@cleocode/adapters 2026.9.8 → 2026.9.10

package/dist/index.js

@@ -480,7 +480,7 @@ var init_cant_context = __esm({
 
 // packages/contracts/src/acceptance-gate-schema.ts
 import { z } from "zod";
-var gateBaseSchema, fileAssertionSchema, testGateSchema, fileGateSchema, commandGateSchema, lintGateSchema, httpGateSchema, manualGateSchema, acceptanceGateSchema, gateResultDetailsSchema, acceptanceGateResultSchema, acceptanceItemSchema, acceptanceArraySchema;
+var gateBaseSchema, fileAssertionSchema, testGateSchema, testCountReportSchema, fileGateSchema, commandGateSchema, lintGateSchema, httpGateSchema, manualGateSchema, acceptanceGateSchema, gateResultDetailsSchema, capturedExecutionSchema, gateBindingPathSchema, acceptanceGateBindingSchema, acceptanceGateResultSchema, acceptanceItemSchema, acceptanceArraySchema;
 var init_acceptance_gate_schema = __esm({
   "packages/contracts/src/acceptance-gate-schema.ts"() {
     "use strict";
@@ -519,6 +519,52 @@ var init_acceptance_gate_schema = __esm({
       cwd: z.string().optional(),
       env: z.record(z.string(), z.string()).optional()
     });
+    testCountReportSchema = z.object({
+      numTotalTests: z.number().int().nonnegative().safe(),
+      numPassedTests: z.number().int().nonnegative().safe(),
+      numFailedTests: z.number().int().nonnegative().safe(),
+      numPendingTests: z.number().int().nonnegative().safe(),
+      numTodoTests: z.number().int().nonnegative().safe(),
+      numTotalTestSuites: z.number().int().nonnegative().safe(),
+      numPassedTestSuites: z.number().int().nonnegative().safe(),
+      numFailedTestSuites: z.number().int().nonnegative().safe(),
+      numPendingTestSuites: z.number().int().nonnegative().safe(),
+      success: z.boolean(),
+      testResults: z.array(
+        z.object({
+          name: z.string().min(1),
+          status: z.enum(["passed", "failed"]),
+          assertionResults: z.array(
+            z.object({
+              fullName: z.string(),
+              status: z.enum(["passed", "failed", "pending", "skipped", "todo"])
+            })
+          )
+        })
+      )
+    }).superRefine((report, context) => {
+      const assertions = report.testResults.flatMap((file2) => file2.assertionResults);
+      const passed = assertions.filter((test) => test.status === "passed").length;
+      const failed = assertions.filter((test) => test.status === "failed").length;
+      const pending = assertions.filter(
+        (test) => test.status === "pending" || test.status === "skipped"
+      ).length;
+      const todo = assertions.filter((test) => test.status === "todo").length;
+      if (report.numTotalTests !== assertions.length || report.numPassedTests !== passed || report.numFailedTests !== failed || report.numPendingTests !== pending || report.numTodoTests !== todo) {
+        context.addIssue({
+          code: "custom",
+          message: "Test counters disagree with assertion results"
+        });
+      }
+      if (report.numTotalTestSuites !== report.numPassedTestSuites + report.numFailedTestSuites + report.numPendingTestSuites) {
+        context.addIssue({ code: "custom", message: "Suite counters are inconsistent" });
+      }
+      if (report.testResults.some(
+        (file2) => file2.status === "passed" && file2.assertionResults.some((test) => test.status === "failed")
+      ) || report.success && (failed > 0 || report.numFailedTestSuites > 0 || report.testResults.some((file2) => file2.status === "failed"))) {
+        context.addIssue({ code: "custom", message: "Success status contradicts failed results" });
+      }
+    });
     fileGateSchema = gateBaseSchema.extend({
       kind: z.literal("file"),
       /** Absolute or project-root-relative file path. Mutually exclusive with `attachmentSha256`. */
@@ -608,7 +654,116 @@ var init_acceptance_gate_schema = __esm({
         accepted: z.boolean()
       })
     ]);
+    capturedExecutionSchema = z.object({
+      started: z.boolean(),
+      targetPid: z.number().int().positive().safe().nullable(),
+      exitCode: z.number().int().nonnegative().safe().nullable(),
+      signal: z.string().min(1).nullable(),
+      error: z.string().nullable(),
+      stopped: z.enum([
+        "deadline",
+        "cancelled",
+        "teardown",
+        "output-limit",
+        "resource-limit",
+        "transport-error"
+      ]).nullable(),
+      stdout: z.string(),
+      stderr: z.string(),
+      outputTruncated: z.boolean(),
+      durationMs: z.number().finite().nonnegative(),
+      mode: z.enum(["systemd", "pgid"]),
+      unitName: z.string().min(1).optional(),
+      nativeMemory: z.enum(["unverified", "observed-cgroup"]),
+      resourceLimits: z.object({
+        cgroup: z.string().startsWith("/"),
+        memoryMaxBytes: z.number().int().positive().safe().nullable(),
+        tasksMax: z.number().int().positive().safe().nullable()
+      }).strict().optional(),
+      cleanupScope: z.enum(["process-group", "direct-child"]),
+      transportClosed: z.literal(true),
+      targetCloseObserved: z.boolean(),
+      cleanupObservation: z.enum([
+        "scope-terminal",
+        "process-group-absent",
+        "process-group-signalled",
+        "unverified"
+      ]),
+      cleanupErrors: z.array(z.string())
+    }).strict().superRefine((execution, context) => {
+      if (execution.started !== (execution.targetPid !== null) || !execution.started && (execution.exitCode !== null || execution.signal !== null) || execution.exitCode !== null && execution.signal !== null || !execution.targetCloseObserved && (execution.exitCode !== null || execution.signal !== null))
+        context.addIssue({ code: "custom", message: "Contradictory target lifecycle observation" });
+      if (execution.nativeMemory === "observed-cgroup" && !execution.resourceLimits?.memoryMaxBytes)
+        context.addIssue({
+          code: "custom",
+          message: "Observed native-memory claim requires a finite kernel limit"
+        });
+      if (execution.resourceLimits && (execution.mode !== "systemd" || !execution.unitName || !execution.resourceLimits.cgroup.split("/").includes(execution.unitName) || execution.resourceLimits.cgroup.split("/").includes("..")))
+        context.addIssue({
+          code: "custom",
+          message: "Resource observation must name the exact owned scope"
+        });
+      if (execution.cleanupObservation === "scope-terminal" && (execution.mode !== "systemd" || !execution.unitName))
+        context.addIssue({
+          code: "custom",
+          message: "Terminal scope observation requires an identified systemd scope"
+        });
+    });
+    gateBindingPathSchema = z.string().min(1).refine(
+      (value) => /^(?:\/|[A-Za-z]:[\\/]|\\\\)/.test(value) && !value.includes("\0"),
+      "Captured gate paths must be absolute and contain no null byte"
+    );
+    acceptanceGateBindingSchema = z.object({
+      version: z.literal(1),
+      verificationId: z.string().uuid(),
+      identity: z.object({
+        projectId: z.string().min(1),
+        projectRoot: gateBindingPathSchema,
+        actor: z.string().min(1),
+        operation: z.literal("check.gate.verify"),
+        idempotencyKey: z.string().min(1)
+      }).strict(),
+      taskId: z.string().min(1),
+      criterionId: z.string().uuid(),
+      criterionHash: z.string().regex(/^[a-f0-9]{64}$/),
+      gateHash: z.string().regex(/^[a-f0-9]{64}$/),
+      capturedAt: z.string().datetime(),
+      deadlineAt: z.number().int().positive().safe(),
+      invocation: z.object({
+        command: z.string().min(1),
+        args: z.array(z.string()),
+        cwd: gateBindingPathSchema,
+        environmentHash: z.string().regex(/^[a-f0-9]{64}$/)
+      }).strict().optional(),
+      artifacts: z.array(
+        z.object({
+          path: gateBindingPathSchema,
+          sha256: z.string().regex(/^[a-f0-9]{64}$/).nullable(),
+          bytes: z.number().int().nonnegative().safe().nullable()
+        }).strict().superRefine((artifact, context) => {
+          if (artifact.sha256 === null !== (artifact.bytes === null))
+            context.addIssue({
+              code: "custom",
+              message: "Absent input requires both null digest and size"
+            });
+        })
+      )
+    }).strict().superRefine((binding, context) => {
+      if (new Set(binding.artifacts.map(({ path }) => path)).size !== binding.artifacts.length)
+        context.addIssue({
+          code: "custom",
+          path: ["artifacts"],
+          message: "Input paths must be unique"
+        });
+      if (Date.parse(binding.capturedAt) >= binding.deadlineAt)
+        context.addIssue({
+          code: "custom",
+          path: ["deadlineAt"],
+          message: "Input capture must precede the original deadline"
+        });
+    });
     acceptanceGateResultSchema = z.object({
+      binding: acceptanceGateBindingSchema.optional(),
       index: z.number().int().nonnegative(),
       req: z.string().optional(),
       kind: z.enum(["test", "file", "command", "lint", "http", "manual"]),
@@ -616,11 +771,57 @@ var init_acceptance_gate_schema = __esm({
       durationMs: z.number().nonnegative(),
       /** Typed kind-specific detail payload (T802). */
       details: gateResultDetailsSchema.optional(),
+      /** Actual target/transport/containment observations when supplied by the runner. */
+      execution: capturedExecutionSchema.optional(),
       evidence: z.string().optional(),
       errorMessage: z.string().optional(),
       /** ISO 8601 timestamp. */
       checkedAt: z.string().datetime(),
       checkedBy: z.string().min(1)
+    }).superRefine((result, context) => {
+      const binding = result.binding;
+      if (binding) {
+        if (binding.identity.actor !== result.checkedBy)
+          context.addIssue({
+            code: "custom",
+            path: ["binding", "identity", "actor"],
+            message: "Result actor must match captured operation identity"
+          });
+        if (Date.parse(binding.capturedAt) > Date.parse(result.checkedAt))
+          context.addIssue({
+            code: "custom",
+            path: ["binding", "capturedAt"],
+            message: "Result cannot precede input capture"
+          });
+        const executable = ["test", "command", "lint"].includes(result.kind);
+        if (executable && !binding.invocation)
+          context.addIssue({
+            code: "custom",
+            path: ["binding", "invocation"],
+            message: "Executable gate requires captured invocation"
+          });
+        if (["pass", "fail", "warn"].includes(result.result)) {
+          if (executable && !result.execution)
+            context.addIssue({
+              code: "custom",
+              path: ["execution"],
+              message: "Bound executable verdict requires process observation"
+            });
+          if (Date.parse(result.checkedAt) > binding.deadlineAt)
+            context.addIssue({
+              code: "custom",
+              path: ["checkedAt"],
+              message: "Verdict exceeds the original admitted deadline"
+            });
+        }
+      }
+      const execution = result.execution;
+      if (execution && ["pass", "fail", "warn"].includes(result.result) && (!execution.started || !execution.targetCloseObserved || execution.exitCode === null || execution.signal !== null || execution.error !== null || execution.stopped !== null || execution.outputTruncated || execution.cleanupErrors.length > 0))
+        context.addIssue({
+          code: "custom",
+          path: ["execution"],
+          message: "Incomplete process observation cannot establish a gate verdict"
+        });
     });
     acceptanceItemSchema = z.union([
       z.string().trim().min(1, {
@@ -1502,11 +1703,46 @@ var init_docs_taxonomy = __esm({
 });
 
 // packages/contracts/src/operations/docs.ts
-var DOCS_LIFECYCLE_STATUSES;
+import { z as z7 } from "zod";
+var DOCS_PROJECTION_PROPOSAL_SCHEMA, DOCS_PROJECTION_RECEIPT_SCHEMA, DOCS_LIFECYCLE_STATUSES;
 var init_docs = __esm({
   "packages/contracts/src/operations/docs.ts"() {
     "use strict";
     init_docs_taxonomy();
+    DOCS_PROJECTION_PROPOSAL_SCHEMA = z7.object({
+      version: z7.literal(1),
+      operation: z7.literal("docs.projection"),
+      identity: z7.object({
+        projectId: z7.string().min(1),
+        projectRoot: z7.string().min(1),
+        actor: z7.string().min(1),
+        operation: z7.literal("docs.projection"),
+        idempotencyKey: z7.string().min(1)
+      }).strict(),
+      source: z7.object({
+        attachmentId: z7.string().min(1),
+        sha256: z7.string().regex(/^[a-f0-9]{64}$/),
+        ownerId: z7.string().min(1),
+        ownerType: z7.enum(["task", "session", "observation", "decision", "learning", "pattern"]),
+        label: z7.string().min(1)
+      }).strict(),
+      observation: z7.object({
+        kind: z7.literal("doc-attachment"),
+        attachmentId: z7.string().min(1),
+        ownerId: z7.string().min(1),
+        addedAt: z7.string().min(1),
+        slug: z7.string().optional(),
+        type: z7.string().optional()
+      }).strict()
+    }).strict();
+    DOCS_PROJECTION_RECEIPT_SCHEMA = z7.object({
+      version: z7.literal(1),
+      sourceHash: z7.string().regex(/^[a-f0-9]{64}$/),
+      graph: z7.enum(["completed", "disabled"]),
+      observationId: z7.string().min(1),
+      verifiedAt: z7.string().min(1),
+      actor: z7.string().min(1)
+    }).strict();
     DOCS_LIFECYCLE_STATUSES = [
       "draft",
       "proposed",
@@ -2038,7 +2274,7 @@ var init_service = __esm({
 });
 
 // packages/contracts/src/operations/output-contracts-data.ts
-var tasksShowOutputContract, tasksListOutputContract, tasksFindOutputContract, TASK_MUTATION_DATA_SCHEMA, tasksAddOutputContract, tasksAddBatchOutputContract, tasksUpdateOutputContract, tasksCompleteOutputContract, tasksReorderRankOutputContract, tasksBulkMoveOutputContract, tasksAssigneeOutputContract, adminConfigGetOutputContract, adminConfigListOutputContract, adminConfigValidateOutputContract, adminConfigUnsetOutputContract, OUTPUT_CONTRACTS;
+var tasksShowOutputContract, taskPopulationSchema, tasksListOutputContract, tasksFindOutputContract, TASK_MUTATION_DATA_SCHEMA, tasksAddOutputContract, tasksAddBatchOutputContract, tasksUpdateOutputContract, tasksCompleteOutputContract, tasksReorderRankOutputContract, tasksBulkMoveOutputContract, tasksAssigneeOutputContract, adminConfigGetOutputContract, adminConfigListOutputContract, adminConfigValidateOutputContract, adminConfigUnsetOutputContract, OUTPUT_CONTRACTS;
 var init_output_contracts_data = __esm({
   "packages/contracts/src/operations/output-contracts-data.ts"() {
     "use strict";
@@ -2105,12 +2341,27 @@ var init_output_contracts_data = __esm({
         "/data/view/title"
       ]
     };
+    taskPopulationSchema = {
+      type: "object",
+      required: ["matched", "returned", "truncated", "archive", "limit", "offset"],
+      properties: {
+        matched: { type: "number", description: "All rows matching the query before pagination." },
+        returned: {
+          type: "number",
+          description: "Rows present in this response; also --output count."
+        },
+        truncated: { type: "boolean", description: "Matching rows are omitted by this page." },
+        archive: { type: "string", enum: ["included", "excluded", "only"] },
+        limit: { type: ["number", "null"] },
+        offset: { type: "number" }
+      }
+    };
     tasksListOutputContract = {
       operation: "tasks.list",
       shapeNote: "Rows are under /data/tasks (an array); counts are /data/total and /data/filtered.",
       dataSchema: {
         type: "object",
-        required: ["tasks", "total", "filtered"],
+        required: ["tasks", "total", "filtered", "population"],
         additionalProperties: true,
         properties: {
           tasks: {
@@ -2126,7 +2377,8 @@ var init_output_contracts_data = __esm({
             }
           },
           total: { type: "number", description: "Total tasks before filtering." },
-          filtered: { type: "number", description: "Number of tasks after filters applied." }
+          filtered: { type: "number", description: "Number of tasks after filters applied." },
+          population: taskPopulationSchema
         }
       },
       fieldPointers: [
@@ -2134,7 +2386,10 @@ var init_output_contracts_data = __esm({
         "/data/tasks/0/title",
         "/data/tasks/0/status",
         "/data/total",
-        "/data/filtered"
+        "/data/filtered",
+        "/data/population/matched",
+        "/data/population/returned",
+        "/data/population/archive"
       ]
     };
     tasksFindOutputContract = {
@@ -2142,7 +2397,7 @@ var init_output_contracts_data = __esm({
       shapeNote: "Results are wrapped: /data/results (array of matches), /data/total (count). Use /data/results/0/id \u2014 NOT /data/0/id.",
       dataSchema: {
         type: "object",
-        required: ["results", "total"],
+        required: ["results", "total", "population"],
         additionalProperties: true,
         properties: {
           results: {
@@ -2159,15 +2414,24 @@ var init_output_contracts_data = __esm({
             }
           },
           total: { type: "number", description: "Total matching tasks." },
+          population: taskPopulationSchema,
           query: { type: "string", description: "The query string that was searched." },
-          searchType: { type: "string", description: "Kind of search performed (fts, semantic, ...)." }
+          searchType: {
+            type: "string",
+            description: "Requested matching mode: lexical (default), fuzzy (explicit opt-in), exact, id, or filter."
+          }
         }
       },
       fieldPointers: [
         "/data/results/0/id",
         "/data/results/0/title",
         "/data/results/0/status",
-        "/data/total"
+        "/data/results/0/match",
+        "/data/searchType",
+        "/data/total",
+        "/data/population/matched",
+        "/data/population/returned",
+        "/data/population/archive"
       ]
     };
     TASK_MUTATION_DATA_SCHEMA = {
@@ -2454,6 +2718,7 @@ var init_tasks = __esm({
           enum: ["pending", "active", "blocked", "done", "cancelled"]
         },
         priority: { type: "string", enum: ["low", "medium", "high", "critical"] },
+        phase: { type: "string" },
         notes: { type: "string" },
         labels: { type: "array", items: { type: "string" } },
         addLabels: { type: "array", items: { type: "string" } },
@@ -2479,6 +2744,7 @@ var init_tasks = __esm({
         dependsWaiver: { type: "string" },
         blockedBy: { type: "string" },
         clearBlockedBy: { type: "boolean" },
+        noAutoComplete: { type: "boolean" },
         relates: {
           type: "array",
           items: {
@@ -2530,14 +2796,142 @@ var init_tasks = __esm({
 });
 
