@cleocode/cleo 2026.5.100 → 2026.5.102

package/dist/cli/index.js

@@ -1531,6 +1531,13 @@ var init_attachment_schema = __esm({
   }
 });
 
+// packages/contracts/src/boundary.ts
+var init_boundary = __esm({
+  "packages/contracts/src/boundary.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/branch-lock.ts
 var init_branch_lock = __esm({
   "packages/contracts/src/branch-lock.ts"() {
@@ -3912,6 +3919,38 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      {
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "saga.detach",
+        description: "tasks.saga.detach (mutate) \u2014 remove a Saga member relation (task_relations type=groups); idempotent; appends to .cleo/audit/saga-detach.jsonl (T10118)",
+        tier: 0,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["sagaId", "memberId"],
+        params: [
+          {
+            name: "sagaId",
+            type: "string",
+            required: true,
+            description: "Saga task ID",
+            cli: { positional: true }
+          },
+          {
+            name: "memberId",
+            type: "string",
+            required: true,
+            description: "Member task ID to detach from the Saga",
+            cli: { positional: true }
+          },
+          {
+            name: "reason",
+            type: "string",
+            required: false,
+            description: "Human-readable reason recorded in the audit log entry"
+          }
+        ]
+      },
       {
         gateway: "query",
         domain: "tasks",
@@ -3961,6 +4000,27 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      {
+        // T10117 — detach I5-violating parentId and re-attach via task_relations
+        // type=groups (ADR-073 §1.2 invariant I5). Idempotent.
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "saga.repair",
+        description: "tasks.saga.repair (mutate) \u2014 detach I5-violating parentId and re-attach via task_relations type=groups; idempotent",
+        tier: 0,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["sagaId"],
+        params: [
+          {
+            name: "sagaId",
+            type: "string",
+            required: true,
+            description: "Saga task ID (must have label=saga)",
+            cli: { positional: true }
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "tasks",
@@ -11081,6 +11141,7 @@ var init_src2 = __esm({
   "packages/contracts/src/index.ts"() {
     init_acceptance_gate_schema();
     init_attachment_schema();
+    init_boundary();
     init_branch_lock();
     init_changesets();
     init_cli_category();
@@ -14606,7 +14667,7 @@ var init_job_manager_accessor = __esm({
 });
 
 // packages/cleo/src/cli/paths.ts
-var CLEO_DIR_NAME, AGENTS_SUBDIR, CANT_AGENTS_SUBDIR, WORKFLOWS_SUBDIR, TEMPLATES_SUBDIR, RESTORE_IMPORTED_SUBDIR, TASKS_DB_FILENAME, BRAIN_DB_FILENAME, CONDUIT_DB_FILENAME, NEXUS_DB_FILENAME, SIGNALDOCK_DB_FILENAME, CONFIG_JSON, PROJECT_INFO_JSON, PROJECT_CONTEXT_JSON, RESTORE_CONFLICTS_MD, MIGRATE_MEMORY_HASHES_JSON, CLEO_INJECTION_MD, CLI_PROJECT_BACKUP_FILES, CLI_GLOBAL_BACKUP_FILES, RESTORE_VALID_JSON_FILENAMES, RESTORE_DEFAULT_FILE;
+var CLEO_DIR_NAME, AGENTS_SUBDIR, CANT_AGENTS_SUBDIR, WORKFLOWS_SUBDIR, TEMPLATES_SUBDIR, RESTORE_IMPORTED_SUBDIR, TASKS_DB_FILENAME, BRAIN_DB_FILENAME, CONDUIT_DB_FILENAME, NEXUS_DB_FILENAME, SIGNALDOCK_DB_FILENAME, CONFIG_JSON, PROJECT_INFO_JSON, PROJECT_CONTEXT_JSON, RESTORE_CONFLICTS_MD, MIGRATE_MEMORY_HASHES_JSON, CLEO_INJECTION_MD, CLI_PROJECT_BACKUP_FILES, CLI_GLOBAL_BACKUP_FILES, RESTORE_DEFAULT_FILE;
 var init_paths = __esm({
   "packages/cleo/src/cli/paths.ts"() {
     "use strict";
@@ -14636,11 +14697,6 @@ var init_paths = __esm({
       `${CLEO_DIR_NAME}/${PROJECT_CONTEXT_JSON}`
     ];
     CLI_GLOBAL_BACKUP_FILES = [NEXUS_DB_FILENAME, SIGNALDOCK_DB_FILENAME];
-    RESTORE_VALID_JSON_FILENAMES = /* @__PURE__ */ new Set([
-      CONFIG_JSON,
-      PROJECT_INFO_JSON,
-      PROJECT_CONTEXT_JSON
-    ]);
     RESTORE_DEFAULT_FILE = TASKS_DB_FILENAME;
   }
 });
@@ -30693,6 +30749,15 @@ var init_sticky2 = __esm({
 // packages/cleo/src/dispatch/domains/tasks.ts
