index = i;
+          break;
+        }
+      }
+      if (index === -1) {
+        return err2("receipt_missing", `no host-observed receipt for purpose ${JSON.stringify(opts.purpose)} — ask the native question for that purpose`);
+      }
+    } else {
+      index = queue.length - 1;
+    }
     const receipt = queue[index];
     if (isNegativeLabel(receipt.selectedLabel)) {
-      this.#bySession.delete(sessionId);
+      if (opts.purpose !== undefined) {
+        const filtered = queue.filter((r) => r.purpose !== opts.purpose);
+        if (filtered.length === 0)
+          this.#bySession.delete(sessionId);
+        else
+          this.#bySession.set(sessionId, filtered);
+      } else {
+        this.#bySession.delete(sessionId);
+      }
       return err2("receipt_rejected", `the user's most recent answer (${JSON.stringify(receipt.selectedLabel)}) is a ` + "negative answer — it cannot authorize an approval; ask the native question again");
     }
     if (opts.label !== undefined && !sameChoiceLabel(receipt.selectedLabel, opts.label)) {
@@ -24396,7 +24483,8 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     execution: {
       status: execution.status ?? "pending",
       mode: execution.mode ?? null,
-      evidence: execution.evidence ?? null
+      evidence: execution.evidence ?? null,
+      coordinator_session_id: execution.coordinator_session_id ?? null
     },
     handoff_destination: p.handoff_destination ?? false,
     updated_at: p.updated_at ?? Date.now()
@@ -24407,7 +24495,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   spec: { path: "", status: "draft", evidence: null, approved_digest: null },
   plan: { path: "", status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null },
+  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
   handoff_destination: false,
   updated_at: Date.now()
 }), readFlowState = (root, slug) => {
@@ -24516,6 +24604,12 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   if (execRaw?.evidence !== undefined && !validateEvidenceValue(execRaw.evidence, true)) {
     return { ok: false, error: "flow state execution.evidence has an unsupported shape" };
   }
+  if (execRaw?.coordinator_session_id !== undefined && execRaw.coordinator_session_id !== null && typeof execRaw.coordinator_session_id !== "string") {
+    return {
+      ok: false,
+      error: "flow state execution.coordinator_session_id must be a string or null"
+    };
+  }
   return {
     ok: true,
     state: {
@@ -24531,7 +24625,8 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
       execution: {
         status: execRaw?.status ?? "pending",
         mode: execRaw?.mode ?? null,
-        evidence: execRaw?.evidence ?? null
+        evidence: execRaw?.evidence ?? null,
+        coordinator_session_id: execRaw?.coordinator_session_id ?? null
       },
       handoff_destination: parsed.handoff_destination ?? false,
       updated_at: parsed.updated_at ?? Date.now()
@@ -24541,7 +24636,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   const file = flowPath(root, slug);
   const rel = path20.posix.join("docs", slug, "sdd", "flow.json");
   if (!existsSync12(file)) {
-    return err2("flow_not_activated", `flow not activated for ${slug} — run workflow_flow_status first`);
+    return err2("flow_not_activated", `flow not activated for ${slug} — run workit_flow_status first`);
   }
   let text;
   try {
@@ -24658,7 +24753,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null },
+  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
   handoff_destination: false,
   updated_at: Date.now()
 }), resetForPlanDrift = (state) => ({
@@ -24697,9 +24792,14 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
 }, deriveLegacyExecution = (root, slug, state) => {
   const ledger = ledgerCompletion(root, slug);
   if (state.plan.status === "approved" && state.menu.chosen === "subagent-driven" && ledger.started && !ledger.complete) {
-    return { status: "active", mode: "subagent-driven", evidence: null };
+    return {
+      status: "active",
+      mode: "subagent-driven",
+      evidence: null,
+      coordinator_session_id: null
+    };
   }
-  return { status: "pending", mode: null, evidence: null };
+  return { status: "pending", mode: null, evidence: null, coordinator_session_id: null };
 }, normalizeCompatibility = (root, slug, parsed, state) => {
   if (!isRecord(parsed) || !("execution" in parsed)) {
     const derived = deriveLegacyExecution(root, slug, state);
@@ -24707,6 +24807,11 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     if (derived.status !== current.status || derived.mode !== current.mode) {