 // packages/contracts/src/dispatch/operations-registry.ts
-var OPERATIONS;
+var requirementTaskParam, OPERATIONS;
 var init_operations_registry = __esm({
   "packages/contracts/src/dispatch/operations-registry.ts"() {
     "use strict";
     init_docs();
     init_output_contracts_data();
     init_tasks();
+    requirementTaskParam = {
+      name: "taskId",
+      type: "string",
+      required: true,
+      description: "Task that owns the requirement gates",
+      cli: { positional: true }
+    };
     OPERATIONS = [
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "req.add",
+        description: "Add a validated typed requirement gate without executing it",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: true,
+        requiredParams: ["taskId", "gate"],
+        params: [
+          requirementTaskParam,
+          {
+            name: "gate",
+            type: "string",
+            required: true,
+            description: "AcceptanceGate JSON; must include kind, description and kind-specific fields",
+            cli: { flag: "gate" }
+          }
+        ],
+        inputSchema: {
+          operation: "tasks.req.add",
+          schema: {
+            type: "object",
+            required: ["taskId", "gate"],
+            additionalProperties: false,
+            properties: {
+              taskId: { type: "string", minLength: 1 },
+              gate: { type: "string", minLength: 1 }
+            }
+          },
+          examples: [
+            {
+              name: "test",
+              value: {
+                taskId: "T121",
+                gate: '{"kind":"test","command":"node","args":["verify.mjs"],"expect":"exit0","description":"Task harness passes","req":"PARTNER-121"}'
+              }
+            }
+          ]
+        }
+      },
+      {
+        gateway: "query",
+        domain: "tasks",
+        operation: "req.list",
+        description: "List named typed requirement gates without executing them",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [requirementTaskParam],
+        inputSchema: {
+          operation: "tasks.req.list",
+          schema: {
+            type: "object",
+            required: ["taskId"],
+            additionalProperties: false,
+            properties: { taskId: { type: "string", minLength: 1 } }
+          },
+          examples: [{ name: "task", value: { taskId: "T121" } }]
+        }
+      },
+      {
+        gateway: "query",
+        domain: "tasks",
+        operation: "req.migrate.preview",
+        description: "Preview typed-gate migration proposals without writing",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          requirementTaskParam,
+          {
+            name: "apply",
+            type: "boolean",
+            required: false,
+            description: "Must be absent or false for preview"
+          }
+        ],
+        inputSchema: {
+          operation: "tasks.req.migrate.preview",
+          schema: {
+            type: "object",
+            required: ["taskId"],
+            additionalProperties: false,
+            properties: { taskId: { type: "string", minLength: 1 }, apply: { const: false } }
+          },
+          examples: [{ name: "preview", value: { taskId: "T121", apply: false } }]
+        }
+      },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "req.migrate",
+        description: "Explicitly apply validated typed-gate migration proposals",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: true,
+        requiredParams: ["taskId", "apply"],
+        params: [
+          requirementTaskParam,
+          {
+            name: "apply",
+            type: "boolean",
+            required: true,
+            description: "Must be true to apply proposals",
+            cli: { flag: "apply" }
+          }
+        ],
+        inputSchema: {
+          operation: "tasks.req.migrate",
+          schema: {
+            type: "object",
+            required: ["taskId", "apply"],
+            additionalProperties: false,
+            properties: { taskId: { type: "string", minLength: 1 }, apply: { const: true } }
+          },
+          examples: [{ name: "apply", value: { taskId: "T121", apply: true } }]
+        }
+      },
       {
         gateway: "query",
         domain: "tasks",
@@ -2772,6 +3166,13 @@ var init_operations_registry = __esm({
         sessionRequired: false,
         requiredParams: [],
         params: [
+          {
+            name: "includeArchive",
+            type: "boolean",
+            required: false,
+            description: "Include archived rows under the same filters",
+            cli: { flag: "include-archive" }
+          },
           { name: "parent", type: "string", required: false, description: "Filter by parent task ID" },
           { name: "status", type: "string", required: false, description: "Filter by task status" },
           { name: "priority", type: "string", required: false, description: "Filter by task priority" },
@@ -2800,7 +3201,7 @@ var init_operations_registry = __esm({
             name: "limit",
             type: "number",
             required: false,
-            description: "Maximum number of tasks to return (default 10). Use --all to return every match. (--limit 0 also returns every match, but only on this command \u2014 prefer --all.)"
+            description: "Maximum number of tasks to return (default 10). --all or --limit 0 returns every match."
           },
           {
             name: "offset",
@@ -4129,6 +4530,35 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // T12308: the typed-gate runner `cleo verify <id> --run`. A query — it
+      // executes the gates and reports them, and records nothing. Documented as
+      // the canonical driver since T768 and emitted into every validation-stage
+      // spawn prompt, but the flag had been dropped from the command.
+      {
+        gateway: "query",
+        domain: "check",
+        operation: "gate.run",
+        description: "check.gate.run (query) \u2014 execute a task's typed acceptance gates and report results; persists nothing (T12308)",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "Task whose typed gates should run",
+            cli: { positional: true }
+          },
+          {
+            name: "agent",
+            type: "string",
+            required: false,
+            description: "Actor attribution recorded on each gate result"
+          }
+        ]
+      },
       // check.archive.stats incoming from admin (T5615)
       {
         gateway: "query",
@@ -4932,7 +5362,7 @@ var init_operations_registry = __esm({
             type: "string",
             required: false,
             description: "Task type",
-            enum: ["epic", "task", "subtask"],
+            enum: ["saga", "epic", "task", "subtask"],
             cli: { flag: "type", short: "-t" }
           },
           {
@@ -4984,6 +5414,72 @@ var init_operations_registry = __esm({
             required: false,
             description: "Initial note entry for the task",
             cli: { flag: "notes" }
+          },
+          {
+            name: "dependsWaiver",
+            type: "string",
+            required: false,
+            description: "Nonempty reason waiving dependencies for explicit critical priority",
+            cli: { flag: "depends-waiver" }
+          },
+          {
+            name: "files",
+            type: "array",
+            required: false,
+            description: "Associated repository file paths",
+            cli: { flag: "files" }
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Preview creation without task or committed audit writes",
+            cli: { flag: "dry-run" }
+          },
+          {
+            name: "parentSearch",
+            type: "string",
+            required: false,
+            description: "Search term for resolving the parent task",
+            cli: { flag: "parent-search" }
+          },
+          {
+            name: "kind",
+            type: "string",
+            required: false,
+            description: "Task intent, independent of hierarchy",
+            enum: ["work", "research", "experiment", "bug", "spike", "release"],
+            cli: { flag: "kind" }
+          },
+          {
+            name: "scope",
+            type: "string",
+            required: false,
+            description: "Task granularity",
+            enum: ["project", "feature", "unit"],
+            cli: { flag: "scope" }
+          },
+          {
+            name: "severity",
+            type: "string",
+            required: false,
+            description: "Project-authorized severity with transactional signed evidence",
+            enum: ["P0", "P1", "P2", "P3"],
+            cli: { flag: "severity" }
+          },
+          {
+            name: "forceDuplicate",
+            type: "boolean",
+            required: false,
+            description: "Bypass duplicate rejection with committed decision provenance",
+            cli: { flag: "force-duplicate" }
+          },
+          {
+            name: "autoDecompose",
+            type: "boolean",
+            required: false,
+            description: "Move the parent's text acceptance criteria onto a new first subtask when they would otherwise block this add (PM-Core V2 design-point 3) (T12298)",
+            cli: { flag: "auto-decompose" }
           }
         ]
       },
@@ -5218,6 +5714,20 @@ var init_operations_registry = __esm({
             type: "array",
             required: false,
             description: "Remove related-task edges by taskId"
+          },
+          {
+            name: "phase",
+            type: "string",
+            required: false,
+            description: "Project-defined phase, independent of pipeline stage",
+            cli: { flag: "phase" }
+          },
+          {
+            name: "noAutoComplete",
+            type: "boolean",
+            required: false,
+            description: "Disable automatic parent completion",
+            cli: { flag: "no-auto-complete" }
           }
         ],
         inputSchema: tasksUpdateInputContract,
@@ -5288,44 +5798,59 @@ var init_operations_registry = __esm({
             required: true,
             description: "taskId parameter",
             cli: { positional: true }
+          },
+          {
+            name: "force",
+            type: "boolean",
+            required: false,
+            description: "Allow dependents and orphan children unless cascade is enabled"
+          },
+          {
+            name: "cascade",
+            type: "boolean",
+            required: false,
+            description: "Archive all descendants with the selected task"
           }
         ]
       },
       {
         gateway: "mutate",
         domain: "tasks",
-        operation: "archive",
-        description: "tasks.archive (mutate)",
-        tier: 1,
-        idempotent: false,
-        sessionRequired: false,
-        requiredParams: [],
-        params: []
-      },
-      {
-        gateway: "mutate",
-        domain: "tasks",
-        operation: "restore",
-        description: "tasks.restore (mutate) \u2014 absorbs reopen and unarchive via from param",
+        operation: "reconcile-scope",
+        description: "tasks.reconcile-scope (mutate) \u2014 sweep a saga/epic subtree for tasks whose scope overlaps and propose merge/absorb/split/link; read-only unless --apply",
         tier: 1,
-        idempotent: false,
+        idempotent: true,
         sessionRequired: false,
-        requiredParams: ["taskId"],
+        requiredParams: ["rootId"],
         params: [
           {
-            name: "taskId",
+            name: "rootId",
             type: "string",
             required: true,
-            description: "taskId parameter",
+            description: "Saga, epic or other container to sweep (its whole subtree is considered)",
             cli: { positional: true }
+          },
+          {
+            name: "apply",
+            type: "boolean",
+            required: false,
+            description: "Write the proposed `relates` edges (read-only without it)",
+            cli: { flag: "apply" }
+          },
+          {
+            name: "threshold",
+            type: "number",
+            required: false,
+            description: "Report pairs at or above this similarity score, 0-1 (default 0.55)",
+            cli: { flag: "threshold" }
           }
         ]
       },
       {
         gateway: "mutate",
         domain: "tasks",
-        operation: "reparent",
-        description: "tasks.reparent (mutate) \u2014 absorbs promote via newParentId:null",
+        operation: "decompose",
+        description: "tasks.decompose (mutate) \u2014 move a task\u2019s free-text acceptance criteria onto a new first child, turning the leaf into a container (PM-Core V2 design-point 3)",
         tier: 1,
         idempotent: false,
         sessionRequired: false,
@@ -5335,16 +5860,83 @@ var init_operations_registry = __esm({
             name: "taskId",
             type: "string",
             required: true,
-            description: "taskId parameter",
+            description: "Task whose text acceptance criteria move to a new child",
             cli: { positional: true }
+          },
+          {
+            name: "childTitle",
+            type: "string",
+            required: false,
+            description: "Title for the child that inherits the criteria (default: the parent\u2019s)"
+          },
+          {
+            name: "childDescription",
+            type: "string",
+            required: false,
+            description: "Description for the child (default: the parent\u2019s)"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Preview the move without writing"
           }
         ]
       },
       {
         gateway: "mutate",
         domain: "tasks",
-        operation: "reorder",
-        description: "tasks.reorder (mutate)",
+        operation: "archive",
+        description: "tasks.archive (mutate)",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "restore",
+        description: "tasks.restore (mutate) \u2014 absorbs reopen and unarchive via from param",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "taskId parameter",
+            cli: { positional: true }
+          }
+        ]
+      },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "reparent",
+        description: "tasks.reparent (mutate) \u2014 absorbs promote via newParentId:null",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "taskId parameter",
+            cli: { positional: true }
+          }
+        ]
+      },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "reorder",
+        description: "tasks.reorder (mutate)",
         tier: 1,
         idempotent: false,
         sessionRequired: false,
@@ -6790,7 +7382,27 @@ var init_operations_registry = __esm({
         idempotent: false,
         sessionRequired: false,
         requiredParams: [],
-        params: []
+        params: [
+          {
+            name: "source",
+            type: "string",
+            required: false,
+            description: "Source of the reviewed backfill request."
+          },
+          { name: "kind", type: "string", required: false, description: "Backfill classification." },
+          {
+            name: "targetTable",
+            type: "string",
+            required: false,
+            description: "Derived brain_page_nodes target only."
+          },
+          {
+            name: "nodeIds",
+            type: "array",
+            required: false,
+            description: "Exact qualified graph node IDs to stage; all must resolve to missing, eligible typed sources."
+          }
+        ]
       },
       {
         gateway: "mutate",
@@ -9552,279 +10164,642 @@ var init_operations_registry = __esm({
             name: "limit",
             type: "number",
             required: false,
-            description: "Maximum number of patterns to return"
+            description: "Maximum number of patterns to return"
+          }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "intelligence",
+        operation: "confidence",
+        description: "Score verification confidence for a task based on current gate state",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          { name: "taskId", type: "string", required: true, description: "Task ID to score" }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "intelligence",
+        operation: "match",
+        description: "Match known brain patterns against a task",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "Task ID to match patterns against"
+          }
+        ]
+      },
+      // ===========================================================================
+      // DIAGNOSTICS domain (T624) — opt-in telemetry for self-improvement
+      // ===========================================================================
+      {
+        gateway: "query",
+        domain: "diagnostics",
+        operation: "status",
+        description: "diagnostics.status (query) \u2014 show telemetry opt-in state and DB path",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
+      {
+        gateway: "query",
+        domain: "diagnostics",
+        operation: "analyze",
+        description: "diagnostics.analyze (query) \u2014 aggregate telemetry patterns; surface failing/slow commands and generate BRAIN observations",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "days",
+            type: "number",
+            required: false,
+            description: "Analysis window in days (default: 30)",
+            cli: { flag: "days", short: "-d" }
+          },
+          {
+            name: "noBrain",
+            type: "boolean",
+            required: false,
+            description: "Skip pushing observations to BRAIN",
+            cli: { flag: "no-brain" }
+          }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "diagnostics",
+        operation: "export",
+        description: "diagnostics.export (query) \u2014 JSON dump of all telemetry events",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "days",
+            type: "number",
+            required: false,
+            description: "Limit export to last N days (default: all)",
+            cli: { flag: "days", short: "-d" }
+          }
+        ]
+      },
+      {
+        gateway: "mutate",
+        domain: "diagnostics",
+        operation: "enable",
+        description: "diagnostics.enable (mutate) \u2014 opt in to anonymous command telemetry; generates stable anonymousId",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
+      {
+        gateway: "mutate",
+        domain: "diagnostics",
+        operation: "disable",
+        description: "diagnostics.disable (mutate) \u2014 opt out of telemetry collection",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
+      // ── docs (T797) ────────────────────────────────────────────────────────────
+      {
+        gateway: "mutate",
+        domain: "docs",
+        operation: "add",
+        description: "docs.add (mutate) \u2014 attach a local file, URL, or inline content to a CLEO owner entity (task, session, observation)",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["ownerId"],
+        params: [
+          {
+            name: "ownerId",
+            type: "string",
+            required: true,
+            description: "Owner entity ID (e.g. T123, ses_*, O-abc)"
+          },
+          {
+            name: "file",
+            type: "string",
+            required: false,
+            description: "Path to local file to attach"
+          },
+          {
+            name: "url",
+            type: "string",
+            required: false,
+            description: "Remote URL to attach"
+          },
+          {
+            name: "content",
+            type: "string",
+            required: false,
+            description: "Inline document body (T10965); mutually exclusive with file/url"
+          },
+          {
+            name: "desc",
+            type: "string",
+            required: false,
+            description: "Free-text description"
+          },
+          {
+            name: "labels",
+            type: "string",
+            required: false,
+            description: "Comma-separated labels"
+          },
+          {
+            name: "attachedBy",
+            type: "string",
+            required: false,
+            description: 'Agent identity (defaults to "human")'
+          }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "docs",
+        operation: "list",
+        description: "docs.list (query) \u2014 list attachments associated with a CLEO owner entity",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "task",
+            type: "string",
+            required: false,
+            description: "Filter by task ID (e.g. T123)"
+          },
+          {
+            name: "session",
+            type: "string",
+            required: false,
+            description: "Filter by session ID (e.g. ses_*)"
+          },
+          {
+            name: "observation",
+            type: "string",
+            required: false,
+            description: "Filter by observation ID (e.g. O-abc)"
+          }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "docs",
+        operation: "fetch",
+        description: "docs.fetch (query) \u2014 retrieve attachment bytes and metadata by attachment ID or SHA-256",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["attachmentRef"],
+        params: [
+          {
+            name: "attachmentRef",
+            type: "string",
+            required: true,
+            description: "Attachment ID (att_*) or SHA-256 hex"
+          }
+        ]
+      },
+      {
+        gateway: "mutate",
+        domain: "docs",
+        operation: "remove",
+        description: "docs.remove (mutate) \u2014 remove an attachment ref from an owner; purges blob when refCount reaches zero",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["attachmentRef", "from"],
+        params: [
+          {
+            name: "attachmentRef",
+            type: "string",
+            required: true,
+            description: "Attachment ID (att_*) or SHA-256 hex"
+          },
+          {
+            name: "from",
+            type: "string",
+            required: true,
+            description: "Owner entity ID to remove the ref from"
+          }
+        ]
+      },
+      // ── docs.supersede (T10162) ──────────────────────────────────────────────
+      {
+        gateway: "mutate",
+        domain: "docs",
+        operation: "supersede",
+        description: "docs.supersede (mutate) \u2014 atomically flip an older doc to `superseded` and link both rows via the supersedes/superseded_by self-FK pointers (T10162 \xB7 Saga T9855)",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["oldSlug", "newSlug"],
+        params: [
+          {
+            name: "oldSlug",
+            type: "string",
+            required: true,
+            description: "Slug of the doc being replaced",
+            cli: { positional: true }
+          },
+          {
+            name: "newSlug",
+            type: "string",
+            required: true,
+            description: "Slug of the doc that replaces oldSlug",
+            cli: { positional: true }
+          },
+          {
+            name: "reason",
+            type: "string",
+            required: false,
+            description: "Optional human-readable reason carried back on the response"
+          }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "docs",
+        operation: "status",
+        description: "docs.status (query) \u2014 inspect published documentation drift",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
+      {
+        gateway: "query",
+        domain: "docs",
+        operation: "export",
+        description: "docs.export (query) \u2014 Export a task document",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "Task whose document to export"
+          },
+          {
+            name: "includeAttachments",
+            type: "boolean",
+            required: false,
+            description: "Include attachment manifest"
+          },
+          {
+            name: "includeMemoryRefs",
+            type: "boolean",
+            required: false,
+            description: "Include memory references"
+          }
+        ]
+      },
+      {
+        gateway: "query",
+        domain: "docs",
+        operation: "search",
+        description: "docs.search (query) \u2014 Search document content",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["query"],
+        params: [
+          {
+            name: "query",
+            type: "string",
+            required: true,
+            description: "Document search text"
+          },
+          {
+            name: "ownerId",
+            type: "string",
+            required: false,
+            description: "Optional owner scope"
+          },
+          { name: "limit", type: "number", required: false, description: "Maximum matches" },
+          {
+            name: "type",
+            type: "string",
+            required: false,
+            description: "Document kind filter"
           }
         ]
       },
       {
         gateway: "query",
-        domain: "intelligence",
-        operation: "confidence",
-        description: "Score verification confidence for a task based on current gate state",
+        domain: "docs",
+        operation: "find",
+        description: "docs.find (query) \u2014 Find similar documents",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
-        requiredParams: ["taskId"],
+        requiredParams: ["similarSlug"],
         params: [
-          { name: "taskId", type: "string", required: true, description: "Task ID to score" }
+          {
+            name: "similarSlug",
+            type: "string",
+            required: true,
+            description: "Existing document slug to compare"
+          },
+          { name: "limit", type: "number", required: false, description: "Maximum matches" },
+          {
+            name: "threshold",
+            type: "number",
+            required: false,
+            description: "Minimum similarity"
+          },
+          {
+            name: "allKinds",
+            type: "boolean",
+            required: false,
+            description: "Compare all document kinds"
+          }
         ]
       },
       {
         gateway: "query",
-        domain: "intelligence",
-        operation: "match",
-        description: "Match known brain patterns against a task",
+        domain: "docs",
+        operation: "merge",
+        description: "docs.merge (query) \u2014 Preview a document merge",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
-        requiredParams: ["taskId"],
+        requiredParams: ["attA", "attB"],
         params: [
           {
-            name: "taskId",
+            name: "attA",
             type: "string",
             required: true,
-            description: "Task ID to match patterns against"
+            description: "First attachment reference"
+          },
+          {
+            name: "attB",
+            type: "string",
+            required: true,
+            description: "Second attachment reference"
+          },
+          {
+            name: "strategy",
+            type: "string",
+            required: false,
+            description: "three-way, cherry-pick, or multi-diff"
+          },
+          {
+            name: "base",
+            type: "string",
+            required: false,
+            description: "Common ancestor attachment reference"
           }
         ]
       },
-      // ===========================================================================
-      // DIAGNOSTICS domain (T624) — opt-in telemetry for self-improvement
-      // ===========================================================================
-      {
-        gateway: "query",
-        domain: "diagnostics",
-        operation: "status",
-        description: "diagnostics.status (query) \u2014 show telemetry opt-in state and DB path",
-        tier: 2,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: [],
-        params: []
-      },
       {
         gateway: "query",
-        domain: "diagnostics",
-        operation: "analyze",
-        description: "diagnostics.analyze (query) \u2014 aggregate telemetry patterns; surface failing/slow commands and generate BRAIN observations",
-        tier: 2,
+        domain: "docs",
+        operation: "rank",
+        description: "docs.rank (query) \u2014 Rank owner documents",
+        tier: 1,
         idempotent: true,
         sessionRequired: false,
-        requiredParams: [],
+        requiredParams: ["ownerId"],
         params: [
           {
-            name: "days",
-            type: "number",
-            required: false,
-            description: "Analysis window in days (default: 30)",
-            cli: { flag: "days", short: "-d" }
+            name: "ownerId",
+            type: "string",
+            required: true,
+            description: "Owner whose documents to rank"
           },
           {
-            name: "noBrain",
-            type: "boolean",
+            name: "query",
+            type: "string",
             required: false,
-            description: "Skip pushing observations to BRAIN",
-            cli: { flag: "no-brain" }
+            description: "Optional ranking query"
           }
         ]
       },
       {
         gateway: "query",
-        domain: "diagnostics",
-        operation: "export",
-        description: "diagnostics.export (query) \u2014 JSON dump of all telemetry events",
-        tier: 2,
+        domain: "docs",
+        operation: "versions",
+        description: "docs.versions (query) \u2014 List document versions",
+        tier: 1,
         idempotent: true,
         sessionRequired: false,
-        requiredParams: [],
+        requiredParams: ["ownerId"],
         params: [
+          { name: "ownerId", type: "string", required: true, description: "Document owner" },
           {
-            name: "days",
-            type: "number",
+            name: "name",
+            type: "string",
             required: false,
-            description: "Limit export to last N days (default: all)",
-            cli: { flag: "days", short: "-d" }
+            description: "Optional document name"
           }
         ]
       },
-      {
-        gateway: "mutate",
-        domain: "diagnostics",
-        operation: "enable",
-        description: "diagnostics.enable (mutate) \u2014 opt in to anonymous command telemetry; generates stable anonymousId",
-        tier: 2,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: [],
-        params: []
-      },
-      {
-        gateway: "mutate",
-        domain: "diagnostics",
-        operation: "disable",
-        description: "diagnostics.disable (mutate) \u2014 opt out of telemetry collection",
-        tier: 2,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: [],
-        params: []
-      },
-      // ── docs (T797) ────────────────────────────────────────────────────────────
       {
         gateway: "mutate",
         domain: "docs",
-        operation: "add",
-        description: "docs.add (mutate) \u2014 attach a local file, URL, or inline content to a CLEO owner entity (task, session, observation)",
+        operation: "publish",
+        description: "docs.publish (mutate) \u2014 Publish a document to a file or pull request",
         tier: 1,
         idempotent: false,
         sessionRequired: false,
-        requiredParams: ["ownerId"],
+        requiredParams: [],
         params: [
           {
-            name: "ownerId",
+            name: "target",
             type: "string",
-            required: true,
-            description: "Owner entity ID (e.g. T123, ses_*, O-abc)"
+            required: false,
+            description: "Publication target: file or pr"
           },
           {
-            name: "file",
+            name: "ownerId",
             type: "string",
             required: false,
-            description: "Path to local file to attach"
+            description: "Required for file publication"
           },
           {
-            name: "url",
+            name: "toPath",
             type: "string",
             required: false,
-            description: "Remote URL to attach"
+            description: "Required destination for file publication"
           },
           {
-            name: "content",
+            name: "attachmentId",
             type: "string",
             required: false,
-            description: "Inline document body (T10965); mutually exclusive with file/url"
+            description: "Attachment to publish"
           },
           {
-            name: "desc",
+            name: "slugOrId",
             type: "string",
             required: false,
-            description: "Free-text description"
+            description: "Required document reference for PR publication"
           },
           {
-            name: "labels",
+            name: "slug",
             type: "string",
             required: false,
-            description: "Comma-separated labels"
+            description: "Override document slug"
           },
           {
-            name: "attachedBy",
+            name: "type",
             type: "string",
             required: false,
-            description: 'Agent identity (defaults to "human")'
-          }
+            description: "Override document kind"
+          },
+          { name: "title", type: "string", required: false, description: "Override PR title" },
+          { name: "body", type: "string", required: false, description: "Override PR body" },
+          { name: "base", type: "string", required: false, description: "PR base branch" }
         ]
       },
       {
-        gateway: "query",
+        gateway: "mutate",
         domain: "docs",
-        operation: "list",
-        description: "docs.list (query) \u2014 list attachments associated with a CLEO owner entity",
+        operation: "publish-pr",
+        description: "docs.publish-pr (mutate) \u2014 Legacy alias for PR publication",
         tier: 1,
-        idempotent: true,
+        idempotent: false,
         sessionRequired: false,
-        requiredParams: [],
+        requiredParams: ["slugOrId"],
         params: [
           {
-            name: "task",
+            name: "slugOrId",
             type: "string",
-            required: false,
-            description: "Filter by task ID (e.g. T123)"
+            required: true,
+            description: "Document reference to publish"
           },
           {
-            name: "session",
+            name: "slug",
             type: "string",
             required: false,
-            description: "Filter by session ID (e.g. ses_*)"
+            description: "Override document slug"
           },
           {
-            name: "observation",
+            name: "type",
             type: "string",
             required: false,
-            description: "Filter by observation ID (e.g. O-abc)"
-          }
+            description: "Override document kind"
+          },
+          { name: "title", type: "string", required: false, description: "Override PR title" },
+          { name: "body", type: "string", required: false, description: "Override PR body" },
+          { name: "base", type: "string", required: false, description: "PR base branch" }
         ]
       },
       {
-        gateway: "query",
+        gateway: "mutate",
         domain: "docs",
-        operation: "fetch",
-        description: "docs.fetch (query) \u2014 retrieve attachment bytes and metadata by attachment ID or SHA-256",
+        operation: "sync",
+        description: "docs.sync (mutate) \u2014 Sync document content from a file",
         tier: 1,
-        idempotent: true,
+        idempotent: false,
         sessionRequired: false,
-        requiredParams: ["attachmentRef"],
+        requiredParams: ["ownerId", "fromPath"],
         params: [
+          { name: "ownerId", type: "string", required: true, description: "Document owner" },
           {
-            name: "attachmentRef",
+            name: "fromPath",
             type: "string",
             required: true,
-            description: "Attachment ID (att_*) or SHA-256 hex"
+            description: "Source file path"
+          },
+          {
+            name: "blobName",
+            type: "string",
+            required: false,
+            description: "Document blob name"
+          },
+          {
+            name: "contentType",
+            type: "string",
+            required: false,
+            description: "Document media type"
           }
         ]
       },
       {
         gateway: "mutate",
         domain: "docs",
-        operation: "remove",
-        description: "docs.remove (mutate) \u2014 remove an attachment ref from an owner; purges blob when refCount reaches zero",
+        operation: "import",
+        description: "docs.import (mutate) \u2014 Import classified project documents",
         tier: 1,
-        idempotent: true,
+        idempotent: false,
         sessionRequired: false,
-        requiredParams: ["attachmentRef", "from"],
+        requiredParams: ["scanRoot"],
         params: [
           {
-            name: "attachmentRef",
+            name: "scanRoot",
             type: "string",
             required: true,
-            description: "Attachment ID (att_*) or SHA-256 hex"
+            description: "Root directory to scan"
           },
           {
-            name: "from",
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Preview without writing"
+          },
+          {
+            name: "force",
+            type: "boolean",
+            required: false,
+            description: "Replace conflicting import mappings"
+          },
+          {
+            name: "manifestPath",
             type: "string",
-            required: true,
-            description: "Owner entity ID to remove the ref from"
+            required: false,
+            description: "Import manifest path"
           }
         ]
       },
-      // ── docs.supersede (T10162) ──────────────────────────────────────────────
       {
-        gateway: "mutate",
+        gateway: "query",
         domain: "docs",
-        operation: "supersede",
-        description: "docs.supersede (mutate) \u2014 atomically flip an older doc to `superseded` and link both rows via the supersedes/superseded_by self-FK pointers (T10162 \xB7 Saga T9855)",
+        operation: "audit",
+        description: "docs.audit (query) \u2014 inspect document history or verify audit chain integrity",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
-        requiredParams: ["oldSlug", "newSlug"],
+        requiredParams: [],
         params: [
           {
-            name: "oldSlug",
-            type: "string",
-            required: true,
-            description: "Slug of the doc being replaced",
-            cli: { positional: true }
-          },
-          {
-            name: "newSlug",
+            name: "slug",
             type: "string",
-            required: true,
-            description: "Slug of the doc that replaces oldSlug",
-            cli: { positional: true }
+            required: false,
+            description: "Document slug whose history to inspect"
           },
           {
-            name: "reason",
-            type: "string",
+            name: "verify",
+            type: "boolean",
             required: false,
-            description: "Optional human-readable reason carried back on the response"
+            description: "Verify the full audit chain"
           }
         ]
       },
@@ -12067,7 +13042,7 @@ var init_operations_registry = __esm({
 });
 