 import { getLogger as getLogger15, getProjectRoot as getProjectRoot18 } from "@cleocode/core";
 import { createAttachmentStore as createAttachmentStore4 } from "@cleocode/core/internal";
+import {
+  sagaAdd as coreSagaAdd,
+  sagaCreate as coreSagaCreate,
+  detachSagaMember as coreSagaDetach,
+  sagaList as coreSagaList,
+  sagaMembers as coreSagaMembers,
+  repairSaga as coreSagaRepair,
+  sagaRollup as coreSagaRollup
+} from "@cleocode/core/sagas";
 async function fetchTaskAttachments(projectRoot, taskId) {
   try {
     const store = createAttachmentStore4();
@@ -30714,137 +30779,42 @@ async function fetchTaskAttachments(projectRoot, taskId) {
   }
 }
 async function sagaCreate(params) {
-  const projectRoot = getProjectRoot18();
   const title = typeof params.title === "string" ? params.title : "";
   const description = typeof params.description === "string" ? params.description : void 0;
   const acceptance = Array.isArray(params.acceptance) ? params.acceptance : void 0;
   return wrapCoreResult(
-    await addTaskWithSessionScope(projectRoot, {
-      title,
-      description,
-      labels: ["saga"],
-      type: "epic",
-      acceptance
-    }),
+    await coreSagaCreate(getProjectRoot18(), { title, description, acceptance }),
     "saga.create"
   );
 }
 async function sagaAdd(params) {
-  const projectRoot = getProjectRoot18();
   const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
   const epicId = typeof params.epicId === "string" ? params.epicId : "";
-  if (!sagaId || !epicId) {
-    return lafsError("E_INVALID_INPUT", "sagaId and epicId are required", "saga.add");
-  }
-  const sagaResult = await taskShow(projectRoot, sagaId);
-  if (!sagaResult.success || !sagaResult.data) {
-    return lafsError("E_NOT_FOUND", `Saga not found: ${sagaId}`, "saga.add");
-  }
-  const sagaTask = sagaResult.data.task;
-  const sagaLabels = sagaTask?.labels ?? [];
-  if (!sagaLabels.includes("saga")) {
-    return lafsError("E_INVALID_INPUT", `Task ${sagaId} does not have label='saga'`, "saga.add");
-  }
-  const epicResult = await taskShow(projectRoot, epicId);
-  if (!epicResult.success || !epicResult.data) {
-    return lafsError("E_NOT_FOUND", `Epic not found: ${epicId}`, "saga.add");
-  }
-  const epicType = epicResult.data.task?.type;
-  if (epicType !== "epic") {
-    return lafsError(
-      "E_INVALID_INPUT",
-      `Task ${epicId} has type='${String(epicType)}', expected type='epic'`,
-      "saga.add"
-    );
-  }
-  const relResult = await taskRelatesAdd(projectRoot, sagaId, epicId, "groups", void 0);
-  if (!relResult.success) {
-    return lafsError(
-      "E_GENERAL",
-      relResult.error?.message ?? "Failed to link Epic to Saga",
-      "saga.add"
-    );
-  }
-  return lafsSuccess({ sagaId, epicId, added: relResult.data?.added ?? true }, "saga.add");
+  return wrapCoreResult(await coreSagaAdd(getProjectRoot18(), { sagaId, epicId }), "saga.add");
+}
+async function sagaDetach(params) {
+  const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
+  const memberId = typeof params.memberId === "string" ? params.memberId : "";
+  const reason = typeof params.reason === "string" ? params.reason : void 0;
+  return wrapCoreResult(
+    await coreSagaDetach(getProjectRoot18(), { sagaId, memberId, reason }),
+    "saga.detach"
+  );
 }
 async function sagaList() {
-  const projectRoot = getProjectRoot18();
-  const result = await taskList(projectRoot, { type: "epic", label: "saga" });
-  if (!result.success) {
-    return lafsError("E_GENERAL", result.error?.message ?? "Failed to list Sagas", "saga.list");
-  }
-  const tasks = result.data?.tasks ?? [];
-  const topLevel = tasks.filter((t) => {
-    const parentId = t.parentId;
-    return !parentId;
-  });
-  return lafsSuccess({ sagas: topLevel, total: topLevel.length }, "saga.list");
+  return wrapCoreResult(await coreSagaList(getProjectRoot18()), "saga.list");
 }
 async function sagaMembers(params) {
-  const projectRoot = getProjectRoot18();
   const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
-  if (!sagaId) {
-    return lafsError("E_INVALID_INPUT", "sagaId is required", "saga.members");
