@cleocode/cleo 2026.4.133 → 2026.4.139

package/dist/cli/index.js

@@ -587,7 +587,7 @@ function createSuccessResult() {
 function isErrorResult(result) {
   return !result.success;
 }
-var ThinAgentViolationError, LifecycleScopeDeniedError;
+var ThinAgentViolationError, LifecycleScopeDeniedError, ClassifierUnregisteredAgentError;
 var init_errors = __esm({
   "packages/contracts/src/errors.ts"() {
     "use strict";
@@ -635,6 +635,26 @@ var init_errors = __esm({
       /** Numeric exit code aligned with {@link ExitCode.TASK_NOT_IN_SCOPE} (34). */
       exitCode = 34 /* TASK_NOT_IN_SCOPE */;
     };
+    ClassifierUnregisteredAgentError = class extends Error {
+      /**
+       * @param emittedAgentId  - The agent ID the classifier tried to emit.
+       * @param registeredIds   - The set of valid, registry-backed agent IDs.
+       */
+      constructor(emittedAgentId, registeredIds) {
+        super(
+          `E_CLASSIFIER_UNREGISTERED_AGENT: classifier emitted '${emittedAgentId}' which is not in the registered agent vocabulary. Valid agent IDs: [${registeredIds.join(", ")}]. Add this agent to the registry or remove it from the classifier rules.`
+        );
+        this.emittedAgentId = emittedAgentId;
+        this.registeredIds = registeredIds;
+        this.name = "ClassifierUnregisteredAgentError";
+      }
+      emittedAgentId;
+      registeredIds;
+      /** Stable LAFS error code string for envelope emission. */
+      code = "E_CLASSIFIER_UNREGISTERED_AGENT";
+      /** Numeric exit code aligned with {@link ExitCode.SPAWN_VALIDATION_FAILED} (63). */
+      exitCode = 63 /* SPAWN_VALIDATION_FAILED */;
+    };
   }
 });
 
@@ -1263,6 +1283,7 @@ __export(src_exports, {
   AGENT_TYPES: () => AGENT_TYPES,
   BRAIN_OBSERVATION_TYPES: () => BRAIN_OBSERVATION_TYPES,
   BRANCH_LOCK_ERROR_CODES: () => BRANCH_LOCK_ERROR_CODES,
+  ClassifierUnregisteredAgentError: () => ClassifierUnregisteredAgentError,
   ExitCode: () => ExitCode,
   GATE_STATUSES: () => GATE_STATUSES,
   LIFECYCLE_PIPELINE_STATUSES: () => LIFECYCLE_PIPELINE_STATUSES,
@@ -7414,6 +7435,40 @@ var init_registry = __esm({
         ]
       },
       // ---------------------------------------------------------------------------
+      // T1386 — nexus.sigil — peer-card identity (PSYCHE Wave 8 follow-up)
+      // ---------------------------------------------------------------------------
+      // Query: list every sigil currently stored in nexus.db
+      {
+        gateway: "query",
+        domain: "nexus",
+        operation: "sigil.list",
+        description: "nexus.sigil.list (query) \u2014 list every sigil currently stored in nexus.db, optionally filtered by role",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "role",
+            type: "string",
+            required: false,
+            description: 'Filter by role (e.g. "orchestrator", "lead", "worker", "specialist", "subagent")'
+          }
+        ]
+      },
+      // Mutate: populate sigils from canonical CANT agents
+      {
+        gateway: "mutate",
+        domain: "nexus",
+        operation: "sigil.sync",
+        description: "nexus.sigil.sync (mutate) \u2014 populate the sigils table with one row per canonical CANT agent (cleo-subagent + 5 seed roles + 2 meta agents). Idempotent.",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
+      // ---------------------------------------------------------------------------
       // sticky — Ephemeral notes for quick capture (T5282)
       // ---------------------------------------------------------------------------
       // Query operations
@@ -9257,6 +9312,38 @@ var init_memory_engine = __esm({
 });
 
 // packages/cleo/src/dispatch/engines/session-engine.ts
+var session_engine_exports = {};
+__export(session_engine_exports, {
+  sessionArchive: () => sessionArchive,
+  sessionBriefing: () => sessionBriefing,
+  sessionChainShow: () => sessionChainShow,
+  sessionCleanup: () => sessionCleanup,
+  sessionComputeDebrief: () => sessionComputeDebrief,
+  sessionComputeHandoff: () => sessionComputeHandoff,
+  sessionContextDrift: () => sessionContextDrift,
+  sessionContextInject: () => sessionContextInject,
+  sessionDebriefShow: () => sessionDebriefShow,
+  sessionDecisionLog: () => sessionDecisionLog,
+  sessionEnd: () => sessionEnd,
+  sessionFind: () => sessionFind,
+  sessionGc: () => sessionGc,
+  sessionHandoff: () => sessionHandoff,
+  sessionHistory: () => sessionHistory,
+  sessionList: () => sessionList,
+  sessionRecordAssumption: () => sessionRecordAssumption,
+  sessionRecordDecision: () => sessionRecordDecision,
+  sessionResume: () => sessionResume,
+  sessionShow: () => sessionShow,
+  sessionStart: () => sessionStart,
+  sessionStats: () => sessionStats,
+  sessionStatus: () => sessionStatus,
+  sessionSuspend: () => sessionSuspend,
+  sessionSwitch: () => sessionSwitch,
+  taskCurrentGet: () => taskCurrentGet,
+  taskStart: () => taskStart,
+  taskStop: () => taskStop,
+  taskWorkHistory: () => taskWorkHistory
+});
 import {
   archiveSessions,
   cleanupSessions,
@@ -10972,6 +11059,13 @@ async function orchestratePlan(input) {
           if (resolved) {
             persona = resolved.agentId;
             orchLevel = resolved.orchLevel;
+            if (resolved.resolverWarning) {
+              warnings.push({
+                taskId: task.id,
+                code: "agent_fallback_universal_base",
+                message: resolved.resolverWarning
+              });
+            }
           } else {
             persona = "cleo-subagent";
             const fallback = resolveAgentGraceful(db, "cleo-subagent", preferTier);