 // packages/contracts/src/docs/provenance.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var PROVENANCE_NODE_KINDS, PROVENANCE_EDGE_RELATIONS, DOC_LIFECYCLE_STATUSES, provenanceNodeKindSchema, provenanceEdgeRelationSchema, docLifecycleStatusSchema, provenanceNodeBaseFields, provenanceDocNodeSchema, provenanceTaskNodeSchema, provenanceDecisionNodeSchema, provenanceSessionNodeSchema, provenanceMemoryNodeSchema, provenanceNodeSchema, provenanceEdgeSchema, docProvenanceResponseSchema;
 var init_provenance = __esm({
   "packages/contracts/src/docs/provenance.ts"() {
@@ -12094,102 +13069,102 @@ var init_provenance = __esm({
       "archived",
       "draft"
     ];
-    provenanceNodeKindSchema = z7.enum(PROVENANCE_NODE_KINDS);
-    provenanceEdgeRelationSchema = z7.enum(PROVENANCE_EDGE_RELATIONS);
-    docLifecycleStatusSchema = z7.enum(DOC_LIFECYCLE_STATUSES);
+    provenanceNodeKindSchema = z8.enum(PROVENANCE_NODE_KINDS);
+    provenanceEdgeRelationSchema = z8.enum(PROVENANCE_EDGE_RELATIONS);
+    docLifecycleStatusSchema = z8.enum(DOC_LIFECYCLE_STATUSES);
     provenanceNodeBaseFields = {
-      id: z7.string().min(1),
-      title: z7.string().min(1),
-      metadata: z7.record(z7.string(), z7.unknown()).optional()
+      id: z8.string().min(1),
+      title: z8.string().min(1),
+      metadata: z8.record(z8.string(), z8.unknown()).optional()
     };
-    provenanceDocNodeSchema = z7.object({
+    provenanceDocNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("doc"),
-      slug: z7.string().min(1),
-      docKind: z7.string().min(1),
+      kind: z8.literal("doc"),
+      slug: z8.string().min(1),
+      docKind: z8.string().min(1),
       lifecycleStatus: docLifecycleStatusSchema,
-      publishedAt: z7.string().min(1),
-      supersededAt: z7.string().min(1).optional(),
-      summary: z7.string().optional()
+      publishedAt: z8.string().min(1),
+      supersededAt: z8.string().min(1).optional(),
+      summary: z8.string().optional()
     });
-    provenanceTaskNodeSchema = z7.object({
+    provenanceTaskNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("task"),
-      taskType: z7.enum(["saga", "epic", "task", "subtask"]),
-      status: z7.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
+      kind: z8.literal("task"),
+      taskType: z8.enum(["saga", "epic", "task", "subtask"]),
+      status: z8.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
     });
-    provenanceDecisionNodeSchema = z7.object({
+    provenanceDecisionNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("decision"),
-      outcome: z7.enum(["proposed", "accepted", "rejected", "superseded"]),
-      decidedAt: z7.string().min(1)
+      kind: z8.literal("decision"),
+      outcome: z8.enum(["proposed", "accepted", "rejected", "superseded"]),
+      decidedAt: z8.string().min(1)
     });
-    provenanceSessionNodeSchema = z7.object({
+    provenanceSessionNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("session"),
-      startedAt: z7.string().min(1),
-      endedAt: z7.string().min(1).optional()
+      kind: z8.literal("session"),
+      startedAt: z8.string().min(1),
+      endedAt: z8.string().min(1).optional()
     });
-    provenanceMemoryNodeSchema = z7.object({
+    provenanceMemoryNodeSchema = z8.object({
       ...provenanceNodeBaseFields,
-      kind: z7.literal("memory"),
-      memoryType: z7.enum(["observation", "pattern", "decision", "diary"]),
-      recordedAt: z7.string().min(1)
+      kind: z8.literal("memory"),
+      memoryType: z8.enum(["observation", "pattern", "decision", "diary"]),
+      recordedAt: z8.string().min(1)
     });
-    provenanceNodeSchema = z7.discriminatedUnion("kind", [
+    provenanceNodeSchema = z8.discriminatedUnion("kind", [
       provenanceDocNodeSchema,
       provenanceTaskNodeSchema,
       provenanceDecisionNodeSchema,
       provenanceSessionNodeSchema,
       provenanceMemoryNodeSchema
     ]);
-    provenanceEdgeSchema = z7.object({
+    provenanceEdgeSchema = z8.object({
       relation: provenanceEdgeRelationSchema,
-      from: z7.string().min(1),
+      from: z8.string().min(1),
       fromKind: provenanceNodeKindSchema,
-      to: z7.string().min(1),
+      to: z8.string().min(1),
       toKind: provenanceNodeKindSchema,
-      addedAt: z7.string().min(1),
-      summary: z7.string().optional()
+      addedAt: z8.string().min(1),
+      summary: z8.string().optional()
     });
-    docProvenanceResponseSchema = z7.object({
-      nodes: z7.array(provenanceNodeSchema).readonly(),
-      edges: z7.array(provenanceEdgeSchema).readonly(),
-      totalNodes: z7.number().int().nonnegative(),
-      totalEdges: z7.number().int().nonnegative()
+    docProvenanceResponseSchema = z8.object({
+      nodes: z8.array(provenanceNodeSchema).readonly(),
+      edges: z8.array(provenanceEdgeSchema).readonly(),
+      totalNodes: z8.number().int().nonnegative(),
+      totalEdges: z8.number().int().nonnegative()
     });
   }
 });
 
 // packages/contracts/src/docs/read.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var docFrontmatterSchema, docBodySchema, docReadResponseSchema;
 var init_read = __esm({
   "packages/contracts/src/docs/read.ts"() {
     "use strict";
-    docFrontmatterSchema = z8.object({
-      slug: z8.string(),
-      kind: z8.string().nullable(),
-      title: z8.string().nullable(),
-      summary: z8.string().nullable(),
-      lifecycleStatus: z8.string(),
-      docVersion: z8.number().int(),
-      ownerVersion: z8.string().nullable(),
-      supersedes: z8.string().nullable(),
-      supersededBy: z8.string().nullable(),
-      topics: z8.array(z8.string()).readonly(),
-      relatedTasks: z8.array(z8.string()).readonly(),
-      sha256: z8.string(),
-      createdAt: z8.string()
-    });
-    docBodySchema = z8.object({
-      encoding: z8.enum(["utf-8", "base64"]),
-      text: z8.string().optional(),
-      base64: z8.string().optional(),
-      sizeBytes: z8.number().int().nonnegative(),
-      mimeType: z8.string().nullable()
-    });
-    docReadResponseSchema = z8.object({
+    docFrontmatterSchema = z9.object({
+      slug: z9.string(),
+      kind: z9.string().nullable(),
+      title: z9.string().nullable(),
+      summary: z9.string().nullable(),
+      lifecycleStatus: z9.string(),
+      docVersion: z9.number().int(),
+      ownerVersion: z9.string().nullable(),
+      supersedes: z9.string().nullable(),
+      supersededBy: z9.string().nullable(),
+      topics: z9.array(z9.string()).readonly(),
+      relatedTasks: z9.array(z9.string()).readonly(),
+      sha256: z9.string(),
+      createdAt: z9.string()
+    });
+    docBodySchema = z9.object({
+      encoding: z9.enum(["utf-8", "base64"]),
+      text: z9.string().optional(),
+      base64: z9.string().optional(),
+      sizeBytes: z9.number().int().nonnegative(),
+      mimeType: z9.string().nullable()
+    });
+    docReadResponseSchema = z9.object({
       frontmatter: docFrontmatterSchema,
       body: docBodySchema
     });
@@ -12249,7 +13224,7 @@ var init_errors = __esm({
 });
 
 // packages/contracts/src/evidence-atom-schema.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var EVIDENCE_ATOM_KINDS, PARSER_PREFIXES, KIND_BOUNDARY_REGEX, commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, AC_UUID_REGEX, AC_ALIAS_REGEX, SATISFIES_TASK_ID_REGEX, SATISFIES_VERSION_PIN_REGEX, satisfiesAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
@@ -12269,67 +13244,67 @@ var init_evidence_atom_schema = __esm({
     ];
     PARSER_PREFIXES = [...EVIDENCE_ATOM_KINDS, "state"];
     KIND_BOUNDARY_REGEX = new RegExp(`;(?=\\s*(?:${PARSER_PREFIXES.join("|")})\\s*:)`, "g");
-    commitAtomSchema = z9.object({
-      kind: z9.literal("commit"),
-      sha: z9.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
+    commitAtomSchema = z10.object({
+      kind: z10.literal("commit"),
+      sha: z10.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
     });
-    filesAtomSchema = z9.object({
-      kind: z9.literal("files"),
-      paths: z9.array(z9.string().min(1)).min(1, "files atom requires at least one path")
+    filesAtomSchema = z10.object({
+      kind: z10.literal("files"),
+      paths: z10.array(z10.string().min(1)).min(1, "files atom requires at least one path")
     });
-    testRunAtomSchema = z9.object({
-      kind: z9.literal("test-run"),
-      path: z9.string().min(1, "test-run atom requires a non-empty path")
+    testRunAtomSchema = z10.object({
+      kind: z10.literal("test-run"),
+      path: z10.string().min(1, "test-run atom requires a non-empty path")
     });
-    toolAtomSchema = z9.object({
-      kind: z9.literal("tool"),
-      tool: z9.string().min(1, "tool atom requires a non-empty tool name")
+    toolAtomSchema = z10.object({
+      kind: z10.literal("tool"),
+      tool: z10.string().min(1, "tool atom requires a non-empty tool name")
     });
-    urlAtomSchema = z9.object({
-      kind: z9.literal("url"),
-      url: z9.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
+    urlAtomSchema = z10.object({
+      kind: z10.literal("url"),
+      url: z10.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
     });
-    noteAtomSchema = z9.object({
-      kind: z9.literal("note"),
-      note: z9.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
+    noteAtomSchema = z10.object({
+      kind: z10.literal("note"),
+      note: z10.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
     });
-    decisionAtomSchema = z9.object({
-      kind: z9.literal("decision"),
-      decisionId: z9.string().min(1, "decision atom requires a non-empty decision ID")
+    decisionAtomSchema = z10.object({
+      kind: z10.literal("decision"),
+      decisionId: z10.string().min(1, "decision atom requires a non-empty decision ID")
     });
-    prAtomSchema = z9.object({
-      kind: z9.literal("pr"),
-      prNumber: z9.number().int().positive("pr atom requires a positive integer PR number")
+    prAtomSchema = z10.object({
+      kind: z10.literal("pr"),
+      prNumber: z10.number().int().positive("pr atom requires a positive integer PR number")
     });
-    locDropAtomSchema = z9.object({
-      kind: z9.literal("loc-drop"),
-      fromLines: z9.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
-      toLines: z9.number().int().nonnegative("loc-drop toLines must be \u2265 0")
+    locDropAtomSchema = z10.object({
+      kind: z10.literal("loc-drop"),
+      fromLines: z10.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
+      toLines: z10.number().int().nonnegative("loc-drop toLines must be \u2265 0")
     });
-    callsiteCoverageAtomSchema = z9.object({
-      kind: z9.literal("callsite-coverage"),
-      symbolName: z9.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
-      relativeSourcePath: z9.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
+    callsiteCoverageAtomSchema = z10.object({
+      kind: z10.literal("callsite-coverage"),
+      symbolName: z10.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
+      relativeSourcePath: z10.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
     });
     AC_UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[45][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
     AC_ALIAS_REGEX = /^AC[0-9]{1,4}$/;
     SATISFIES_TASK_ID_REGEX = /^T[0-9]{1,7}$/;
     SATISFIES_VERSION_PIN_REGEX = /^[0-9]{14}$/;
-    satisfiesAtomSchema = z9.object({
-      kind: z9.literal("satisfies"),
+    satisfiesAtomSchema = z10.object({
+      kind: z10.literal("satisfies"),
       /** Target task ID — `T<1-7 digits>` per ADR-079-r2 §2.1. */
-      targetTaskId: z9.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
+      targetTaskId: z10.string().regex(SATISFIES_TASK_ID_REGEX, "satisfies atom targetTaskId must match /^T[0-9]{1,7}$/"),
       /** Lowercase UUIDv4/v5 — populated for the canonical form; undefined for alias form. */
-      targetAcId: z9.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4/v5").optional(),
+      targetAcId: z10.string().regex(AC_UUID_REGEX, "satisfies atom targetAcId must be a lowercase UUIDv4/v5").optional(),
       /** Positional alias `AC<1-4 digits>` — populated for alias form; undefined for UUID form. */
-      targetAcAlias: z9.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
+      targetAcAlias: z10.string().regex(AC_ALIAS_REGEX, "satisfies atom targetAcAlias must match /^AC[0-9]{1,4}$/").optional(),
       /** Optional `@<14-digit YYYYMMDDhhmmss>` pin captured at mint time. */
-      versionPin: z9.string().regex(
+      versionPin: z10.string().regex(
         SATISFIES_VERSION_PIN_REGEX,
         "satisfies atom versionPin must be 14 digits (YYYYMMDDhhmmss)"
       ).optional()
     });
-    EvidenceAtomSchema = z9.discriminatedUnion("kind", [
+    EvidenceAtomSchema = z10.discriminatedUnion("kind", [
       commitAtomSchema,
       filesAtomSchema,
       testRunAtomSchema,
@@ -12349,11 +13324,11 @@ var init_evidence_atom_schema = __esm({
           ["commit", "note"],
           ["decision", "files"],
           ["decision", "note"],
-          ["pr"]
+          ["pr", "files"]
         ]
       },
-      testsPassed: { oneOf: [["test-run"], ["tool"], ["pr"]] },
-      qaPassed: { oneOf: [["tool"], ["pr"]] },
+      testsPassed: { oneOf: [["test-run"], ["tool"]] },
+      qaPassed: { oneOf: [["tool"]] },
       documented: { oneOf: [["files"], ["url"]] },
       securityPassed: { oneOf: [["tool"], ["note"]] },
       cleanupDone: { oneOf: [["note"]] },
@@ -12376,58 +13351,58 @@ var init_evidence_atom_schema = __esm({
 });
 