-  }
-  const result = await taskRelates(projectRoot, sagaId);
-  if (!result.success) {
-    return lafsError(
-      "E_GENERAL",
-      result.error?.message ?? "Failed to list Saga members",
-      "saga.members"
-    );
-  }
-  const relations = result.data?.relations ?? [];
-  const members = relations.filter((r) => r.type === "groups");
-  return lafsSuccess(
-    {
-      sagaId,
-      members: members.map((r) => ({ epicId: r.taskId, type: r.type, reason: r.reason })),
-      total: members.length
-    },
-    "saga.members"
-  );
+  return wrapCoreResult(await coreSagaMembers(getProjectRoot18(), { sagaId }), "saga.members");
 }
 async function sagaRollup(params) {
-  const projectRoot = getProjectRoot18();
   const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
-  if (!sagaId) {
-    return lafsError("E_INVALID_INPUT", "sagaId is required", "saga.rollup");
-  }
-  const relResult = await taskRelates(projectRoot, sagaId);
-  if (!relResult.success) {
-    return lafsError(
-      "E_GENERAL",
-      relResult.error?.message ?? "Failed to fetch Saga members for rollup",
-      "saga.rollup"
-    );
-  }
-  const members = (relResult.data?.relations ?? []).filter((r) => r.type === "groups");
-  const total = members.length;
-  if (total === 0) {
-    return lafsSuccess(
-      { sagaId, total: 0, done: 0, active: 0, blocked: 0, pending: 0, completionPct: 0 },
-      "saga.rollup"
-    );
-  }
-  const shows = await Promise.all(members.map((m) => taskShow(projectRoot, m.taskId)));
-  let done = 0;
-  let active = 0;
-  let blocked = 0;
-  let pending = 0;
-  for (const r of shows) {
-    if (!r.success) continue;
-    const status = r.data?.task?.status ?? "pending";
-    if (status === "done") done++;
-    else if (status === "active") active++;
-    else if (status === "blocked") blocked++;
-    else pending++;
-  }
-  const completionPct = total > 0 ? Math.round(done / total * 100) : 0;
-  return lafsSuccess(
-    { sagaId, total, done, active, blocked, pending, completionPct },
-    "saga.rollup"
-  );
+  return wrapCoreResult(await coreSagaRollup(getProjectRoot18(), { sagaId }), "saga.rollup");
+}
+async function sagaRepair(params) {
+  const sagaId = typeof params.sagaId === "string" ? params.sagaId : "";
+  return wrapCoreResult(await coreSagaRepair(getProjectRoot18(), { sagaId }), "saga.repair");
 }
 var _tasksTypedHandler, QUERY_OPS11, MUTATE_OPS10, TasksHandler;
 var init_tasks3 = __esm({
@@ -31301,7 +31271,11 @@ var init_tasks3 = __esm({
       "unclaim",
       // Saga sub-domain (ADR-073)
       "saga.create",
-      "saga.add"
+      "saga.add",
+      // T10117 — repair an I5-violating saga (detach parentId, write groups edge).
+      "saga.repair",
+      // T10118 — repair verb for ADR-073 §1.2 I7 violations (detach saga member).
+      "saga.detach"
     ]);
     TasksHandler = class {
       // -----------------------------------------------------------------------
@@ -31398,6 +31372,26 @@ var init_tasks3 = __esm({
               startTime
             );
           }
+          if (operation === "saga.repair") {
+            const envelope = await sagaRepair(params ?? {});
+            return wrapResult(
+              envelopeToEngineResult(envelope),
+              "mutate",
+              "tasks",
+              operation,
+              startTime
+            );
+          }
+          if (operation === "saga.detach") {
+            const envelope = await sagaDetach(params ?? {});
+            return wrapResult(
+              envelopeToEngineResult(envelope),
+              "mutate",
+              "tasks",
+              operation,
+              startTime
+            );
+          }
         } catch (error) {
           getLogger15("domain:tasks").error(
             { gateway: "mutate", domain: "tasks", operation, err: error },
@@ -31470,7 +31464,11 @@ var init_tasks3 = __esm({
             "unclaim",
             // Saga sub-domain (ADR-073)
             "saga.create",
-            "saga.add"
+            "saga.add",
+            // T10117 — repair an I5-violating saga.