       return { state: { ...state, execution: derived, updated_at: Date.now() }, changed: true };
     }
+    return { state, changed: false };
+  }
+  const execRaw = isRecord(parsed.execution) ? parsed.execution : undefined;
+  if (execRaw && !("coordinator_session_id" in execRaw)) {
+    return { state: { ...state, updated_at: Date.now() }, changed: true };
   }
   return { state, changed: false };
 }, withFlowLock = (file, fn) => {
@@ -24836,14 +24941,6 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     return err2("workspace_mismatch", `mutation context workspace ${JSON.stringify(ctx.hostWorkspace)} does not match flow workspace ${JSON.stringify(root)}`);
   }
   return { ok: true };
-}, assertCoordinatorBoundary = (ctx, state) => {
-  if (ctx?.role === "coordinator" && state.execution.status === "active" && state.execution.mode === "subagent-driven") {
-    return err2("coordinator_blocked", COORDINATOR_RECOVERY_TEXT);
-  }
-  if (ctx?.role === "delegated" && !ctx.taskIdentity) {
-    return err2("delegated_unauthenticated", "delegated mutations require an authenticated task identity (taskIdentity) — re-run inside the delegated worker session");
-  }
-  return { ok: true };
 }, MAX_CLOCK_SKEW_MS = 60000, MAX_RECEIPTS_PER_SESSION = 10, RECEIPT_FRESHNESS_MS, EVIDENCE_WINDOW_MS, NEGATIVE_ANSWER_LABELS, isNegativeLabel = (label) => {
   const normalized = label.trim().toLowerCase();
   return NEGATIVE_ANSWER_LABELS.some((entry) => {
@@ -24854,6 +24951,31 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     }
     return firstWord.replace(/[^a-z]/g, "") === entry;
   });
+}, receiptPurposeForLabel = (label) => {
+  const n = normalizeLabel(label);
+  if (n === "approve spec" || n === "approve spec recommended")
+    return "spec-approval";
+  if (n === "approve plan" || n === "approve plan recommended")
+    return "plan-approval";
+  if (n === "approve")
+    return;
+  if (n === "pause plan")
+    return "plan-pause";
+  if (n === "resume plan")
+    return "plan-resume";
+  if (n === "complete plan")
+    return "plan-complete";
+  const exec = new Set([
+    "subagent driven",
+    "inline",
+    "handoff",
+    "review spec",
+    "review plan",
+    "change model"
+  ]);
+  if (exec.has(n))
+    return "execution-menu";
+  return;
 }, sameChoiceLabel = (a, b) => normalizeLabel(a) === normalizeLabel(b), normalizeLabel = (s) => s.replace(/\s*\([^)]*\)/g, " ").replace(/\s*\bfirst\b\s*$/i, " ").replace(/[^a-z0-9]+/gi, " ").trim().toLowerCase(), createCursorConfirmation = () => ({
   ok: true,
   evidence: { host: "cursor", attested: false, confirmation: "contract" }
@@ -24958,7 +25080,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
         spec: { path: specPath, status: "draft", evidence: null, approved_digest: null },
         plan: { path: planPath, status: "draft", evidence: null, approved_digest: null },
         menu: { presented: false, chosen: "", evidence: null },
-        execution: { status: "pending", mode: null, evidence: null },
+        execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
         handoff_destination: false,
         updated_at: Date.now()
       });
@@ -25101,13 +25223,24 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
       return err2("recursive_handoff", "this flow is already a handoff destination — a second handoff is rejected");
     }
     const executing = choice === "subagent-driven" || choice === "inline";
+    const coordinatorSessionId = choice === "subagent-driven" && recorded.evidence.host === "opencode" ? ctx?.sessionId ?? null : null;
     return {
       ok: true,
       next: {
         ...state,
         plan: { ...state.plan, path: state.plan.path || `docs/${slug}/plan.md` },
         menu: { presented: true, chosen: choice, evidence: recorded.evidence },
-        execution: executing ? { status: "active", mode: choice, evidence: recorded.evidence } : { status: "pending", mode: null, evidence: recorded.evidence },
+        execution: executing ? {
+          status: "active",
+          mode: choice,
+          evidence: recorded.evidence,
+          coordinator_session_id: coordinatorSessionId
+        } : {
+          status: "pending",
+          mode: null,
+          evidence: recorded.evidence,
+          coordinator_session_id: null
+        },
         updated_at: Date.now()
       }
     };
@@ -25195,7 +25328,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     }
     const next = {
       ...reconciled.state,
-      execution: { ...exec, status: "completed" },