 // packages/contracts/src/evidence-record-schema.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var evidenceBaseSchema, implDiffRecordSchema, validateSpecCheckRecordSchema, testOutputRecordSchema, lintReportRecordSchema, commandOutputRecordSchema, evidenceRecordSchema;
 var init_evidence_record_schema = __esm({
   "packages/contracts/src/evidence-record-schema.ts"() {
     "use strict";
-    evidenceBaseSchema = z10.object({
+    evidenceBaseSchema = z11.object({
       /** Identity string of the agent that produced this record. */
-      agentIdentity: z10.string().min(1),
+      agentIdentity: z11.string().min(1),
       /** SHA-256 hex digest (64 chars) of the attached artifact. */
-      attachmentSha256: z10.string().length(64),
+      attachmentSha256: z11.string().length(64),
       /** ISO 8601 timestamp at which the action ran. */
-      ranAt: z10.string().datetime(),
+      ranAt: z11.string().datetime(),
       /** Wall-clock duration of the action in milliseconds. */
-      durationMs: z10.number().nonnegative()
+      durationMs: z11.number().nonnegative()
     });
     implDiffRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("impl-diff"),
-      phase: z10.literal("implement"),
-      filesChanged: z10.array(z10.string().min(1)).min(1),
-      linesAdded: z10.number().int().nonnegative(),
-      linesRemoved: z10.number().int().nonnegative()
+      kind: z11.literal("impl-diff"),
+      phase: z11.literal("implement"),
+      filesChanged: z11.array(z11.string().min(1)).min(1),
+      linesAdded: z11.number().int().nonnegative(),
+      linesRemoved: z11.number().int().nonnegative()
     });
     validateSpecCheckRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("validate-spec-check"),
-      phase: z10.literal("validate"),
-      reqIdsChecked: z10.array(z10.string().min(1)).min(1),
-      passed: z10.boolean(),
-      details: z10.string().min(1)
+      kind: z11.literal("validate-spec-check"),
+      phase: z11.literal("validate"),
+      reqIdsChecked: z11.array(z11.string().min(1)).min(1),
+      passed: z11.boolean(),
+      details: z11.string().min(1)
     });
     testOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("test-output"),
-      phase: z10.literal("test"),
-      command: z10.string().min(1),
-      exitCode: z10.number().int(),
-      testsPassed: z10.number().int().nonnegative(),
-      testsFailed: z10.number().int().nonnegative()
+      kind: z11.literal("test-output"),
+      phase: z11.literal("test"),
+      command: z11.string().min(1),
+      exitCode: z11.number().int(),
+      testsPassed: z11.number().int().nonnegative(),
+      testsFailed: z11.number().int().nonnegative()
     });
     lintReportRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("lint-report"),
-      phase: z10.enum(["implement", "test"]),
-      tool: z10.string().min(1),
-      passed: z10.boolean(),
-      warnings: z10.number().int().nonnegative(),
-      errors: z10.number().int().nonnegative()
+      kind: z11.literal("lint-report"),
+      phase: z11.enum(["implement", "test"]),
+      tool: z11.string().min(1),
+      passed: z11.boolean(),
+      warnings: z11.number().int().nonnegative(),
+      errors: z11.number().int().nonnegative()
     });
     commandOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z10.literal("command-output"),
-      phase: z10.enum(["implement", "validate", "test"]),
-      cmd: z10.string().min(1),
-      exitCode: z10.number().int()
+      kind: z11.literal("command-output"),
+      phase: z11.enum(["implement", "validate", "test"]),
+      cmd: z11.string().min(1),
+      exitCode: z11.number().int()
     });
-    evidenceRecordSchema = z10.discriminatedUnion("kind", [
+    evidenceRecordSchema = z11.discriminatedUnion("kind", [
       implDiffRecordSchema,
       validateSpecCheckRecordSchema,
       testOutputRecordSchema,
@@ -12577,7 +13552,7 @@ var init_adr_070_orchestration = __esm({
     WORKTREE_CREATE_MODULE = "packages/worktree/src/worktree-create.ts";
     CT_ORCHESTRATOR_SKILL = "packages/skills/skills/ct-orchestrator/SKILL.md";
     VALIDATE_SPAWN_MODULE = "packages/core/src/orchestration/validate-spawn.ts";
-    SKILL_VALIDATOR_TESTS = "packages/core/src/skills/orchestrator/__tests__/validator.test.ts";
+    SKILL_VALIDATOR_TESTS = "packages/core/src/skills/orchestrator/__tests__/validator.orchestrator.test.ts";
     ADR_070_INVARIANTS = Object.freeze([
       {
         adr: "ADR-070",
@@ -12861,8 +13836,8 @@ var init_adr_073_saga = __esm({
       {
         adr: "ADR-073",
         code: "I7",
-        name: "Maximum parent depth is 3",
-        description: "The parent ladder Subtask \u2192 Task \u2192 Epic is fixed at depth 3 (hierarchy.maxDepth=3). Sagas do NOT consume depth \u2014 they attach via groups relations, not parent edges. Enforced at runtime by assertSagaInvariantI7.",
+        name: "No nested sagas",
+        description: 'A saga-member candidate MUST NOT itself be saga-shaped. Enforced at runtime by assertSagaInvariantI7, which checks exactly this and nothing else. The depth clause this invariant used to carry \u2014 "the parent ladder Subtask \u2192 Task \u2192 Epic is fixed at depth 3; sagas do NOT consume depth, they attach via groups relations, not parent edges" \u2014 is SUPERSEDED BY ADR-088: member epics now attach via tasks.parent_id containment and task_relations.groups is non-containment provenance only, so a saga DOES consume a level. The canonical spine is saga(0) \u2192 epic(1) \u2192 task(2) \u2192 subtask(3) at hierarchy.maxDepth=3, inclusive; the depth rule lives in exceedsMaxDepth (core tasks/hierarchy.ts), never here. The stale clause outlived its premise by long enough for the write-path guards calibrated on it to make the subtask tier unreachable.',
         severity: "error",
         runtimeGate: {
           module: SAGA_ENFORCEMENT_MODULE,
@@ -12931,111 +13906,111 @@ var init_lafs = __esm({
 });
 
 // packages/contracts/src/lease-ipc/messages.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var LeaseScopeSchema, LeaseLaneSchema, LeaseAcquireRequestSchema, LeaseReleaseRequestSchema, LeaseRenewRequestSchema, RateCheckRequestSchema, ToolGrantRequestSchema, QueuePriorityClassSchema, QueueAdmitRequestSchema, WorkerHeartbeatRequestSchema, ResourceAdmitRequestSchema, ResourceReleaseRequestSchema, LeaseIpcRequestSchema, LeaseGrantedResponseSchema, LeaseQueuedResponseSchema, LeaseDeniedResponseSchema, RateResultResponseSchema, ToolGrantedResponseSchema, LeaseRevokedResponseSchema, ChildKilledUnresponsiveResponseSchema, QueueAdmitDispositionSchema, QueueAdmitResultResponseSchema, HeartbeatAckResponseSchema, ResourceAdmitDispositionSchema, ResourceAdmitResultResponseSchema, ResourceReleaseResultResponseSchema, LeaseErrorResponseSchema, LeaseIpcResponseSchema, LeaseIpcRequestEnvelopeSchema, LeaseIpcResponseEnvelopeSchema, LeaseIpcEnvelopeSchema, LEASE_IPC_REQUEST_KINDS, LEASE_IPC_RESPONSE_KINDS, LEASE_IPC_MESSAGE_KINDS;
 var init_messages2 = __esm({
   "packages/contracts/src/lease-ipc/messages.ts"() {
     "use strict";
-    LeaseScopeSchema = z11.enum(["project", "global"]);
-    LeaseLaneSchema = z11.enum(["tasks", "brain", "bulk"]);
-    LeaseAcquireRequestSchema = z11.object({
+    LeaseScopeSchema = z12.enum(["project", "global"]);
+    LeaseLaneSchema = z12.enum(["tasks", "brain", "bulk"]);
+    LeaseAcquireRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("lease_acquire"),
+      kind: z12.literal("lease_acquire"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** Advisory priority — lower acquires sooner. `0` = highest. */
-      priority: z11.number().int().min(0).max(255),
+      priority: z12.number().int().min(0).max(255),
       /** Lease time-to-live in milliseconds. */
-      ttl_ms: z11.number().int().nonnegative(),
+      ttl_ms: z12.number().int().nonnegative(),
       /** When true, a same-holder acquire re-enters (refcount++) rather than queuing. */
-      reentrant: z11.boolean()
+      reentrant: z12.boolean()
     }).strict();
-    LeaseReleaseRequestSchema = z11.object({
+    LeaseReleaseRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("lease_release"),
+      kind: z12.literal("lease_release"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The epoch fence the holder acquired — a stale epoch no-ops. */
-      epoch: z11.number().int().nonnegative()
+      epoch: z12.number().int().nonnegative()
     }).strict();
-    LeaseRenewRequestSchema = z11.object({
+    LeaseRenewRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("lease_renew"),
+      kind: z12.literal("lease_renew"),
       /** The cleo.db scope being arbitrated. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Process+lane holder identity. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The epoch fence the holder acquired (epoch-guarded renew). */
-      epoch: z11.number().int().nonnegative()
+      epoch: z12.number().int().nonnegative()
     }).strict();
-    RateCheckRequestSchema = z11.object({
+    RateCheckRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("rate_check"),
+      kind: z12.literal("rate_check"),
       /** The cleo.db scope being checked. */
       scope: LeaseScopeSchema,
       /** The write lane within the scope. */
       lane: LeaseLaneSchema,
       /** Estimated bytes the caller intends to write. */
-      est_bytes: z11.number().int().nonnegative()
+      est_bytes: z12.number().int().nonnegative()
     }).strict();
-    ToolGrantRequestSchema = z11.object({
+    ToolGrantRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("tool_grant"),
+      kind: z12.literal("tool_grant"),
       /** The tool name being requested. */
-      tool: z11.string().min(1),
+      tool: z12.string().min(1),
       /** The requesting holder identity. */
-      holder_id: z11.string().min(1)
+      holder_id: z12.string().min(1)
     }).strict();
-    QueuePriorityClassSchema = z11.enum(["lead", "worker", "background"]);
-    QueueAdmitRequestSchema = z11.object({
+    QueuePriorityClassSchema = z12.enum(["lead", "worker", "background"]);
+    QueueAdmitRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("queue_admit"),
+      kind: z12.literal("queue_admit"),
       /** The LLM provider id the call targets (rate budget is per-provider). */
-      provider: z11.string().min(1),
+      provider: z12.string().min(1),
       /** The caller's priority class (lead > worker > background). */
       priority_class: QueuePriorityClassSchema,
       /** The caller's estimate of the request's token cost (debited on admit). */
-      est_tokens: z11.number().int().nonnegative(),
+      est_tokens: z12.number().int().nonnegative(),
       /** The child the call belongs to (in-flight tracking — the watchdog seam). */
-      child_id: z11.string().min(1)
+      child_id: z12.string().min(1)
     }).strict();
-    WorkerHeartbeatRequestSchema = z11.object({
+    WorkerHeartbeatRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("worker_heartbeat"),
+      kind: z12.literal("worker_heartbeat"),
       /** The logical id of the heartbeating child (matches the registry key). */
-      child_id: z11.string().min(1),
+      child_id: z12.string().min(1),
       /** The worker's own view of whether it is currently inside an LLM call. */
-      in_flight_llm: z11.boolean()
+      in_flight_llm: z12.boolean()
     }).strict();
-    ResourceAdmitRequestSchema = z11.object({
+    ResourceAdmitRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("resource_admit"),
+      kind: z12.literal("resource_admit"),
       /** The resource class (e.g. `"db-heavy"`, `"full-build"`, `"test-run"`). */
-      class: z11.string().min(1),
+      class: z12.string().min(1),
       /** The caller holding the slot — process/worktree-unique; the release key. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The client-computed budget: the max concurrent holders for this class. */
-      budget: z11.number().int().nonnegative()
+      budget: z12.number().int().nonnegative()
     }).strict();
-    ResourceReleaseRequestSchema = z11.object({
+    ResourceReleaseRequestSchema = z12.object({
       /** Tag discriminating this request variant. */
-      kind: z11.literal("resource_release"),
+      kind: z12.literal("resource_release"),
       /** The resource class the slot belongs to. */
-      class: z11.string().min(1),
+      class: z12.string().min(1),
       /** The holder that was admitted (matches the admit `holder_id`). */
-      holder_id: z11.string().min(1)
+      holder_id: z12.string().min(1)
     }).strict();
-    LeaseIpcRequestSchema = z11.discriminatedUnion("kind", [
+    LeaseIpcRequestSchema = z12.discriminatedUnion("kind", [
       LeaseAcquireRequestSchema,
       LeaseReleaseRequestSchema,
       LeaseRenewRequestSchema,
@@ -13046,133 +14021,133 @@ var init_messages2 = __esm({
       ResourceAdmitRequestSchema,
       ResourceReleaseRequestSchema
     ]);
-    LeaseGrantedResponseSchema = z11.object({
+    LeaseGrantedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_granted"),
+      kind: z12.literal("lease_granted"),
       /** The granted cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The granted write lane. */
       lane: LeaseLaneSchema,
       /** The holder the lease was granted to. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The monotonic epoch fence assigned to this grant. */
-      epoch: z11.number().int().nonnegative(),
+      epoch: z12.number().int().nonnegative(),
       /** The lease TTL in milliseconds. */
-      ttl_ms: z11.number().int().nonnegative(),
+      ttl_ms: z12.number().int().nonnegative(),
       /** Absolute expiry timestamp (epoch ms) for this grant. */
-      expires_at_ms: z11.number().int().nonnegative()
+      expires_at_ms: z12.number().int().nonnegative()
     }).strict();
-    LeaseQueuedResponseSchema = z11.object({
+    LeaseQueuedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_queued"),
+      kind: z12.literal("lease_queued"),
       /** The queued cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The queued write lane. */
       lane: LeaseLaneSchema,
       /** The monotonic ticket assigned for FIFO tiebreak. */
-      ticket: z11.number().int().nonnegative(),
+      ticket: z12.number().int().nonnegative(),
       /** Number of waiters ahead of this one. */
-      ahead: z11.number().int().nonnegative()
+      ahead: z12.number().int().nonnegative()
     }).strict();
-    LeaseDeniedResponseSchema = z11.object({
+    LeaseDeniedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_denied"),
+      kind: z12.literal("lease_denied"),
       /** The denied cleo.db scope. */
       scope: LeaseScopeSchema,
       /** Machine-readable denial code (e.g. `E_LEASE_UNAVAILABLE`). */
-      code: z11.string().min(1),
+      code: z12.string().min(1),
       /** Human-readable denial message. */
-      message: z11.string()
+      message: z12.string()
     }).strict();
-    RateResultResponseSchema = z11.object({
+    RateResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("rate_result"),
+      kind: z12.literal("rate_result"),
       /** The checked cleo.db scope. */
       scope: LeaseScopeSchema,
       /** Whether the write is within budget. */
-      ok: z11.boolean(),
+      ok: z12.boolean(),
       /** Suggested back-off in milliseconds when `ok` is false. */
-      retry_after_ms: z11.number().int().nonnegative(),
+      retry_after_ms: z12.number().int().nonnegative(),
       /** Remaining token budget for the scope. */
-      tokens_remaining: z11.number().int().nonnegative()
+      tokens_remaining: z12.number().int().nonnegative()
     }).strict();
-    ToolGrantedResponseSchema = z11.object({
+    ToolGrantedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("tool_granted"),
+      kind: z12.literal("tool_granted"),
       /** The granted tool name. */
-      tool: z11.string().min(1),
+      tool: z12.string().min(1),
       /** The holder the tool grant was issued to. */
-      holder_id: z11.string().min(1)
+      holder_id: z12.string().min(1)
     }).strict();
-    LeaseRevokedResponseSchema = z11.object({
+    LeaseRevokedResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("lease_revoked"),
+      kind: z12.literal("lease_revoked"),
       /** The revoked cleo.db scope. */
       scope: LeaseScopeSchema,
       /** The revoked write lane. */
       lane: LeaseLaneSchema,
       /** The holder whose lease was revoked. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** Human-readable reason for the revocation. */
-      reason: z11.string()
+      reason: z12.string()
     }).strict();
-    ChildKilledUnresponsiveResponseSchema = z11.object({
+    ChildKilledUnresponsiveResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("child_killed_unresponsive"),
+      kind: z12.literal("child_killed_unresponsive"),
       /** Logical id of the killed child. */
-      child_id: z11.string().min(1),
+      child_id: z12.string().min(1),
       /** The holder identity the killed child held the lease as. */
-      holder_id: z11.string().min(1),
+      holder_id: z12.string().min(1),
       /** The cleo.db scope the killed child held the lease in. */
       scope: LeaseScopeSchema,
       /** Human-readable reason for the kill. */
-      reason: z11.string()
+      reason: z12.string()
     }).strict();
-    QueueAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
-    QueueAdmitResultResponseSchema = z11.object({
+    QueueAdmitDispositionSchema = z12.enum(["admitted", "deferred"]);
+    QueueAdmitResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("queue_admit_result"),
+      kind: z12.literal("queue_admit_result"),
       /** Whether the LLM call was admitted or deferred. */
       disposition: QueueAdmitDispositionSchema,
       /** Back-off in ms before re-requesting (0 when admitted). */
-      retry_after_ms: z11.number().int().nonnegative(),
+      retry_after_ms: z12.number().int().nonnegative(),
       /** Remaining provider token budget after this decision. */
-      tokens_remaining: z11.number().int().nonnegative(),
+      tokens_remaining: z12.number().int().nonnegative(),
       /** Number of higher/equal-priority waiters ahead (0 when admitted). */
-      queue_position: z11.number().int().nonnegative()
+      queue_position: z12.number().int().nonnegative()
     }).strict();
-    HeartbeatAckResponseSchema = z11.object({
+    HeartbeatAckResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("heartbeat_ack")
+      kind: z12.literal("heartbeat_ack")
     }).strict();
-    ResourceAdmitDispositionSchema = z11.enum(["admitted", "deferred"]);
-    ResourceAdmitResultResponseSchema = z11.object({
+    ResourceAdmitDispositionSchema = z12.enum(["admitted", "deferred"]);
+    ResourceAdmitResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("resource_admit_result"),
+      kind: z12.literal("resource_admit_result"),
       /** Whether the heavy op was admitted or deferred. */
       disposition: ResourceAdmitDispositionSchema,
       /** Back-off in ms before re-requesting (0 when admitted). */
-      retry_after_ms: z11.number().int().nonnegative(),
+      retry_after_ms: z12.number().int().nonnegative(),
       /** Remaining slots for the class after this decision. */
-      slots_remaining: z11.number().int().nonnegative()
+      slots_remaining: z12.number().int().nonnegative()
     }).strict();
-    ResourceReleaseResultResponseSchema = z11.object({
+    ResourceReleaseResultResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("resource_release_result"),
+      kind: z12.literal("resource_release_result"),
       /** Whether a held slot was actually released (false = no such holder). */
-      released: z11.boolean(),
+      released: z12.boolean(),
       /** Remaining in-flight holders for the class after the release. */
-      slots_remaining: z11.number().int().nonnegative()
+      slots_remaining: z12.number().int().nonnegative()
     }).strict();
-    LeaseErrorResponseSchema = z11.object({
+    LeaseErrorResponseSchema = z12.object({
       /** Tag discriminating this response variant. */
-      kind: z11.literal("error"),
+      kind: z12.literal("error"),
       /** Machine-readable error code (e.g. `E_LEASE_BAD_VERSION`, `E_LEASE_UNIMPLEMENTED`). */
-      code: z11.string().min(1),
+      code: z12.string().min(1),
       /** Human-readable error message. */
-      message: z11.string()
+      message: z12.string()
     }).strict();
-    LeaseIpcResponseSchema = z11.discriminatedUnion("kind", [
+    LeaseIpcResponseSchema = z12.discriminatedUnion("kind", [
       LeaseGrantedResponseSchema,
       LeaseQueuedResponseSchema,
       LeaseDeniedResponseSchema,
@@ -13186,27 +14161,27 @@ var init_messages2 = __esm({
       ResourceReleaseResultResponseSchema,
       LeaseErrorResponseSchema
     ]);
-    LeaseIpcRequestEnvelopeSchema = z11.object({
+    LeaseIpcRequestEnvelopeSchema = z12.object({
       /** Parallel protocol version. */
-      protocol_version: z11.string(),
+      protocol_version: z12.string(),
       /** Correlation id echoed back on the matching response. */
-      id: z11.string().min(1),
+      id: z12.string().min(1),
       /** Direction discriminator. */
-      direction: z11.literal("request"),
+      direction: z12.literal("request"),
       /** The request body. */
       request: LeaseIpcRequestSchema
     }).strict();
-    LeaseIpcResponseEnvelopeSchema = z11.object({
+    LeaseIpcResponseEnvelopeSchema = z12.object({
       /** Parallel protocol version. */
-      protocol_version: z11.string(),
+      protocol_version: z12.string(),
       /** Correlation id echoed from the originating request (or a fresh id for events). */
-      id: z11.string().min(1),
+      id: z12.string().min(1),
       /** Direction discriminator. */
-      direction: z11.literal("response"),
+      direction: z12.literal("response"),
       /** The response body. */
       response: LeaseIpcResponseSchema
     }).strict();
-    LeaseIpcEnvelopeSchema = z11.discriminatedUnion("direction", [
+    LeaseIpcEnvelopeSchema = z12.discriminatedUnion("direction", [
       LeaseIpcRequestEnvelopeSchema,
       LeaseIpcResponseEnvelopeSchema
     ]);
@@ -13259,7 +14234,7 @@ var init_lease_ipc = __esm({
 });
 