+            "saga.repair",
+            // T10118 — repair verb for ADR-073 §1.2 I7 violations
+            "saga.detach"
           ]
         };
       }
@@ -32235,13 +32233,13 @@ var init_upgrade = __esm({
 // packages/cleo/src/dispatch/domains/worktree.ts
 import {
   adoptWorktree,
+  destroyWorktree,
   forceUnlockWorktree,
   getLogger as getLogger18,
   getProjectRoot as getProjectRoot21,
   listWorktrees,
   pruneOrphanedWorktreesByStatus
 } from "@cleocode/core/internal";
-import { destroyWorktree } from "@cleocode/worktree";
 function coerceStatusFilter(value) {
   if (value === void 0 || value === null) return void 0;
   const raw = Array.isArray(value) ? value.filter((v) => typeof v === "string") : typeof value === "string" ? value.split(",").map((s) => s.trim()) : [];
@@ -37755,66 +37753,19 @@ var backup_inspect_exports = {};
 __export(backup_inspect_exports, {
   backupInspectSubCommand: () => backupInspectSubCommand
 });
-import crypto2 from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import zlib from "node:zlib";
-function extractManifestFromTar(tarBuf) {
-  let offset = 0;
-  while (offset + TAR_BLOCK_SIZE <= tarBuf.length) {
-    const header = tarBuf.subarray(offset, offset + TAR_BLOCK_SIZE);
-    if (header.every((b) => b === 0)) {
-      break;
-    }
-    const rawName = header.subarray(TAR_NAME_OFFSET, TAR_NAME_OFFSET + TAR_NAME_LENGTH);
-    const nullIdx = rawName.indexOf(0);
-    const entryName = rawName.subarray(0, nullIdx === -1 ? TAR_NAME_LENGTH : nullIdx).toString("utf8");
-    const typeFlag = String.fromCharCode(header[TAR_TYPE_OFFSET] ?? 0);
-    const isRegular = typeFlag === "0" || typeFlag === "\0";
-    const rawSize = header.subarray(TAR_SIZE_OFFSET, TAR_SIZE_OFFSET + TAR_SIZE_LENGTH).toString("utf8").replace(/\0/g, "").trim();
-    const fileSize = parseInt(rawSize, 8);
-    offset += TAR_BLOCK_SIZE;
-    const normalizedName = entryName.replace(/^\.\//, "");
-    if (isRegular && normalizedName === "manifest.json") {
-      if (offset + fileSize > tarBuf.length) {
-        return null;
-      }
-      return tarBuf.subarray(offset, offset + fileSize).toString("utf8");
-    }
-    if (!Number.isNaN(fileSize) && fileSize > 0) {
-      offset += Math.ceil(fileSize / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
-    }
-  }
-  return null;
-}
-function verifyManifestHash(raw, manifest) {
-  const integrity = manifest["integrity"];
-  if (!integrity || typeof integrity["manifestHash"] !== "string") {
-    return false;
-  }
-  const expectedHash = integrity["manifestHash"];
-  let obj;
-  try {
-    obj = JSON.parse(raw);
-  } catch {
-    return false;
-  }
-  const intObj = obj["integrity"];
-  intObj["manifestHash"] = "";
-  const forHashing = JSON.stringify(obj);
-  const computed = crypto2.createHash("sha256").update(forHashing).digest("hex");
-  return computed === expectedHash;
-}
-function fmtBytes(bytes) {
-  if (bytes >= 1024 * 1024) {
-    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-  }
-  if (bytes >= 1024) {
-    return `${(bytes / 1024).toFixed(1)} KB`;
-  }
-  return `${bytes} B`;
-}
+import {
+  detectEncryption,
+  ENC_MIN_LENGTH,
+  ENC_VERSION_OFFSET,
+  ENC_VERSION_SUPPORTED,
+  extractManifestFromTar,
+  fmtBytes,
+  verifyManifestHash
+} from "@cleocode/core";
 function printInspectReport(bundlePath, bundleSize, encrypted, manifest, integrityOk) {
   const backup = manifest["backup"] ?? {};
   const databases = manifest["databases"] ?? [];
@@ -37870,16 +37821,6 @@ function printInspectReport(bundlePath, bundleSize, encrypted, manifest, integri
   lines.push(`Manifest integrity: [${integrityOk ? "OK" : "TAMPERED"}]`);
   humanLine(lines.join("\n"));
 }
-function detectEncryption(filePath) {
-  const header = Buffer.alloc(8);
-  const fd = fs.openSync(filePath, "r");
-  try {
-    fs.readSync(fd, header, 0, 8, 0);
-  } finally {
-    fs.closeSync(fd);
-  }
-  return header.toString("utf8") === CLEO_ENC_MAGIC;
-}
 async function inspectAction(bundlePath) {
   const resolved = path.resolve(bundlePath);
   if (!fs.existsSync(resolved)) {
@@ -37980,22 +37921,12 @@ async function inspectTarball(tarPath, displayPath, encrypted) {
   printInspectReport(displayPath, stat3.size, encrypted, manifest, integrityOk);
   process.exitCode = 0;
 }
-var CLEO_ENC_MAGIC, ENC_VERSION_OFFSET, ENC_VERSION_SUPPORTED, ENC_MIN_LENGTH, TAR_BLOCK_SIZE, TAR_NAME_OFFSET, TAR_NAME_LENGTH, TAR_SIZE_OFFSET, TAR_SIZE_LENGTH, TAR_TYPE_OFFSET, backupInspectSubCommand;
+var backupInspectSubCommand;
 var init_backup_inspect = __esm({
   "packages/cleo/src/cli/commands/backup-inspect.ts"() {
     "use strict";
     init_dist();
     init_renderers();
-    CLEO_ENC_MAGIC = "CLEOENC1";
-    ENC_VERSION_OFFSET = 8;
-    ENC_VERSION_SUPPORTED = 1;
-    ENC_MIN_LENGTH = 8 + 1 + 7 + 32 + 12 + 16;
-    TAR_BLOCK_SIZE = 512;
-    TAR_NAME_OFFSET = 0;
-    TAR_NAME_LENGTH = 100;
-    TAR_SIZE_OFFSET = 124;
-    TAR_SIZE_LENGTH = 12;
-    TAR_TYPE_OFFSET = 156;
     backupInspectSubCommand = defineCommand({
       meta: {
         name: "inspect",
@@ -38020,7 +37951,7 @@ var backup_exports = {};
 __export(backup_exports, {
   backupCommand: () => backupCommand
 });
-import crypto3 from "node:crypto";
+import crypto2 from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 import readline from "node:readline";
@@ -38074,7 +38005,7 @@ function sha256OfMachineKey(cleoHome) {
   if (!fs2.existsSync(keyPath)) {
     return "0".repeat(64);
   }
-  return crypto3.createHash("sha256").update(fs2.readFileSync(keyPath)).digest("hex");
+  return crypto2.createHash("sha256").update(fs2.readFileSync(keyPath)).digest("hex");
 }
 var addCommand2, listCommand4, exportCommand, importCommand, backupCommand;
 var init_backup = __esm({
@@ -45916,6 +45847,31 @@ var init_doctor = __esm({
           type: "boolean",
           description: "Audit orphaned CLEO-generated temp directories and report what cleo gc --temp would remove (T9043)"
         },
+        /**
+         * T10119: audit every Saga (`type='epic'` + `label='saga'`) for
+         * ADR-073 §1.2 invariant violations (I5/I7 + depth ladder) and
+         * auto-close drift. Read-only; non-zero exit when any I-invariant
+         * fails so the check is CI-gateable.