+      execution: { ...exec, status: "completed", coordinator_session_id: null },
       handoff_destination: false,
       updated_at: Date.now()
     };
@@ -25255,7 +25388,7 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
 }, slugFromSddPath = (p) => {
   const match = p.split(path20.sep).join("/").match(/^docs\/([^/]+)\/sdd(\/|$|['"])/);
   return match?.[1] ?? "";
-}, assertProductGates = (root, slug, opts = {}, ctx) => {
+}, assertSddControlGates = (root, slug, opts = {}, ctx) => {
   const bound = assertMutationWorkspace(root, ctx);
   if (!bound.ok)
     return bound;
@@ -25264,13 +25397,13 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     return effective;
   const state = effective.state;
   if (state.spec.status !== "approved") {
-    return err2("spec_not_approved", `spec not approved (status: ${state.spec.status}). Run workflow_spec_approve after the user's approval.`);
+    return err2("spec_not_approved", `spec not approved (status: ${state.spec.status}). Run workit_spec_approve after the user's approval.`);
   }
   if (state.plan.status !== "approved") {
-    return err2("plan_not_approved", `plan not approved (status: ${state.plan.status}). Run workflow_plan_approve after the user's approval.`);
+    return err2("plan_not_approved", `plan not approved (status: ${state.plan.status}). Run workit_plan_approve after the user's approval.`);
   }
   if (opts.requireMenu && !state.menu.presented) {
-    return err2("menu_not_presented", "post-plan menu not presented. Record the native question answer with workflow_plan_menu.");
+    return err2("menu_not_presented", "post-plan menu not presented. Record the native question answer with workit_plan_menu.");
   }
   if (opts.requireDocs) {
     const validated = docsValidate({
@@ -25281,15 +25414,18 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     if (validated.ok === false)
       return err2("docs_invalid", validated.error);
   }
-  return assertCoordinatorBoundary(ctx, state);
-}, BASH_READ_TOKENS, BASH_GIT_READ_SUBCOMMANDS, BASH_GIT_MUTABLE_SUBCOMMANDS, BASH_GIT_READ_FLAGS, BASH_FIND_DENIED_FLAGS, BASH_TEST_VERBS, BASH_DENIED_HEADS, BASH_OUTPUT_FLAG_VERBS, BASH_PAREN_EXEMPT_HEADS, BASH_GIT_VALUE_FLAGS, COORDINATOR_SHELL_DENIED_TEXT;
+  if (state.execution.status === "active" && state.execution.mode === "subagent-driven" && roleFromParentage(ctx?.parentSessionId, state.execution.coordinator_session_id) === "delegated") {
+    return err2("sdd_control_denied", "SDD control metadata is coordinator-owned while a subagent-driven plan is active — delegated workers cannot mutate task briefs, review packages, progress, or advisories");
+  }
+  return { ok: true };
+}, roleFromParentage = (parentID, coordinatorSessionId) => typeof parentID === "string" && parentID !== "" && parentID === coordinatorSessionId ? "delegated" : "coordinator", BASH_READ_TOKENS, BASH_GIT_READ_SUBCOMMANDS, BASH_GIT_MUTABLE_SUBCOMMANDS, BASH_GIT_READ_FLAGS, BASH_FIND_DENIED_FLAGS, BASH_TEST_VERBS, BASH_DENIED_HEADS, BASH_OUTPUT_FLAG_VERBS, BASH_PAREN_EXEMPT_HEADS, BASH_GIT_VALUE_FLAGS, COORDINATOR_SHELL_DENIED_TEXT;
 var init_flow_state = __esm(() => {
   init_docs_validate();
   init_docs_layout();
   init_sdd();
   init_verify_project();
   init_menu();
-  COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations (task briefs, progress, review packages) to an " + "authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
+  COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations to an authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
   CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
   MENU_CHOICES = [
     "subagent-driven",
@@ -25460,7 +25596,7 @@ import {
   existsSync as existsSync13,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync8,
-  readdirSync as readdirSync6,
+  readdirSync as readdirSync7,
   readFileSync as readFileSync14,
   realpathSync as realpathSync3,
   renameSync as renameSync2,
@@ -25505,7 +25641,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   const root = legacyRoot(workspace_root);
   const raw = [];
   if (existsSync13(root)) {
-    for (const entry of readdirSync6(root, { withFileTypes: true })) {
+    for (const entry of readdirSync7(root, { withFileTypes: true })) {
       const abs = path21.join(root, entry.name);
       const rel = posix3(path21.relative(workspace_root, abs));
       if (entry.isDirectory()) {
@@ -25639,7 +25775,7 @@ var LEGACY_DIR = "docs/superpowers", MIGRATION_CHOICES, SLUG_RE3, RESERVED_SLUG
   if (visits.has(real))
     return { ok: true };
   visits.add(real);