 // packages/contracts/src/llm/catalog-schema.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var CATALOG_MODEL_STATUSES, CATALOG_AUTH_TYPES, isoDate, semver, catalogModalitiesSchema, catalogCostSchema, catalogLimitSchema, catalogModelProviderSchema, catalogModelEntrySchema, catalogProviderSchema, curatedCatalogSchema, modelsCatalogRowInsertSchema, modelsCatalogRowSelectSchema;
 var init_catalog_schema = __esm({
   "packages/contracts/src/llm/catalog-schema.ts"() {
@@ -13272,78 +14247,78 @@ var init_catalog_schema = __esm({
       "retired"
     ];
     CATALOG_AUTH_TYPES = ["api_key", "oauth", "bedrock", "vertex"];
-    isoDate = z12.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)");
-    semver = z12.string().regex(/^\d+\.\d+\.\d+$/, "must be semver (MAJOR.MINOR.PATCH)");
-    catalogModalitiesSchema = z12.object({
-      input: z12.array(z12.string()),
-      output: z12.array(z12.string())
+    isoDate = z13.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be an ISO date (YYYY-MM-DD)");
+    semver = z13.string().regex(/^\d+\.\d+\.\d+$/, "must be semver (MAJOR.MINOR.PATCH)");
+    catalogModalitiesSchema = z13.object({
+      input: z13.array(z13.string()),
+      output: z13.array(z13.string())
     }).strict();
-    catalogCostSchema = z12.object({
-      input: z12.number().optional(),
-      output: z12.number().optional(),
-      cache_read: z12.number().optional(),
-      cache_write: z12.number().optional(),
-      context_over_200k: z12.number().optional()
+    catalogCostSchema = z13.object({
+      input: z13.number().optional(),
+      output: z13.number().optional(),
+      cache_read: z13.number().optional(),
+      cache_write: z13.number().optional(),
+      context_over_200k: z13.number().optional()
     }).strict();
-    catalogLimitSchema = z12.object({
-      context: z12.number(),
-      output: z12.number()
+    catalogLimitSchema = z13.object({
+      context: z13.number(),
+      output: z13.number()
     }).strict();
-    catalogModelProviderSchema = z12.object({
-      npm: z12.string(),
-      api: z12.string()
+    catalogModelProviderSchema = z13.object({
+      npm: z13.string(),
+      api: z13.string()
     }).strict();
-    catalogModelEntrySchema = z12.object({
-      id: z12.string(),
-      name: z12.string(),
-      family: z12.string(),
-      attachment: z12.boolean(),
-      reasoning: z12.boolean(),
-      temperature: z12.boolean(),
-      interleaved: z12.boolean(),
-      tool_call: z12.boolean(),
+    catalogModelEntrySchema = z13.object({
+      id: z13.string(),
+      name: z13.string(),
+      family: z13.string(),
+      attachment: z13.boolean(),
+      reasoning: z13.boolean(),
+      temperature: z13.boolean(),
+      interleaved: z13.boolean(),
+      tool_call: z13.boolean(),
       modalities: catalogModalitiesSchema,
       cost: catalogCostSchema,
       limit: catalogLimitSchema,
-      status: z12.enum(CATALOG_MODEL_STATUSES),
+      status: z13.enum(CATALOG_MODEL_STATUSES),
       release_date: isoDate,
       provider: catalogModelProviderSchema
     }).strict();
-    catalogProviderSchema = z12.object({
-      id: z12.string(),
-      endpoint: z12.string(),
-      authTypes: z12.array(z12.enum(CATALOG_AUTH_TYPES)).min(1),
-      npm: z12.string().optional()
+    catalogProviderSchema = z13.object({
+      id: z13.string(),
+      endpoint: z13.string(),
+      authTypes: z13.array(z13.enum(CATALOG_AUTH_TYPES)).min(1),
+      npm: z13.string().optional()
     }).strict();
-    curatedCatalogSchema = z12.object({
-      $schema: z12.string().optional(),
+    curatedCatalogSchema = z13.object({
+      $schema: z13.string().optional(),
       version: semver,
       lastUpdated: isoDate,
-      providers: z12.record(z12.string(), catalogProviderSchema),
-      models: z12.record(z12.string(), z12.record(z12.string(), catalogModelEntrySchema))
+      providers: z13.record(z13.string(), catalogProviderSchema),
+      models: z13.record(z13.string(), z13.record(z13.string(), catalogModelEntrySchema))
     }).strict();
-    modelsCatalogRowInsertSchema = z12.object({
-      id: z12.string(),
-      providerId: z12.string(),
-      name: z12.string(),
-      family: z12.string(),
-      attachment: z12.boolean(),
-      reasoning: z12.boolean(),
-      temperature: z12.boolean(),
-      interleaved: z12.boolean(),
-      toolCall: z12.boolean(),
-      modalities: z12.string(),
-      cost: z12.string(),
-      contextLimit: z12.number().nullable().optional(),
-      outputLimit: z12.number().nullable().optional(),
-      status: z12.enum(CATALOG_MODEL_STATUSES),
+    modelsCatalogRowInsertSchema = z13.object({
+      id: z13.string(),
+      providerId: z13.string(),
+      name: z13.string(),
+      family: z13.string(),
+      attachment: z13.boolean(),
+      reasoning: z13.boolean(),
+      temperature: z13.boolean(),
+      interleaved: z13.boolean(),
+      toolCall: z13.boolean(),
+      modalities: z13.string(),
+      cost: z13.string(),
+      contextLimit: z13.number().nullable().optional(),
+      outputLimit: z13.number().nullable().optional(),
+      status: z13.enum(CATALOG_MODEL_STATUSES),
       releaseDate: isoDate,
-      modelsDevId: z12.string(),
-      source: z12.string(),
-      seededAt: z12.string().optional()
+      modelsDevId: z13.string(),
+      source: z13.string(),
+      seededAt: z13.string().optional()
     }).strict();
     modelsCatalogRowSelectSchema = modelsCatalogRowInsertSchema.extend({
-      seededAt: z12.string()
+      seededAt: z13.string()
     });
   }
 });
@@ -13458,7 +14433,7 @@ var init_status_registry = __esm({
 });
 
 // packages/contracts/src/workgraph.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var E_WORKGRAPH_PARENT_TYPE_MATRIX, taskTypeSchema, taskPrioritySchema, taskStatusSchema, verificationGateSchema, workGraphRelationKindSchema, workGraphTraversalDirectionSchema, workGraphEdgeDirectionSchema, paginationParamsSchema, workGraphNodeSchema, workGraphEdgeSchema, workGraphHierarchyEdgeSchema, workGraphPageInfoSchema, workGraphRollupCountsSchema, workGraphSubtreePercentagesSchema, workGraphProjectionMismatchSchema, workGraphReadyFrontierTaskSchema, workGraphRelationEdgeSchema, workGraphDependencyEdgeSchema, workGraphOmissionReasonSchema, workGraphContextBudgetSchema, workGraphOmissionSchema, workGraphDirectEdgeSchema, workGraphContextPackParamsSchema, workGraphSliceParamsSchema, workGraphSliceSchema, workGraphReadinessParamsSchema, workGraphReadinessResultSchema, workGraphContextPackSchema, workGraphScaffoldValidateParamsSchema, workGraphScaffoldValidationIssueSchema, workGraphScaffoldValidateResultSchema, workGraphScaffoldApplyParamsSchema, workGraphScaffoldApplyResultSchema, workGraphPlanningDocParamsSchema, workGraphPlanningDocSchema, tasksTraverseParamsSchema, tasksTraverseResultSchema, tasksTreeParamsSchema, tasksTreeResultSchema, tasksRollupParamsSchema, tasksRollupResultSchema, tasksFrontierParamsSchema, tasksFrontierResultSchema, tasksWorkGraphAuditParamsSchema, tasksWorkGraphAuditResultSchema;
 var init_workgraph = __esm({
   "packages/contracts/src/workgraph.ts"() {
@@ -13466,10 +14441,10 @@ var init_workgraph = __esm({
     init_enums();
     init_status_registry();
     E_WORKGRAPH_PARENT_TYPE_MATRIX = "E_WORKGRAPH_PARENT_TYPE_MATRIX";
-    taskTypeSchema = z13.enum(["saga", "epic", "task", "subtask"]);
-    taskPrioritySchema = z13.enum(["critical", "high", "medium", "low"]);
-    taskStatusSchema = z13.enum(TASK_STATUSES);
-    verificationGateSchema = z13.enum([
+    taskTypeSchema = z14.enum(["saga", "epic", "task", "subtask"]);
+    taskPrioritySchema = z14.enum(["critical", "high", "medium", "low"]);
+    taskStatusSchema = z14.enum(TASK_STATUSES);
+    verificationGateSchema = z14.enum([
       "implemented",
       "testsPassed",
       "qaPassed",
@@ -13478,7 +14453,7 @@ var init_workgraph = __esm({
       "documented",
       "nexusImpact"
     ]);
-    workGraphRelationKindSchema = z13.enum([
+    workGraphRelationKindSchema = z14.enum([
       "contains",
       "depends_on",
       "blocks",
@@ -13486,317 +14461,317 @@ var init_workgraph = __esm({
       "groups",
       "satisfies"
     ]);
-    workGraphTraversalDirectionSchema = z13.enum([
+    workGraphTraversalDirectionSchema = z14.enum([
       "ancestors",
       "descendants",
       "upstream",
       "downstream"
     ]);
-    workGraphEdgeDirectionSchema = z13.enum(["out", "in", "both"]);
-    paginationParamsSchema = z13.object({
-      cursor: z13.string().min(1).optional(),
-      limit: z13.number().int().positive().max(500).optional()
+    workGraphEdgeDirectionSchema = z14.enum(["out", "in", "both"]);
+    paginationParamsSchema = z14.object({
+      cursor: z14.string().min(1).optional(),
+      limit: z14.number().int().positive().max(500).optional()
     });
-    workGraphNodeSchema = z13.object({
-      id: z13.string().min(1),
+    workGraphNodeSchema = z14.object({
+      id: z14.string().min(1),
       type: taskTypeSchema,
-      title: z13.string(),
+      title: z14.string(),
       status: taskStatusSchema,
       priority: taskPrioritySchema,
-      parentId: z13.string().min(1).optional()
+      parentId: z14.string().min(1).optional()
     });
-    workGraphEdgeSchema = z13.object({
-      fromId: z13.string().min(1),
-      toId: z13.string().min(1),
+    workGraphEdgeSchema = z14.object({
+      fromId: z14.string().min(1),
+      toId: z14.string().min(1),
       kind: workGraphRelationKindSchema
     });
-    workGraphHierarchyEdgeSchema = z13.object({
-      fromId: z13.string().min(1),
-      toId: z13.string().min(1),
-      kind: z13.literal("contains")
+    workGraphHierarchyEdgeSchema = z14.object({
+      fromId: z14.string().min(1),
+      toId: z14.string().min(1),
+      kind: z14.literal("contains")
     }).strict();
-    workGraphPageInfoSchema = z13.object({
-      nextCursor: z13.string().min(1).optional(),
-      hasMore: z13.boolean()
-    });
-    workGraphRollupCountsSchema = z13.object({
-      total: z13.number().int().nonnegative(),
-      byStatus: z13.partialRecord(taskStatusSchema, z13.number().int().nonnegative()),
-      byType: z13.partialRecord(taskTypeSchema, z13.number().int().nonnegative())
-    });
-    workGraphSubtreePercentagesSchema = z13.object({
-      done: z13.number().nonnegative(),
-      active: z13.number().nonnegative(),
-      blocked: z13.number().nonnegative(),
-      pending: z13.number().nonnegative(),
-      cancelled: z13.number().nonnegative()
-    });
-    workGraphProjectionMismatchSchema = z13.object({
-      field: z13.string().min(1),
-      expected: z13.number().int().nonnegative(),
-      actual: z13.number().int().nonnegative()
+    workGraphPageInfoSchema = z14.object({
+      nextCursor: z14.string().min(1).optional(),
+      hasMore: z14.boolean()
+    });
+    workGraphRollupCountsSchema = z14.object({
+      total: z14.number().int().nonnegative(),
+      byStatus: z14.partialRecord(taskStatusSchema, z14.number().int().nonnegative()),
+      byType: z14.partialRecord(taskTypeSchema, z14.number().int().nonnegative())
+    });
+    workGraphSubtreePercentagesSchema = z14.object({
+      done: z14.number().nonnegative(),
+      active: z14.number().nonnegative(),
+      blocked: z14.number().nonnegative(),
+      pending: z14.number().nonnegative(),
+      cancelled: z14.number().nonnegative()
+    });
+    workGraphProjectionMismatchSchema = z14.object({
+      field: z14.string().min(1),
+      expected: z14.number().int().nonnegative(),
+      actual: z14.number().int().nonnegative()
     });
     workGraphReadyFrontierTaskSchema = workGraphNodeSchema.extend({
-      role: z13.string().min(1).optional(),
-      dependencyBlockers: z13.array(z13.object({ taskId: z13.string().min(1), status: taskStatusSchema })),
-      gateBlockers: z13.array(z13.object({ gate: verificationGateSchema }))
+      role: z14.string().min(1).optional(),
+      dependencyBlockers: z14.array(z14.object({ taskId: z14.string().min(1), status: taskStatusSchema })),
+      gateBlockers: z14.array(z14.object({ gate: verificationGateSchema }))
     });
     workGraphRelationEdgeSchema = workGraphEdgeSchema.extend({
-      source: z13.literal("relation"),
-      relationType: z13.enum(TASK_RELATION_TYPES),
-      reason: z13.string().min(1).optional()
+      source: z14.literal("relation"),
+      relationType: z14.enum(TASK_RELATION_TYPES),
+      reason: z14.string().min(1).optional()
     });
     workGraphDependencyEdgeSchema = workGraphEdgeSchema.extend({
-      source: z13.literal("dependency"),
-      kind: z13.literal("depends_on")
+      source: z14.literal("dependency"),
+      kind: z14.literal("depends_on")
     });
-    workGraphOmissionReasonSchema = z13.enum([
+    workGraphOmissionReasonSchema = z14.enum([
       "budget_exceeded",
       "not_requested",
       "not_available",
       "redacted",
       "truncated"
     ]);
-    workGraphContextBudgetSchema = z13.object({
-      tokenBudget: z13.number().int().nonnegative(),
-      estimatedTokens: z13.number().int().nonnegative(),
-      remainingTokens: z13.number().int().nonnegative(),
-      truncated: z13.boolean()
-    });
-    workGraphOmissionSchema = z13.object({
-      path: z13.string().min(1),
+    workGraphContextBudgetSchema = z14.object({
+      tokenBudget: z14.number().int().nonnegative(),
+      estimatedTokens: z14.number().int().nonnegative(),
+      remainingTokens: z14.number().int().nonnegative(),
+      truncated: z14.boolean()
+    });
+    workGraphOmissionSchema = z14.object({
+      path: z14.string().min(1),
       reason: workGraphOmissionReasonSchema,
-      message: z13.string().min(1),
-      estimatedTokens: z13.number().int().nonnegative().optional()
+      message: z14.string().min(1),
+      estimatedTokens: z14.number().int().nonnegative().optional()
     });
-    workGraphDirectEdgeSchema = z13.discriminatedUnion("source", [
+    workGraphDirectEdgeSchema = z14.discriminatedUnion("source", [
       workGraphRelationEdgeSchema,
       workGraphDependencyEdgeSchema
     ]);
     workGraphContextPackParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
-      tokenBudget: z13.number().int().positive().optional(),
-      includeRelations: z13.boolean().optional(),
-      includeReadiness: z13.boolean().optional(),
-      includeRollup: z13.boolean().optional()
+      rootId: z14.string().min(1),
+      tokenBudget: z14.number().int().positive().optional(),
+      includeRelations: z14.boolean().optional(),
+      includeReadiness: z14.boolean().optional(),
+      includeRollup: z14.boolean().optional()
     });
     workGraphSliceParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema.optional(),
-      maxDepth: z13.number().int().nonnegative().optional(),
-      includeRelations: z13.boolean().optional()
+      maxDepth: z14.number().int().nonnegative().optional(),
+      includeRelations: z14.boolean().optional()
     });
-    workGraphSliceSchema = z13.object({
-      rootId: z13.string().min(1),
+    workGraphSliceSchema = z14.object({
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      nodes: z13.array(workGraphNodeSchema),
-      edges: z13.array(workGraphEdgeSchema),
+      nodes: z14.array(workGraphNodeSchema),
+      edges: z14.array(workGraphEdgeSchema),
       pageInfo: workGraphPageInfoSchema,
-      omissions: z13.array(workGraphOmissionSchema).optional()
-    });
-    workGraphReadinessParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional(),
-      includeGateBlockers: z13.boolean().optional()
-    });
-    workGraphReadinessResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional(),
-      ready: z13.boolean(),
-      warnings: z13.array(z13.string()),
-      groups: z13.object({
-        ready: z13.array(workGraphReadyFrontierTaskSchema),
-        blocked: z13.array(workGraphReadyFrontierTaskSchema),
-        blockedBy: z13.array(
-          z13.discriminatedUnion("kind", [
-            z13.object({
-              kind: z13.literal("dependency"),
-              blockerId: z13.string().min(1),
-              blocks: z13.array(z13.string().min(1))
+      omissions: z14.array(workGraphOmissionSchema).optional()
+    });
+    workGraphReadinessParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional(),
+      includeGateBlockers: z14.boolean().optional()
+    });
+    workGraphReadinessResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional(),
+      ready: z14.boolean(),
+      warnings: z14.array(z14.string()),
+      groups: z14.object({
+        ready: z14.array(workGraphReadyFrontierTaskSchema),
+        blocked: z14.array(workGraphReadyFrontierTaskSchema),
+        blockedBy: z14.array(
+          z14.discriminatedUnion("kind", [
+            z14.object({
+              kind: z14.literal("dependency"),
+              blockerId: z14.string().min(1),
+              blocks: z14.array(z14.string().min(1))
             }),
-            z13.object({
-              kind: z13.literal("gate"),
+            z14.object({
+              kind: z14.literal("gate"),
               gate: verificationGateSchema,
-              blocks: z13.array(z13.string().min(1))
+              blocks: z14.array(z14.string().min(1))
             })
           ])
         )
       })
     });
-    workGraphContextPackSchema = z13.object({
-      rootId: z13.string().min(1),
-      generatedAt: z13.string().min(1),
+    workGraphContextPackSchema = z14.object({
+      rootId: z14.string().min(1),
+      generatedAt: z14.string().min(1),
       budget: workGraphContextBudgetSchema,
       slice: workGraphSliceSchema,
-      relationEdges: z13.object({
-        rootId: z13.string().min(1),
+      relationEdges: z14.object({
+        rootId: z14.string().min(1),
         direction: workGraphEdgeDirectionSchema,
-        edges: z13.array(workGraphDirectEdgeSchema)
+        edges: z14.array(workGraphDirectEdgeSchema)
       }).optional(),
       readiness: workGraphReadinessResultSchema.optional(),
-      rollup: z13.lazy(() => tasksRollupResultSchema).optional(),
-      omissions: z13.array(workGraphOmissionSchema)
-    });
-    workGraphScaffoldValidateParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      nodes: z13.array(
-        z13.object({
-          id: z13.string().min(1),
+      rollup: z14.lazy(() => tasksRollupResultSchema).optional(),
+      omissions: z14.array(workGraphOmissionSchema)
+    });
+    workGraphScaffoldValidateParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      nodes: z14.array(
+        z14.object({
+          id: z14.string().min(1),
           type: taskTypeSchema,
-          parentId: z13.string().min(1).nullable().optional()
+          parentId: z14.string().min(1).nullable().optional()
         })
       ),
-      edges: z13.array(workGraphDirectEdgeSchema).optional(),
-      dryRun: z13.boolean().optional()
-    });
-    workGraphScaffoldValidationIssueSchema = z13.object({
-      code: z13.string().min(1),
-      message: z13.string().min(1),
-      taskId: z13.string().min(1).optional(),
-      severity: z13.enum(["error", "warning"])
-    });
-    workGraphScaffoldValidateResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      valid: z13.boolean(),
-      dryRun: z13.boolean(),
-      issues: z13.array(workGraphScaffoldValidationIssueSchema),
-      hierarchy: z13.object({
-        valid: z13.boolean(),
-        violations: z13.array(
-          z13.object({
-            code: z13.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
-            taskId: z13.string().min(1),
+      edges: z14.array(workGraphDirectEdgeSchema).optional(),
+      dryRun: z14.boolean().optional()
+    });
+    workGraphScaffoldValidationIssueSchema = z14.object({
+      code: z14.string().min(1),
+      message: z14.string().min(1),
+      taskId: z14.string().min(1).optional(),
+      severity: z14.enum(["error", "warning"])
+    });
+    workGraphScaffoldValidateResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      valid: z14.boolean(),
+      dryRun: z14.boolean(),
+      issues: z14.array(workGraphScaffoldValidationIssueSchema),
+      hierarchy: z14.object({
+        valid: z14.boolean(),
+        violations: z14.array(
+          z14.object({
+            code: z14.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
+            taskId: z14.string().min(1),
             taskType: taskTypeSchema,
-            parentId: z13.string().min(1).nullable(),
+            parentId: z14.string().min(1).nullable(),
             parentType: taskTypeSchema.optional(),
-            message: z13.string().min(1)
+            message: z14.string().min(1)
           })
         )
       })
     });
     workGraphScaffoldApplyParamsSchema = workGraphScaffoldValidateParamsSchema.extend({
-      apply: z13.boolean().optional()
+      apply: z14.boolean().optional()
     });
     workGraphScaffoldApplyResultSchema = workGraphScaffoldValidateResultSchema.extend({
-      applied: z13.boolean(),
-      nodesChanged: z13.number().int().nonnegative(),
-      edgesChanged: z13.number().int().nonnegative()
-    });
-    workGraphPlanningDocParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      audience: z13.enum(["agent", "maintainer"]),
-      tokenBudget: z13.number().int().positive().optional(),
-      includeRelations: z13.boolean().optional(),
-      includeReadiness: z13.boolean().optional(),
-      includeRollup: z13.boolean().optional()
-    });
-    workGraphPlanningDocSchema = z13.object({
-      rootId: z13.string().min(1),
-      generatedAt: z13.string().min(1),
-      audience: z13.enum(["agent", "maintainer"]),
-      title: z13.string().min(1),
-      content: z13.string(),
-      sections: z13.array(z13.string().min(1)),
-      estimatedTokens: z13.number().int().nonnegative(),
-      budget: z13.object({
-        tokenBudget: z13.number().int().positive(),
-        truncated: z13.boolean()
+      applied: z14.boolean(),
+      nodesChanged: z14.number().int().nonnegative(),
+      edgesChanged: z14.number().int().nonnegative()
+    });
+    workGraphPlanningDocParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      audience: z14.enum(["agent", "maintainer"]),
+      tokenBudget: z14.number().int().positive().optional(),
+      includeRelations: z14.boolean().optional(),
+      includeReadiness: z14.boolean().optional(),
+      includeRollup: z14.boolean().optional()
+    });
+    workGraphPlanningDocSchema = z14.object({
+      rootId: z14.string().min(1),
+      generatedAt: z14.string().min(1),
+      audience: z14.enum(["agent", "maintainer"]),
+      title: z14.string().min(1),
+      content: z14.string(),
+      sections: z14.array(z14.string().min(1)),
+      estimatedTokens: z14.number().int().nonnegative(),
+      budget: z14.object({
+        tokenBudget: z14.number().int().positive(),
+        truncated: z14.boolean()
       }).optional()
     });
     tasksTraverseParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      maxDepth: z13.number().int().nonnegative().optional(),
-      includeRelations: z13.boolean().optional()
+      maxDepth: z14.number().int().nonnegative().optional(),
+      includeRelations: z14.boolean().optional()
     });
-    tasksTraverseResultSchema = z13.object({
-      rootId: z13.string().min(1),
+    tasksTraverseResultSchema = z14.object({
+      rootId: z14.string().min(1),
       direction: workGraphTraversalDirectionSchema,
-      nodes: z13.array(workGraphNodeSchema),
-      edges: z13.array(workGraphEdgeSchema),
+      nodes: z14.array(workGraphNodeSchema),
+      edges: z14.array(workGraphEdgeSchema),
       pageInfo: workGraphPageInfoSchema
     });
     tasksTreeParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
-      maxDepth: z13.number().int().nonnegative().optional()
+      rootId: z14.string().min(1),
+      maxDepth: z14.number().int().nonnegative().optional()
     });
-    tasksTreeResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      nodes: z13.array(workGraphNodeSchema.extend({ depth: z13.number().int().positive() })),
-      edges: z13.array(workGraphHierarchyEdgeSchema),
+    tasksTreeResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      nodes: z14.array(workGraphNodeSchema.extend({ depth: z14.number().int().positive() })),
+      edges: z14.array(workGraphHierarchyEdgeSchema),
       pageInfo: workGraphPageInfoSchema
     });
-    tasksRollupParamsSchema = z13.object({
-      rootId: z13.string().min(1),
+    tasksRollupParamsSchema = z14.object({
+      rootId: z14.string().min(1),
       expectedDirectRollup: workGraphRollupCountsSchema.optional()
     });
-    tasksRollupResultSchema = z13.object({
-      rootId: z13.string().min(1),
+    tasksRollupResultSchema = z14.object({
+      rootId: z14.string().min(1),
       direct: workGraphRollupCountsSchema,
       subtree: workGraphRollupCountsSchema,
-      percentDenominator: z13.object({
-        basis: z13.literal("subtree-total"),
-        total: z13.number().int().nonnegative(),
-        description: z13.string().min(1)
+      percentDenominator: z14.object({
+        basis: z14.literal("subtree-total"),
+        total: z14.number().int().nonnegative(),
+        description: z14.string().min(1)
       }),
       percentages: workGraphSubtreePercentagesSchema,
-      staleProjection: z13.boolean(),
-      projectionMismatches: z13.array(workGraphProjectionMismatchSchema)
-    });
-    tasksFrontierParamsSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional()
-    });
-    tasksFrontierResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      role: z13.string().min(1).optional(),
-      groups: z13.object({
-        ready: z13.array(workGraphReadyFrontierTaskSchema),
-        blocked: z13.array(workGraphReadyFrontierTaskSchema),
-        blockedBy: z13.array(
-          z13.discriminatedUnion("kind", [
-            z13.object({
-              kind: z13.literal("dependency"),
-              blockerId: z13.string().min(1),
-              blocks: z13.array(z13.string().min(1))
+      staleProjection: z14.boolean(),
+      projectionMismatches: z14.array(workGraphProjectionMismatchSchema)
+    });
+    tasksFrontierParamsSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional()
+    });
+    tasksFrontierResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      role: z14.string().min(1).optional(),
+      groups: z14.object({
+        ready: z14.array(workGraphReadyFrontierTaskSchema),
+        blocked: z14.array(workGraphReadyFrontierTaskSchema),
+        blockedBy: z14.array(
+          z14.discriminatedUnion("kind", [
+            z14.object({
+              kind: z14.literal("dependency"),
+              blockerId: z14.string().min(1),
+              blocks: z14.array(z14.string().min(1))
             }),
-            z13.object({
-              kind: z13.literal("gate"),
+            z14.object({
+              kind: z14.literal("gate"),
               gate: verificationGateSchema,
-              blocks: z13.array(z13.string().min(1))
+              blocks: z14.array(z14.string().min(1))
             })
           ])
         )
       })
     });
     tasksWorkGraphAuditParamsSchema = paginationParamsSchema.extend({
-      rootId: z13.string().min(1),
-      maxDepth: z13.number().int().nonnegative().optional(),
-      includeRelations: z13.boolean().optional()
-    });
-    tasksWorkGraphAuditResultSchema = z13.object({
-      rootId: z13.string().min(1),
-      hierarchy: z13.object({
-        valid: z13.boolean(),
-        violations: z13.array(
-          z13.object({
-            code: z13.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
-            taskId: z13.string().min(1),
+      rootId: z14.string().min(1),
+      maxDepth: z14.number().int().nonnegative().optional(),
+      includeRelations: z14.boolean().optional()
+    });
+    tasksWorkGraphAuditResultSchema = z14.object({
+      rootId: z14.string().min(1),
+      hierarchy: z14.object({
+        valid: z14.boolean(),
+        violations: z14.array(
+          z14.object({
+            code: z14.literal(E_WORKGRAPH_PARENT_TYPE_MATRIX),
+            taskId: z14.string().min(1),
             taskType: taskTypeSchema,
-            parentId: z13.string().min(1).nullable(),
+            parentId: z14.string().min(1).nullable(),
             parentType: taskTypeSchema.optional(),
-            message: z13.string().min(1)
+            message: z14.string().min(1)
           })
         )
       }),
       traversal: tasksTraverseResultSchema,
       frontier: tasksFrontierResultSchema,
       rollup: tasksRollupResultSchema,
-      relationEdges: z13.object({
-        rootId: z13.string().min(1),
+      relationEdges: z14.object({
+        rootId: z14.string().min(1),
         direction: workGraphEdgeDirectionSchema,
-        edges: z13.array(
-          z13.discriminatedUnion("source", [
+        edges: z14.array(
+          z14.discriminatedUnion("source", [
             workGraphRelationEdgeSchema,
             workGraphDependencyEdgeSchema
           ])
@@ -13816,22 +14791,22 @@ var init_operation_envelope_validation = __esm({
 });
 