@@ -13515,6 +13609,16 @@ async function taskComplete(projectRoot, taskId, notes) {
   try {
     const accessor = await getAccessor6(projectRoot);
     const result = await coreCompleteTask({ taskId, notes }, projectRoot, accessor);
+    try {
+      const agentId = process.env["CLEO_AGENT_ID"] ?? "cleo";
+      let sessionId = typeof process.env["CLEO_SESSION_ID"] === "string" && process.env["CLEO_SESSION_ID"].length > 0 ? process.env["CLEO_SESSION_ID"] : null;
+      const activeSession = await getActiveSession2(projectRoot);
+      if (activeSession?.id) {
+        sessionId = activeSession.id;
+      }
+      await accessor.updateTaskFields(taskId, { modifiedBy: agentId, sessionId });
+    } catch {
+    }
     return {
       success: true,
       data: {
@@ -13644,6 +13748,20 @@ async function taskCompleteStrict(projectRoot, taskId, notes) {
         }
       }
     }
+    if (lifecycleMode === "strict") {
+      const accessor = await getAccessor6(projectRoot);
+      const task = await accessor.loadSingleTask(taskId);
+      if (task && task.type !== "epic" && !task.verification) {
+        return engineError(
+          "E_EVIDENCE_MISSING",
+          `Task ${taskId} has no verification record (verification_json IS NULL). Run 'cleo verify' with programmatic evidence before completing. See ADR-051.`,
+          {
+            details: { taskId, verificationStatus: "null" },
+            fix: `Initialize and populate verification gates: 'cleo verify ${taskId} --gate implemented --evidence "commit:<sha>;files:<list>"' and other required gates, then retry 'cleo complete ${taskId}'.`
+          }
+        );
+      }
+    }
     return taskComplete(projectRoot, taskId, notes);
   } catch (err) {
     return cleoErrorToEngineError(err, "E_INTERNAL", "Failed to complete task (strict mode)");
@@ -19058,12 +19176,12 @@ var init_memory2 = __esm({
                   const { getBrainNativeDb: _getDoctorNativeDb } = await import("@cleocode/core/store/memory-sqlite.js");
                   const doctorNativeDb = _getDoctorNativeDb();
                   if (doctorNativeDb) {
-                    const tableExists = doctorNativeDb.prepare(
-                      `SELECT name FROM sqlite_master WHERE type='table' AND name='brain_v2_candidate'`
+                    const stagingTableRow = doctorNativeDb.prepare(
+                      `SELECT name FROM sqlite_master WHERE type='table' AND name IN ('brain_observations_staging', 'brain_v2_candidate') ORDER BY CASE name WHEN 'brain_observations_staging' THEN 0 ELSE 1 END LIMIT 1`
                     ).get();
-                    if (tableExists) {
+                    if (stagingTableRow?.name) {
                       const countRow = doctorNativeDb.prepare(
-                        `SELECT COUNT(*) AS cnt FROM brain_v2_candidate WHERE validation_status = 'pending'`
+                        `SELECT COUNT(*) AS cnt FROM ${stagingTableRow.name} WHERE validation_status = 'pending'`
                       ).get();
                       pendingCandidates = countRow?.cnt ?? 0;
                     }
@@ -19086,7 +19204,7 @@ var init_memory2 = __esm({
                     "memory",
                     operation,
                     "E_SWEEP_PENDING",
-                    `Staged sweep has ${pendingCandidates} pending brain_v2_candidate rows. Run \`cleo memory sweep --status\` to review, then \`cleo memory sweep --approve <runId>\` to apply.`,
+                    `Staged sweep has ${pendingCandidates} pending brain_observations_staging rows. Run \`cleo memory sweep --status\` to review, then \`cleo memory sweep --approve <runId>\` to apply.`,
                     startTime
                   );
                 }
@@ -20357,6 +20475,7 @@ import {
   getUserProfileTrait,
   importSnapshot as importSnapshot2,
   importUserProfile,
+  listSigils,
   listUserProfile,
   nexusDeps,
   nexusGetProject,
@@ -20377,6 +20496,7 @@ import {
   searchAcrossProjects,
   setPermission,
   supersedeTrait,
+  syncCanonicalSigils,
   upsertUserProfileTrait,
   validateSyntax,
   writeSnapshot as writeSnapshot2
@@ -20895,6 +21015,23 @@ async function nexusProfileSupersede(oldKey, newKey) {
     return engineError("E_INTERNAL", error instanceof Error ? error.message : String(error));
   }
 }
+async function nexusSigilList(role) {
+  try {
+    const nexusDb = await getNexusDb();
+    const sigils = await listSigils(nexusDb, role ? { role } : void 0);
+    return engineSuccess({ sigils, count: sigils.length });
+  } catch (error) {
+    return engineError("E_INTERNAL", error instanceof Error ? error.message : String(error));
+  }
+}
+async function nexusSigilSync() {
+  try {
+    const result = await syncCanonicalSigils();
+    return engineSuccess(result);
+  } catch (error) {
+    return engineError("E_INTERNAL", error instanceof Error ? error.message : String(error));
+  }
+}
 var init_nexus_engine = __esm({
   "packages/cleo/src/dispatch/engines/nexus-engine.ts"() {
     "use strict";
@@ -21645,6 +21782,11 @@ var init_nexus2 = __esm({
               const result = await nexusProfileGet(traitKey);
               return wrapResult(result, "query", "nexus", operation, startTime);
             }
+            case "sigil.list": {
+              const role = params?.role;
+              const result = await nexusSigilList(role);
+              return wrapResult(result, "query", "nexus", operation, startTime);
+            }
             default:
               return unsupportedOp("query", "nexus", operation, startTime);
           }
@@ -21867,6 +22009,10 @@ var init_nexus2 = __esm({
               const result = await nexusProfileSupersede(oldKey, newKey);