-  for (const entry of readdirSync6(real, { withFileTypes: true })) {
+  for (const entry of readdirSync7(real, { withFileTypes: true })) {
     const fromAbs = path21.join(real, entry.name);
     const fromRel = posix3(path21.join(legacyRel, entry.name));
     const toRel = posix3(path21.join(destRelRoot, entry.name));
@@ -25828,7 +25964,7 @@ var init_docs_migration = __esm(() => {
 });
 
 // packages/workit-core/src/core/docs-repo.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8, readdirSync as readdirSync7 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8, readdirSync as readdirSync8 } from "node:fs";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import path22 from "node:path";
 var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(configDir(), "docs-repo.json"), readDocsRepoConfig = () => {
@@ -25868,7 +26004,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
   const specs = [];
   const docsDir = path22.join(workspaceRoot, "docs");
   if (existsSync14(docsDir)) {
-    for (const slug of readdirSync7(docsDir)) {
+    for (const slug of readdirSync8(docsDir)) {
       if (slug.startsWith("."))
         continue;
       const spec = path22.posix.join("docs", slug, "spec.md");
@@ -25879,7 +26015,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
       if (repoPath) {
         const featuresDir = path22.join(repoPath, "features");
         if (existsSync14(featuresDir)) {
-          const match = readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d));
+          const match = readdirSync8(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d));
           if (match) {
             promoted = true;
             target = path22.join(repoPath, "features", match);
@@ -25918,7 +26054,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
   const workspaceRootCanonical = resolved.layout.workspace;
   const repoPath = docsRepoPath();
   if (!repoPath)
-    return { ok: false, error: "docs repo not linked — run workflow_docs_repo_link" };
+    return { ok: false, error: "docs repo not linked — run workit_docs_repo_link" };
   const repoValid = validateDocsRepo(repoPath);
   if (!repoValid.ok)
     return { ok: false, error: repoValid.error };
@@ -25966,7 +26102,7 @@ var configPath = () => process.env.WORKFLOW_DOCS_REPO_CONFIG ?? path22.join(conf
   }
   const prefix = monthPrefix();
   const featuresDir = path22.join(repoPath, "features");
-  const existing = existsSync14(featuresDir) ? readdirSync7(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d)) : undefined;
+  const existing = existsSync14(featuresDir) ? readdirSync8(featuresDir).find((d) => new RegExp(`^20\\d{2}-\\d{2}-${slug}$`).test(d)) : undefined;
   const targetDir = path22.join(featuresDir, existing ?? `${prefix}-${slug}`);
   mkdirSync9(targetDir, { recursive: true });
   const files = ["spec.md"];
@@ -26111,7 +26247,7 @@ var init_templates = __esm(() => {
 });
 
 // packages/workit-core/src/core/rules.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import path25 from "node:path";
 var rulesDir = () => path25.join(configDir(), "rules"), parseRule = (markdown) => {
   const fm = markdown.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -26141,7 +26277,7 @@ var rulesDir = () => path25.join(configDir(), "rules"), parseRule = (markdown) =
   const result = [];
   const dir = rulesDir();
   if (existsSync17(dir)) {
-    for (const entry of readdirSync8(dir)) {
+    for (const entry of readdirSync9(dir)) {
       const file = path25.join(dir, entry, "rule.md");
       if (!existsSync17(file))
         continue;
@@ -26264,7 +26400,7 @@ import {
   mkdirSync as mkdirSync12,
   mkdtempSync,
   readFileSync as readFileSync19,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   renameSync as renameSync3,
   rmSync as rmSync3,
   statSync as statSync9,
@@ -26849,7 +26985,7 @@ async function postUpdate({
         postedComment: true,
         loggedMinutes: 0,
         error: time3.error,
-        retry: "workflow_youtrack_log_time"
+        retry: "workit_youtrack_log_time"
       };
     }
     return { ok: true, issueId, postedComment: true, loggedMinutes: minutes };
@@ -27523,7 +27659,7 @@ var logger, readServerVersion = () => {
     }
   });
 }, changelogCategorySchema, lifecycleTool = (action, description) => {
-  registerTool(`workflow_plan_${action}`, {
+  registerTool(`workit_plan_${action}`, {
     description,
     inputSchema: {
       plan_path: exports_external.string(),
@@ -27603,7 +27739,7 @@ var init_server3 = __esm(async () => {
     name: "workit",
     version: VERSION
   });
-  registerTool("workflow_verify", {
+  registerTool("workit_verify", {