+         *
+         * @task T10119
+         * @saga T10113
+         * @epic T10209
+         */
+        "audit-sagas": {
+          type: "boolean",
+          description: "Audit every Saga for ADR-073 \xA71.2 invariant violations (I5/I7/depth) + auto-close drift (T10119)"
+        },
+        /**
+         * T9983: migrate the worktree-include file location from
+         * `<root>/.cleo/worktree-include` (legacy) to `<root>/.worktreeinclude`
+         * (canonical, matches Claude Code Desktop + worktrunk-core). Backs the
+         * legacy file up to `.cleo/backups/worktree-include-<iso>.bak` before
+         * removing it from the legacy path. Combine with `--dry-run` to preview.
+         */
+        "migrate-worktree-include": {
+          type: "boolean",
+          description: "Migrate <root>/.cleo/worktree-include (legacy) \u2192 <root>/.worktreeinclude (canonical, T9983). Combine with --dry-run to preview."
+        },
         "dry-run": {
           type: "boolean",
           description: "With --quarantine-rogue-cleo-dirs or --scan-stray-nexus-dbs: print what would be done without acting"
@@ -46291,6 +46247,17 @@ var init_doctor = __esm({
             if (result.rejected.length > 0) {
               process.exitCode = 1;
             }
+          } else if (args["migrate-worktree-include"]) {
+            const isDryRun = args["dry-run"] === true;
+            progress.step(
+              0,
+              `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
+            );
+            const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
+            const projectRoot = getProjectRoot33();
+            const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
+            progress.complete(`Migration ${result.action}`);
+            cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
           } else if (args["audit-temp"]) {
             progress.step(0, "Auditing orphaned CLEO temp directories");
             const { auditOrphanTempDirs } = await import("@cleocode/core/gc/index.js");
@@ -46300,6 +46267,17 @@ var init_doctor = __esm({
             if (checkResult.details?.["orphans"] && checkResult.details["orphans"].length > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
               process.exitCode = 2;
             }
+          } else if (args["audit-sagas"]) {
+            progress.step(0, "Auditing Saga hierarchy for ADR-073 invariants");
+            const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
+            const projectRoot = getProjectRoot33();
+            const result = await auditSagaHierarchy(projectRoot);
+            const summary = `Saga audit complete \u2014 ${result.sagas.length} saga(s) inspected, ${result.count} invariant violation(s), ${result.driftCount} drift warning(s)`;
+            progress.complete(summary);
+            cliOutput(result, { command: "doctor", operation: "doctor.audit-sagas" });
+            if (result.count > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+              process.exitCode = 2;
+            }
           } else {
             progress.step(0, "Checking CLEO directory");
             await dispatchFromCli(
@@ -46340,6 +46318,34 @@ var init_doctor = __esm({
             } catch {
               progress.complete("Health check complete");
             }
+            try {
+              const projectRoot = getProjectRoot33();
+              const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
+              const sagaAudit = await auditSagaHierarchy(projectRoot);
+              if (sagaAudit.sagas.length === 0) {
+                humanLine("\nSaga Hierarchy: no sagas found in tasks.db");
+              } else {
+                const header = `
+Saga Hierarchy (${sagaAudit.sagas.length} saga(s), ${sagaAudit.count} violation(s), ${sagaAudit.driftCount} drift warning(s)):`;
+                humanLine(header);
+                for (const s of sagaAudit.sagas) {
+                  const violationSuffix = s.violations.length > 0 ? `, ${s.violations.length} violation(s)` : "";
+                  humanLine(
+                    `  ${s.sagaId} \xB7 status=${s.status} \xB7 ${s.doneCount}/${s.memberCount} members done${violationSuffix}`
+                  );
+                  for (const v of s.violations) {
+                    humanLine(`    [${v.kind}] ${v.message}`);
+                  }
+                }
+              }
+              if (sagaAudit.count > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+                process.exitCode = 2;
+              }
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              humanLine(`
+Saga Hierarchy: audit skipped (${msg})`);