               return wrapResult(result, "mutate", "nexus", operation, startTime);
             }
+            case "sigil.sync": {
+              const result = await nexusSigilSync();
+              return wrapResult(result, "mutate", "nexus", operation, startTime);
+            }
             default:
               return unsupportedOp("mutate", "nexus", operation, startTime);
           }
@@ -21919,7 +22065,9 @@ var init_nexus2 = __esm({
             "task-symbols",
             // T1080 — user-profile query verbs
             "profile.view",
-            "profile.get"
+            "profile.get",
+            // T1386 — sigil list (peer-card identity)
+            "sigil.list"
           ],
           mutate: [
             "share.snapshot.export",
@@ -21940,7 +22088,9 @@ var init_nexus2 = __esm({
             "profile.export",
             "profile.reinforce",
             "profile.upsert",
-            "profile.supersede"
+            "profile.supersede",
+            // T1386 — sigil sync (canonical CANT agent peer cards)
+            "sigil.sync"
           ]
         };
       }
@@ -26745,8 +26895,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot29 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot29();
+  const { getProjectRoot: getProjectRoot31 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot31();
   return {
     async dispatch(input) {
       try {
@@ -27099,14 +27249,14 @@ var init_playbook = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot29 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot31 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot29()
+            projectRoot: getProjectRoot31()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -32628,11 +32778,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot29) {
+function createSanitizer(getProjectRoot31) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot29 ? getProjectRoot29() : void 0;
+        const root = getProjectRoot31 ? getProjectRoot31() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -33004,7 +33154,7 @@ import {
   ensureGlobalSignaldockDb as ensureGlobalSignaldockDb2,
   getGlobalSalt,
   getLogger as getLogger18,
-  getProjectRoot as getProjectRoot28,
+  getProjectRoot as getProjectRoot30,
   migrateSignaldockToConduit,
   needsSignaldockToConduitMigration,
   validateGlobalSalt
@@ -33607,6 +33757,42 @@ function createCustomShowUsage(version, subCommands2, aliasMap2) {
   };
 }
 
+// packages/cleo/src/cli/lib/did-you-mean.ts
+function levenshteinDistance(input, candidate) {
+  const inputLen = input.length;
+  const candidateLen = candidate.length;
+  const matrix = Array.from({ length: inputLen + 1 }, (_, i) => [i]);
+  for (let j = 1; j <= candidateLen; j++) {
+    matrix[0][j] = j;
+  }
+  for (let i = 1; i <= inputLen; i++) {
+    for (let j = 1; j <= candidateLen; j++) {
+      const cost = input[i - 1] === candidate[j - 1] ? 0 : 1;
+      matrix[i][j] = Math.min(
+        matrix[i - 1][j] + 1,
+        // deletion
+        matrix[i][j - 1] + 1,
+        // insertion
+        matrix[i - 1][j - 1] + cost
+        // substitution
+      );
+    }
+  }
+  return matrix[inputLen][candidateLen];
+}
+function didYouMean(input, candidates, maxDistance = 2) {
+  const suggestions = candidates.map((candidate) => ({
+    command: candidate,
+    distance: levenshteinDistance(input, candidate)
+  })).filter((item) => item.distance <= maxDistance).sort((a, b) => {
+    if (a.distance !== b.distance) {
+      return a.distance - b.distance;
+    }
+    return a.command.localeCompare(b.command);
+  }).map((item) => item.command);
+  return suggestions;
+}
+
 // packages/cleo/src/cli/middleware/output-format.ts
 import { resolveOutputFormat } from "@cleocode/lafs";
 function resolveFormat(opts, defaults) {
@@ -33757,7 +33943,49 @@ var adapterCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/add.ts
+import { getProjectRoot as getProjectRoot18 } from "@cleocode/core";
 init_cli();
+
+// packages/cleo/src/cli/infer-files-via-gitnexus.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+function inferFilesViaGitNexus(title, description) {
+  const queryText = description ? `${title} ${description}` : title;
+  try {
+    const output = execFileSync3("gitnexus", ["query", "--json", "--limit", "5", queryText], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+      // suppress stderr
+    });
+    const result = JSON.parse(output);
+    const files = /* @__PURE__ */ new Set();
+    if (Array.isArray(result)) {
+      for (const process2 of result) {
+        if (Array.isArray(process2.symbols)) {
+          for (const symbol of process2.symbols) {
+            if (symbol.location && typeof symbol.location === "string") {
+              const match = symbol.location.match(/^([^:]+):/);
+              if (match?.[1]) {
+                files.add(match[1]);
+              }
+            }
+          }
+        }
+        if (Array.isArray(process2.files)) {
+          for (const file of process2.files) {
+            if (typeof file === "string") {
+              files.add(file);
+            }
+          }
+        }
+      }
+    }
+    return Array.from(files);
+  } catch {
+    return [];
+  }
+}
+
+// packages/cleo/src/cli/commands/add.ts
 init_renderers();
 var addCommand = defineCommand({
   meta: {
@@ -33816,6 +34044,10 @@ var addCommand = defineCommand({
       type: "string",
       description: "Comma-separated file paths"
     },
+    "files-infer": {
+      type: "boolean",
+      description: "Infer touched files from task title and description using GitNexus"
+    },
     acceptance: {
       type: "string",
       description: 'Pipe-separated acceptance criteria (e.g. "AC1|AC2|AC3")'