     description: "Run project validation scripts (verify-project.sh). Defaults to Cursor workspace; pass workspace_root when the target repo differs.",
     inputSchema: {
       dry_run: exports_external.boolean().optional(),
@@ -27620,7 +27756,7 @@ var init_server3 = __esm(async () => {
       workspace_root: cwd
     }));
   });
-  registerTool("workflow_doctor", {
+  registerTool("workit_doctor", {
     description: "Run the offline workit doctor and report installation health. Defaults to Cursor workspace; pass workspace_root when the target repo differs.",
     inputSchema: {
       workspace_root: workspaceRootSchema
@@ -27629,7 +27765,7 @@ var init_server3 = __esm(async () => {
     const report = runDoctor({ host: "cursor", cwd: workspace_root });
     return jsonResult(report);
   });
-  registerTool("workflow_pr_context", {
+  registerTool("workit_pr_context", {
     description: "Gather PR-ready repository context. On feature/* or bugfix/*, fetches and fast-forwards develop + current branch before diffing against develop.",
     inputSchema: {
       range: exports_external.string().optional(),
@@ -27693,7 +27829,7 @@ var init_server3 = __esm(async () => {
       stderr: stderr || undefined
     }));
   });
-  registerTool("workflow_pr_create", {
+  registerTool("workit_pr_create", {
     description: "Create GitLab MR or GitHub PR via glab/gh using vcs.json — requires confirmed: true",
     inputSchema: {
       confirmed: exports_external.boolean(),
@@ -27721,7 +27857,7 @@ var init_server3 = __esm(async () => {
     }
     return jsonResult(withWorkspace(workspace_root, { ...data }));
   });
-  registerTool("workflow_changelog_context", {
+  registerTool("workit_changelog_context", {
     description: "Gather changelog update context. Defaults to Cursor workspace; pass workspace_root when the target repo differs.",
     inputSchema: {
       range: exports_external.string().optional(),
@@ -27738,7 +27874,7 @@ var init_server3 = __esm(async () => {
       diff_stat: sections["Diff Stat"] ?? "",
       files: sections["Changed Files"] ?? "",
       unreleased,
-      apply_hint: "ALWAYS merge via workflow_changelog_apply — never hand-edit ### Added/Changed/… under [Unreleased].",
+      apply_hint: "ALWAYS merge via workit_changelog_apply — never hand-edit ### Added/Changed/… under [Unreleased].",
       workspace_root: cwd,
       stdout,
       exitCode,
@@ -27753,7 +27889,7 @@ var init_server3 = __esm(async () => {
     "Fixed",
     "Security"
   ]);
-  registerTool("workflow_changelog_apply", {
+  registerTool("workit_changelog_apply", {
     description: "Merge Keep a Changelog bullets into ## [Unreleased] under the correct ### category. Collapses duplicate category headings. NEVER append a second ### Added block.",
     inputSchema: {
       entries: exports_external.union([
@@ -27781,7 +27917,7 @@ var init_server3 = __esm(async () => {
       unreleased: changelogUnreleasedStats(workspace_root, changelogPath)
     }));
   });
-  registerTool("workflow_release_notes_context", {
+  registerTool("workit_release_notes_context", {
     description: "Gather release notes context. Defaults to Cursor workspace; pass workspace_root when the target repo differs.",
     inputSchema: {
       range_or_tag: exports_external.string().min(1),
@@ -27805,7 +27941,7 @@ var init_server3 = __esm(async () => {
       stderr: stderr || undefined
     }));
   });
-  registerTool("workflow_docs_context", {
+  registerTool("workit_docs_context", {
     description: "Gather docs refresh context. Defaults to Cursor workspace; pass workspace_root when the target repo differs.",
     inputSchema: {
       range: exports_external.string().optional(),
@@ -27825,7 +27961,7 @@ var init_server3 = __esm(async () => {
       stderr: stderr || undefined
     }));
   });
-  registerTool("workflow_git_context", {
+  registerTool("workit_git_context", {
     description: "Gather git status for commit skill. Defaults to Cursor workspace; pass workspace_root when the target repo differs.",
     inputSchema: {
       paths: exports_external.array(exports_external.string()).optional(),
@@ -27835,7 +27971,7 @@ var init_server3 = __esm(async () => {
     const data = gitContext(workspace_root, paths ?? []);
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_resolve_branch", {
+  registerTool("workit_resolve_branch", {
     description: "Resolve feature/* or bugfix/* branch from spec/plan. Returns current_branch, dirty, needs_checkout. No worktrees.",
     inputSchema: {
       spec_path: exports_external.string(),