+            }
           }
         } catch (err) {
           progress.error("Health check failed");
@@ -59079,116 +59085,19 @@ var init_research2 = __esm({
 // packages/cleo/src/cli/commands/restore.ts
 var restore_exports = {};
 __export(restore_exports, {
-  parseConflictReport: () => parseConflictReport,
+  parseConflictReport: () => parseConflictReport2,
   restoreCommand: () => restoreCommand
 });
 import fs3 from "node:fs";
 import path5 from "node:path";
-import { CleoError as CleoError7, getProjectRoot as getProjectRoot39, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core";
-function parseMarkdownValue(raw) {
-  const trimmed = raw.trim();
-  if (trimmed === "_(not present)_" || trimmed === "") return void 0;
-  const stripped = trimmed.replace(/^`([\s\S]*)`$/, "$1").trim();
-  try {
-    return JSON.parse(stripped);
-  } catch {
-    return stripped;
-  }
-}
-function setAtPath(obj, dotPath, value) {
-  const parts = dotPath.split(".");
-  let curr = obj;
-  for (let i = 0; i < parts.length - 1; i++) {
-    const key = parts[i];
-    if (curr[key] === void 0 || typeof curr[key] !== "object" || curr[key] === null) {
-      curr[key] = {};
-    }
-    curr = curr[key];
-  }
-  const lastKey = parts[parts.length - 1];
-  curr[lastKey] = value;
-}
-function parseConflictReport(md) {
-  const results = [];
-  const VALID_FILENAMES = RESTORE_VALID_JSON_FILENAMES;
-  const lines = md.split("\n");
-  let currentFilename = null;
-  let currentSection = null;
-  let entryField = null;
-  let entryLocalRaw = null;
-  let entryImportedRaw = null;
-  let entryResolution = null;
-  function flushEntry() {
-    if (entryField !== null && entryResolution !== null && currentFilename !== null && currentSection !== null) {
-      results.push({
-        section: currentSection,
-        filename: currentFilename,
-        fieldPath: entryField,
-        localValue: entryLocalRaw !== null ? parseMarkdownValue(entryLocalRaw) : void 0,
-        importedValue: entryImportedRaw !== null ? parseMarkdownValue(entryImportedRaw) : void 0,
-        resolution: entryResolution
-      });
-    }
-    entryField = null;
-    entryLocalRaw = null;
-    entryImportedRaw = null;
-    entryResolution = null;
-  }
-  for (const line of lines) {
-    const fileHeading = /^##\s+(.+\.json)\s*$/.exec(line);
-    if (fileHeading) {
-      flushEntry();
-      const name = fileHeading[1]?.trim() ?? "";
-      currentFilename = VALID_FILENAMES.has(name) ? name : null;
-      currentSection = null;
-      continue;
-    }
-    const sectionHeading = /^###\s+(.+)$/.exec(line);
-    if (sectionHeading) {
-      flushEntry();
-      const headingText = (sectionHeading[1] ?? "").toLowerCase();
-      if (headingText.includes("manual")) {
-        currentSection = "manual";
-      } else if (headingText.includes("resolved") || headingText.includes("auto")) {
-        currentSection = "auto";
-      } else {
-        currentSection = null;
-      }
-      continue;
-    }
-    if (currentFilename === null || currentSection === null) continue;
-    const fieldLine = /^-\s+`([^`]+)`\s*$/.exec(line);
-    if (fieldLine) {
-      flushEntry();
-      entryField = fieldLine[1] ?? null;
-      continue;
-    }
-    if (entryField === null) continue;
-    const localLine = /^\s+-\s+Local\s+\(A\):\s+(.+)$/.exec(line);
-    if (localLine) {
-      entryLocalRaw = localLine[1] ?? "";
-      continue;
-    }
-    const importedLine = /^\s+-\s+Imported\s+\(B\):\s+(.+)$/.exec(line);
-    if (importedLine) {
-      entryImportedRaw = importedLine[1] ?? "";
-      continue;
-    }
-    const resolutionLine = /^\s+-\s+Resolution:\s+\*\*([^*]+)\*\*/.exec(line);
-    if (resolutionLine) {
-      const resText = (resolutionLine[1] ?? "").trim();
-      if (resText === "A") {
-        entryResolution = "A";
-      } else if (resText === "B") {
-        entryResolution = "B";
-      } else {
-        entryResolution = "manual-review";
-      }
-    }
-  }
-  flushEntry();
-  return results;
-}
+import {
+  CleoError as CleoError7,
+  getProjectRoot as getProjectRoot39,
+  getTaskAccessor as getTaskAccessor3,
+  parseConflictReport,
+  setAtPath
+} from "@cleocode/core";
+import { parseConflictReport as parseConflictReport2 } from "@cleocode/core";
 var finalizeCommand, backupSubCommand, taskSubCommand, restoreCommand;
 var init_restore = __esm({
   "packages/cleo/src/cli/commands/restore.ts"() {
@@ -59902,7 +59811,7 @@ __export(saga_exports, {
   sagaCommand: () => sagaCommand
 });
 import { parseAcceptanceCriteria } from "@cleocode/core";
-var createCommand3, addCommand11, listCommand22, membersCommand, rollupCommand2, sagaCommand;
+var createCommand3, addCommand11, detachCommand2, listCommand22, membersCommand, repairCommand, rollupCommand2, sagaCommand;
 var init_saga = __esm({
   "packages/cleo/src/cli/commands/saga.ts"() {
     "use strict";
@@ -59974,6 +59883,38 @@ var init_saga = __esm({
         );
       }
     });
+    detachCommand2 = defineCommand({
+      meta: {
+        name: "detach",
+        description: "Remove a Saga member relation (task_relations type=groups) \u2014 idempotent, audit-logged"
+      },
+      args: {
+        sagaId: {
+          type: "positional",
+          description: "Saga task ID",
+          required: true
+        },
+        memberId: {
+          type: "positional",
+          description: "Member task ID to detach from the Saga",
+          required: true
+        },
+        reason: {
+          type: "string",
+          description: "Human-readable reason recorded in the audit log entry",
+          required: false
+        }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "mutate",
+          "tasks",
+          "saga.detach",
+          { sagaId: args.sagaId, memberId: args.memberId, reason: args.reason },
+          { command: "saga", operation: "tasks.saga.detach" }
+        );
+      }
+    });
     listCommand22 = defineCommand({
       meta: {
         name: "list",
@@ -60005,6 +59946,28 @@ var init_saga = __esm({
         );
       }
     });
+    repairCommand = defineCommand({
+      meta: {
+        name: "repair",
+        description: "Detach an I5-violating parentId from a Saga and re-attach via task_relations.type='groups' (ADR-073 \xA71.2). Idempotent."
+      },
+      args: {
+        sagaId: {
+          type: "positional",
+          description: "Saga task ID (must have label=saga)",
+          required: true
+        }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "mutate",
+          "tasks",
+          "saga.repair",
+          { sagaId: args.sagaId },
+          { command: "saga", operation: "tasks.saga.repair" }
+        );
+      }
+    });
     rollupCommand2 = defineCommand({
       meta: {
         name: "rollup",
@@ -60033,9 +59996,11 @@ var init_saga = __esm({
       subCommands: {
         create: createCommand3,
         add: addCommand11,
+        detach: detachCommand2,
         list: listCommand22,
         members: membersCommand,
-        rollup: rollupCommand2
+        rollup: rollupCommand2,
+        repair: repairCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -61611,7 +61576,7 @@ __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
 import { getProjectRoot as getProjectRoot40 } from "@cleocode/core/internal";
-var showCommand12, checkCommand6, repairCommand, sequenceCommand;
+var showCommand12, checkCommand6, repairCommand2, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
     "use strict";
@@ -61642,7 +61607,7 @@ var init_sequence = __esm({
         );
       }
     });
-    repairCommand = defineCommand({
+    repairCommand2 = defineCommand({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
@@ -61666,7 +61631,7 @@ var init_sequence = __esm({
       subCommands: {
         show: showCommand12,
         check: checkCommand6,
-        repair: repairCommand
+        repair: repairCommand2
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -62539,119 +62504,11 @@ __export(setup_exports, {
   runSetup: () => runSetup,
   setupCommand: () => setupCommand2
 });
-import { createDefaultWizardRunner, WizardInterruptError as WizardInterruptError2 } from "@cleocode/core/setup";
-function mergeConfigJson(parsed, out) {
-  out.configJson = parsed;
-  for (const [sectionId, sectionOpts] of Object.entries(parsed)) {
-    if (!WIZARD_SECTION_IDS.has(sectionId)) continue;
-    if (typeof sectionOpts !== "object" || sectionOpts === null) continue;
-    if ("provider" in sectionOpts && out.provider === void 0) {
-      if (typeof sectionOpts["provider"] === "string" && sectionOpts["provider"] !== "") {
-        out.provider = sectionOpts["provider"];
-      }
-    }
-    if ("apiKey" in sectionOpts && out.apiKey === void 0) {
-      if (typeof sectionOpts["apiKey"] === "string" && sectionOpts["apiKey"] !== "") {
-        out.apiKey = sectionOpts["apiKey"];
-      }
-    }
-    if ("label" in sectionOpts && out.label === void 0) {
-      if (typeof sectionOpts["label"] === "string" && sectionOpts["label"] !== "") {
-        out.label = sectionOpts["label"];
-      }
-    }
-    if ("agentName" in sectionOpts && out.agentName === void 0) {
-      if (typeof sectionOpts["agentName"] === "string" && sectionOpts["agentName"] !== "") {
-        out.agentName = sectionOpts["agentName"];
-      }
-    }
-    if ("soulMdContent" in sectionOpts && out.soulMdContent === void 0) {
-      if (typeof sectionOpts["soulMdContent"] === "string" && sectionOpts["soulMdContent"] !== "") {
-        out.soulMdContent = sectionOpts["soulMdContent"];
-      }
-    }
-    if ("strictness" in sectionOpts && out.strictness === void 0) {
-      const s = sectionOpts["strictness"];
-      if (s === "strict" || s === "standard" || s === "minimal") {
-        out.strictness = s;
-      }
-    }
-    if ("harness" in sectionOpts && out.harness === void 0) {
-      const h = sectionOpts["harness"];
-      if (h === "pi" || h === "claude-code") {
-        out.harness = h;
-      }
-    }
-    if ("brainBridgeMode" in sectionOpts && out.brainBridgeMode === void 0) {
-      const b = sectionOpts["brainBridgeMode"];
-      if (b === "digest" || b === "file" || b === "disabled") {
-        out.brainBridgeMode = b;
-      }
-    }
-    if ("sentientEnabled" in sectionOpts && out.sentientEnabled === void 0) {
-      if (typeof sectionOpts["sentientEnabled"] === "boolean") {
-        out.sentientEnabled = sectionOpts["sentientEnabled"];
-      }
-    }
-    if ("tier2Enabled" in sectionOpts && out.tier2Enabled === void 0) {
-      if (typeof sectionOpts["tier2Enabled"] === "boolean") {
-        out.tier2Enabled = sectionOpts["tier2Enabled"];
-      }
-    }
-    if ("signaldockAutoConnect" in sectionOpts && out.signaldockAutoConnect === void 0) {
-      if (typeof sectionOpts["signaldockAutoConnect"] === "boolean") {
-        out.signaldockAutoConnect = sectionOpts["signaldockAutoConnect"];
-      }
-    }
-    if ("brainRetentionDays" in sectionOpts && out.brainRetentionDays === void 0) {
-      const v = sectionOpts["brainRetentionDays"];
-      if (typeof v === "number" && Number.isInteger(v) && v >= 0) {
-        out.brainRetentionDays = v;
-      }
-    }
-    if ("brainEmbeddingEnabled" in sectionOpts && out.brainEmbeddingEnabled === void 0) {
-      if (typeof sectionOpts["brainEmbeddingEnabled"] === "boolean") {
-        out.brainEmbeddingEnabled = sectionOpts["brainEmbeddingEnabled"];
-      }
-    }
-    if ("signaldockEnabled" in sectionOpts && out.signaldockEnabled === void 0) {
-      if (typeof sectionOpts["signaldockEnabled"] === "boolean") {
-        out.signaldockEnabled = sectionOpts["signaldockEnabled"];
-      }
-    }
-    if ("signaldockEndpoint" in sectionOpts && out.signaldockEndpoint === void 0) {
-      if (typeof sectionOpts["signaldockEndpoint"] === "string" && sectionOpts["signaldockEndpoint"] !== "") {
-        out.signaldockEndpoint = sectionOpts["signaldockEndpoint"];
-      }
-    }
-    if ("studioEnabled" in sectionOpts && out.studioEnabled === void 0) {
-      if (typeof sectionOpts["studioEnabled"] === "boolean") {
-        out.studioEnabled = sectionOpts["studioEnabled"];
-      }
-    }
-    if ("conduitPath" in sectionOpts && out.conduitPath === void 0) {
-      if (typeof sectionOpts["conduitPath"] === "string" && sectionOpts["conduitPath"] !== "") {
-        out.conduitPath = sectionOpts["conduitPath"];
-      }
-    }
-    if ("poolSeedingConsent" in sectionOpts && out.poolSeedingConsent === void 0) {
-      if (typeof sectionOpts["poolSeedingConsent"] === "boolean") {
-        out.poolSeedingConsent = sectionOpts["poolSeedingConsent"];
-      }
-    }
-    if ("acEnforcementMode" in sectionOpts && out.acEnforcementMode === void 0) {
-      const m = sectionOpts["acEnforcementMode"];
-      if (m === "block" || m === "warn" || m === "off") {
-        out.acEnforcementMode = m;
-      }
-    }
-    if ("sessionAutoStart" in sectionOpts && out.sessionAutoStart === void 0) {
-      if (typeof sectionOpts["sessionAutoStart"] === "boolean") {
-        out.sessionAutoStart = sectionOpts["sessionAutoStart"];
-      }
-    }
-  }
-}
+import {
+  createDefaultWizardRunner,
+  mergeConfigJson,
+  WizardInterruptError as WizardInterruptError2
+} from "@cleocode/core/setup";
 function buildWizardOptions(args) {
   const out = {};
   const configJsonRaw = args["config-json"] ?? args["configJson"];
@@ -62781,23 +62638,13 @@ async function runSetup(args, io) {
     ok: isOk(runResult)
   };
 }
-var WIZARD_SECTION_IDS, setupCommand2;
+var setupCommand2;
 var init_setup = __esm({
   "packages/cleo/src/cli/commands/setup.ts"() {
     "use strict";
     init_dist();
     init_readline_wizard_io();
     init_renderers();
-    WIZARD_SECTION_IDS = /* @__PURE__ */ new Set([
-      "llm",
-      "identity",
-      "harness",
-      "sentient",
-      "project-conventions",
-      "brain",
-      "integrations",
-      "verification"
-    ]);
     setupCommand2 = defineCommand({
       meta: {
         name: "setup",