@@ -33900,7 +34132,18 @@ var addCommand = defineCommand({
       params["description"] = args.desc;
     }
     if (args.labels) params["labels"] = args.labels.split(",").map((s) => s.trim());
-    if (args.files) params["files"] = args.files.split(",").map((s) => s.trim());
+    if (args["files-infer"] && !args.files) {
+      const inferredFiles = inferFilesViaGitNexus(args.title, args.description ?? args.desc);
+      if (inferredFiles.length > 0) {
+        params["files"] = inferredFiles;
+      } else {
+        process.stderr.write(
+          "\u26A0 No files inferred by GitNexus. Use --files to specify files explicitly, or leave empty for atomicity check at spawn time.\n"
+        );
+      }
+    } else if (args.files) {
+      params["files"] = args.files.split(",").map((s) => s.trim());
+    }
     if (args.acceptance) {
       const raw = args.acceptance;
       if (raw.trimStart().startsWith("[")) {
@@ -33924,6 +34167,21 @@ var addCommand = defineCommand({
     if (args.kind !== void 0) params["kind"] = args.kind;
     if (args.scope !== void 0) params["scope"] = args.scope;
     if (args.severity !== void 0) params["severity"] = args.severity;
+    if (!params["parent"] && params["type"] !== "epic") {
+      try {
+        const projectRoot = getProjectRoot18();
+        const { taskCurrentGet: taskCurrentGet2 } = await Promise.resolve().then(() => (init_session_engine(), session_engine_exports));
+        const currentResult = await taskCurrentGet2(projectRoot);
+        if (currentResult.success && currentResult.data?.currentTask) {
+          params["parent"] = currentResult.data.currentTask;
+          process.stderr.write(
+            `[cleo add] inferred --parent from current task: ${currentResult.data.currentTask}
+`
+          );
+        }
+      } catch {
+      }
+    }
     const response = await dispatchRaw("mutate", "tasks", "add", params);
     if (!response.success) {
       handleRawError(response, { command: "add", operation: "tasks.add" });
@@ -36248,11 +36506,11 @@ var installCommand = defineCommand({
       if (stat2.isFile() && ext === ".cant") {
         cantPath = resolvedPath;
       } else if (stat2.isFile() && ext === ".cantz") {
-        const { execFileSync: execFileSync6 } = await import("node:child_process");
+        const { execFileSync: execFileSync7 } = await import("node:child_process");
         tempDir = join23(tmpdir(), `cleo-agent-install-${Date.now()}`);
         mkdirSync5(tempDir, { recursive: true });
         try {
-          execFileSync6("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
+          execFileSync7("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
             encoding: "utf-8",
             timeout: 3e4
           });
@@ -36453,7 +36711,7 @@ var packCommand = defineCommand({
     try {
       const { existsSync: existsSync12, statSync } = await import("node:fs");
       const { resolve: resolve5, basename: basename2, dirname: dirname11 } = await import("node:path");
-      const { execFileSync: execFileSync6 } = await import("node:child_process");
+      const { execFileSync: execFileSync7 } = await import("node:child_process");
       const resolvedDir = resolve5(args.dir);
       if (!existsSync12(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
         cliOutput(
@@ -36490,7 +36748,7 @@ var packCommand = defineCommand({
       const archivePath = resolve5(archiveName);
       const parentDir = dirname11(resolvedDir);
       try {
-        execFileSync6("zip", ["-r", archivePath, agentName], {
+        execFileSync7("zip", ["-r", archivePath, agentName], {
           cwd: parentDir,
           encoding: "utf-8",
           timeout: 3e4
@@ -37493,8 +37751,113 @@ var archiveStatsCommand = defineCommand({
   }
 });
 
+// packages/cleo/src/cli/commands/audit.ts
+import { getProjectRoot as getProjectRoot19, reconstructLineage } from "@cleocode/core/internal";
+var reconstructCommand = defineCommand({
+  meta: {
+    name: "reconstruct",
+    description: "Reconstruct git-backed lineage (commits + release tags) for a task"
+  },
+  args: {
+    taskId: {
+      type: "positional",
+      description: "Task ID to reconstruct (e.g. T991)",
+      required: true
+    },
+    json: {
+      type: "boolean",
+      description: "Emit raw JSON output instead of formatted summary",
+      default: false
+    },
+    "repo-root": {
+      type: "string",
+      description: "Path to the git repository root (defaults to current project root)"
+    }
+  },
+  async run({ args }) {
+    const taskId = args["taskId"];
+    if (!taskId || !/^T\d+$/i.test(taskId)) {
+      process.stderr.write(
+        `Error: taskId must match /^T\\d+$/ (e.g. T991). Got: ${JSON.stringify(taskId)}
+`
+      );
+      process.exit(1);
+    }
+    let repoRoot;
+    if (args["repo-root"]) {
+      repoRoot = args["repo-root"];
+    } else {
+      try {
+        repoRoot = getProjectRoot19(process.cwd()) ?? process.cwd();
+      } catch {
+        repoRoot = process.cwd();
+      }
+    }
+    const result = await reconstructLineage(taskId, repoRoot);
+    if (args["json"]) {
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+      return;
+    }
+    const lines = [
+      `Lineage for ${result.taskId}`,
+      `${"=".repeat(40)}`,
+      "",
+      `Direct commits: ${result.directCommits.length}`
+    ];
+    for (const c of result.directCommits) {
+      lines.push(`  ${c.sha.slice(0, 10)}  ${c.subject}`);
+    }
+    lines.push("");
+    if (result.childIdRange) {
+      lines.push(
+        `Inferred children: ${result.inferredChildren.join(", ")} (${result.childIdRange.min} \u2192 ${result.childIdRange.max})`