@@ -27848,7 +27984,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_branch_setup", {
+  registerTool("workit_branch_setup", {
     description: "In-place checkout of feature/* or bugfix/* branch. Stash required when dirty. NEVER uses worktrees.",
     inputSchema: {
       action: exports_external.enum(["setup", "reapply_stash"]).optional(),
@@ -27869,7 +28005,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_sdd_context", {
+  registerTool("workit_sdd_context", {
     description: "Resolve canonical docs/<slug>/sdd/ paths; creates nothing (progress.md appears only on the first confirmed append). NEVER use .superpowers/sdd.",
     inputSchema: {
       slug: exports_external.string().optional(),
@@ -27882,7 +28018,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_sdd_task_brief", {
+  registerTool("workit_sdd_task_brief", {
     description: "Write task-N-brief.md under docs/<slug>/sdd/",
     inputSchema: {
       sdd_dir: exports_external.string(),
@@ -27894,7 +28030,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(sdd_dir);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertProductGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddTaskBrief({
@@ -27905,7 +28041,7 @@ var init_server3 = __esm(async () => {
     });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_sdd_review_package", {
+  registerTool("workit_sdd_review_package", {
     description: "Write review diff under SDD dir between base and head SHAs",
     inputSchema: {
       sdd_dir: exports_external.string(),
@@ -27917,7 +28053,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(sdd_dir);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertProductGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddReviewPackage({
@@ -27930,7 +28066,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_sdd_append_progress", {
+  registerTool("workit_sdd_append_progress", {
     description: "Append one validated line to docs/<slug>/sdd/progress.md",
     inputSchema: {
       progress_path: exports_external.string(),
@@ -27941,7 +28077,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(progress_path);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertProductGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddAppendProgress({ progress_path, line, workspace_root });
@@ -27949,7 +28085,27 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_docs_branch", {
+  registerTool("workit_sdd_append_advisory", {
+    description: "Append a validated advisory line to docs/<slug>/sdd/advisories.md (coordinator-owned)",
+    inputSchema: {
+      advisories_path: exports_external.string(),
+      task_id: exports_external.number(),
+      text: exports_external.string(),
+      workspace_root: workspaceRootSchema
+    }
+  }, async ({ advisories_path, task_id, text, workspace_root }) => {
+    const slug = slugFromSddPath(advisories_path);
+    if (!slug)
+      return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    if (!gate.ok)
+      return jsonResult({ error: gate.error, code: gate.code });
+    const data = sddAppendAdvisory({ advisories_path, task_id, text, workspace_root });
+    if ("error" in data)
+      return jsonResult({ error: data.error, code: data.code });
+    return jsonResult(withWorkspace(workspace_root, data));
+  });
+  registerTool("workit_docs_branch", {
     description: "Resolve branch for spec/plan authors: keep current feature|bugfix or create from the configured base.",
     inputSchema: {
       plan_path: exports_external.string().optional(),
@@ -27962,7 +28118,7 @@ var init_server3 = __esm(async () => {
       return jsonResult(withWorkspace(workspace_root, { error: data.error }));
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_docs_layout", {
+  registerTool("workit_docs_layout", {
     description: "Canonical docs layout: prepare creates missing docs/ and docs/<slug>/; migrate detects legacy docs/superpowers/ and copies safe pairs after a native Migrate safely / Not now question",
     inputSchema: {
       action: exports_external.enum(["prepare", "migrate"]).default("prepare"),
@@ -28006,7 +28162,7 @@ var init_server3 = __esm(async () => {
       return jsonResult(withWorkspace(workspace_root, { error: result.error }));
     return jsonResult(withWorkspace(workspace_root, result));
   });
-  registerTool("workflow_docs_validate", {
+  registerTool("workit_docs_validate", {
     description: "Hard-fail validate spec/plan headers, link, branch, task order; returns quality findings (hard/warning). Defaults to Cursor workspace; pass workspace_root when paths are relative to another repo.",