 // packages/contracts/src/operations/ensures-schema-registry.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var taskTreeEntrySchema, taskTreeSchema, evidenceSchema, passthroughSchema, LEGACY_PASSTHROUGH_SCHEMA_NAMES, ENSURES_SCHEMA_REGISTRY;
 var init_ensures_schema_registry = __esm({
   "packages/contracts/src/operations/ensures-schema-registry.ts"() {
     "use strict";
-    taskTreeEntrySchema = z14.object({
-      title: z14.string({ message: "title must be a non-empty string" }).refine((s) => s.trim().length > 0, { message: "title must be a non-empty string" }),
-      acceptance: z14.array(z14.unknown(), { message: "must have a non-empty acceptance array" }).min(1, { message: "must have a non-empty acceptance array" }).refine((arr) => arr.some((s) => typeof s === "string" && s.trim().length > 0), {
+    taskTreeEntrySchema = z15.object({
+      title: z15.string({ message: "title must be a non-empty string" }).refine((s) => s.trim().length > 0, { message: "title must be a non-empty string" }),
+      acceptance: z15.array(z15.unknown(), { message: "must have a non-empty acceptance array" }).min(1, { message: "must have a non-empty acceptance array" }).refine((arr) => arr.some((s) => typeof s === "string" && s.trim().length > 0), {
         message: "acceptance array contains no non-empty strings"
       }),
-      id: z14.string().optional(),
-      parentId: z14.string().optional(),
-      depends: z14.array(z14.string()).optional()
+      id: z15.string().optional(),
+      parentId: z15.string().optional(),
+      depends: z15.array(z15.string()).optional()
     });
-    taskTreeSchema = z14.array(taskTreeEntrySchema, { message: "task_tree must be a non-empty array" }).min(1, { message: "task_tree is an empty array \u2014 decomposition produced no tasks" });
-    evidenceSchema = z14.unknown().superRefine((value, ctx) => {
+    taskTreeSchema = z15.array(taskTreeEntrySchema, { message: "task_tree must be a non-empty array" }).min(1, { message: "task_tree is an empty array \u2014 decomposition produced no tasks" });
+    evidenceSchema = z15.unknown().superRefine((value, ctx) => {
       if (value === null || value === void 0) {
         ctx.addIssue({
           code: "custom",
@@ -13865,7 +14840,7 @@ var init_ensures_schema_registry = __esm({
         message: `evidence must be a string, array, or object (got ${typeof value})`
       });
     });
-    passthroughSchema = z14.unknown();
+    passthroughSchema = z15.unknown();
     LEGACY_PASSTHROUGH_SCHEMA_NAMES = [
       // release.cantbook
       "version_bump_report",
@@ -14143,31 +15118,37 @@ var init_peer = __esm({
 });
 
 // packages/contracts/src/release/evidence-atoms.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var parsedPrEvidenceAtomSchema, prEvidenceStateModifierSchema, ghPrViewSchema, PR_REQUIRED_WORKFLOWS;
 var init_evidence_atoms = __esm({
   "packages/contracts/src/release/evidence-atoms.ts"() {
     "use strict";
-    parsedPrEvidenceAtomSchema = z15.object({
-      kind: z15.literal("pr"),
-      prNumber: z15.number().int().positive()
-    });
-    prEvidenceStateModifierSchema = z15.object({
-      kind: z15.literal("state"),
-      value: z15.literal("MERGED")
-    });
-    ghPrViewSchema = z15.object({
-      state: z15.enum(["OPEN", "CLOSED", "MERGED"]),
-      mergedAt: z15.string().nullable(),
-      headRefOid: z15.string().optional(),
-      mergeable: z15.string().optional(),
-      statusCheckRollup: z15.array(
-        z15.object({
-          __typename: z15.string().optional(),
-          name: z15.string().optional(),
-          workflowName: z15.string().optional(),
-          conclusion: z15.string().nullable().optional(),
-          status: z15.string().optional()
+    parsedPrEvidenceAtomSchema = z16.object({
+      kind: z16.literal("pr"),
+      prNumber: z16.number().int().positive()
+    });
+    prEvidenceStateModifierSchema = z16.object({
+      kind: z16.literal("state"),
+      value: z16.literal("MERGED")
+    });
+    ghPrViewSchema = z16.object({
+      state: z16.enum(["OPEN", "CLOSED", "MERGED"]),
+      mergedAt: z16.string().nullable(),
+      headRefOid: z16.string().optional(),
+      mergeCommit: z16.object({ oid: z16.string() }).nullable().optional(),
+      title: z16.string().optional(),
+      body: z16.string().optional(),
+      headRefName: z16.string().optional(),
+      files: z16.array(z16.object({ path: z16.string() })).optional(),
+      changedFiles: z16.number().int().nonnegative().optional(),
+      mergeable: z16.string().optional(),
+      statusCheckRollup: z16.array(
+        z16.object({
+          __typename: z16.string().optional(),
+          name: z16.string().optional(),
+          workflowName: z16.string().optional(),
+          conclusion: z16.string().nullable().optional(),
+          status: z16.string().optional()
         }).passthrough()
       ).optional().default([])
     }).passthrough();
@@ -14180,7 +15161,7 @@ var init_evidence_atoms = __esm({
 });
 
 // packages/contracts/src/release/plan.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var RELEASE_CHANNEL, RELEASE_SCHEME, RELEASE_KIND, RELEASE_STATUS, GATE_STATUS, GATE_NAME, PLATFORM_TUPLE, PUBLISHER, TASK_KIND, IMPACT, RESOLVED_SOURCE, ReleaseChannelSchema, ReleaseSchemeSchema, ReleaseKindSchema, ReleaseStatusSchema, GateStatusSchema, GateNameSchema, PlatformTupleSchema, PublisherSchema, TaskKindSchema, ImpactSchema, ResolvedSourceSchema, Iso8601, NonEmptyString, ReleasePlanTaskSchema, ReleaseGateSchema, ReleasePlatformMatrixEntrySchema, ReleasePreflightSummarySchema, ReleasePlanChangelogSchema, ReleasePlanMetaSchema, ReleasePlanSchema;
 var init_plan = __esm({
   "packages/contracts/src/release/plan.ts"() {
@@ -14223,20 +15204,20 @@ var init_plan = __esm({
     ];
     IMPACT = ["major", "minor", "patch"];
     RESOLVED_SOURCE = ["project-context", "language-default", "legacy-alias"];
-    ReleaseChannelSchema = z16.enum(RELEASE_CHANNEL);
-    ReleaseSchemeSchema = z16.enum(RELEASE_SCHEME);
-    ReleaseKindSchema = z16.enum(RELEASE_KIND);
-    ReleaseStatusSchema = z16.enum(RELEASE_STATUS);
-    GateStatusSchema = z16.enum(GATE_STATUS);
-    GateNameSchema = z16.enum(GATE_NAME);
-    PlatformTupleSchema = z16.enum(PLATFORM_TUPLE);
-    PublisherSchema = z16.enum(PUBLISHER);
-    TaskKindSchema = z16.enum(TASK_KIND);
-    ImpactSchema = z16.enum(IMPACT);
-    ResolvedSourceSchema = z16.enum(RESOLVED_SOURCE);
-    Iso8601 = z16.iso.datetime({ offset: true });
-    NonEmptyString = z16.string().min(1);
-    ReleasePlanTaskSchema = z16.object({
+    ReleaseChannelSchema = z17.enum(RELEASE_CHANNEL);
+    ReleaseSchemeSchema = z17.enum(RELEASE_SCHEME);
+    ReleaseKindSchema = z17.enum(RELEASE_KIND);
+    ReleaseStatusSchema = z17.enum(RELEASE_STATUS);
+    GateStatusSchema = z17.enum(GATE_STATUS);
+    GateNameSchema = z17.enum(GATE_NAME);
+    PlatformTupleSchema = z17.enum(PLATFORM_TUPLE);
+    PublisherSchema = z17.enum(PUBLISHER);
+    TaskKindSchema = z17.enum(TASK_KIND);
+    ImpactSchema = z17.enum(IMPACT);
+    ResolvedSourceSchema = z17.enum(RESOLVED_SOURCE);
+    Iso8601 = z17.iso.datetime({ offset: true });
+    NonEmptyString = z17.string().min(1);
+    ReleasePlanTaskSchema = z17.object({
       /** Task ID (e.g. "T10001"). Format intentionally loose so historical IDs validate. */
       id: NonEmptyString,
       /** Conventional-commit-aligned task classification. */
@@ -14244,20 +15225,20 @@ var init_plan = __esm({
       /** SemVer impact classification. */
       impact: ImpactSchema,
       /** Human-readable changelog line for this task. */
-      userFacingSummary: z16.string(),
+      userFacingSummary: z17.string(),
       /**
        * ADR-051 evidence atoms attesting the task's gate results. Format is
        * `kind:value` (e.g. `commit:abc123`, `test-run:vitest.json`). The contract
        * accepts empty arrays so legacy plans validate; `cleo release plan`
        * enforces non-empty via R-301.
        */
-      evidenceAtoms: z16.array(NonEmptyString),
+      evidenceAtoms: z17.array(NonEmptyString),
       /** IVTR phase at plan time — informational only per R-316. */
-      ivtrPhaseAtPlan: z16.string().optional(),
+      ivtrPhaseAtPlan: z17.string().optional(),
       /** Epic this task rolls up to, locked at plan time per R-303. */
       epicAncestor: NonEmptyString
     });
-    ReleaseGateSchema = z16.object({
+    ReleaseGateSchema = z17.object({
       /** Canonical gate name. */
       name: GateNameSchema,
       /** ADR-051 atom string identifying the resolved tool (e.g. `tool:test`). */
@@ -14267,11 +15248,11 @@ var init_plan = __esm({
       /** ISO-8601 timestamp the gate was last verified. */
       lastVerifiedAt: Iso8601,
       /** Resolved shell command (e.g. `pnpm run test`). Optional for unresolved gates. */
-      resolvedCommand: z16.string().optional(),
+      resolvedCommand: z17.string().optional(),
       /** Provenance of the resolved command. Optional for unresolved gates. */
       resolvedSource: ResolvedSourceSchema.optional()
     });
-    ReleasePlatformMatrixEntrySchema = z16.object({
+    ReleasePlatformMatrixEntrySchema = z17.object({
       /** Target platform tuple. */
       platform: PlatformTupleSchema,
       /** Distribution backend. */
@@ -14279,47 +15260,47 @@ var init_plan = __esm({
       /** Package identifier on the target backend (e.g. `@cleocode/cleo`). */
       package: NonEmptyString,
       /** Whether to run the GHA smoke job for this matrix entry. */
-      smoke: z16.boolean().default(true).optional()
+      smoke: z17.boolean().default(true).optional()
     });
-    ReleasePreflightSummarySchema = z16.object({
+    ReleasePreflightSummarySchema = z17.object({
       /** True if esbuild externals are out of sync with package.json. */
-      esbuildExternalsDrift: z16.boolean(),
+      esbuildExternalsDrift: z17.boolean(),
       /** True if `pnpm-lock.yaml` diverges from the workspace manifest. */
-      lockfileDrift: z16.boolean(),
+      lockfileDrift: z17.boolean(),
       /** True if all epic children are in terminal lifecycle states. */
-      epicCompletenessClean: z16.boolean(),
+      epicCompletenessClean: z17.boolean(),
       /** True if no task appears in multiple in-flight release plans. */
-      doubleListingClean: z16.boolean(),
+      doubleListingClean: z17.boolean(),
       /** Non-fatal preflight warnings (e.g. unresolved tools per R-024). */
-      preflightWarnings: z16.array(z16.string()).default([]).optional()
+      preflightWarnings: z17.array(z17.string()).default([]).optional()
     });
-    ReleasePlanChangelogSchema = z16.object({
+    ReleasePlanChangelogSchema = z17.object({
       /** `kind=feat` tasks. */
-      features: z16.array(NonEmptyString).default([]),
+      features: z17.array(NonEmptyString).default([]),
       /** `kind=fix` or `kind=hotfix` tasks. */
-      fixes: z16.array(NonEmptyString).default([]),
+      fixes: z17.array(NonEmptyString).default([]),
       /** `kind=chore`, `docs`, `refactor`, `test`, `perf` tasks. */
-      chores: z16.array(NonEmptyString).default([]),
+      chores: z17.array(NonEmptyString).default([]),
       /** `kind=breaking` or `kind=revert` tasks. */
-      breaking: z16.array(NonEmptyString).default([])
+      breaking: z17.array(NonEmptyString).default([])
     });
-    ReleasePlanMetaSchema = z16.object({
+    ReleasePlanMetaSchema = z17.object({
       /** True if this is the project's first ever release. */
-      firstEverRelease: z16.boolean().optional(),
+      firstEverRelease: z17.boolean().optional(),
       /** Canonical tool names that could not be resolved at plan time. */
-      unresolvedTools: z16.array(z16.string()).optional(),
+      unresolvedTools: z17.array(z17.string()).optional(),
       /** Project archetype detected at plan time. */
-      archetype: z16.string().optional()
-    }).catchall(z16.unknown());
-    ReleasePlanSchema = z16.object({
+      archetype: z17.string().optional()
+    }).catchall(z17.unknown());
+    ReleasePlanSchema = z17.object({
       /** Schema URL for this plan version. */
-      $schema: z16.string().optional(),
+      $schema: z17.string().optional(),
       /** Requested version string (e.g. "v2026.6.0"). Includes the leading `v`. */
       version: NonEmptyString,
       /** Resolved version string after suffix application (e.g. "v2026.6.0.2"). */
       resolvedVersion: NonEmptyString,
       /** True if a `calver-suffix` was applied to disambiguate a same-day hotfix. */
-      suffixApplied: z16.boolean(),
+      suffixApplied: z17.boolean(),
       /** Versioning scheme governing `version` / `resolvedVersion`. */
       scheme: ReleaseSchemeSchema,
       /** npm dist-tag channel for this release. */
@@ -14336,27 +15317,27 @@ var init_plan = __esm({
        * Version of the previous release on the same channel. MUST be `null` only
        * for first-ever releases (R-300, enforced at the verb layer).
        */
-      previousVersion: z16.string().nullable(),
+      previousVersion: z17.string().nullable(),
       /** Git tag of the previous release (typically `previousVersion` prefixed). */
-      previousTag: z16.string().nullable(),
+      previousTag: z17.string().nullable(),
       /** ISO-8601 timestamp the previous release was published. */
       previousShippedAt: Iso8601.nullable(),
       /** Tasks rolled into this release. */
-      tasks: z16.array(ReleasePlanTaskSchema),
+      tasks: z17.array(ReleasePlanTaskSchema),
       /** Bucketed changelog. */
       changelog: ReleasePlanChangelogSchema,
       /** Per-gate verification status. */
-      gates: z16.array(ReleaseGateSchema),
+      gates: z17.array(ReleaseGateSchema),
       /** Platform / publisher matrix. */
-      platformMatrix: z16.array(ReleasePlatformMatrixEntrySchema),
+      platformMatrix: z17.array(ReleasePlatformMatrixEntrySchema),
       /** Preflight summary from `cleo release plan`. */
       preflightSummary: ReleasePreflightSummarySchema,
       /** URL of the GHA workflow run (populated by `release-prepare.yml`). */
-      workflowRunUrl: z16.string().nullable(),
+      workflowRunUrl: z17.string().nullable(),
       /** URL of the bump PR (populated by `cleo release open`). */
-      prUrl: z16.string().nullable(),
+      prUrl: z17.string().nullable(),
       /** Merge commit SHA on `main` (populated by `release-publish.yml`). */
-      mergeCommitSha: z16.string().nullable(),
+      mergeCommitSha: z17.string().nullable(),
       /** Current FSM state per R-302. */
       status: ReleaseStatusSchema,
       /** Informational / forward-compat metadata. */
@@ -14430,52 +15411,52 @@ var init_session2 = __esm({
 });
 