+      );
+    } else {
+      lines.push("Inferred children: none");
+    }
+    const childEntries = Object.entries(result.childCommits);
+    if (childEntries.length > 0) {
+      lines.push("");
+      lines.push("Child commits:");
+      for (const [childId, commits] of childEntries) {
+        lines.push(`  ${childId}: ${commits.length} commit(s)`);
+        for (const c of commits) {
+          lines.push(`    ${c.sha.slice(0, 10)}  ${c.subject}`);
+        }
+      }
+    }
+    lines.push("");
+    if (result.releaseTags.length > 0) {
+      lines.push(`Release tags (${result.releaseTags.length}):`);
+      for (const t of result.releaseTags) {
+        lines.push(`  ${t.tag}  ${t.commitSha.slice(0, 10)}  ${t.subject}`);
+      }
+    } else {
+      lines.push("Release tags: none found");
+    }
+    lines.push("");
+    lines.push(`First seen: ${result.firstSeenAt ?? "n/a"}`);
+    lines.push(`Last seen:  ${result.lastSeenAt ?? "n/a"}`);
+    process.stdout.write(`${lines.join("\n")}
+`);
+  }
+});
+var auditCommand = defineCommand({
+  meta: {
+    name: "audit",
+    description: "Git-backed audit tooling (lineage reconstruction, integrity checks)"
+  },
+  subCommands: {
+    reconstruct: reconstructCommand
+  },
+  async run({ args: _args }) {
+    await showUsage(auditCommand);
+  }
+});
+
 // packages/cleo/src/cli/commands/backfill.ts
-import { backfillTasks, getProjectRoot as getProjectRoot18, populateEmbeddings } from "@cleocode/core/internal";
+import { backfillTasks, getProjectRoot as getProjectRoot20, populateEmbeddings } from "@cleocode/core/internal";
 init_renderers();
 var backfillCommand = defineCommand({
   meta: {
@@ -37523,7 +37886,7 @@ var backfillCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot18();
+    const root = getProjectRoot20();
     if (args.embeddings) {
       try {
         let lastLine = "";
@@ -38012,9 +38375,9 @@ var exportCommand = defineCommand({
   },
   async run({ args }) {
     const scope = args.scope;
-    const { packBundle, getProjectRoot: getProjectRoot29 } = await import("@cleocode/core/internal");
+    const { packBundle, getProjectRoot: getProjectRoot31 } = await import("@cleocode/core/internal");
     const includesProject = scope === "project" || scope === "all";
-    const projectRoot = includesProject ? getProjectRoot29() : void 0;
+    const projectRoot = includesProject ? getProjectRoot31() : void 0;
     let passphrase;
     if (args.encrypt === true) {
       passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -38342,7 +38705,7 @@ import {
   exportBrainAsJson,
   getMemoryQualityReport,
   getPlasticityStats,
-  getProjectRoot as getProjectRoot19,
+  getProjectRoot as getProjectRoot21,
   purgeBrainNoise,
   runBrainMaintenance
 } from "@cleocode/core/internal";
@@ -38375,7 +38738,7 @@ var maintenanceCommand = defineCommand({
     json: { type: "boolean", description: "Output results as JSON" }
   },
   async run({ args }) {
-    const root = getProjectRoot19();
+    const root = getProjectRoot21();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Running brain maintenance...");
@@ -38455,7 +38818,7 @@ var backfillCommand2 = defineCommand({
     json: { type: "boolean", description: "Output results as JSON" }
   },
   async run({ args }) {
-    const root = getProjectRoot19();
+    const root = getProjectRoot21();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Running brain graph back-fill...");
@@ -38510,7 +38873,7 @@ var purgeCommand = defineCommand({
     json: { type: "boolean", description: "Output results as JSON" }
   },
   async run({ args }) {
-    const root = getProjectRoot19();
+    const root = getProjectRoot21();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Running brain noise purge...");
@@ -38568,7 +38931,7 @@ var plasticityStatsCommand = defineCommand({
     json: { type: "boolean", description: "Output results as JSON" }
   },
   async run({ args }) {
-    const root = getProjectRoot19();
+    const root = getProjectRoot21();
     const isJson = !!args.json;
     const limit = Number.parseInt(args.limit, 10) || 20;
     try {
@@ -38641,7 +39004,7 @@ var qualityCommand = defineCommand({
     json: { type: "boolean", description: "Output results as JSON" }
   },
   async run({ args }) {
-    const root = getProjectRoot19();
+    const root = getProjectRoot21();
     const isJson = !!args.json;
     try {
       const report = await getMemoryQualityReport(root);
@@ -38718,7 +39081,7 @@ var exportCommand2 = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot19();
+    const root = getProjectRoot21();
     const format = args.format ?? "gexf";
     if (format !== "gexf" && format !== "json") {
       console.error(`Invalid format: ${format}. Use 'gexf' or 'json'.`);
@@ -40026,7 +40389,7 @@ var trendCommand = defineCommand({
     );
   }
 });
-var auditCommand = defineCommand({
+var auditCommand2 = defineCommand({
   meta: {
     name: "audit",
     description: "Check compliance for a specific task and its subtasks"
@@ -40178,7 +40541,7 @@ var complianceCommand = defineCommand({
     summary: summaryCommand,
     violations: violationsCommand,
     trend: trendCommand,
-    audit: auditCommand,
+    audit: auditCommand2,
     sync: syncCommand2,
     skills: skillsCommand,
     value: valueCommand,
@@ -41911,7 +42274,7 @@ import {
   exportDocument,
   formatError as formatError5,
   getAgentOutputsAbsolute,
-  getProjectRoot as getProjectRoot20,
+  getProjectRoot as getProjectRoot22,
   listDocVersions,
   mergeDocs,
   publishDocs,
@@ -42200,7 +42563,7 @@ var exportCommand4 = defineCommand({
     const taskId = String(args.task);