     inputSchema: {
       spec_path: exports_external.string(),
@@ -28020,7 +28176,7 @@ var init_server3 = __esm(async () => {
     }
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_plan_tasks", {
+  registerTool("workit_plan_tasks", {
     description: "Parse plan ### Task N sections into structured tasks with section_text. Defaults to Cursor workspace; pass workspace_root when paths are relative to another repo.",
     inputSchema: {
       plan_path: exports_external.string(),
@@ -28044,7 +28200,7 @@ var init_server3 = __esm(async () => {
     }
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_handoff_prompt", {
+  registerTool("workit_handoff_prompt", {
     description: "Build copy-paste handoff prompt for next session. Defaults to Cursor workspace; pass workspace_root when spec/plan paths are relative to another repo.",
     inputSchema: {
       message: exports_external.string(),
@@ -28232,7 +28388,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(data.data);
   });
-  registerTool("workflow_youtrack_verify_token", {
+  registerTool("workit_youtrack_verify_token", {
     description: "Read-only YouTrack token test (GET /api/users/me). No work items created.",
     inputSchema: {}
   }, async () => {
@@ -28244,7 +28400,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error ?? "token invalid", ...data });
     return jsonResult(data);
   });
-  registerTool("workflow_youtrack_parse_issue", {
+  registerTool("workit_youtrack_parse_issue", {
     description: "Parse YouTrack issue URL or bare id (e.g. NSR-40) into issueId",
     inputSchema: {
       issue_ref: exports_external.string().describe("YouTrack URL or issue id, e.g. https://…/issue/NSR-40 or NSR-40")
@@ -28255,7 +28411,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(data);
   });
-  registerTool("workflow_youtrack_context", {
+  registerTool("workit_youtrack_context", {
     description: "YouTrack config, greeting, issue resolution (from issue_url/id or meetings)",
     inputSchema: {
       mode: exports_external.enum(["meetings", "task"]).optional(),
@@ -28284,7 +28440,7 @@ var init_server3 = __esm(async () => {
     }
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_youtrack_parse_duration", {
+  registerTool("workit_youtrack_parse_duration", {
     description: "Parse duration text (e.g. 1h 30m) to integer minutes",
     inputSchema: {
       text: exports_external.string(),
@@ -28296,7 +28452,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_youtrack_log_time", {
+  registerTool("workit_youtrack_log_time", {
     description: "POST YouTrack work item (time only, no comment)",
     inputSchema: {
       issueId: exports_external.string(),
@@ -28317,7 +28473,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_youtrack_draft", {
+  registerTool("workit_youtrack_draft", {
     description: "Build ES-CL comment markdown without posting (envelope only by default)",
     inputSchema: {
       issueId: exports_external.string(),
@@ -28329,7 +28485,7 @@ var init_server3 = __esm(async () => {
       facts: exports_external.record(exports_external.any()).optional()
     }
   }, async (input) => jsonResult(buildDraft(input)));
-  registerTool("workflow_youtrack_post", {
+  registerTool("workit_youtrack_post", {
     description: "Post YouTrack comment and optional time — requires confirmed: true",
     inputSchema: {
       confirmed: exports_external.boolean(),
@@ -28350,7 +28506,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(withWorkspace(workspace_root, data));
   });
-  registerTool("workflow_present_ascii", {
+  registerTool("workit_present_ascii", {
     description: "Render deterministic ASCII UI wireframe from JSON spec",
     inputSchema: {
       title: exports_external.string().optional(),
@@ -28363,7 +28519,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(data.data);
   });
-  registerTool("workflow_present_flow", {
+  registerTool("workit_present_flow", {
     description: "Render mermaid flowchart from JSON nodes/edges",
     inputSchema: {
       title: exports_external.string().optional(),
@@ -28385,7 +28541,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: data.error });
     return jsonResult(data.data);
   });
-  registerTool("workflow_flow_status", {
+  registerTool("workit_flow_status", {
     description: "Read the spec/plan approval flow state for a workflow; on first read it records flow activation and canonical document paths (FG-01)",
     inputSchema: {
       plan_path: exports_external.string().optional(),
@@ -28421,7 +28577,7 @@ var init_server3 = __esm(async () => {