 // packages/contracts/src/session-journal.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var SESSION_JOURNAL_SCHEMA_VERSION, sessionJournalDoctorSummarySchema, sessionJournalDebriefSummarySchema, sessionJournalEntrySchema;
 var init_session_journal = __esm({
   "packages/contracts/src/session-journal.ts"() {
     "use strict";
     SESSION_JOURNAL_SCHEMA_VERSION = "1.0";
-    sessionJournalDoctorSummarySchema = z17.object({
+    sessionJournalDoctorSummarySchema = z18.object({
       /** `true` when zero noise patterns were detected. */
-      isClean: z17.boolean(),
+      isClean: z18.boolean(),
       /** Total number of noise findings across all patterns. */
-      findingsCount: z17.number().int().nonnegative(),
+      findingsCount: z18.number().int().nonnegative(),
       /** Pattern names that were detected (empty when isClean). */
-      patterns: z17.array(z17.string()),
+      patterns: z18.array(z18.string()),
       /** Total brain entries scanned. `0` = empty or unavailable. */
-      totalScanned: z17.number().int().nonnegative()
+      totalScanned: z18.number().int().nonnegative()
     });
-    sessionJournalDebriefSummarySchema = z17.object({
+    sessionJournalDebriefSummarySchema = z18.object({
       /** First 200 characters of the session end note (if provided). */
-      noteExcerpt: z17.string().max(200).optional(),
+      noteExcerpt: z18.string().max(200).optional(),
       /** Number of tasks completed during the session. */
-      tasksCompletedCount: z17.number().int().nonnegative(),
+      tasksCompletedCount: z18.number().int().nonnegative(),
       /** Up to 5 task IDs (not titles) that were the focus of the session. */
-      tasksFocused: z17.array(z17.string()).max(5).optional()
+      tasksFocused: z18.array(z18.string()).max(5).optional()
     });
-    sessionJournalEntrySchema = z17.object({
+    sessionJournalEntrySchema = z18.object({
       // Identity
       /** Schema version for forward-compatibility. Always `'1.0'` in this release. */
-      schemaVersion: z17.literal(SESSION_JOURNAL_SCHEMA_VERSION),
+      schemaVersion: z18.literal(SESSION_JOURNAL_SCHEMA_VERSION),
       /** ISO 8601 timestamp when the entry was written. */
-      timestamp: z17.string(),
+      timestamp: z18.string(),
       /** CLEO session ID (e.g. `ses_20260424055456_ede571`). */
-      sessionId: z17.string(),
+      sessionId: z18.string(),
       /** Event type that triggered this journal entry. */
-      eventType: z17.enum(["session_start", "session_end", "observation", "decision", "error"]),
+      eventType: z18.enum(["session_start", "session_end", "observation", "decision", "error"]),
       // Session metadata (set on session_start / session_end)
       /** Agent identifier (e.g. `cleo-prime`, `claude-code`). */
-      agentIdentifier: z17.string().optional(),
+      agentIdentifier: z18.string().optional(),
       /** Provider adapter ID active for this session. */
-      providerId: z17.string().optional(),
+      providerId: z18.string().optional(),
       /** Session scope string (e.g. `'global'` or `'epic:T1263'`). */
-      scope: z17.string().optional(),
+      scope: z18.string().optional(),
       // Session-end fields
       /** Duration of the session in seconds (session_end only). */
-      duration: z17.number().int().nonnegative().optional(),
+      duration: z18.number().int().nonnegative().optional(),
       /** Task IDs (not titles) completed during the session. */
-      tasksCompleted: z17.array(z17.string()).optional(),
+      tasksCompleted: z18.array(z18.string()).optional(),
       // Doctor summary (T1262 absorbed)
       /** Compact result of `scanBrainNoise` run at session-end. */
       doctorSummary: sessionJournalDoctorSummarySchema.optional(),
@@ -14484,7 +15465,7 @@ var init_session_journal = __esm({
       debriefSummary: sessionJournalDebriefSummarySchema.optional(),
       // Optional hash chain
       /** SHA-256 hex of the previous entry's raw JSON string (for integrity chain). */
-      prevEntryHash: z17.string().optional()
+      prevEntryHash: z18.string().optional()
     });
   }
 });
@@ -14497,52 +15478,52 @@ var init_task = __esm({
 });
 
 // packages/contracts/src/task-evidence.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var fileEvidenceSchema, logEvidenceSchema, screenshotEvidenceSchema, testOutputEvidenceSchema, commandOutputEvidenceSchema, taskEvidenceSchema;
 var init_task_evidence = __esm({
   "packages/contracts/src/task-evidence.ts"() {
     "use strict";
-    fileEvidenceSchema = z18.object({
-      kind: z18.literal("file"),
-      sha256: z18.string().length(64),
-      timestamp: z18.string().datetime(),
-      path: z18.string().min(1),
-      mime: z18.string().optional(),
-      description: z18.string().optional()
-    });
-    logEvidenceSchema = z18.object({
-      kind: z18.literal("log"),
-      sha256: z18.string().length(64),
-      timestamp: z18.string().datetime(),
-      source: z18.string().min(1),
-      description: z18.string().optional()
-    });
-    screenshotEvidenceSchema = z18.object({
-      kind: z18.literal("screenshot"),
-      sha256: z18.string().length(64),
-      timestamp: z18.string().datetime(),
-      mime: z18.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
-      description: z18.string().optional()
-    });
-    testOutputEvidenceSchema = z18.object({
-      kind: z18.literal("test-output"),
-      sha256: z18.string().length(64),
-      timestamp: z18.string().datetime(),
-      passed: z18.number().int().nonnegative(),
-      failed: z18.number().int().nonnegative(),
-      skipped: z18.number().int().nonnegative(),
-      exitCode: z18.number().int(),
-      description: z18.string().optional()
-    });
-    commandOutputEvidenceSchema = z18.object({
-      kind: z18.literal("command-output"),
-      sha256: z18.string().length(64),
-      timestamp: z18.string().datetime(),
-      cmd: z18.string().min(1),
-      exitCode: z18.number().int(),
-      description: z18.string().optional()
-    });
-    taskEvidenceSchema = z18.discriminatedUnion("kind", [
+    fileEvidenceSchema = z19.object({
+      kind: z19.literal("file"),
+      sha256: z19.string().length(64),
+      timestamp: z19.string().datetime(),
+      path: z19.string().min(1),
+      mime: z19.string().optional(),
+      description: z19.string().optional()
+    });
+    logEvidenceSchema = z19.object({
+      kind: z19.literal("log"),
+      sha256: z19.string().length(64),
+      timestamp: z19.string().datetime(),
+      source: z19.string().min(1),
+      description: z19.string().optional()
+    });
+    screenshotEvidenceSchema = z19.object({
+      kind: z19.literal("screenshot"),
+      sha256: z19.string().length(64),
+      timestamp: z19.string().datetime(),
+      mime: z19.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
+      description: z19.string().optional()
+    });
+    testOutputEvidenceSchema = z19.object({
+      kind: z19.literal("test-output"),
+      sha256: z19.string().length(64),
+      timestamp: z19.string().datetime(),
+      passed: z19.number().int().nonnegative(),
+      failed: z19.number().int().nonnegative(),
+      skipped: z19.number().int().nonnegative(),
+      exitCode: z19.number().int(),
+      description: z19.string().optional()
+    });
+    commandOutputEvidenceSchema = z19.object({
+      kind: z19.literal("command-output"),
+      sha256: z19.string().length(64),
+      timestamp: z19.string().datetime(),
+      cmd: z19.string().min(1),
+      exitCode: z19.number().int(),
+      description: z19.string().optional()
+    });
+    taskEvidenceSchema = z19.discriminatedUnion("kind", [
       fileEvidenceSchema,
       logEvidenceSchema,
       screenshotEvidenceSchema,
@@ -14553,12 +15534,12 @@ var init_task_evidence = __esm({
 });
 
 // packages/contracts/src/tasks/archive.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var ArchiveReason, ARCHIVE_REASON_VALUES;
 var init_archive = __esm({
   "packages/contracts/src/tasks/archive.ts"() {
     "use strict";
-    ArchiveReason = z19.enum([
+    ArchiveReason = z20.enum([
       "verified",
       "reconciled",
       "superseded",
@@ -14571,47 +15552,47 @@ var init_archive = __esm({
 });
 
 // packages/contracts/src/tasks.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var taskMutationWarningSeveritySchema, taskMutationWarningSchema, taskMutationDryRunSummarySchema, taskMutationTaskRecordSchema, taskMutationEnvelopeSchema, completionTaskStatusSchema, completionCriterionKindSchema, completionCriterionStatusSchema, completionBlockerReasonSchema, completionStaleReasonSchema, completionProjectionRepairErrorCodeSchema, completionCriterionWaiverSchema, completionCriterionReplacementSchema, completionCriterionEvaluationSchema, unsatisfiedCompletionCriterionSchema, completionTotalsSchema, completionContextPackSchema, completionEvaluationSchema, completionExplanationSchema, completionListParamsSchema, completionListResultSchema, completionEvaluateParamsSchema, completionProjectionRepairErrorSchema, completionProjectionRepairParamsSchema, completionProjectionRepairResultSchema;
 var init_tasks2 = __esm({
   "packages/contracts/src/tasks.ts"() {
     "use strict";
     init_status_registry();
-    taskMutationWarningSeveritySchema = z20.enum(["info", "warning"]);
-    taskMutationWarningSchema = z20.object({
-      code: z20.string().min(1),
-      message: z20.string().min(1),
+    taskMutationWarningSeveritySchema = z21.enum(["info", "warning"]);
+    taskMutationWarningSchema = z21.object({
+      code: z21.string().min(1),
+      message: z21.string().min(1),
       severity: taskMutationWarningSeveritySchema.optional(),
-      taskId: z20.string().min(1).optional(),
-      field: z20.string().min(1).optional(),
-      index: z20.number().int().nonnegative().optional()
-    });
-    taskMutationDryRunSummarySchema = z20.object({
-      dryRun: z20.literal(true),
-      wouldCreate: z20.number().int().nonnegative(),
-      wouldUpdate: z20.number().int().nonnegative(),
-      wouldDelete: z20.number().int().nonnegative(),
-      wouldAffect: z20.number().int().nonnegative(),
-      validatedCount: z20.number().int().nonnegative(),
-      insertedCount: z20.literal(0),
-      updatedCount: z20.literal(0),
-      deletedCount: z20.literal(0),
-      warnings: z20.array(taskMutationWarningSchema)
-    });
-    taskMutationTaskRecordSchema = z20.object({ id: z20.string().min(1) }).passthrough();
-    taskMutationEnvelopeSchema = z20.object({
-      dryRun: z20.boolean().optional(),
-      created: z20.array(taskMutationTaskRecordSchema),
-      updated: z20.array(taskMutationTaskRecordSchema),
-      deleted: z20.array(taskMutationTaskRecordSchema),
-      affectedCount: z20.number().int().nonnegative(),
-      mutationWarnings: z20.array(taskMutationWarningSchema),
+      taskId: z21.string().min(1).optional(),
+      field: z21.string().min(1).optional(),
+      index: z21.number().int().nonnegative().optional()
+    });
+    taskMutationDryRunSummarySchema = z21.object({
+      dryRun: z21.literal(true),
+      wouldCreate: z21.number().int().nonnegative(),
+      wouldUpdate: z21.number().int().nonnegative(),
+      wouldDelete: z21.number().int().nonnegative(),
+      wouldAffect: z21.number().int().nonnegative(),
+      validatedCount: z21.number().int().nonnegative(),
+      insertedCount: z21.literal(0),
+      updatedCount: z21.literal(0),
+      deletedCount: z21.literal(0),
+      warnings: z21.array(taskMutationWarningSchema)
+    });
+    taskMutationTaskRecordSchema = z21.object({ id: z21.string().min(1) }).passthrough();
+    taskMutationEnvelopeSchema = z21.object({
+      dryRun: z21.boolean().optional(),
+      created: z21.array(taskMutationTaskRecordSchema),
+      updated: z21.array(taskMutationTaskRecordSchema),
+      deleted: z21.array(taskMutationTaskRecordSchema),
+      affectedCount: z21.number().int().nonnegative(),
+      mutationWarnings: z21.array(taskMutationWarningSchema),
       dryRunSummary: taskMutationDryRunSummarySchema.optional()
     });
-    completionTaskStatusSchema = z20.enum(TASK_STATUSES);
-    completionCriterionKindSchema = z20.enum(["text", "evidence_bound", "child_task"]);
-    completionCriterionStatusSchema = z20.enum(["satisfied", "unsatisfied", "waived", "replaced"]);
-    completionBlockerReasonSchema = z20.enum([
+    completionTaskStatusSchema = z21.enum(TASK_STATUSES);
+    completionCriterionKindSchema = z21.enum(["text", "evidence_bound", "child_task"]);
+    completionCriterionStatusSchema = z21.enum(["satisfied", "unsatisfied", "waived", "replaced"]);
+    completionBlockerReasonSchema = z21.enum([
       "missing_evidence_binding",
       "child_not_done",
       "child_cancelled_requires_waiver",
@@ -14619,68 +15600,68 @@ var init_tasks2 = __esm({
       "child_missing",
       "done_parent_stale"
     ]);
-    completionStaleReasonSchema = z20.enum(["done_parent_has_unsatisfied_criteria"]);
-    completionProjectionRepairErrorCodeSchema = z20.enum([
+    completionStaleReasonSchema = z21.enum(["done_parent_has_unsatisfied_criteria"]);
+    completionProjectionRepairErrorCodeSchema = z21.enum([
       "projection_not_stale",
       "criteria_missing",
       "binding_target_missing",
       "repair_conflict"
     ]);
-    completionCriterionWaiverSchema = z20.object({
-      criterionAcId: z20.string().min(1),
-      childTaskId: z20.string().min(1),
-      reason: z20.string().min(1),
-      actor: z20.string().min(1),
-      waivedAt: z20.string().min(1)
-    });
-    completionCriterionReplacementSchema = z20.object({
-      criterionAcId: z20.string().min(1),
-      originalChildTaskId: z20.string().min(1),
-      replacementChildTaskId: z20.string().min(1),
-      reason: z20.string().min(1),
-      actor: z20.string().min(1),
-      replacedAt: z20.string().min(1)
-    });
-    completionCriterionEvaluationSchema = z20.object({
-      acId: z20.string().min(1),
-      alias: z20.string().min(1),
-      text: z20.string(),
+    completionCriterionWaiverSchema = z21.object({
+      criterionAcId: z21.string().min(1),
+      childTaskId: z21.string().min(1),
+      reason: z21.string().min(1),
+      actor: z21.string().min(1),
+      waivedAt: z21.string().min(1)
+    });
+    completionCriterionReplacementSchema = z21.object({
+      criterionAcId: z21.string().min(1),
+      originalChildTaskId: z21.string().min(1),
+      replacementChildTaskId: z21.string().min(1),
+      reason: z21.string().min(1),
+      actor: z21.string().min(1),
+      replacedAt: z21.string().min(1)
+    });
+    completionCriterionEvaluationSchema = z21.object({
+      acId: z21.string().min(1),
+      alias: z21.string().min(1),
+      text: z21.string(),
       kind: completionCriterionKindSchema,
       status: completionCriterionStatusSchema,
       reason: completionBlockerReasonSchema.optional(),
-      targetTaskId: z20.string().min(1).optional(),
+      targetTaskId: z21.string().min(1).optional(),
       targetTaskStatus: completionTaskStatusSchema.optional(),
       waiver: completionCriterionWaiverSchema.optional(),
       replacement: completionCriterionReplacementSchema.optional(),
       replacementTaskStatus: completionTaskStatusSchema.optional(),
-      evidenceBindings: z20.number().int().nonnegative()
+      evidenceBindings: z21.number().int().nonnegative()
     });
     unsatisfiedCompletionCriterionSchema = completionCriterionEvaluationSchema.extend({
-      status: z20.literal("unsatisfied"),
+      status: z21.literal("unsatisfied"),
       reason: completionBlockerReasonSchema
     });
-    completionTotalsSchema = z20.object({
-      criteria: z20.number().int().nonnegative(),
-      satisfied: z20.number().int().nonnegative(),
-      unsatisfied: z20.number().int().nonnegative(),
-      waived: z20.number().int().nonnegative(),
-      replaced: z20.number().int().nonnegative()
-    });
-    completionContextPackSchema = z20.object({
-      taskId: z20.string().min(1),
-      generatedAt: z20.string().min(1),
-      source: z20.literal("audit_log"),
-      window: z20.object({
-        limit: z20.number().int().positive(),
-        since: z20.string().min(1).optional(),
-        relationDepth: z20.number().int().nonnegative(),
-        relatedTaskIds: z20.array(z20.string().min(1))
+    completionTotalsSchema = z21.object({
+      criteria: z21.number().int().nonnegative(),
+      satisfied: z21.number().int().nonnegative(),
+      unsatisfied: z21.number().int().nonnegative(),
+      waived: z21.number().int().nonnegative(),
+      replaced: z21.number().int().nonnegative()
+    });
+    completionContextPackSchema = z21.object({
+      taskId: z21.string().min(1),
+      generatedAt: z21.string().min(1),
+      source: z21.literal("audit_log"),
+      window: z21.object({
+        limit: z21.number().int().positive(),
+        since: z21.string().min(1).optional(),
+        relationDepth: z21.number().int().nonnegative(),
+        relatedTaskIds: z21.array(z21.string().min(1))
       }),
-      events: z20.array(
-        z20.object({
-          id: z20.string().min(1),
-          timestamp: z20.string().min(1),
-          action: z20.enum([
+      events: z21.array(
+        z21.object({
+          id: z21.string().min(1),
+          timestamp: z21.string().min(1),
+          action: z21.enum([
             "task_completed",
             "task_reopened",
             "task_cancelled",
@@ -14688,77 +15669,77 @@ var init_tasks2 = __esm({
             "task_reparented",
             "ac_projection_rebuilt"
           ]),
-          taskId: z20.string().min(1),
-          relation: z20.enum(["self", "parent", "child", "sibling", "related"]),
-          actor: z20.string().min(1),
-          details: z20.record(z20.string(), z20.unknown()).optional(),
-          before: z20.record(z20.string(), z20.unknown()).optional(),
-          after: z20.record(z20.string(), z20.unknown()).optional()
+          taskId: z21.string().min(1),
+          relation: z21.enum(["self", "parent", "child", "sibling", "related"]),
+          actor: z21.string().min(1),
+          details: z21.record(z21.string(), z21.unknown()).optional(),
+          before: z21.record(z21.string(), z21.unknown()).optional(),
+          after: z21.record(z21.string(), z21.unknown()).optional()
         })
       ),
-      summary: z20.object({
-        totalEvents: z20.number().int().nonnegative(),
-        byAction: z20.record(z20.string(), z20.number().int().nonnegative()),
-        byRelation: z20.record(z20.string(), z20.number().int().nonnegative()),
-        latestEventAt: z20.string().nullable()
+      summary: z21.object({
+        totalEvents: z21.number().int().nonnegative(),
+        byAction: z21.record(z21.string(), z21.number().int().nonnegative()),
+        byRelation: z21.record(z21.string(), z21.number().int().nonnegative()),
+        latestEventAt: z21.string().nullable()
       })
     });
-    completionEvaluationSchema = z20.object({
-      taskId: z20.string().min(1),
+    completionEvaluationSchema = z21.object({
+      taskId: z21.string().min(1),
       taskStatus: completionTaskStatusSchema,
-      ready: z20.boolean(),
-      stale: z20.boolean(),
-      staleReasons: z20.array(completionStaleReasonSchema),
+      ready: z21.boolean(),
+      stale: z21.boolean(),
+      staleReasons: z21.array(completionStaleReasonSchema),
       contextPack: completionContextPackSchema.optional(),
-      satisfied: z20.array(completionCriterionEvaluationSchema),
-      unsatisfied: z20.array(unsatisfiedCompletionCriterionSchema),
-      waived: z20.array(completionCriterionEvaluationSchema),
-      replaced: z20.array(completionCriterionEvaluationSchema),
+      satisfied: z21.array(completionCriterionEvaluationSchema),
+      unsatisfied: z21.array(unsatisfiedCompletionCriterionSchema),
+      waived: z21.array(completionCriterionEvaluationSchema),
+      replaced: z21.array(completionCriterionEvaluationSchema),
       totals: completionTotalsSchema
     });
-    completionExplanationSchema = z20.object({
-      taskId: z20.string().min(1),
-      ready: z20.boolean(),
-      stale: z20.boolean(),
-      summary: z20.string(),
+    completionExplanationSchema = z21.object({
+      taskId: z21.string().min(1),
+      ready: z21.boolean(),
+      stale: z21.boolean(),
+      summary: z21.string(),
       contextPack: completionContextPackSchema.optional(),
-      blockers: z20.array(completionCriterionEvaluationSchema)
+      blockers: z21.array(completionCriterionEvaluationSchema)
     });
-    completionListParamsSchema = z20.object({
-      taskId: z20.string().min(1),
+    completionListParamsSchema = z21.object({
+      taskId: z21.string().min(1),
       status: completionCriterionStatusSchema.optional(),
       kind: completionCriterionKindSchema.optional()
     });
-    completionListResultSchema = z20.object({
-      taskId: z20.string().min(1),
-      criteria: z20.array(completionCriterionEvaluationSchema),
+    completionListResultSchema = z21.object({
+      taskId: z21.string().min(1),
+      criteria: z21.array(completionCriterionEvaluationSchema),
       totals: completionTotalsSchema
     });
-    completionEvaluateParamsSchema = z20.object({
-      taskId: z20.string().min(1),
-      includeContext: z20.boolean().optional(),
-      limit: z20.number().int().positive().optional(),
-      since: z20.string().min(1).optional(),
-      relationDepth: z20.number().int().nonnegative().optional()
+    completionEvaluateParamsSchema = z21.object({
+      taskId: z21.string().min(1),
+      includeContext: z21.boolean().optional(),
+      limit: z21.number().int().positive().optional(),
+      since: z21.string().min(1).optional(),
+      relationDepth: z21.number().int().nonnegative().optional()
     });
-    completionProjectionRepairErrorSchema = z20.object({
+    completionProjectionRepairErrorSchema = z21.object({
       code: completionProjectionRepairErrorCodeSchema,
-      message: z20.string().min(1),
-      taskId: z20.string().min(1),
-      acId: z20.string().min(1).optional(),
-      evidenceAtomId: z20.string().min(1).optional()
+      message: z21.string().min(1),
+      taskId: z21.string().min(1),
+      acId: z21.string().min(1).optional(),
+      evidenceAtomId: z21.string().min(1).optional()
     });
-    completionProjectionRepairParamsSchema = z20.object({
-      taskId: z20.string().min(1),
-      dryRun: z20.boolean().optional()
+    completionProjectionRepairParamsSchema = z21.object({
+      taskId: z21.string().min(1),
+      dryRun: z21.boolean().optional()
     });
-    completionProjectionRepairResultSchema = z20.object({
-      taskId: z20.string().min(1),
-      repaired: z20.boolean(),
-      dryRun: z20.boolean(),
-      staleBefore: z20.boolean(),
-      staleAfter: z20.boolean(),
-      errors: z20.array(completionProjectionRepairErrorSchema)
+    completionProjectionRepairResultSchema = z21.object({
+      taskId: z21.string().min(1),
+      repaired: z21.boolean(),
+      dryRun: z21.boolean(),
+      staleBefore: z21.boolean(),
+      staleAfter: z21.boolean(),
+      errors: z21.array(completionProjectionRepairErrorSchema)
     });
   }
 });
@@ -15269,7 +16250,7 @@ var init_taxonomy = __esm({
 });
 
 // packages/contracts/src/templates/manifest.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var TEMPLATE_KINDS, TEMPLATE_SUBSTITUTIONS, TEMPLATE_UPDATE_STRATEGIES, PLACEHOLDER_SOURCES, PlaceholderSpecSchema, TemplateManifestEntrySchema;
 var init_manifest2 = __esm({
   "packages/contracts/src/templates/manifest.ts"() {
@@ -15290,85 +16271,85 @@ var init_manifest2 = __esm({
       "tool-resolver",
       "literal"
     ];
-    PlaceholderSpecSchema = z21.object({
+    PlaceholderSpecSchema = z22.object({
       /**
        * Placeholder identifier as it appears in the template body
        * (e.g. `NODE_VERSION` matches `{{NODE_VERSION}}`).
        */
-      name: z21.string().min(1, "placeholder name must be non-empty"),
+      name: z22.string().min(1, "placeholder name must be non-empty"),
       /** Resolver source the installer consults for this placeholder. */
-      source: z21.enum(PLACEHOLDER_SOURCES),
+      source: z22.enum(PLACEHOLDER_SOURCES),
       /**
        * Path expression evaluated against `source` (e.g. `engines.node` against
        * `project-context`, `defaults.branchModel` against `.cleo/config`).
        * For `literal` source, this MAY be the literal value's identifier.
        */
-      sourcePath: z21.string().min(1, "placeholder sourcePath must be non-empty"),
+      sourcePath: z22.string().min(1, "placeholder sourcePath must be non-empty"),
       /**
        * Fallback value used when `source[sourcePath]` resolves to `undefined`.
        * `null` is permitted to explicitly mark "no default — failure required".
        */
-      defaultValue: z21.union([z21.string(), z21.number(), z21.boolean(), z21.null()]).optional()
+      defaultValue: z22.union([z22.string(), z22.number(), z22.boolean(), z22.null()]).optional()
     });
-    TemplateManifestEntrySchema = z21.object({
+    TemplateManifestEntrySchema = z22.object({
       /** Stable identifier for this template entry. */
-      id: z21.string().min(1, "id must be non-empty"),
+      id: z22.string().min(1, "id must be non-empty"),
       /** Category of file this template represents. */
-      kind: z21.enum(TEMPLATE_KINDS),
+      kind: z22.enum(TEMPLATE_KINDS),
       /** Repo-relative path of the template source file. */
-      sourcePath: z21.string().min(1, "sourcePath must be non-empty"),
+      sourcePath: z22.string().min(1, "sourcePath must be non-empty"),
       /** Project-relative path where the rendered template installs. */
-      installPath: z21.string().min(1, "installPath must be non-empty"),
+      installPath: z22.string().min(1, "installPath must be non-empty"),
       /** Substitution strategy the installer applies to `sourcePath`. */
-      substitution: z21.enum(TEMPLATE_SUBSTITUTIONS),
+      substitution: z22.enum(TEMPLATE_SUBSTITUTIONS),
       /** Declared placeholders this template requires. May be empty. */
-      placeholders: z21.array(PlaceholderSpecSchema),
+      placeholders: z22.array(PlaceholderSpecSchema),
       /** Reconciliation policy on upgrade. */
-      updateStrategy: z21.enum(TEMPLATE_UPDATE_STRATEGIES)
+      updateStrategy: z22.enum(TEMPLATE_UPDATE_STRATEGIES)
     });
   }
 });
 
 // packages/contracts/src/validator/index.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var VALIDATOR_ID_REGEX, validatorFindingSchema, validatorAttestationSchema, validatorRejectionSchema, validatorVerdictSchema;
 var init_validator = __esm({
   "packages/contracts/src/validator/index.ts"() {
     "use strict";
     VALIDATOR_ID_REGEX = /^validator-[a-z0-9][a-z0-9-]*$/;
-    validatorFindingSchema = z22.object({
-      acId: z22.string().min(1, "acId must be non-empty"),
-      status: z22.enum(["pass", "fail", "inconclusive"]),
-      reasoning: z22.string().min(1, "reasoning must be non-empty"),
-      evidenceRefs: z22.array(z22.string()).optional(),
-      checkedAt: z22.string().min(1, "checkedAt must be a non-empty ISO-8601 string")
-    });
-    validatorAttestationSchema = z22.object({
-      verdict: z22.literal("attest"),
-      taskId: z22.string().min(1),
-      validatorId: z22.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
-      findings: z22.array(validatorFindingSchema).min(1, "attestation must contain at least one finding").refine(
+    validatorFindingSchema = z23.object({
+      acId: z23.string().min(1, "acId must be non-empty"),
+      status: z23.enum(["pass", "fail", "inconclusive"]),
+      reasoning: z23.string().min(1, "reasoning must be non-empty"),
+      evidenceRefs: z23.array(z23.string()).optional(),
+      checkedAt: z23.string().min(1, "checkedAt must be a non-empty ISO-8601 string")
+    });
+    validatorAttestationSchema = z23.object({
+      verdict: z23.literal("attest"),
+      taskId: z23.string().min(1),
+      validatorId: z23.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z23.array(validatorFindingSchema).min(1, "attestation must contain at least one finding").refine(
         (findings) => findings.every((f) => f.status === "pass"),
         'attestation requires every finding to have status="pass"'
       ),
-      summary: z22.string().optional(),
-      attestedAt: z22.string().min(1),
-      schemaVersion: z22.literal("1")
-    });
-    validatorRejectionSchema = z22.object({
-      verdict: z22.literal("reject"),
-      taskId: z22.string().min(1),
-      validatorId: z22.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
-      findings: z22.array(validatorFindingSchema).min(1, "rejection must contain at least one finding").refine(
+      summary: z23.string().optional(),
+      attestedAt: z23.string().min(1),
+      schemaVersion: z23.literal("1")
+    });
+    validatorRejectionSchema = z23.object({
+      verdict: z23.literal("reject"),
+      taskId: z23.string().min(1),
+      validatorId: z23.string().regex(VALIDATOR_ID_REGEX, "validatorId must match the pattern validator-<discriminator>"),
+      findings: z23.array(validatorFindingSchema).min(1, "rejection must contain at least one finding").refine(
         (findings) => findings.some((f) => f.status !== "pass"),
         'rejection requires at least one finding with status "fail" or "inconclusive"'
       ),
-      summary: z22.string().min(1, "rejection summary must be non-empty"),
-      remediationHints: z22.array(z22.string()).optional(),
-      rejectedAt: z22.string().min(1),
-      schemaVersion: z22.literal("1")
+      summary: z23.string().min(1, "rejection summary must be non-empty"),
+      remediationHints: z23.array(z23.string()).optional(),
+      rejectedAt: z23.string().min(1),
+      schemaVersion: z23.literal("1")
     });
-    validatorVerdictSchema = z22.discriminatedUnion("verdict", [
+    validatorVerdictSchema = z23.discriminatedUnion("verdict", [
       validatorAttestationSchema,
       validatorRejectionSchema
     ]);
@@ -30234,7 +31215,7 @@ function resolveRef(ref, ctx) {
 function convertBaseSchema(schema, ctx) {
   if (schema.not !== void 0) {
     if (typeof schema.not === "object" && Object.keys(schema.not).length === 0) {
-      return z23.never();
+      return z24.never();
     }
     throw new Error("not is not supported in Zod (except { not: {} } for never)");
   }
@@ -30256,7 +31237,7 @@ function convertBaseSchema(schema, ctx) {
       return ctx.refs.get(refPath);
     }
     if (ctx.processing.has(refPath)) {
-      return z23.lazy(() => {
+      return z24.lazy(() => {
         if (!ctx.refs.has(refPath)) {
           throw new Error(`Circular reference not resolved: ${refPath}`);
         }
@@ -30273,25 +31254,25 @@ function convertBaseSchema(schema, ctx) {
   if (schema.enum !== void 0) {
     const enumValues = schema.enum;
     if (ctx.version === "openapi-3.0" && schema.nullable === true && enumValues.length === 1 && enumValues[0] === null) {
-      return z23.null();
+      return z24.null();
     }
     if (enumValues.length === 0) {
-      return z23.never();
+      return z24.never();
     }
     if (enumValues.length === 1) {
-      return z23.literal(enumValues[0]);
+      return z24.literal(enumValues[0]);
     }
     if (enumValues.every((v) => typeof v === "string")) {
-      return z23.enum(enumValues);
+      return z24.enum(enumValues);
     }
-    const literalSchemas = enumValues.map((v) => z23.literal(v));
+    const literalSchemas = enumValues.map((v) => z24.literal(v));
     if (literalSchemas.length < 2) {
       return literalSchemas[0];
     }
-    return z23.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
+    return z24.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
   }
   if (schema.const !== void 0) {
-    return z23.literal(schema.const);
+    return z24.literal(schema.const);
   }
   const type = schema.type;
   if (Array.isArray(type)) {
@@ -30300,68 +31281,68 @@ function convertBaseSchema(schema, ctx) {
       return convertBaseSchema(typeSchema, ctx);
     });
     if (typeSchemas.length === 0) {
-      return z23.never();
+      return z24.never();
     }
     if (typeSchemas.length === 1) {
       return typeSchemas[0];
     }
-    return z23.union(typeSchemas);
+    return z24.union(typeSchemas);
   }
   if (!type) {
-    return z23.any();
+    return z24.any();
   }
   let zodSchema2;
   switch (type) {
     case "string": {
-      let stringSchema = z23.string();
+      let stringSchema = z24.string();
       if (schema.format) {
         const format = schema.format;
         if (format === "email") {
-          stringSchema = stringSchema.check(z23.email());
+          stringSchema = stringSchema.check(z24.email());
         } else if (format === "uri" || format === "uri-reference") {
-          stringSchema = stringSchema.check(z23.url());
+          stringSchema = stringSchema.check(z24.url());
         } else if (format === "uuid" || format === "guid") {
-          stringSchema = stringSchema.check(z23.uuid());
+          stringSchema = stringSchema.check(z24.uuid());
         } else if (format === "date-time") {
-          stringSchema = stringSchema.check(z23.iso.datetime());
+          stringSchema = stringSchema.check(z24.iso.datetime());
         } else if (format === "date") {
-          stringSchema = stringSchema.check(z23.iso.date());
+          stringSchema = stringSchema.check(z24.iso.date());
         } else if (format === "time") {
-          stringSchema = stringSchema.check(z23.iso.time());
+          stringSchema = stringSchema.check(z24.iso.time());
         } else if (format === "duration") {
-          stringSchema = stringSchema.check(z23.iso.duration());
+          stringSchema = stringSchema.check(z24.iso.duration());
         } else if (format === "ipv4") {
-          stringSchema = stringSchema.check(z23.ipv4());
+          stringSchema = stringSchema.check(z24.ipv4());
         } else if (format === "ipv6") {
-          stringSchema = stringSchema.check(z23.ipv6());
+          stringSchema = stringSchema.check(z24.ipv6());
         } else if (format === "mac") {
-          stringSchema = stringSchema.check(z23.mac());
+          stringSchema = stringSchema.check(z24.mac());
         } else if (format === "cidr") {
-          stringSchema = stringSchema.check(z23.cidrv4());
+          stringSchema = stringSchema.check(z24.cidrv4());
         } else if (format === "cidr-v6") {
-          stringSchema = stringSchema.check(z23.cidrv6());
+          stringSchema = stringSchema.check(z24.cidrv6());
         } else if (format === "base64") {
-          stringSchema = stringSchema.check(z23.base64());
+          stringSchema = stringSchema.check(z24.base64());
         } else if (format === "base64url") {
-          stringSchema = stringSchema.check(z23.base64url());
+          stringSchema = stringSchema.check(z24.base64url());
         } else if (format === "e164") {
-          stringSchema = stringSchema.check(z23.e164());
+          stringSchema = stringSchema.check(z24.e164());
         } else if (format === "jwt") {
-          stringSchema = stringSchema.check(z23.jwt());
+          stringSchema = stringSchema.check(z24.jwt());
         } else if (format === "emoji") {
-          stringSchema = stringSchema.check(z23.emoji());
+          stringSchema = stringSchema.check(z24.emoji());
         } else if (format === "nanoid") {
-          stringSchema = stringSchema.check(z23.nanoid());
+          stringSchema = stringSchema.check(z24.nanoid());
         } else if (format === "cuid") {
-          stringSchema = stringSchema.check(z23.cuid());
+          stringSchema = stringSchema.check(z24.cuid());
         } else if (format === "cuid2") {
-          stringSchema = stringSchema.check(z23.cuid2());
+          stringSchema = stringSchema.check(z24.cuid2());
         } else if (format === "ulid") {
-          stringSchema = stringSchema.check(z23.ulid());
+          stringSchema = stringSchema.check(z24.ulid());
         } else if (format === "xid") {
-          stringSchema = stringSchema.check(z23.xid());
+          stringSchema = stringSchema.check(z24.xid());
         } else if (format === "ksuid") {
-          stringSchema = stringSchema.check(z23.ksuid());
+          stringSchema = stringSchema.check(z24.ksuid());
         }
       }
       if (typeof schema.minLength === "number") {
@@ -30378,7 +31359,7 @@ function convertBaseSchema(schema, ctx) {
     }
     case "number":
     case "integer": {
-      let numberSchema = type === "integer" ? z23.number().int() : z23.number();
+      let numberSchema = type === "integer" ? z24.number().int() : z24.number();
       if (typeof schema.minimum === "number") {
         numberSchema = numberSchema.min(schema.minimum);
       }
@@ -30402,11 +31383,11 @@ function convertBaseSchema(schema, ctx) {
       break;
     }
     case "boolean": {
-      zodSchema2 = z23.boolean();
+      zodSchema2 = z24.boolean();
       break;
     }
     case "null": {
-      zodSchema2 = z23.null();
+      zodSchema2 = z24.null();
       break;
     }
     case "object": {
@@ -30419,14 +31400,14 @@ function convertBaseSchema(schema, ctx) {
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
-        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z23.any();
+        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z24.any();
         if (Object.keys(shape).length === 0) {
-          zodSchema2 = z23.record(keySchema, valueSchema);
+          zodSchema2 = z24.record(keySchema, valueSchema);
           break;
         }
-        const objectSchema2 = z23.object(shape).passthrough();
-        const recordSchema = z23.looseRecord(keySchema, valueSchema);
-        zodSchema2 = z23.intersection(objectSchema2, recordSchema);
+        const objectSchema2 = z24.object(shape).passthrough();
+        const recordSchema = z24.looseRecord(keySchema, valueSchema);
+        zodSchema2 = z24.intersection(objectSchema2, recordSchema);
         break;
       }
       if (schema.patternProperties) {
@@ -30435,28 +31416,28 @@ function convertBaseSchema(schema, ctx) {
         const looseRecords = [];
         for (const pattern of patternKeys) {
           const patternValue = convertSchema(patternProps[pattern], ctx);
-          const keySchema = z23.string().regex(new RegExp(pattern));
-          looseRecords.push(z23.looseRecord(keySchema, patternValue));
+          const keySchema = z24.string().regex(new RegExp(pattern));
+          looseRecords.push(z24.looseRecord(keySchema, patternValue));
         }
         const schemasToIntersect = [];
         if (Object.keys(shape).length > 0) {
-          schemasToIntersect.push(z23.object(shape).passthrough());
+          schemasToIntersect.push(z24.object(shape).passthrough());
         }
         schemasToIntersect.push(...looseRecords);
         if (schemasToIntersect.length === 0) {
-          zodSchema2 = z23.object({}).passthrough();
+          zodSchema2 = z24.object({}).passthrough();
         } else if (schemasToIntersect.length === 1) {
           zodSchema2 = schemasToIntersect[0];
         } else {
-          let result = z23.intersection(schemasToIntersect[0], schemasToIntersect[1]);
+          let result = z24.intersection(schemasToIntersect[0], schemasToIntersect[1]);
           for (let i = 2; i < schemasToIntersect.length; i++) {
-            result = z23.intersection(result, schemasToIntersect[i]);
+            result = z24.intersection(result, schemasToIntersect[i]);
           }
           zodSchema2 = result;
         }
         break;
       }
-      const objectSchema = z23.object(shape);
+      const objectSchema = z24.object(shape);
       if (schema.additionalProperties === false) {
         zodSchema2 = objectSchema.strict();
       } else if (typeof schema.additionalProperties === "object") {
@@ -30473,33 +31454,33 @@ function convertBaseSchema(schema, ctx) {
         const tupleItems = prefixItems.map((item) => convertSchema(item, ctx));
         const rest = items && typeof items === "object" && !Array.isArray(items) ? convertSchema(items, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z23.tuple(tupleItems).rest(rest);
+          zodSchema2 = z24.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z23.tuple(tupleItems);
+          zodSchema2 = z24.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z23.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z24.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z23.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z24.maxLength(schema.maxItems));
         }
       } else if (Array.isArray(items)) {
         const tupleItems = items.map((item) => convertSchema(item, ctx));
         const rest = schema.additionalItems && typeof schema.additionalItems === "object" ? convertSchema(schema.additionalItems, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z23.tuple(tupleItems).rest(rest);
+          zodSchema2 = z24.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z23.tuple(tupleItems);
+          zodSchema2 = z24.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z23.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z24.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z23.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z24.maxLength(schema.maxItems));
         }
       } else if (items !== void 0) {
         const element = convertSchema(items, ctx);
-        let arraySchema = z23.array(element);
+        let arraySchema = z24.array(element);
         if (typeof schema.minItems === "number") {
           arraySchema = arraySchema.min(schema.minItems);
         }
@@ -30508,7 +31489,7 @@ function convertBaseSchema(schema, ctx) {
         }
         zodSchema2 = arraySchema;
       } else {
-        zodSchema2 = z23.array(z23.any());
+        zodSchema2 = z24.array(z24.any());
       }
       break;
     }
@@ -30525,37 +31506,37 @@ function convertBaseSchema(schema, ctx) {
 }
 function convertSchema(schema, ctx) {
   if (typeof schema === "boolean") {
-    return schema ? z23.any() : z23.never();
+    return schema ? z24.any() : z24.never();
   }
   let baseSchema = convertBaseSchema(schema, ctx);
   const hasExplicitType = schema.type || schema.enum !== void 0 || schema.const !== void 0;
   if (schema.anyOf && Array.isArray(schema.anyOf)) {
     const options = schema.anyOf.map((s) => convertSchema(s, ctx));
-    const anyOfUnion = z23.union(options);
-    baseSchema = hasExplicitType ? z23.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+    const anyOfUnion = z24.union(options);
+    baseSchema = hasExplicitType ? z24.intersection(baseSchema, anyOfUnion) : anyOfUnion;
   }
   if (schema.oneOf && Array.isArray(schema.oneOf)) {
     const options = schema.oneOf.map((s) => convertSchema(s, ctx));
-    const oneOfUnion = z23.xor(options);
-    baseSchema = hasExplicitType ? z23.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+    const oneOfUnion = z24.xor(options);
+    baseSchema = hasExplicitType ? z24.intersection(baseSchema, oneOfUnion) : oneOfUnion;
   }
   if (schema.allOf && Array.isArray(schema.allOf)) {
     if (schema.allOf.length === 0) {
-      baseSchema = hasExplicitType ? baseSchema : z23.any();
+      baseSchema = hasExplicitType ? baseSchema : z24.any();
     } else {
       let result = hasExplicitType ? baseSchema : convertSchema(schema.allOf[0], ctx);
       const startIdx = hasExplicitType ? 0 : 1;
       for (let i = startIdx; i < schema.allOf.length; i++) {
-        result = z23.intersection(result, convertSchema(schema.allOf[i], ctx));
+        result = z24.intersection(result, convertSchema(schema.allOf[i], ctx));
       }
       baseSchema = result;
     }
   }
   if (schema.nullable === true && ctx.version === "openapi-3.0") {
-    baseSchema = z23.nullable(baseSchema);
+    baseSchema = z24.nullable(baseSchema);
   }
   if (schema.readOnly === true) {
-    baseSchema = z23.readonly(baseSchema);
+    baseSchema = z24.readonly(baseSchema);
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
@@ -30582,7 +31563,7 @@ function convertSchema(schema, ctx) {
 }
 function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
-    return schema ? z23.any() : z23.never();
+    return schema ? z24.any() : z24.never();
   }
   const version2 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
@@ -30596,14 +31577,14 @@ function fromJSONSchema(schema, params) {
   };
   return convertSchema(schema, ctx);
 }
-var z23, RECOGNIZED_KEYS;
+var z24, RECOGNIZED_KEYS;
 var init_from_json_schema = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/from-json-schema.js"() {
     init_registries();
     init_checks2();
     init_iso();
     init_schemas2();
-    z23 = {
+    z24 = {
       ...schemas_exports2,
       ...checks_exports2,
       iso: iso_exports