     const includeAttachments = args["include-attachments"] !== false;
     const includeMemoryRefs = args["include-memory-refs"] === true;
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     try {
       const result = await exportDocument({
         taskId,
@@ -42264,7 +42627,7 @@ var searchCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     try {
       const result = await searchDocs(String(args.query), {
         ownerId: args.owner ?? void 0,
@@ -42316,7 +42679,7 @@ var mergeCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     const rawStrategy = args.strategy ?? "three-way";
     const strategy = rawStrategy === "cherry-pick" || rawStrategy === "multi-diff" ? rawStrategy : "three-way";
     try {
@@ -42367,7 +42730,7 @@ var graphCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     const fmt = args.format ?? "mermaid";
     try {
       const result = await buildDocsGraph({ ownerId: String(args.for), projectRoot });
@@ -42438,7 +42801,7 @@ var rankCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     try {
       const result = await rankDocs({
         ownerId: String(args.for),
@@ -42477,7 +42840,7 @@ var versionsCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     try {
       const result = await listDocVersions({
         ownerId: String(args.for),
@@ -42521,7 +42884,7 @@ var publishCommand2 = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot20();
+    const projectRoot = getProjectRoot22();
     try {
       const result = await publishDocs({
         ownerId: String(args.for),
@@ -43468,10 +43831,10 @@ var gcCommand = defineCommand({
 
 // packages/cleo/src/cli/commands/generate-changelog.ts
 init_src();
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname9, join as join16 } from "node:path";
-import { CleoError as CleoError4, formatError as formatError6, getConfigPath as getConfigPath2, getProjectRoot as getProjectRoot21 } from "@cleocode/core";
+import { CleoError as CleoError4, formatError as formatError6, getConfigPath as getConfigPath2, getProjectRoot as getProjectRoot23 } from "@cleocode/core";
 init_renderers();
 function getChangelogSource(cwd) {
   const configPath = getConfigPath2(cwd);
@@ -43503,9 +43866,9 @@ function getDefaultOutputPath(platform) {
   }
 }
 function getGitHubRepoSlug(cwd) {
-  const projectRoot = getProjectRoot21(cwd);
+  const projectRoot = getProjectRoot23(cwd);
   try {
-    const remoteUrl = execFileSync3("git", ["remote", "get-url", "origin"], {
+    const remoteUrl = execFileSync4("git", ["remote", "get-url", "origin"], {
       cwd: projectRoot,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -43629,7 +43992,7 @@ var generateChangelogCommand = defineCommand({
       const targetPlatform = args.platform;
       const dryRun = args["dry-run"] === true;
       const sourceFile = getChangelogSource();
-      const sourcePath = join16(getProjectRoot21(), sourceFile);
+      const sourcePath = join16(getProjectRoot23(), sourceFile);
       if (!existsSync10(sourcePath)) {
         throw new CleoError4(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
       }
@@ -43642,7 +44005,7 @@ var generateChangelogCommand = defineCommand({
         const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
         const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
         if (!dryRun) {
-          const fullPath = join16(getProjectRoot21(), outputPath);
+          const fullPath = join16(getProjectRoot23(), outputPath);
           mkdirSync3(dirname9(fullPath), { recursive: true });
           writeFileSync3(fullPath, content, "utf-8");
         }
@@ -43663,7 +44026,7 @@ var generateChangelogCommand = defineCommand({
             limit
           );
           if (!dryRun) {
-            const fullPath = join16(getProjectRoot21(), platformConfig.path);
+            const fullPath = join16(getProjectRoot23(), platformConfig.path);
             mkdirSync3(dirname9(fullPath), { recursive: true });
             writeFileSync3(fullPath, content, "utf-8");
           }
@@ -44253,7 +44616,7 @@ var intelligenceCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/issue.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { addIssue, BUILD_CONFIG } from "@cleocode/core/internal";
 init_cli();
 init_renderers();
@@ -44277,7 +44640,7 @@ async function handleIssueType(issueType, opts) {
   if (opts["open"] && typeof result.url === "string" && result.url.startsWith("https://")) {
     const issueNumber = result.url.match(/(\d+)$/)?.[1] ?? "unknown";
     try {
-      execFileSync4("gh", ["issue", "view", issueNumber, "--repo", CLEO_REPO, "--web"], {
+      execFileSync5("gh", ["issue", "view", issueNumber, "--repo", CLEO_REPO, "--web"], {
         stdio: ["pipe", "pipe", "pipe"]
       });
     } catch {
@@ -45079,7 +45442,7 @@ import { join as join17 } from "node:path";
 import {
   getBrainDb as getBrainDb2,
   getBrainNativeDb as getBrainNativeDb3,
-  getProjectRoot as getProjectRoot22,
+  getProjectRoot as getProjectRoot24,
   runConsolidation,
   triggerManualDream
 } from "@cleocode/core/internal";
@@ -45988,7 +46351,7 @@ var consolidateCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Running memory consolidation (including tier promotion)...");
@@ -46053,7 +46416,7 @@ var dreamCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Triggering dream cycle (full consolidation including STDP plasticity)...");
@@ -46131,7 +46494,7 @@ var reflectCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Running Observer + Reflector pipeline...");
@@ -46216,7 +46579,7 @@ var dedupScanCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     if (!isJson) {
       console.log("Scanning brain.db for duplicate entries...");