       flow_path: `docs/${slug}/sdd/flow.json`
     });
   });
-  registerTool("workflow_spec_approve", {
+  registerTool("workit_spec_approve", {
     description: "Advance spec status with the Cursor policy-only confirmation: draft -> approved in a single call. The self-review validation runs automatically inside the transition; only the final approval asks for your confirmation. Cursor records attested: false (the MCP cannot observe AskQuestion results); there is no evidence argument (CA-42).",
     inputSchema: {
       spec_path: exports_external.string(),
@@ -28437,7 +28593,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: result.error, code: result.code });
     return jsonResult({ spec: spec_path, status: readFlowState(workspace, slug).spec.status });
   });
-  registerTool("workflow_plan_approve", {
+  registerTool("workit_plan_approve", {
     description: "Advance plan status with the Cursor policy-only confirmation: draft -> approved in a single call. The self-review validation runs automatically inside the transition; only the final approval asks for your confirmation. Requires approved spec. Cursor records attested: false; there is no evidence argument (CA-42).",
     inputSchema: {
       plan_path: exports_external.string(),
@@ -28453,7 +28609,7 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: result.error, code: result.code });
     return jsonResult({ plan: plan_path, status: readFlowState(workspace, slug).plan.status });
   });
-  registerTool("workflow_plan_menu", {
+  registerTool("workit_plan_menu", {
     description: "Record the answered post-plan choice menu with the Cursor policy-only confirmation. subagent-driven is rejected as unsupported on Cursor (CA-42); there is no evidence argument.",
     inputSchema: {
       plan_path: exports_external.string(),
@@ -28473,7 +28629,7 @@ var init_server3 = __esm(async () => {
   lifecycleTool("pause", "Pause a running plan with the Cursor policy-only confirmation: active -> paused. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
   lifecycleTool("resume", "Resume a paused plan with the Cursor policy-only confirmation: paused -> active. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
   lifecycleTool("complete", "Complete a running plan with the Cursor policy-only confirmation: active/paused -> completed, after the SDD ledger is complete and repository verification passes. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
-  registerTool("workflow_docs_repo_link", {
+  registerTool("workit_docs_repo_link", {
     description: "Link the component docs repo in the toolkit config",
     inputSchema: {
       path: exports_external.string(),
@@ -28485,11 +28641,11 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: result.error });
     return jsonResult({ path: result.path });
   });
-  registerTool("workflow_docs_list", {
+  registerTool("workit_docs_list", {
     description: "List local specs with docs-repo promotion status",
     inputSchema: { workspace_root: workspaceRootSchema }
   }, async ({ workspace_root }) => jsonResult(listSpecs(workspace_root)));
-  registerTool("workflow_docs_promote", {
+  registerTool("workit_docs_promote", {
     description: "Promote a spec (+plan) to the linked docs repo with quality gate",
     inputSchema: {
       slug: exports_external.string(),
@@ -28507,11 +28663,11 @@ var init_server3 = __esm(async () => {
       index_updated: result.index_updated
     });
   });
-  registerTool("workflow_template_list", {
+  registerTool("workit_template_list", {
     description: "List editable templates with their source",
     inputSchema: { workspace_root: workspaceRootSchema }
   }, async () => jsonResult({ templates: listTemplates() }));
-  registerTool("workflow_template_edit", {
+  registerTool("workit_template_edit", {
     description: "Write an edited template to the toolkit config dir",
     inputSchema: {
       name: exports_external.enum(["issue-update", "greeting", "headers"]),
@@ -28524,11 +28680,11 @@ var init_server3 = __esm(async () => {
       return jsonResult({ error: result.error });
     return jsonResult({ path: result.path });
   });
-  registerTool("workflow_rule_list", {
+  registerTool("workit_rule_list", {
     description: "List canonical rules (config) with platforms",
     inputSchema: { workspace_root: workspaceRootSchema }
   }, async () => jsonResult({ rules: listRules() }));
-  registerTool("workflow_rule_edit", {
+  registerTool("workit_rule_edit", {
     description: "Write a canonical rule to the toolkit config dir",
     inputSchema: {
       name: exports_external.string(),