@@ -46376,7 +46739,7 @@ var importCommand3 = defineCommand({
     const sourceDir = args.from ?? join17(homedir4(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
     const isDryRun = !!args["dry-run"];
     const isJson = !!args.json;
-    const projectRoot = getProjectRoot22();
+    const projectRoot = getProjectRoot24();
     const stateFile = join17(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
     if (!existsSync11(sourceDir)) {
       const msg = `Source directory not found: ${sourceDir}`;
@@ -46629,7 +46992,7 @@ var tierStatsCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     try {
       await getBrainDb2(root);
@@ -46773,7 +47136,7 @@ var tierPromoteCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     const targetTier = args.to;
     const reason = args.reason;
@@ -46919,7 +47282,7 @@ var tierDemoteCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot22();
+    const root = getProjectRoot24();
     const isJson = !!args.json;
     const targetTier = args.to;
     const reason = args.reason;
@@ -47455,7 +47818,7 @@ var memoryCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/migrate-claude-mem.ts
-import { getProjectRoot as getProjectRoot23, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot25, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 init_cli();
@@ -47512,7 +47875,7 @@ var claudeMemCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot23();
+    const root = getProjectRoot25();
     try {
       const result = await migrateClaudeMem(root, {
         sourcePath: args.source,
@@ -47561,7 +47924,7 @@ var manifestIngestCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot23();
+    const projectRoot = getProjectRoot25();
     try {
       const db = await getDb2(projectRoot);
       const rcasdFlag = Boolean(args.rcasd);
@@ -49295,7 +49658,7 @@ var analyzeCommand3 = defineCommand({
       );
     }
     try {
-      const [{ getNexusDb: getNexusDb2, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot29 }, { eq: eq2 }] = await Promise.all([
+      const [{ getNexusDb: getNexusDb2, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot31 }, { eq: eq2 }] = await Promise.all([
         import("@cleocode/core/store/nexus-sqlite"),
         import("@cleocode/nexus/pipeline"),
         import("@cleocode/core/internal"),
@@ -49401,7 +49764,7 @@ var analyzeCommand3 = defineCommand({
 `
         );
       }
-      void getProjectRoot29;
+      void getProjectRoot31;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (jsonOutput) {
@@ -52171,6 +52534,52 @@ ${result.count} cold symbol(s) found (threshold: ${thresholdDays} days).
     }
   }
 });
+var sigilSyncCommand = defineCommand({
+  meta: {
+    name: "sync",
+    description: "Populate the nexus.db sigils table with one row per canonical CANT agent (cleo-subagent + 5 seed roles + 2 meta agents). Idempotent."
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Output as JSON (LAFS envelope format)"
+    }
+  },
+  async run() {
+    await dispatchFromCli("mutate", "nexus", "sigil.sync", {}, { command: "nexus" });
+  }
+});
+var sigilListCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List every sigil currently stored in nexus.db, optionally filtered by role."
+  },
+  args: {
+    role: {
+      type: "string",
+      description: 'Filter by role (e.g. "orchestrator", "lead", "worker", "specialist", "subagent")'
+    }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "query",
+      "nexus",
+      "sigil.list",
+      { role: args.role },
+      { command: "nexus" }
+    );
+  }
+});
+var sigilCommand = defineCommand({
+  meta: {
+    name: "sigil",
+    description: "Sigil (peer-card) operations \u2014 sync from canonical CANT agents, list current rows"
+  },
+  subCommands: {
+    sync: sigilSyncCommand,
+    list: sigilListCommand
+  }
+});
 var topEntriesCommand = defineCommand({
   meta: {
     name: "top-entries",
@@ -52264,7 +52673,9 @@ var nexusCommand = defineCommand({
     "hot-nodes": hotNodesCommand,
     "cold-symbols": coldSymbolsCommand,
     // T1013 / T1006 — top-weighted symbols by nexus_relations.weight
-    "top-entries": topEntriesCommand
+    "top-entries": topEntriesCommand,
+    // T1386 — sigil sync + list (canonical CANT agent peer cards)
+    sigil: sigilCommand
   },
   async run({ cmd, rawArgs }) {
     const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -53906,14 +54317,14 @@ var reasonCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/refresh-memory.ts
-import { getProjectRoot as getProjectRoot24 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot26 } from "@cleocode/core";
 var refreshMemoryCommand = defineCommand({
   meta: {
     name: "refresh-memory",
     description: "Regenerate .cleo/memory-bridge.md from brain.db"
   },
   async run() {
-    const projectDir = getProjectRoot24();
+    const projectDir = getProjectRoot26();
     const { writeMemoryBridge } = await import("@cleocode/core/internal");
     const result = await writeMemoryBridge(projectDir);
     if (result.written) {
@@ -55018,7 +55429,7 @@ init_src();
 import fs3 from "node:fs";
 import path4 from "node:path";
 import { CleoError as CleoError8, formatError as formatError10, getAccessor as getAccessor9 } from "@cleocode/core";
-import { getProjectRoot as getProjectRoot25 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot27 } from "@cleocode/core/internal";
 init_cli();
 init_paths();
 init_renderers();
@@ -55132,7 +55543,7 @@ var finalizeCommand = defineCommand({
     description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
   },
   async run() {
-    const projectRoot = getProjectRoot25();
+    const projectRoot = getProjectRoot27();
     const reportPath = path4.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
     if (!fs3.existsSync(reportPath)) {
       console.log("No pending restore conflicts. Nothing to finalize.");
@@ -56843,7 +57254,7 @@ var sentientCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/sequence.ts
-import { getProjectRoot as getProjectRoot26 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot28 } from "@cleocode/core/internal";
 init_cli();
 init_renderers();
 var showCommand12 = defineCommand({
@@ -56874,7 +57285,7 @@ var repairCommand = defineCommand({
   meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
   async run() {
     const { systemSequenceRepair: systemSequenceRepair2 } = await Promise.resolve().then(() => (init_system_engine(), system_engine_exports));
-    const projectRoot = getProjectRoot26();
+    const projectRoot = getProjectRoot28();
     const result = await systemSequenceRepair2(projectRoot);
     cliOutput(result, { command: "sequence", operation: "admin.sequence.repair" });
   }
@@ -58701,7 +59112,7 @@ var tokenCommand = defineCommand({
 // packages/cleo/src/cli/commands/transcript.ts
 import { homedir as homedir5 } from "node:os";
 import { join as join20 } from "node:path";
-import { getProjectRoot as getProjectRoot27 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot29 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -58729,7 +59140,7 @@ var scanCommand = defineCommand({
   async run({ args }) {
     if (args.pending) {
       try {
-        const projectRoot = getProjectRoot27();
+        const projectRoot = getProjectRoot29();
         const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
         const pending = await scanPendingTranscripts(projectRoot);
         const envelope = { success: true, data: { count: pending.length, pending } };
@@ -58862,7 +59273,7 @@ var extractCommand = defineCommand({
   async run({ args }) {
     const tier = args.tier ?? "warm";
     const dryRun = args["dry-run"] ?? false;
-    const projectRoot = getProjectRoot27();
+    const projectRoot = getProjectRoot29();
     try {
       const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
       const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -58993,7 +59404,7 @@ var migrateCommand2 = defineCommand({
     const dryRun = args["dry-run"] ?? false;
     const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
     const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-    const projectRoot = getProjectRoot27();
+    const projectRoot = getProjectRoot29();
     try {
       const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
       const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -59567,7 +59978,7 @@ var verifyCommand2 = defineCommand({
 
 // packages/cleo/src/cli/commands/web.ts
 init_src();
-import { execFileSync as execFileSync5, spawn } from "node:child_process";
+import { execFileSync as execFileSync6, spawn } from "node:child_process";
 import { mkdir as mkdir4, open, readFile as readFile5, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join21 } from "node:path";
 import { CleoError as CleoError12, formatError as formatError14, getCleoHome as getCleoHome3 } from "@cleocode/core";
@@ -59634,7 +60045,7 @@ async function startWebServer(port, host) {
     await stat(webIndexPath);
   } catch {
     try {
-      execFileSync5("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
+      execFileSync6("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
         cwd: projectRoot,
         stdio: "ignore"
       });
@@ -59928,6 +60339,7 @@ subCommands["admin"] = adminCommand;
 subCommands["adr"] = adrCommand;
 subCommands["agent"] = agentCommand;
 subCommands["analyze"] = analyzeCommand;
+subCommands["audit"] = auditCommand;
 subCommands["archive"] = archiveCommand;
 subCommands["archive-stats"] = archiveStatsCommand;
 subCommands["backfill"] = backfillCommand;
@@ -60061,12 +60473,12 @@ subCommands["pipeline"] = phaseCommand;
   } catch {
   }
   try {
-    detectAndRemoveStrayProjectNexus(getProjectRoot28());
+    detectAndRemoveStrayProjectNexus(getProjectRoot30());
   } catch {
   }
   const _startupLog = getLogger18("cli-startup");
   try {
-    const _projectRootForMigration = getProjectRoot28();
+    const _projectRootForMigration = getProjectRoot30();
     if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
       const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
       if (migrationResult.status === "failed") {
@@ -60086,7 +60498,7 @@ subCommands["pipeline"] = phaseCommand;
     }
   }
   try {
-    ensureConduitDb(getProjectRoot28());
+    ensureConduitDb(getProjectRoot30());
   } catch {
   }
   try {
@@ -60124,6 +60536,26 @@ var main = defineCommand({
 });
 var aliasMap = buildAliasMap(subCommands);
 var customShowUsage = createCustomShowUsage(CLI_VERSION, subCommands, aliasMap);
+{
+  const rawArgs = process.argv.slice(2);
+  const firstArg = rawArgs[0];
+  if (firstArg && !firstArg.startsWith("-") && firstArg !== "--help" && firstArg !== "-h" && firstArg !== "--version" && firstArg !== "-V") {
+    const availableCommands = Object.keys(subCommands);
+    if (!availableCommands.includes(firstArg)) {
+      const suggestions = didYouMean(firstArg, availableCommands, 3);
+      process.stderr.write(`Unknown command ${firstArg}
+`);
+      if (suggestions.length > 0) {
+        process.stderr.write("\nDid you mean one of:\n");
+        for (const suggestion of suggestions) {
+          process.stderr.write(`  cleo ${suggestion}
+`);
+        }
+      }
+      process.exit(127);
+    }
+  }
+}
 runMain(main, { showUsage: customShowUsage });
 /*! Bundled license information: