@cleocode/cleo 2026.5.112 → 2026.5.113

package/dist/cli/index.js

@@ -1219,7 +1219,6 @@ var init_tree = __esm({
 // packages/animations/src/render/index.ts
 var init_render = __esm({
   "packages/animations/src/render/index.ts"() {
-    "use strict";
     init_legend();
     init_tree();
   }
@@ -1337,6 +1336,7 @@ var init_spinner_handle = __esm({
 var init_src = __esm({
   "packages/animations/src/index.ts"() {
     init_animate_context();
+    init_render();
     init_spinner_handle();
   }
 });
@@ -1740,6 +1740,63 @@ var init_cli_category = __esm({
   }
 });
 
+// packages/contracts/src/config/manifest.ts
+import { z as z4 } from "zod";
+var PROJECT_INFO_MANIFEST, PROJECT_CONTEXT_MANIFEST, CLEO_CONFIG_MANIFEST, GLOBAL_CLEO_CONFIG_MANIFEST, CONFIG_MANIFEST_ENTRIES, configManifestEntrySchema;
+var init_manifest = __esm({
+  "packages/contracts/src/config/manifest.ts"() {
+    "use strict";
+    PROJECT_INFO_MANIFEST = {
+      id: "project-info",
+      scope: "metadata",
+      path: ".cleo/project-info.json",
+      mergePrecedence: 0,
+      driftDetection: "schema-validate"
+    };
+    PROJECT_CONTEXT_MANIFEST = {
+      id: "project-context",
+      scope: "metadata",
+      path: ".cleo/project-context.json",
+      mergePrecedence: 0,
+      driftDetection: "staleness-gate"
+    };
+    CLEO_CONFIG_MANIFEST = {
+      id: "cleo-config-project",
+      scope: "project",
+      path: ".cleo/config.json",
+      mergePrecedence: 20,
+      driftDetection: "schema-validate"
+    };
+    GLOBAL_CLEO_CONFIG_MANIFEST = {
+      id: "cleo-config-global",
+      scope: "global",
+      path: "~/.cleo/config.json",
+      mergePrecedence: 10,
+      driftDetection: "schema-validate"
+    };
+    CONFIG_MANIFEST_ENTRIES = Object.freeze([
+      PROJECT_INFO_MANIFEST,
+      PROJECT_CONTEXT_MANIFEST,
+      GLOBAL_CLEO_CONFIG_MANIFEST,
+      CLEO_CONFIG_MANIFEST
+    ]);
+    configManifestEntrySchema = z4.object({
+      id: z4.string().min(1),
+      scope: z4.union([z4.literal("global"), z4.literal("project"), z4.literal("metadata")]),
+      path: z4.string().min(1),
+      schema: z4.unknown().optional(),
+      mergePrecedence: z4.number().int().nonnegative(),
+      driftDetection: z4.union([
+        z4.literal("schema-validate"),
+        z4.literal("staleness-gate"),
+        z4.literal("value-diff"),
+        z4.literal("none")
+      ]),
+      defaults: z4.record(z4.string(), z4.unknown()).optional()
+    });
+  }
+});
+
 // packages/contracts/src/credentials.ts
 var init_credentials = __esm({
   "packages/contracts/src/credentials.ts"() {
@@ -9688,6 +9745,100 @@ var init_operations_registry = __esm({
   }
 });
 
+// packages/contracts/src/docs/provenance.ts
+import { z as z5 } from "zod";
+var PROVENANCE_NODE_KINDS, PROVENANCE_EDGE_RELATIONS, DOC_LIFECYCLE_STATUSES, provenanceNodeKindSchema, provenanceEdgeRelationSchema, docLifecycleStatusSchema, provenanceNodeBaseFields, provenanceDocNodeSchema, provenanceTaskNodeSchema, provenanceDecisionNodeSchema, provenanceSessionNodeSchema, provenanceMemoryNodeSchema, provenanceNodeSchema, provenanceEdgeSchema, docProvenanceResponseSchema;
+var init_provenance = __esm({
+  "packages/contracts/src/docs/provenance.ts"() {
+    "use strict";
+    PROVENANCE_NODE_KINDS = [
+      "doc",
+      "task",
+      "decision",
+      "session",
+      "memory"
+    ];
+    PROVENANCE_EDGE_RELATIONS = [
+      "attached-to",
+      "supersedes",
+      "superseded-by",
+      "related-task",
+      "linked-decision",
+      "derived-from"
+    ];
+    DOC_LIFECYCLE_STATUSES = [
+      "active",
+      "superseded",
+      "archived",
+      "draft"
+    ];
+    provenanceNodeKindSchema = z5.enum(PROVENANCE_NODE_KINDS);
+    provenanceEdgeRelationSchema = z5.enum(PROVENANCE_EDGE_RELATIONS);
+    docLifecycleStatusSchema = z5.enum(DOC_LIFECYCLE_STATUSES);
+    provenanceNodeBaseFields = {
+      id: z5.string().min(1),
+      title: z5.string().min(1),
+      metadata: z5.record(z5.string(), z5.unknown()).optional()
+    };
+    provenanceDocNodeSchema = z5.object({
+      ...provenanceNodeBaseFields,
+      kind: z5.literal("doc"),
+      slug: z5.string().min(1),
+      docKind: z5.string().min(1),
+      lifecycleStatus: docLifecycleStatusSchema,
+      publishedAt: z5.string().min(1),
+      supersededAt: z5.string().min(1).optional(),
+      summary: z5.string().optional()
+    });
+    provenanceTaskNodeSchema = z5.object({
+      ...provenanceNodeBaseFields,
+      kind: z5.literal("task"),
+      taskType: z5.enum(["saga", "epic", "task", "subtask"]),
+      status: z5.enum(["pending", "in_progress", "done", "blocked", "cancelled", "archived"])
+    });
+    provenanceDecisionNodeSchema = z5.object({
+      ...provenanceNodeBaseFields,
+      kind: z5.literal("decision"),
+      outcome: z5.enum(["proposed", "accepted", "rejected", "superseded"]),
+      decidedAt: z5.string().min(1)
+    });
+    provenanceSessionNodeSchema = z5.object({
+      ...provenanceNodeBaseFields,
+      kind: z5.literal("session"),
+      startedAt: z5.string().min(1),
+      endedAt: z5.string().min(1).optional()
+    });
+    provenanceMemoryNodeSchema = z5.object({
+      ...provenanceNodeBaseFields,
+      kind: z5.literal("memory"),
+      memoryType: z5.enum(["observation", "pattern", "decision", "diary"]),
+      recordedAt: z5.string().min(1)
+    });
+    provenanceNodeSchema = z5.discriminatedUnion("kind", [
+      provenanceDocNodeSchema,
+      provenanceTaskNodeSchema,
+      provenanceDecisionNodeSchema,
+      provenanceSessionNodeSchema,
+      provenanceMemoryNodeSchema
+    ]);
+    provenanceEdgeSchema = z5.object({
+      relation: provenanceEdgeRelationSchema,
+      from: z5.string().min(1),
+      fromKind: provenanceNodeKindSchema,
+      to: z5.string().min(1),
+      toKind: provenanceNodeKindSchema,
+      addedAt: z5.string().min(1),
+      summary: z5.string().optional()
+    });
+    docProvenanceResponseSchema = z5.object({
+      nodes: z5.array(provenanceNodeSchema).readonly(),
+      edges: z5.array(provenanceEdgeSchema).readonly(),
+      totalNodes: z5.number().int().nonnegative(),
+      totalEdges: z5.number().int().nonnegative()
+    });
+  }
+});
+
 // packages/contracts/src/docs-taxonomy.ts
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -9762,6 +9913,24 @@ function validateExtensionEntry(raw, source, index) {
       source
     );
   }
+  let requiredSections;
+  if (obj.requiredSections !== void 0) {
+    if (!Array.isArray(obj.requiredSections)) {
+      throw new DocKindConfigError(`${where}: 'requiredSections' must be an array`, source);
+    }
+    const sections = [];
+    for (let i = 0; i < obj.requiredSections.length; i++) {
+      const item = obj.requiredSections[i];
+      if (typeof item !== "string" || item.length === 0) {
+        throw new DocKindConfigError(
+          `${where}: 'requiredSections[${i}]' must be a non-empty string`,
+          source
+        );
+      }
+      sections.push(item);
+    }
+    requiredSections = sections;
+  }
   return {
     kind,
     label,
@@ -9769,7 +9938,8 @@ function validateExtensionEntry(raw, source, index) {
     defaultOwnerKind,
     publishDir,
     requiresEntityId,
-    ...entityIdPattern !== void 0 ? { entityIdPattern } : {}
+    ...entityIdPattern !== void 0 ? { entityIdPattern } : {},
+    ...requiredSections !== void 0 ? { requiredSections } : {}
   };
 }
 function compileExtension(ext, source) {
@@ -9792,6 +9962,7 @@ function compileExtension(ext, source) {
     publishDir: ext.publishDir,
     requiresEntityId: ext.requiresEntityId,
     ...entityIdPattern !== void 0 ? { entityIdPattern } : {},
+    ...ext.requiredSections !== void 0 ? { requiredSections: ext.requiredSections } : {},
     isExtension: true
   };
 }
@@ -9828,7 +9999,8 @@ var init_docs_taxonomy = __esm({
         defaultOwnerKind: "task",
         publishDir: "docs/adr",
         requiresEntityId: true,
-        entityIdPattern: /^adr-\d{3,4}-[a-z0-9-]+$/
+        entityIdPattern: /^adr-\d{3,4}-[a-z0-9-]+$/,
+        requiredSections: ["Status", "Date", "Context", "Decision", "Consequences"]
       },
       {
         kind: "spec",
@@ -9836,7 +10008,8 @@ var init_docs_taxonomy = __esm({
         description: "Technical specification",
         defaultOwnerKind: "task",
         publishDir: "docs/spec",
-        requiresEntityId: false
+        requiresEntityId: false,
+        requiredSections: ["Goal", "Non-Goals", "Requirements", "Out-of-Scope"]
       },
       {
         kind: "research",
@@ -9844,7 +10017,8 @@ var init_docs_taxonomy = __esm({
         description: "Investigation / research note",
         defaultOwnerKind: "task",
         publishDir: "docs/research",
-        requiresEntityId: false
+        requiresEntityId: false,
+        requiredSections: ["Question", "Findings", "Sources"]
       },
       {
         kind: "handoff",
@@ -9852,7 +10026,8 @@ var init_docs_taxonomy = __esm({
         description: "Session / agent handoff",
         defaultOwnerKind: "session",
         publishDir: "docs/handoff",
-        requiresEntityId: false
+        requiresEntityId: false,
+        requiredSections: ["Context", "State", "Next-Steps"]
       },
       {
         kind: "note",
@@ -9860,7 +10035,8 @@ var init_docs_taxonomy = __esm({
         description: "Agent observation / informal note",
         defaultOwnerKind: "observation",
         publishDir: "docs/note",
-        requiresEntityId: false
+        requiresEntityId: false,
+        requiredSections: []
       },
       {
         kind: "llm-readme",
@@ -9868,7 +10044,8 @@ var init_docs_taxonomy = __esm({
         description: "Machine-readable README (llms.txt)",
         defaultOwnerKind: "project",
         publishDir: ".",
-        requiresEntityId: false
+        requiresEntityId: false,
+        requiredSections: []
       },
       {
         kind: "changeset",
@@ -9877,7 +10054,8 @@ var init_docs_taxonomy = __esm({
         defaultOwnerKind: "task",
         publishDir: ".changeset",
         requiresEntityId: true,
-        entityIdPattern: /^t\d+-[a-z0-9-]+$/
+        entityIdPattern: /^t\d+-[a-z0-9-]+$/,
+        requiredSections: []
       },
       {
         kind: "release-note",
@@ -9886,7 +10064,8 @@ var init_docs_taxonomy = __esm({
         defaultOwnerKind: "project",
         publishDir: "docs/release",
         requiresEntityId: true,
-        entityIdPattern: /^v\d{4}\.\d+\.\d+(-[a-z0-9-]+)?$/
+        entityIdPattern: /^v\d{4}\.\d+\.\d+(-[a-z0-9-]+)?$/,
+        requiredSections: ["Changes", "Migration"]
       },
       {
         kind: "plan",
@@ -9894,7 +10073,8 @@ var init_docs_taxonomy = __esm({
         description: "Epic / saga decomposition plan",
         defaultOwnerKind: "task",
         publishDir: "docs/plan",
-        requiresEntityId: false
+        requiresEntityId: false,
+        requiredSections: ["Goal", "Steps", "Owners"]
       },
       {
         kind: "rcasd",
@@ -9903,7 +10083,8 @@ var init_docs_taxonomy = __esm({
         defaultOwnerKind: "task",
         publishDir: ".cleo/rcasd",
         requiresEntityId: true,
-        entityIdPattern: /^t\d+(-.+)?$/
+        entityIdPattern: /^t\d+(-.+)?$/,
+        requiredSections: ["Root-Cause", "Action", "Schedule", "Detection"]
       }
     ];
     BUILTIN_DOC_KIND_VALUES = Object.freeze(
@@ -10080,9 +10261,11 @@ var init_engine_result = __esm({
 });
 
 // packages/contracts/src/enums.ts
+var TASK_SEVERITIES;
 var init_enums = __esm({
   "packages/contracts/src/enums.ts"() {
     "use strict";
+    TASK_SEVERITIES = ["P0", "P1", "P2", "P3"];
   }
 });
 
@@ -10213,54 +10396,54 @@ var init_errors = __esm({
 });
 
 // packages/contracts/src/evidence-atom-schema.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
-    commitAtomSchema = z4.object({
-      kind: z4.literal("commit"),
-      sha: z4.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
+    commitAtomSchema = z6.object({
+      kind: z6.literal("commit"),
+      sha: z6.string().regex(/^[0-9a-f]{7,40}$/i, "commit sha must be 7-40 hex characters")
     });
-    filesAtomSchema = z4.object({
-      kind: z4.literal("files"),
-      paths: z4.array(z4.string().min(1)).min(1, "files atom requires at least one path")
+    filesAtomSchema = z6.object({
+      kind: z6.literal("files"),
+      paths: z6.array(z6.string().min(1)).min(1, "files atom requires at least one path")
     });
-    testRunAtomSchema = z4.object({
-      kind: z4.literal("test-run"),
-      path: z4.string().min(1, "test-run atom requires a non-empty path")
+    testRunAtomSchema = z6.object({
+      kind: z6.literal("test-run"),
+      path: z6.string().min(1, "test-run atom requires a non-empty path")
     });
-    toolAtomSchema = z4.object({
-      kind: z4.literal("tool"),
-      tool: z4.string().min(1, "tool atom requires a non-empty tool name")
+    toolAtomSchema = z6.object({
+      kind: z6.literal("tool"),
+      tool: z6.string().min(1, "tool atom requires a non-empty tool name")
     });
-    urlAtomSchema = z4.object({
-      kind: z4.literal("url"),
-      url: z4.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
+    urlAtomSchema = z6.object({
+      kind: z6.literal("url"),
+      url: z6.string().min(1).regex(/^https?:\/\//, "url atom must start with http:// or https://")
     });
-    noteAtomSchema = z4.object({
-      kind: z4.literal("note"),
-      note: z4.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
+    noteAtomSchema = z6.object({
+      kind: z6.literal("note"),
+      note: z6.string().min(1, "note atom must be non-empty").max(512, "note atom is too long (max 512 chars)")
     });
-    decisionAtomSchema = z4.object({
-      kind: z4.literal("decision"),
-      decisionId: z4.string().min(1, "decision atom requires a non-empty decision ID")
+    decisionAtomSchema = z6.object({
+      kind: z6.literal("decision"),
+      decisionId: z6.string().min(1, "decision atom requires a non-empty decision ID")
     });
-    prAtomSchema = z4.object({
-      kind: z4.literal("pr"),
-      prNumber: z4.number().int().positive("pr atom requires a positive integer PR number")
+    prAtomSchema = z6.object({
+      kind: z6.literal("pr"),
+      prNumber: z6.number().int().positive("pr atom requires a positive integer PR number")
     });
-    locDropAtomSchema = z4.object({
-      kind: z4.literal("loc-drop"),
-      fromLines: z4.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
-      toLines: z4.number().int().nonnegative("loc-drop toLines must be \u2265 0")
+    locDropAtomSchema = z6.object({
+      kind: z6.literal("loc-drop"),
+      fromLines: z6.number().int().nonnegative("loc-drop fromLines must be \u2265 0"),
+      toLines: z6.number().int().nonnegative("loc-drop toLines must be \u2265 0")
     });
-    callsiteCoverageAtomSchema = z4.object({
-      kind: z4.literal("callsite-coverage"),
-      symbolName: z4.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
-      relativeSourcePath: z4.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
+    callsiteCoverageAtomSchema = z6.object({
+      kind: z6.literal("callsite-coverage"),
+      symbolName: z6.string().min(1, "callsite-coverage atom requires a non-empty symbolName"),
+      relativeSourcePath: z6.string().min(1, "callsite-coverage atom requires a non-empty relativeSourcePath")
     });
-    EvidenceAtomSchema = z4.discriminatedUnion("kind", [
+    EvidenceAtomSchema = z6.discriminatedUnion("kind", [
       commitAtomSchema,
       filesAtomSchema,
       testRunAtomSchema,
@@ -10293,58 +10476,58 @@ var init_evidence_atom_schema = __esm({
 });
 
 // packages/contracts/src/evidence-record-schema.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 var evidenceBaseSchema, implDiffRecordSchema, validateSpecCheckRecordSchema, testOutputRecordSchema, lintReportRecordSchema, commandOutputRecordSchema, evidenceRecordSchema;
 var init_evidence_record_schema = __esm({
   "packages/contracts/src/evidence-record-schema.ts"() {
     "use strict";
-    evidenceBaseSchema = z5.object({
+    evidenceBaseSchema = z7.object({
       /** Identity string of the agent that produced this record. */
-      agentIdentity: z5.string().min(1),
+      agentIdentity: z7.string().min(1),
       /** SHA-256 hex digest (64 chars) of the attached artifact. */
-      attachmentSha256: z5.string().length(64),
+      attachmentSha256: z7.string().length(64),
       /** ISO 8601 timestamp at which the action ran. */
-      ranAt: z5.string().datetime(),
+      ranAt: z7.string().datetime(),
       /** Wall-clock duration of the action in milliseconds. */
-      durationMs: z5.number().nonnegative()
+      durationMs: z7.number().nonnegative()
     });
     implDiffRecordSchema = evidenceBaseSchema.extend({
-      kind: z5.literal("impl-diff"),
-      phase: z5.literal("implement"),
-      filesChanged: z5.array(z5.string().min(1)).min(1),
-      linesAdded: z5.number().int().nonnegative(),
-      linesRemoved: z5.number().int().nonnegative()
+      kind: z7.literal("impl-diff"),
+      phase: z7.literal("implement"),
+      filesChanged: z7.array(z7.string().min(1)).min(1),
+      linesAdded: z7.number().int().nonnegative(),
+      linesRemoved: z7.number().int().nonnegative()
     });
     validateSpecCheckRecordSchema = evidenceBaseSchema.extend({
-      kind: z5.literal("validate-spec-check"),
-      phase: z5.literal("validate"),
-      reqIdsChecked: z5.array(z5.string().min(1)).min(1),
-      passed: z5.boolean(),
-      details: z5.string().min(1)
+      kind: z7.literal("validate-spec-check"),
+      phase: z7.literal("validate"),
+      reqIdsChecked: z7.array(z7.string().min(1)).min(1),
+      passed: z7.boolean(),
+      details: z7.string().min(1)
     });
     testOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z5.literal("test-output"),
-      phase: z5.literal("test"),
-      command: z5.string().min(1),
-      exitCode: z5.number().int(),
-      testsPassed: z5.number().int().nonnegative(),
-      testsFailed: z5.number().int().nonnegative()
+      kind: z7.literal("test-output"),
+      phase: z7.literal("test"),
+      command: z7.string().min(1),
+      exitCode: z7.number().int(),
+      testsPassed: z7.number().int().nonnegative(),
+      testsFailed: z7.number().int().nonnegative()
     });
     lintReportRecordSchema = evidenceBaseSchema.extend({
-      kind: z5.literal("lint-report"),
-      phase: z5.enum(["implement", "test"]),
-      tool: z5.string().min(1),
-      passed: z5.boolean(),
-      warnings: z5.number().int().nonnegative(),
-      errors: z5.number().int().nonnegative()
+      kind: z7.literal("lint-report"),
+      phase: z7.enum(["implement", "test"]),
+      tool: z7.string().min(1),
+      passed: z7.boolean(),
+      warnings: z7.number().int().nonnegative(),
+      errors: z7.number().int().nonnegative()
     });
     commandOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z5.literal("command-output"),
-      phase: z5.enum(["implement", "validate", "test"]),
-      cmd: z5.string().min(1),
-      exitCode: z5.number().int()
+      kind: z7.literal("command-output"),
+      phase: z7.enum(["implement", "validate", "test"]),
+      cmd: z7.string().min(1),
+      exitCode: z7.number().int()
     });
-    evidenceRecordSchema = z5.discriminatedUnion("kind", [
+    evidenceRecordSchema = z7.discriminatedUnion("kind", [
       implDiffRecordSchema,
       validateSpecCheckRecordSchema,
       testOutputRecordSchema,
@@ -10368,6 +10551,302 @@ var init_graph = __esm({
   }
 });
 
+// packages/contracts/src/invariants/adr-056-release.ts
+var ARCHIVE_REASON_MODULE, RELEASE_INVARIANTS_REGISTRY_MODULE, RELEASE_COMMIT_MSG_HOOK, ADR_056_INVARIANTS;
+var init_adr_056_release = __esm({
+  "packages/contracts/src/invariants/adr-056-release.ts"() {
+    "use strict";
+    ARCHIVE_REASON_MODULE = "packages/contracts/src/tasks/archive.ts";
+    RELEASE_INVARIANTS_REGISTRY_MODULE = "packages/core/src/release/invariants/registry.ts";
+    RELEASE_COMMIT_MSG_HOOK = "scripts/hooks/commit-msg-release-lint.mjs";
+    ADR_056_INVARIANTS = Object.freeze([
+      {
+        adr: "ADR-056",
+        code: "D1",
+        name: "Database topology: keep per-domain split",
+        description: "CLEO retains the six per-domain SQLite databases (tasks, brain, conduit, nexus, signaldock, telemetry) documented in DATABASE-ERDS.md. Consolidation is rejected to preserve per-DB WAL throughput, per-DB rollback granularity, and avoid single-writer contention during multi-agent waves.",
+        severity: "info",
+        // D1 is a topology decision; the absence of consolidation is its only
+        // enforcement surface. No runtime guard, no lint script.
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: []
+      },
+      {
+        adr: "ADR-056",
+        code: "D2",
+        name: "Store-layer naming convention",
+        description: "New always-on store-layer domains MUST use the kebab-case pair `packages/core/src/store/<domain>-schema.ts` (Drizzle defs) + `packages/core/src/store/<domain>-sqlite.ts` (open/init/CRUD). Opt-in / isolated domains MAY use the folder variant `packages/core/src/<domain>/{schema,sqlite}.ts` (currently telemetry only).",
+        severity: "info",
+        // D2 is a naming-convention decision; enforced by code review and the
+        // ADR-073/ADR-056 doctor audit. No runtime guard.
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: []
+      },
+      {
+        adr: "ADR-056",
+        code: "D3",
+        name: "Migration runner SSoT under migration-manager.ts",
+        description: "All six SQLite databases MUST be initialized via `packages/core/src/migration/migration-manager.ts` (`migrateWithRetry()` + `reconcileJournal()`). Per-DB bespoke runners are prohibited for new domains. Rust Diesel migrations for cloud signaldock-storage MUST NOT touch the local SQLite signaldock.db at runtime.",
+        severity: "info",
+        // D3 is enforced by the absence of bespoke runners — every domain's
+        // `<domain>-sqlite.ts` open path delegates to migration-manager. No
+        // single runtime guard; per-DB chokepoints are the enforcement surface.
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: []
+      },
+      {
+        adr: "ADR-056",
+        code: "D4",
+        name: "archiveReason 6-value enum with tombstone semantics",
+        description: "The tasks.archive_reason column is constrained to exactly six values (verified, reconciled, superseded, shadowed, cancelled, completed-unverified) via SQLite CHECK constraint AND Zod z.enum validation. Writing 'completed-unverified' from non-migration code MUST throw E_ARCHIVE_REASON_TOMBSTONE \u2014 the tombstone is reserved for the T1408 backfill migration only.",
+        severity: "error",
+        runtimeGate: {
+          module: ARCHIVE_REASON_MODULE,
+          functionName: "assertArchiveReason"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: ["packages/contracts/src/tasks/__tests__/archive.test.ts"]
+      },
+      {
+        adr: "ADR-056",
+        code: "D5",
+        name: "Post-release reconciliation: registry-driven cleo verify --release",
+        description: "Post-release reconciliation flows through the executable invariants registry at packages/core/src/release/invariants/registry.ts. Customers register via registerInvariant() and the CLI runs every entry on `cleo verify --release <tag>`. First customer: archive-reason-invariant.ts (stamps verified tasks done; creates follow-up tasks for unverified references).",
+        severity: "warning",
+        runtimeGate: {
+          module: RELEASE_INVARIANTS_REGISTRY_MODULE,
+          functionName: "runInvariants"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: ["packages/core/src/release/invariants/__tests__/archive-reason-invariant.test.ts"]
+      },
+      {
+        adr: "ADR-056",
+        code: "D6",
+        name: "Commit-message lint for release commits",
+        description: "Every commit whose subject matches `^(chore|feat)\\(release\\):` MUST contain at least one `T\\d+` task reference in the commit body. Enforced by scripts/hooks/commit-msg-release-lint.mjs (T1410). Bypass via CLEO_OWNER_OVERRIDE=1 with audited justification.",
+        severity: "info",
+        // D6 is a CI-hook concern. The hook itself is the enforcement surface
+        // — represented here via lintRule for cross-reference rendering.
+        runtimeGate: null,
+        lintRule: {
+          lintScript: RELEASE_COMMIT_MSG_HOOK
+        },
+        doctorAudit: null,
+        tests: []
+      }
+    ]);
+  }
+});
+
+// packages/contracts/src/invariants/adr-070-orchestration.ts
+var THIN_AGENT_MODULE, SESSIONS_MODULE, WORKTREE_CREATE_MODULE, CT_ORCHESTRATOR_SKILL, VALIDATE_SPAWN_MODULE, SKILL_VALIDATOR_TESTS, ADR_070_INVARIANTS, ADR_070_INVARIANT_COUNT;
+var init_adr_070_orchestration = __esm({
+  "packages/contracts/src/invariants/adr-070-orchestration.ts"() {
+    "use strict";
+    THIN_AGENT_MODULE = "packages/core/src/orchestration/thin-agent.ts";
+    SESSIONS_MODULE = "packages/core/src/sessions/index.ts";
+    WORKTREE_CREATE_MODULE = "packages/worktree/src/worktree-create.ts";
+    CT_ORCHESTRATOR_SKILL = "packages/skills/skills/ct-orchestrator/SKILL.md";
+    VALIDATE_SPAWN_MODULE = "packages/core/src/orchestration/validate-spawn.ts";
+    SKILL_VALIDATOR_TESTS = "packages/core/src/skills/orchestrator/__tests__/validator.test.ts";
+    ADR_070_INVARIANTS = Object.freeze([
+      {
+        adr: "ADR-070",
+        code: "ORC-001",
+        name: "Orchestrator is the HITL interface",
+        description: "The Orchestrator (Cleo) is the single subagent that talks to the human operator. It plans, decomposes, and delegates \u2014 it never produces line-level implementation. Source-of-truth lives in ct-orchestrator/SKILL.md row ORC-001 and is injected into the Orchestrator prompt at spawn time. UNENFORCED at the dispatch layer: this is a prompt-time invariant with no runtime guard today.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: [CT_ORCHESTRATOR_SKILL]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-002",
+        name: "Orchestrator MUST NOT write or edit code",
+        description: "Every line of code is written by a spawned subagent. The Orchestrator delegates implementation work via cleo orchestrate spawn / delegate_task. UNENFORCED at the dispatch layer: this is a prompt-time invariant \u2014 there is no runtime gate that blocks the Orchestrator from calling Edit/Write, so the contract is held by the ct-orchestrator skill text.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: [CT_ORCHESTRATOR_SKILL]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-003",
+        name: "Orchestrator MUST NOT read full source files",
+        description: "Orchestrator reads only pipeline manifests, task envelopes, and rolled-up phase summaries returned by Phase Leads. Workers read code; the Orchestrator reads summaries. UNENFORCED at the dispatch layer \u2014 held by the ct-orchestrator skill text and reinforced by ORC-005 budget pressure.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: [CT_ORCHESTRATOR_SKILL]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-004",
+        name: "Dependency-ordered spawning",
+        description: "Spawns within a wave are ordered by task.depends \u2014 a Worker MUST NOT be dispatched until its declared dependencies are status=done. Surfaced by validateSpawnReadiness via V_MISSING_DEP / V_UNMET_DEP codes; surfaced by the skill-orchestrator validator via the ORC-004_DEPENDENCY_ORDER warning emitted from packages/core/src/skills/orchestrator/validator.ts. Tier: warning because the validator surfaces ordering issues but does not throw \u2014 workers can still proceed if the operator overrides.",
+        severity: "warning",
+        runtimeGate: {
+          module: VALIDATE_SPAWN_MODULE,
+          functionName: "validateSpawnReadiness"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: [
+          "packages/core/src/orchestration/__tests__/validate-spawn.test.ts",
+          SKILL_VALIDATOR_TESTS
+        ]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-005",
+        name: "Orchestrator context budget \u2248 10 K tokens",
+        description: "The Orchestrator MUST keep its working context under ~10 K tokens; delegate at 80 %. Surfaced by cleo orchestrate context (estimateContext) and by the skill-orchestrator validator (ORC-005_NO_MANIFEST / ORC-005_EMPTY_MANIFEST). UNENFORCED as a hard gate \u2014 the budget is advisory, surfaced to the Orchestrator as a warning so the human operator can intervene.",
+        severity: "warning",
+        runtimeGate: {
+          module: "packages/core/src/orchestration/context.ts",
+          functionName: "estimateContext"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: ["packages/core/src/orchestration/__tests__/"]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-006",
+        name: "Worker scope \u2264 3 files per spawn",
+        description: "Cross-file reasoning quality degrades beyond ~3 files for a single Worker. Enforced at spawn-time by validateSpawnReadiness \u2014 V_ATOMIC_SCOPE_MISSING when task.files is empty, V_ATOMIC_SCOPE_TOO_LARGE when files.length > MAX_WORKER_FILES (currently 3). Spawn-prompt builder injects a Worker Budget Constraints section so the Worker sees the budget inline. Tier: error because the gate refuses to spawn an over-scoped Worker.",
+        severity: "error",
+        runtimeGate: {
+          module: VALIDATE_SPAWN_MODULE,
+          functionName: "validateSpawnReadiness"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: [
+          "packages/core/src/orchestration/__tests__/validate-spawn.test.ts",
+          "packages/core/src/orchestration/__tests__/spawn-prompt.test.ts"
+        ]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-007",
+        name: "All work traced to an Epic",
+        description: "Every Task and Subtask MUST attach to a parent Epic (directly or transitively). No orphan work \u2014 orphans are filed against the ADR-066 acceptance-criteria gate and surface via cleo find. UNENFORCED at the dispatch layer; the parent-id requirement is materialised through cleo add validation rather than a single ORC-named guard. R6 doctor audit should walk the task graph to surface orphans.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: [CT_ORCHESTRATOR_SKILL]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-008",
+        name: "Zero architectural decisions during execution",
+        description: "Architectural choices MUST be pre-decided via RCASD consensus or HITL \u2014 never inside a worker session. UNENFORCED at the dispatch layer: this is a behavioural invariant held by the ct-orchestrator skill text plus the ADR-066 acceptance criterion that every task must declare its architecture-relevant decisions before spawn.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: [CT_ORCHESTRATOR_SKILL]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-009",
+        name: "Manifest-mediated handoffs",
+        description: "Orchestrator reads only the key_findings field of pipeline_manifest rows when reconciling worker output. Subagents read the full task description and supporting files. UNENFORCED at the dispatch layer: the contract is held by the ct-orchestrator skill text and reinforced by ORC-003 + ORC-005 budget pressure.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: [CT_ORCHESTRATOR_SKILL]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-010",
+        name: "Lead-interposition required for Epic-child Workers",
+        description: "A Worker spawn against a Task whose parent is type=epic MUST be preceded by a Lead spawn for the same Task (ADR-083 \xA72.4 / \xA76). The intended runtime gate (composeSpawnPayload throwing E_LEAD_REQUIRED_FOR_EPIC_CHILD) is FILED but UNSHIPPED \u2014 tracked under T10278. Registered here as a warning + runtimeGate:null so the gap is visible in the R6 doctor audit.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: []
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-011",
+        name: "Orchestrator-depth cap at 3",
+        description: "Recursive Orchestrator spawns (Cleo \u2192 sub-Orchestrator \u2192 sub-Orchestrator \u2192 \u2026) MUST stop at depth 3 (ADR-083 \xA72.2 + \xA72.4). The intended runtime gate (composeSpawnPayload throwing E_ORCHESTRATOR_DEPTH_EXCEEDED) is FILED but UNSHIPPED \u2014 tracked under T10279. Registered here as a warning + runtimeGate:null so the gap is visible in the R6 doctor audit.",
+        severity: "warning",
+        runtimeGate: null,
+        lintRule: null,
+        doctorAudit: null,
+        tests: []
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-012",
+        name: "Thin-agent inversion-of-control",
+        description: "Workers MUST NOT spawn other subagents. The spawn-capable tools (Agent / Task / TaskCreate) are stripped from the Worker tool list at .cant compile time, and any survivor at spawn time triggers ThinAgentViolationError \u2192 E_THIN_AGENT_VIOLATION (exit 68). The only ORC rule with a hard-enforced dispatch-time gate today.",
+        severity: "error",
+        runtimeGate: {
+          module: THIN_AGENT_MODULE,
+          functionName: "enforceThinAgent"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: [
+          "packages/core/src/orchestration/__tests__/thin-agent.test.ts",
+          "packages/cant/src/__tests__/hierarchy.test.ts"
+        ]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-013",
+        name: "Worktree provisioning at canonical XDG location",
+        description: "Every agent worktree MUST be created under <cleoHome>/worktrees/<projectHash>/<taskId>/ (ADR-055 + Council D009). createWorktree throws E_WT_LOCATION_FORBIDDEN before any git worktree add call when the computed path falls outside the canonical root. CI gate lint-worktree-location.mjs enforces the same invariant on every PR. The single-most-load-bearing orchestration guard after ORC-012.",
+        severity: "error",
+        runtimeGate: {
+          module: WORKTREE_CREATE_MODULE,
+          functionName: "assertCanonicalWorktreeLocation"
+        },
+        lintRule: {
+          lintScript: "scripts/lint-worktree-location.mjs"
+        },
+        doctorAudit: null,
+        tests: ["packages/worktree/src/__tests__/"]
+      },
+      {
+        adr: "ADR-070",
+        code: "ORC-014",
+        name: "Lead-bypass detection at session end",
+        description: "A Lead session (CLEO_AGENT_ROLE=lead) that ends with tasks_completed > 0 AND delegate_task_count = 0 is rejected with LeadBypassDetectedError \u2192 E_LEAD_BYPASS_DETECTED (exit 107). Leads MUST fan out work to Workers; a Lead that did the work itself defeats the three-tier topology. Override via CLEO_OWNER_OVERRIDE=1 (audited to force-bypass.jsonl).",
+        severity: "error",
+        runtimeGate: {
+          module: SESSIONS_MODULE,
+          functionName: "endSession"
+        },
+        lintRule: null,
+        doctorAudit: null,
+        tests: ["packages/core/src/sessions/__tests__/"]
+      }
+    ]);
+    ADR_070_INVARIANT_COUNT = ADR_070_INVARIANTS.length;
+  }
+});
+
 // packages/contracts/src/invariants/adr-073-saga.ts
 var SAGA_ENFORCEMENT_MODULE, SAGA_ENFORCEMENT_TESTS, ADR_073_INVARIANTS;
 var init_adr_073_saga = __esm({
@@ -10495,7 +10974,11 @@ function buildKey(invariant) {
   return `${invariant.adr}.${invariant.code}`;
 }
 function buildRegistry() {
-  const entries = [...ADR_073_INVARIANTS];
+  const entries = [
+    ...ADR_073_INVARIANTS,
+    ...ADR_056_INVARIANTS,
+    ...ADR_070_INVARIANTS
+  ];
   const record = {};
   for (const entry of entries) {
     const key = buildKey(entry);
@@ -10510,7 +10993,11 @@ var INVARIANTS_REGISTRY;
 var init_invariants = __esm({
   "packages/contracts/src/invariants/index.ts"() {
     "use strict";
+    init_adr_056_release();
+    init_adr_070_orchestration();
     init_adr_073_saga();
+    init_adr_056_release();
+    init_adr_070_orchestration();
     init_adr_073_saga();
     INVARIANTS_REGISTRY = buildRegistry();
   }
@@ -11322,31 +11809,31 @@ var init_peer = __esm({
 });
 
 // packages/contracts/src/release/evidence-atoms.ts
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 var parsedPrEvidenceAtomSchema, prEvidenceStateModifierSchema, ghPrViewSchema, PR_REQUIRED_WORKFLOWS;
 var init_evidence_atoms = __esm({
   "packages/contracts/src/release/evidence-atoms.ts"() {
     "use strict";
-    parsedPrEvidenceAtomSchema = z6.object({
-      kind: z6.literal("pr"),
-      prNumber: z6.number().int().positive()
-    });
-    prEvidenceStateModifierSchema = z6.object({
-      kind: z6.literal("state"),
-      value: z6.literal("MERGED")
-    });
-    ghPrViewSchema = z6.object({
-      state: z6.enum(["OPEN", "CLOSED", "MERGED"]),
-      mergedAt: z6.string().nullable(),
-      headRefOid: z6.string().optional(),
-      mergeable: z6.string().optional(),
-      statusCheckRollup: z6.array(
-        z6.object({
-          __typename: z6.string().optional(),
-          name: z6.string().optional(),
-          workflowName: z6.string().optional(),
-          conclusion: z6.string().nullable().optional(),
-          status: z6.string().optional()
+    parsedPrEvidenceAtomSchema = z8.object({
+      kind: z8.literal("pr"),
+      prNumber: z8.number().int().positive()
+    });
+    prEvidenceStateModifierSchema = z8.object({
+      kind: z8.literal("state"),
+      value: z8.literal("MERGED")
+    });
+    ghPrViewSchema = z8.object({
+      state: z8.enum(["OPEN", "CLOSED", "MERGED"]),
+      mergedAt: z8.string().nullable(),
+      headRefOid: z8.string().optional(),
+      mergeable: z8.string().optional(),
+      statusCheckRollup: z8.array(
+        z8.object({
+          __typename: z8.string().optional(),
+          name: z8.string().optional(),
+          workflowName: z8.string().optional(),
+          conclusion: z8.string().nullable().optional(),
+          status: z8.string().optional()
         }).passthrough()
       ).optional().default([])
     }).passthrough();
@@ -11359,7 +11846,7 @@ var init_evidence_atoms = __esm({
 });
 
 // packages/contracts/src/release/plan.ts
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 var RELEASE_CHANNEL, RELEASE_SCHEME, RELEASE_KIND, RELEASE_STATUS, GATE_STATUS, GATE_NAME, PLATFORM_TUPLE, PUBLISHER, TASK_KIND, IMPACT, RESOLVED_SOURCE, ReleaseChannelSchema, ReleaseSchemeSchema, ReleaseKindSchema, ReleaseStatusSchema, GateStatusSchema, GateNameSchema, PlatformTupleSchema, PublisherSchema, TaskKindSchema, ImpactSchema, ResolvedSourceSchema, Iso8601, NonEmptyString, ReleasePlanTaskSchema, ReleaseGateSchema, ReleasePlatformMatrixEntrySchema, ReleasePreflightSummarySchema, ReleasePlanChangelogSchema, ReleasePlanMetaSchema, ReleasePlanSchema;
 var init_plan = __esm({
   "packages/contracts/src/release/plan.ts"() {
@@ -11402,20 +11889,20 @@ var init_plan = __esm({
     ];
     IMPACT = ["major", "minor", "patch"];
     RESOLVED_SOURCE = ["project-context", "language-default", "legacy-alias"];
-    ReleaseChannelSchema = z7.enum(RELEASE_CHANNEL);
-    ReleaseSchemeSchema = z7.enum(RELEASE_SCHEME);
-    ReleaseKindSchema = z7.enum(RELEASE_KIND);
-    ReleaseStatusSchema = z7.enum(RELEASE_STATUS);
-    GateStatusSchema = z7.enum(GATE_STATUS);
-    GateNameSchema = z7.enum(GATE_NAME);
-    PlatformTupleSchema = z7.enum(PLATFORM_TUPLE);
-    PublisherSchema = z7.enum(PUBLISHER);
-    TaskKindSchema = z7.enum(TASK_KIND);
-    ImpactSchema = z7.enum(IMPACT);
-    ResolvedSourceSchema = z7.enum(RESOLVED_SOURCE);
-    Iso8601 = z7.iso.datetime({ offset: true });
-    NonEmptyString = z7.string().min(1);
-    ReleasePlanTaskSchema = z7.object({
+    ReleaseChannelSchema = z9.enum(RELEASE_CHANNEL);
+    ReleaseSchemeSchema = z9.enum(RELEASE_SCHEME);
+    ReleaseKindSchema = z9.enum(RELEASE_KIND);
+    ReleaseStatusSchema = z9.enum(RELEASE_STATUS);
+    GateStatusSchema = z9.enum(GATE_STATUS);
+    GateNameSchema = z9.enum(GATE_NAME);
+    PlatformTupleSchema = z9.enum(PLATFORM_TUPLE);
+    PublisherSchema = z9.enum(PUBLISHER);
+    TaskKindSchema = z9.enum(TASK_KIND);
+    ImpactSchema = z9.enum(IMPACT);
+    ResolvedSourceSchema = z9.enum(RESOLVED_SOURCE);
+    Iso8601 = z9.iso.datetime({ offset: true });
+    NonEmptyString = z9.string().min(1);
+    ReleasePlanTaskSchema = z9.object({
       /** Task ID (e.g. "T10001"). Format intentionally loose so historical IDs validate. */
       id: NonEmptyString,
       /** Conventional-commit-aligned task classification. */
@@ -11423,20 +11910,20 @@ var init_plan = __esm({
       /** SemVer impact classification. */
       impact: ImpactSchema,
       /** Human-readable changelog line for this task. */
-      userFacingSummary: z7.string(),
+      userFacingSummary: z9.string(),
       /**
        * ADR-051 evidence atoms attesting the task's gate results. Format is
        * `kind:value` (e.g. `commit:abc123`, `test-run:vitest.json`). The contract
        * accepts empty arrays so legacy plans validate; `cleo release plan`
        * enforces non-empty via R-301.
        */
-      evidenceAtoms: z7.array(NonEmptyString),
+      evidenceAtoms: z9.array(NonEmptyString),
       /** IVTR phase at plan time — informational only per R-316. */
-      ivtrPhaseAtPlan: z7.string().optional(),
+      ivtrPhaseAtPlan: z9.string().optional(),
       /** Epic this task rolls up to, locked at plan time per R-303. */
       epicAncestor: NonEmptyString
     });
-    ReleaseGateSchema = z7.object({
+    ReleaseGateSchema = z9.object({
       /** Canonical gate name. */
       name: GateNameSchema,
       /** ADR-051 atom string identifying the resolved tool (e.g. `tool:test`). */
@@ -11446,11 +11933,11 @@ var init_plan = __esm({
       /** ISO-8601 timestamp the gate was last verified. */
       lastVerifiedAt: Iso8601,
       /** Resolved shell command (e.g. `pnpm run test`). Optional for unresolved gates. */
-      resolvedCommand: z7.string().optional(),
+      resolvedCommand: z9.string().optional(),
       /** Provenance of the resolved command. Optional for unresolved gates. */
       resolvedSource: ResolvedSourceSchema.optional()
     });
-    ReleasePlatformMatrixEntrySchema = z7.object({
+    ReleasePlatformMatrixEntrySchema = z9.object({
       /** Target platform tuple. */
       platform: PlatformTupleSchema,
       /** Distribution backend. */
@@ -11458,47 +11945,47 @@ var init_plan = __esm({
       /** Package identifier on the target backend (e.g. `@cleocode/cleo`). */
       package: NonEmptyString,
       /** Whether to run the GHA smoke job for this matrix entry. */
-      smoke: z7.boolean().default(true).optional()
+      smoke: z9.boolean().default(true).optional()
     });
-    ReleasePreflightSummarySchema = z7.object({
+    ReleasePreflightSummarySchema = z9.object({
       /** True if esbuild externals are out of sync with package.json. */
-      esbuildExternalsDrift: z7.boolean(),
+      esbuildExternalsDrift: z9.boolean(),
       /** True if `pnpm-lock.yaml` diverges from the workspace manifest. */
-      lockfileDrift: z7.boolean(),
+      lockfileDrift: z9.boolean(),
       /** True if all epic children are in terminal lifecycle states. */
-      epicCompletenessClean: z7.boolean(),
+      epicCompletenessClean: z9.boolean(),
       /** True if no task appears in multiple in-flight release plans. */
-      doubleListingClean: z7.boolean(),
+      doubleListingClean: z9.boolean(),
       /** Non-fatal preflight warnings (e.g. unresolved tools per R-024). */
-      preflightWarnings: z7.array(z7.string()).default([]).optional()
+      preflightWarnings: z9.array(z9.string()).default([]).optional()
     });
-    ReleasePlanChangelogSchema = z7.object({
+    ReleasePlanChangelogSchema = z9.object({
       /** `kind=feat` tasks. */
-      features: z7.array(NonEmptyString).default([]),
+      features: z9.array(NonEmptyString).default([]),
       /** `kind=fix` or `kind=hotfix` tasks. */
-      fixes: z7.array(NonEmptyString).default([]),
+      fixes: z9.array(NonEmptyString).default([]),
       /** `kind=chore`, `docs`, `refactor`, `test`, `perf` tasks. */
-      chores: z7.array(NonEmptyString).default([]),
+      chores: z9.array(NonEmptyString).default([]),
       /** `kind=breaking` or `kind=revert` tasks. */
-      breaking: z7.array(NonEmptyString).default([])
+      breaking: z9.array(NonEmptyString).default([])
     });
-    ReleasePlanMetaSchema = z7.object({
+    ReleasePlanMetaSchema = z9.object({
       /** True if this is the project's first ever release. */
-      firstEverRelease: z7.boolean().optional(),
+      firstEverRelease: z9.boolean().optional(),
       /** Canonical tool names that could not be resolved at plan time. */
-      unresolvedTools: z7.array(z7.string()).optional(),
+      unresolvedTools: z9.array(z9.string()).optional(),
       /** Project archetype detected at plan time. */
-      archetype: z7.string().optional()
-    }).catchall(z7.unknown());
-    ReleasePlanSchema = z7.object({
+      archetype: z9.string().optional()
+    }).catchall(z9.unknown());
+    ReleasePlanSchema = z9.object({
       /** Schema URL for this plan version. */
-      $schema: z7.string().optional(),
+      $schema: z9.string().optional(),
       /** Requested version string (e.g. "v2026.6.0"). Includes the leading `v`. */
       version: NonEmptyString,
       /** Resolved version string after suffix application (e.g. "v2026.6.0.2"). */
       resolvedVersion: NonEmptyString,
       /** True if a `calver-suffix` was applied to disambiguate a same-day hotfix. */
-      suffixApplied: z7.boolean(),
+      suffixApplied: z9.boolean(),
       /** Versioning scheme governing `version` / `resolvedVersion`. */
       scheme: ReleaseSchemeSchema,
       /** npm dist-tag channel for this release. */
@@ -11515,27 +12002,27 @@ var init_plan = __esm({
        * Version of the previous release on the same channel. MUST be `null` only
        * for first-ever releases (R-300, enforced at the verb layer).
        */
-      previousVersion: z7.string().nullable(),
+      previousVersion: z9.string().nullable(),
       /** Git tag of the previous release (typically `previousVersion` prefixed). */
-      previousTag: z7.string().nullable(),
+      previousTag: z9.string().nullable(),
       /** ISO-8601 timestamp the previous release was published. */
       previousShippedAt: Iso8601.nullable(),
       /** Tasks rolled into this release. */
-      tasks: z7.array(ReleasePlanTaskSchema),
+      tasks: z9.array(ReleasePlanTaskSchema),
       /** Bucketed changelog. */
       changelog: ReleasePlanChangelogSchema,
       /** Per-gate verification status. */
-      gates: z7.array(ReleaseGateSchema),
+      gates: z9.array(ReleaseGateSchema),
       /** Platform / publisher matrix. */
-      platformMatrix: z7.array(ReleasePlatformMatrixEntrySchema),
+      platformMatrix: z9.array(ReleasePlatformMatrixEntrySchema),
       /** Preflight summary from `cleo release plan`. */
       preflightSummary: ReleasePreflightSummarySchema,
       /** URL of the GHA workflow run (populated by `release-prepare.yml`). */
-      workflowRunUrl: z7.string().nullable(),
+      workflowRunUrl: z9.string().nullable(),
       /** URL of the bump PR (populated by `cleo release open`). */
-      prUrl: z7.string().nullable(),
+      prUrl: z9.string().nullable(),
       /** Merge commit SHA on `main` (populated by `release-publish.yml`). */
-      mergeCommitSha: z7.string().nullable(),
+      mergeCommitSha: z9.string().nullable(),
       /** Current FSM state per R-302. */
       status: ReleaseStatusSchema,
       /** Informational / forward-compat metadata. */
@@ -11591,52 +12078,52 @@ var init_session2 = __esm({
 });
 
 // packages/contracts/src/session-journal.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 var SESSION_JOURNAL_SCHEMA_VERSION, sessionJournalDoctorSummarySchema, sessionJournalDebriefSummarySchema, sessionJournalEntrySchema;
 var init_session_journal = __esm({
   "packages/contracts/src/session-journal.ts"() {
     "use strict";
     SESSION_JOURNAL_SCHEMA_VERSION = "1.0";
-    sessionJournalDoctorSummarySchema = z8.object({
+    sessionJournalDoctorSummarySchema = z10.object({
       /** `true` when zero noise patterns were detected. */
-      isClean: z8.boolean(),
+      isClean: z10.boolean(),
       /** Total number of noise findings across all patterns. */
-      findingsCount: z8.number().int().nonnegative(),
+      findingsCount: z10.number().int().nonnegative(),
       /** Pattern names that were detected (empty when isClean). */
-      patterns: z8.array(z8.string()),
+      patterns: z10.array(z10.string()),
       /** Total brain entries scanned. `0` = empty or unavailable. */
-      totalScanned: z8.number().int().nonnegative()
+      totalScanned: z10.number().int().nonnegative()
     });
-    sessionJournalDebriefSummarySchema = z8.object({
+    sessionJournalDebriefSummarySchema = z10.object({
       /** First 200 characters of the session end note (if provided). */
-      noteExcerpt: z8.string().max(200).optional(),
+      noteExcerpt: z10.string().max(200).optional(),
       /** Number of tasks completed during the session. */
-      tasksCompletedCount: z8.number().int().nonnegative(),
+      tasksCompletedCount: z10.number().int().nonnegative(),
       /** Up to 5 task IDs (not titles) that were the focus of the session. */
-      tasksFocused: z8.array(z8.string()).max(5).optional()
+      tasksFocused: z10.array(z10.string()).max(5).optional()
     });
-    sessionJournalEntrySchema = z8.object({
+    sessionJournalEntrySchema = z10.object({
       // Identity
       /** Schema version for forward-compatibility. Always `'1.0'` in this release. */
-      schemaVersion: z8.literal(SESSION_JOURNAL_SCHEMA_VERSION),
+      schemaVersion: z10.literal(SESSION_JOURNAL_SCHEMA_VERSION),
       /** ISO 8601 timestamp when the entry was written. */
-      timestamp: z8.string(),
+      timestamp: z10.string(),
       /** CLEO session ID (e.g. `ses_20260424055456_ede571`). */
-      sessionId: z8.string(),
+      sessionId: z10.string(),
       /** Event type that triggered this journal entry. */
-      eventType: z8.enum(["session_start", "session_end", "observation", "decision", "error"]),
+      eventType: z10.enum(["session_start", "session_end", "observation", "decision", "error"]),
       // Session metadata (set on session_start / session_end)
       /** Agent identifier (e.g. `cleo-prime`, `claude-code`). */
-      agentIdentifier: z8.string().optional(),
+      agentIdentifier: z10.string().optional(),
       /** Provider adapter ID active for this session. */
-      providerId: z8.string().optional(),
+      providerId: z10.string().optional(),
       /** Session scope string (e.g. `'global'` or `'epic:T1263'`). */
-      scope: z8.string().optional(),
+      scope: z10.string().optional(),
       // Session-end fields
       /** Duration of the session in seconds (session_end only). */
-      duration: z8.number().int().nonnegative().optional(),
+      duration: z10.number().int().nonnegative().optional(),
       /** Task IDs (not titles) completed during the session. */
-      tasksCompleted: z8.array(z8.string()).optional(),
+      tasksCompleted: z10.array(z10.string()).optional(),
       // Doctor summary (T1262 absorbed)
       /** Compact result of `scanBrainNoise` run at session-end. */
       doctorSummary: sessionJournalDoctorSummarySchema.optional(),
@@ -11645,7 +12132,7 @@ var init_session_journal = __esm({
       debriefSummary: sessionJournalDebriefSummarySchema.optional(),
       // Optional hash chain
       /** SHA-256 hex of the previous entry's raw JSON string (for integrity chain). */
-      prevEntryHash: z8.string().optional()
+      prevEntryHash: z10.string().optional()
     });
   }
 });
@@ -11665,52 +12152,52 @@ var init_task = __esm({
 });
 
 // packages/contracts/src/task-evidence.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 var fileEvidenceSchema, logEvidenceSchema, screenshotEvidenceSchema, testOutputEvidenceSchema, commandOutputEvidenceSchema, taskEvidenceSchema;
 var init_task_evidence = __esm({
   "packages/contracts/src/task-evidence.ts"() {
     "use strict";
-    fileEvidenceSchema = z9.object({
-      kind: z9.literal("file"),
-      sha256: z9.string().length(64),
-      timestamp: z9.string().datetime(),
-      path: z9.string().min(1),
-      mime: z9.string().optional(),
-      description: z9.string().optional()
-    });
-    logEvidenceSchema = z9.object({
-      kind: z9.literal("log"),
-      sha256: z9.string().length(64),
-      timestamp: z9.string().datetime(),
-      source: z9.string().min(1),
-      description: z9.string().optional()
-    });
-    screenshotEvidenceSchema = z9.object({
-      kind: z9.literal("screenshot"),
-      sha256: z9.string().length(64),
-      timestamp: z9.string().datetime(),
-      mime: z9.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
-      description: z9.string().optional()
-    });
-    testOutputEvidenceSchema = z9.object({
-      kind: z9.literal("test-output"),
-      sha256: z9.string().length(64),
-      timestamp: z9.string().datetime(),
-      passed: z9.number().int().nonnegative(),
-      failed: z9.number().int().nonnegative(),
-      skipped: z9.number().int().nonnegative(),
-      exitCode: z9.number().int(),
-      description: z9.string().optional()
-    });
-    commandOutputEvidenceSchema = z9.object({
-      kind: z9.literal("command-output"),
-      sha256: z9.string().length(64),
-      timestamp: z9.string().datetime(),
-      cmd: z9.string().min(1),
-      exitCode: z9.number().int(),
-      description: z9.string().optional()
-    });
-    taskEvidenceSchema = z9.discriminatedUnion("kind", [
+    fileEvidenceSchema = z11.object({
+      kind: z11.literal("file"),
+      sha256: z11.string().length(64),
+      timestamp: z11.string().datetime(),
+      path: z11.string().min(1),
+      mime: z11.string().optional(),
+      description: z11.string().optional()
+    });
+    logEvidenceSchema = z11.object({
+      kind: z11.literal("log"),
+      sha256: z11.string().length(64),
+      timestamp: z11.string().datetime(),
+      source: z11.string().min(1),
+      description: z11.string().optional()
+    });
+    screenshotEvidenceSchema = z11.object({
+      kind: z11.literal("screenshot"),
+      sha256: z11.string().length(64),
+      timestamp: z11.string().datetime(),
+      mime: z11.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
+      description: z11.string().optional()
+    });
+    testOutputEvidenceSchema = z11.object({
+      kind: z11.literal("test-output"),
+      sha256: z11.string().length(64),
+      timestamp: z11.string().datetime(),
+      passed: z11.number().int().nonnegative(),
+      failed: z11.number().int().nonnegative(),
+      skipped: z11.number().int().nonnegative(),
+      exitCode: z11.number().int(),
+      description: z11.string().optional()
+    });
+    commandOutputEvidenceSchema = z11.object({
+      kind: z11.literal("command-output"),
+      sha256: z11.string().length(64),
+      timestamp: z11.string().datetime(),
+      cmd: z11.string().min(1),
+      exitCode: z11.number().int(),
+      description: z11.string().optional()
+    });
+    taskEvidenceSchema = z11.discriminatedUnion("kind", [
       fileEvidenceSchema,
       logEvidenceSchema,
       screenshotEvidenceSchema,
@@ -11721,12 +12208,12 @@ var init_task_evidence = __esm({
 });
 
 // packages/contracts/src/tasks/archive.ts
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 var ArchiveReason, ARCHIVE_REASON_VALUES;
 var init_archive = __esm({
   "packages/contracts/src/tasks/archive.ts"() {
     "use strict";
-    ArchiveReason = z10.enum([
+    ArchiveReason = z12.enum([
       "verified",
       "reconciled",
       "superseded",
@@ -11738,6 +12225,67 @@ var init_archive = __esm({
   }
 });
 
+// packages/contracts/src/templates/manifest.ts
+import { z as z13 } from "zod";
+var TEMPLATE_KINDS, TEMPLATE_SUBSTITUTIONS, TEMPLATE_UPDATE_STRATEGIES, PLACEHOLDER_SOURCES, PlaceholderSpecSchema, TemplateManifestEntrySchema;
+var init_manifest2 = __esm({
+  "packages/contracts/src/templates/manifest.ts"() {
+    "use strict";
+    TEMPLATE_KINDS = ["workflow", "config", "agent", "skill", "provider", "doc"];
+    TEMPLATE_SUBSTITUTIONS = ["regex-tmpl", "static", "json-merge"];
+    TEMPLATE_UPDATE_STRATEGIES = [
+      "overwrite-on-bump",
+      "diff-prompt",
+      "immutable",
+      "manifest-merge"
+    ];
+    PLACEHOLDER_SOURCES = [
+      "project-context",
+      "project-info",
+      ".cleo/config",
+      "~/.cleo/config",
+      "tool-resolver",
+      "literal"
+    ];
+    PlaceholderSpecSchema = z13.object({
+      /**
+       * Placeholder identifier as it appears in the template body
+       * (e.g. `NODE_VERSION` matches `{{NODE_VERSION}}`).
+       */
+      name: z13.string().min(1, "placeholder name must be non-empty"),
+      /** Resolver source the installer consults for this placeholder. */
+      source: z13.enum(PLACEHOLDER_SOURCES),
+      /**
+       * Path expression evaluated against `source` (e.g. `engines.node` against
+       * `project-context`, `defaults.branchModel` against `.cleo/config`).
+       * For `literal` source, this MAY be the literal value's identifier.
+       */
+      sourcePath: z13.string().min(1, "placeholder sourcePath must be non-empty"),
+      /**
+       * Fallback value used when `source[sourcePath]` resolves to `undefined`.
+       * `null` is permitted to explicitly mark "no default — failure required".
+       */
+      defaultValue: z13.union([z13.string(), z13.number(), z13.boolean(), z13.null()]).optional()
+    });
+    TemplateManifestEntrySchema = z13.object({
+      /** Stable identifier for this template entry. */
+      id: z13.string().min(1, "id must be non-empty"),
+      /** Category of file this template represents. */
+      kind: z13.enum(TEMPLATE_KINDS),
+      /** Repo-relative path of the template source file. */
+      sourcePath: z13.string().min(1, "sourcePath must be non-empty"),
+      /** Project-relative path where the rendered template installs. */
+      installPath: z13.string().min(1, "installPath must be non-empty"),
+      /** Substitution strategy the installer applies to `sourcePath`. */
+      substitution: z13.enum(TEMPLATE_SUBSTITUTIONS),
+      /** Declared placeholders this template requires. May be empty. */
+      placeholders: z13.array(PlaceholderSpecSchema),
+      /** Reconciliation policy on upgrade. */
+      updateStrategy: z13.enum(TEMPLATE_UPDATE_STRATEGIES)
+    });
+  }
+});
+
 // packages/contracts/src/index.ts
 var init_src2 = __esm({
   "packages/contracts/src/index.ts"() {
@@ -11747,10 +12295,12 @@ var init_src2 = __esm({
     init_branch_lock();
     init_changesets();
     init_cli_category();
+    init_manifest();
     init_credentials();
     init_db_inventory2();
     init_identity();
     init_operations_registry();
+    init_provenance();
     init_docs_taxonomy();
     init_engine_result();
     init_enums();
@@ -11777,6 +12327,7 @@ var init_src2 = __esm({
     init_task();
     init_task_evidence();
     init_archive();
+    init_manifest2();
   }
 });
 
@@ -16450,7 +17001,10 @@ var init_diagnostics = __esm({
 // packages/cleo/src/dispatch/domains/docs.ts
 import { readFile } from "node:fs/promises";
 import { resolve as resolve2 } from "node:path";
+import { pushWarning } from "@cleocode/core";
 import {
+  AUTO_TOKEN,
+  allocateAutoSlugForDispatch,
   createAttachmentStore,
   createAttachmentStoreV2,
   generateDocsLlmsTxt,
@@ -16462,6 +17016,7 @@ import {
   reserveSlugForDispatch,
   resolveAttachmentBackend,
   SlugCollisionError,
+  validateDocBody,
   writeChangesetEntry
 } from "@cleocode/core/internal";
 function getDocKindRegistry() {
@@ -16938,7 +17493,8 @@ var init_docs2 = __esm({
           labels: rawLabels,
           attachedBy: rawAttachedBy,
           slug: rawSlug,
-          type: rawType
+          type: rawType,
+          strict: strictMode
         } = params;
         if (!ownerId) {
           return lafsError("E_INVALID_INPUT", "ownerId is required", "add");
@@ -16952,11 +17508,19 @@ var init_docs2 = __esm({
         }
         let slug;
         if (rawSlug !== void 0) {
-          const check = validateSlug(rawSlug);
+          let candidate = rawSlug;
+          if (typeof candidate === "string" && candidate.includes(AUTO_TOKEN)) {
+            const allocated = await allocateAutoSlugForDispatch(getProjectRoot5(), {
+              kind: typeof rawType === "string" ? rawType : "",
+              rawSlug: candidate
+            });
+            candidate = allocated.resolvedSlug;
+          }
+          const check = validateSlug(candidate);
           if (!check.valid) {
             return lafsError("E_INVALID_SLUG", check.reason, "add");
           }
-          slug = rawSlug;
+          slug = candidate;
         }
         let type2;
         if (rawType !== void 0) {
@@ -17109,6 +17673,36 @@ var init_docs2 = __esm({
           } catch {
             return lafsError("E_FILE_ERROR", `Cannot read file: ${absPath}`, "add");
           }
+          if (type2 !== void 0) {
+            const bodyText = bytes.toString("utf-8");
+            let registry;
+            try {
+              registry = DocKindRegistry.load(getProjectRoot5());
+            } catch {
+              registry = void 0;
+            }
+            const check = validateDocBody(type2, bodyText, registry);
+            if (!check.ok) {
+              const missingList = check.missing.join(", ");
+              if (strictMode === true) {
+                return lafsError(
+                  "E_DOC_SCHEMA_MISMATCH",
+                  `body for kind '${type2}' is missing required section(s): ${missingList}`,
+                  "add",
+                  `Add the missing H2 section(s) \u2014 '## ${check.missing[0] ?? ""}' \u2014 then retry. Pass --strict=false (default) to surface as an advisory warning instead of an error.`,
+                  {
+                    kind: type2,
+                    missing: check.missing,
+                    strict: true
+                  }
+                );
+              }
+              pushWarning({
+                code: "W_DOC_SCHEMA_MISMATCH",
+                message: `body for kind '${type2}' is missing required section(s): ${missingList}. Add '--strict' to fail on schema violations.`
+              });
+            }
+          }
           const mime = mimeFromPath(absPath);
           const attachment = {
             kind: "local-file",
@@ -25630,8 +26224,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot48 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot48();
+    const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot53();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -25675,8 +26269,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot48 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot48();
+  const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot53();
   return {
     async dispatch(input2) {
       try {
@@ -25866,8 +26460,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot48 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot48();
+              const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot53();
             } catch {
               projectRoot = void 0;
             }
@@ -25931,14 +26525,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot48 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot48()
+            projectRoot: getProjectRoot53()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -28158,7 +28752,7 @@ import {
   verifyProvenance
 } from "@cleocode/core/internal";
 var log2, ProvenanceHandler;
-var init_provenance = __esm({
+var init_provenance2 = __esm({
   "packages/cleo/src/dispatch/domains/provenance.ts"() {
     "use strict";
     init_base();
@@ -31281,7 +31875,7 @@ var init_domains = __esm({
     init_orchestrate2();
     init_pipeline3();
     init_playbook2();
-    init_provenance();
+    init_provenance2();
     init_release2();
     init_sentient2();
     init_session3();
@@ -31726,11 +32320,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot48) {
+function createSanitizer(getProjectRoot53) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot48 ? getProjectRoot48() : void 0;
+        const root = getProjectRoot53 ? getProjectRoot53() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -32389,6 +32983,7 @@ var addCommand;
 var init_add = __esm({
   "packages/cleo/src/cli/commands/add.ts"() {
     "use strict";
+    init_src2();
     init_dist();
     init_cli();
     init_renderers();
@@ -32565,6 +33160,20 @@ For 2+ tasks at once: cleo add-batch --file tasks.json (single transaction, atom
           await showUsage(cmd);
           return;
         }
+        if (args.severity !== void 0 && !TASK_SEVERITIES.includes(args.severity)) {
+          const valid = TASK_SEVERITIES.join(", ");
+          cliError(
+            `severity must be one of: ${valid} \u2014 got '${args.severity}'`,
+            6,
+            {
+              name: "E_INVALID_SEVERITY_VALUE",
+              fix: `Pass --severity with one of: ${valid}`
+            },
+            { operation: "tasks.add" }
+          );
+          process.exit(6);
+          return;
+        }
         const params = { title: args.title };
         if (args.status !== void 0) params["status"] = args.status;
         if (args.priority !== void 0) params["priority"] = args.priority;
@@ -35841,8 +36450,8 @@ var init_consent = __esm({
           /* webpackIgnore: true */
           "@cleocode/core/config.js"
         );
-        const getConfigValue2 = configMod.getConfigValue;
-        const setConfigValue2 = configMod.setConfigValue;
+        const getConfigValue3 = configMod.getConfigValue;
+        const setConfigValue3 = configMod.setConfigValue;
         const { addSuppression, removeSuppression, isSuppressed } = await import(
           /* webpackIgnore: true */
           "@cleocode/core/llm/credential-removal.js"
@@ -35851,7 +36460,7 @@ var init_consent = __esm({
         const SOURCE_ID = "claude-code";
         const PROVIDER = "anthropic";
         if (showStatus) {
-          const resolved = await getConfigValue2(CONSENT_KEY);
+          const resolved = await getConfigValue3(CONSENT_KEY);
           const consentEnabled = resolved.value === true;
           const suppressed = isSuppressed(PROVIDER, SOURCE_ID);
           const result2 = {
@@ -35871,7 +36480,7 @@ var init_consent = __esm({
           return;
         }
         if (enableClaudeCode) {
-          await setConfigValue2(CONSENT_KEY, true, void 0, { global: true });
+          await setConfigValue3(CONSENT_KEY, true, void 0, { global: true });
           const suppressionChanged2 = removeSuppression(PROVIDER, SOURCE_ID);
           const result2 = {
             action: "enabled",
@@ -35887,7 +36496,7 @@ var init_consent = __esm({
           });
           return;
         }
-        await setConfigValue2(CONSENT_KEY, false, void 0, { global: true });
+        await setConfigValue3(CONSENT_KEY, false, void 0, { global: true });
         const wasAlreadySuppressed = isSuppressed(PROVIDER, SOURCE_ID);
         addSuppression(PROVIDER, SOURCE_ID);
         const suppressionChanged = !wasAlreadySuppressed;
@@ -37148,9 +37757,9 @@ var init_backup = __esm({
       async run({ args }) {
         const scope = args.scope;
         const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
-        const { getProjectRoot: getProjectRoot48 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot48() : void 0;
+        const projectRoot = includesProject ? getProjectRoot53() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -37226,12 +37835,12 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const bundlePath = args.bundle;
-        const { getProjectRoot: getProjectRoot48, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot53, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot48();
+        const projectRoot = getProjectRoot53();
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome6());
           if (existing.length > 0) {
@@ -37835,7 +38444,7 @@ __export(briefing_exports, {
 });
 import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
 import { join as join11 } from "node:path";
-import { pushWarning } from "@cleocode/core";
+import { pushWarning as pushWarning2 } from "@cleocode/core";
 import { resolveLegacyCleoDir } from "@cleocode/paths";
 function resolveInjectionTemplatePath() {
   const xdgConfig = resolveLegacyCleoDir(process.env["XDG_CONFIG_HOME"]);
@@ -37867,7 +38476,7 @@ function renderForAdapter(sectionName, content, format) {
 async function runBriefingInject(sectionName, formatStr) {
   const templatePath = resolveInjectionTemplatePath();
   if (!existsSync9(templatePath)) {
-    pushWarning({
+    pushWarning2({
       code: "W_TEMPLATE_INJECT_FAILED",
       message: `CLEO-INJECTION.md not found at ${templatePath}`
     });
@@ -37887,7 +38496,7 @@ async function runBriefingInject(sectionName, formatStr) {
   const section = extractSection(content, sectionName);
   if (section === null) {
     const available = INJECTION_SECTION_NAMES.join(", ");
-    pushWarning({
+    pushWarning2({
       code: "W_TEMPLATE_INJECT_FAILED",
       message: `Section "${sectionName}" not found in CLEO-INJECTION.md.`
     });
@@ -37908,7 +38517,7 @@ async function runBriefingInject(sectionName, formatStr) {
     const adapterName = formatStr.slice("adapter:".length);
     if (!ADAPTER_FORMATS.includes(adapterName)) {
       const supported = ADAPTER_FORMATS.join(", ");
-      pushWarning({
+      pushWarning2({
         code: "W_TEMPLATE_INJECT_FAILED",
         message: `Unknown adapter format "${adapterName}".`
       });
@@ -40310,71 +40919,479 @@ var init_conduit3 = __esm({
   }
 });
 
-// packages/cleo/src/cli/commands/config.ts
-var config_exports = {};
-__export(config_exports, {
-  configCommand: () => configCommand
+// packages/cleo/src/cli/commands/config/drift-check.ts
+import { getProjectRoot as getProjectRoot31 } from "@cleocode/core";
+import { checkDrift } from "@cleocode/core/config/registry";
+function parseDriftScope(raw) {
+  const value = raw ?? "project";
+  if (value === "global" || value === "project" || value === "metadata") {
+    return value;
+  }
+  return null;
+}
+var configDriftCheckCommand;
+var init_drift_check = __esm({
+  "packages/cleo/src/cli/commands/config/drift-check.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    configDriftCheckCommand = defineCommand({
+      meta: {
+        name: "drift-check",
+        description: "Check a scoped config file for drift (default scope: project; metadata covers project-info/project-context)"
+      },
+      args: {
+        scope: {
+          type: "string",
+          description: "Scope to check: global | project | metadata (default project)",
+          default: "project"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const scope = parseDriftScope(args["scope"]);
+        if (scope === null) {
+          cliError(
+            `config drift-check failed: invalid --scope (must be global|project|metadata)`,
+            1 /* GENERAL_ERROR */,
+            { name: "E_CONFIG_DRIFT_CHECK_FAILED" }
+          );
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        let driftResult;
+        try {
+          const projectRoot = getProjectRoot31();
+          driftResult = await checkDrift(scope, projectRoot);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`config drift-check failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_CONFIG_DRIFT_CHECK_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const result = {
+          scope,
+          drift: driftResult.drift,
+          ...driftResult.reason !== void 0 ? { reason: driftResult.reason } : {}
+        };
+        cliOutput(result, {
+          command: "config-drift-check",
+          operation: "config.drift-check"
+        });
+        if (driftResult.drift) {
+          process.exit(6 /* VALIDATION_ERROR */);
+        }
+      }
+    });
+  }
 });
-import { CleoError as CleoError2, formatError as formatError4, loadConfig as loadConfig2 } from "@cleocode/core";
-var PRESET_DESCRIPTIONS, getCommand2, setCommand, setPresetCommand, presetsCommand, listCommand7, configCommand;
-var init_config2 = __esm({
-  "packages/cleo/src/cli/commands/config.ts"() {
+
+// packages/cleo/src/cli/commands/config/get.ts
+import { getProjectRoot as getProjectRoot32 } from "@cleocode/core";
+import { getConfigValue } from "@cleocode/core/config/registry";
+function parseResolveScope(raw) {
+  const value = raw ?? "merged";
+  if (value === "global" || value === "project" || value === "merged") {
+    return value;
+  }
+  return null;
+}
+var configGetCommand;
+var init_get = __esm({
+  "packages/cleo/src/cli/commands/config/get.ts"() {
     "use strict";
-    init_dist();
-    init_cli();
+    init_src2();
+    init_define_cli_command();
     init_renderers();
-    PRESET_DESCRIPTIONS = {
-      strict: "Block on missing AC, require session notes, enforce lifecycle pipeline.",
-      standard: "Warn on missing AC, optional session notes, advisory lifecycle pipeline.",
-      minimal: "No AC checking, no session requirement, lifecycle pipeline off."
-    };
-    getCommand2 = defineCommand({
-      meta: { name: "get", description: "Get a configuration value" },
+    configGetCommand = defineCommand({
+      meta: {
+        name: "get",
+        description: "Read a single config value by dot-separated key (default scope: merged)"
+      },
       args: {
         key: {
           type: "positional",
-          description: "Configuration key to retrieve",
-          required: true
+          required: true,
+          description: "Dot-separated key path (e.g. release.branchModel)"
+        },
+        scope: {
+          type: "string",
+          description: "Cascade scope to read: global | project | merged (default merged)",
+          default: "merged"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
         }
       },
       async run({ args }) {
-        await dispatchFromCli(
-          "query",
-          "admin",
-          "config.show",
-          { key: args.key },
-          { command: "config" }
-        );
+        const key = String(args["key"] ?? "").trim();
+        if (key.length === 0) {
+          cliError(`config get failed: <key> is required`, 2 /* INVALID_INPUT */, {
+            name: "E_CONFIG_GET_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const scope = parseResolveScope(args["scope"]);
+        if (scope === null) {
+          cliError(
+            `config get failed: invalid --scope (must be global|project|merged)`,
+            1 /* GENERAL_ERROR */,
+            { name: "E_CONFIG_GET_FAILED" }
+          );
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        let value;
+        try {
+          const projectRoot = getProjectRoot32();
+          value = await getConfigValue(key, { scope, projectRoot });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`config get failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_CONFIG_GET_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        if (value === void 0) {
+          cliError(`config get failed: key "${key}" not found`, 4 /* NOT_FOUND */, {
+            name: "E_NOT_FOUND",
+            details: { key, scope }
+          });
+          process.exit(4 /* NOT_FOUND */);
+          return;
+        }
+        const result = { scope, key, value };
+        cliOutput(result, {
+          command: "config-get",
+          operation: "config.get"
+        });
       }
     });
-    setCommand = defineCommand({
-      meta: { name: "set", description: "Set a configuration value" },
+  }
+});
+
+// packages/cleo/src/cli/commands/config/set.ts
+import { getProjectRoot as getProjectRoot33, parseConfigValue, setConfigValue } from "@cleocode/core";
+import { validateConfig as validateConfig2 } from "@cleocode/core/config/registry";
+function parseWriteScope(raw) {
+  const value = raw ?? "project";
+  if (value === "global" || value === "project") {
+    return value;
+  }
+  return null;
+}
+function coerceValue(raw, typeFlag) {
+  if (typeFlag === void 0) return parseConfigValue(raw);
+  if (typeFlag === "string") return raw;
+  if (typeFlag === "number") return coerceNumber(raw);
+  if (typeFlag === "boolean") return coerceBoolean(raw);
+  if (typeFlag === "json") return coerceJson(raw);
+  throw new Error(`--type must be one of: string | number | boolean | json (got "${typeFlag}")`);
+}
+function coerceNumber(raw) {
+  const n = Number(raw);
+  if (Number.isNaN(n)) {
+    throw new Error(`--type number cannot coerce "${raw}"`);
+  }
+  return n;
+}
+function coerceBoolean(raw) {
+  const lower = raw.toLowerCase();
+  if (lower === "true") return true;
+  if (lower === "false") return false;
+  throw new Error(`--type boolean accepts only "true"/"false" (got "${raw}")`);
+}
+function coerceJson(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`--type json failed to parse: ${msg}`);
+  }
+}
+var configSetCommand;
+var init_set = __esm({
+  "packages/cleo/src/cli/commands/config/set.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    configSetCommand = defineCommand({
+      meta: {
+        name: "set",
+        description: "Write a value into project or global .cleo/config.json"
+      },
       args: {
         key: {
           type: "positional",
-          description: "Configuration key to set",
-          required: true
+          required: true,
+          description: "Dot-separated key path"
         },
         value: {
           type: "positional",
-          description: "Value to assign",
-          required: true
+          required: true,
+          description: "Raw value (string). Use --type to coerce explicitly."
         },
-        global: {
+        scope: {
+          type: "string",
+          description: "Where to write: project | global (default project)",
+          default: "project"
+        },
+        type: {
+          type: "string",
+          description: "Explicit value type: string | number | boolean | json"
+        },
+        json: {
           type: "boolean",
-          description: "Set in global config instead of project config"
+          description: "Output as JSON"
         }
       },
       async run({ args }) {
-        await dispatchFromCli(
-          "mutate",
-          "admin",
-          "config.set",
-          { key: args.key, value: args.value },
-          { command: "config" }
-        );
+        const key = String(args["key"] ?? "").trim();
+        if (key.length === 0) {
+          cliError(`config set failed: <key> is required`, 2 /* INVALID_INPUT */, {
+            name: "E_CONFIG_SET_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const rawValue = String(args["value"] ?? "");
+        const scope = parseWriteScope(args["scope"]);
+        if (scope === null) {
+          cliError(
+            `config set failed: invalid --scope (must be global|project)`,
+            1 /* GENERAL_ERROR */,
+            { name: "E_CONFIG_SET_FAILED" }
+          );
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const typeFlag = args["type"];
+        let coerced;
+        try {
+          coerced = coerceValue(rawValue, typeFlag);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`config set failed: ${message}`, 2 /* INVALID_INPUT */, {
+            name: "E_CONFIG_SET_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        let written;
+        let validate;
+        try {
+          const projectRoot = getProjectRoot33();
+          written = await setConfigValue(key, coerced, projectRoot, {
+            global: scope === "global"
+          });
+          validate = await validateConfig2(scope, projectRoot);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`config set failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_CONFIG_SET_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const result = {
+          scope: written.scope,
+          key: written.key,
+          value: written.value,
+          validate
+        };
+        cliOutput(result, {
+          command: "config-set",
+          operation: "config.set"
+        });
+        if (!validate.ok) {
+          process.exit(6 /* VALIDATION_ERROR */);
+        }
       }
     });
+  }
+});
+
+// packages/cleo/src/cli/commands/config/show.ts
+import { getProjectRoot as getProjectRoot34 } from "@cleocode/core";
+import {
+  resolveCleoConfig
+} from "@cleocode/core/config/registry";
+function parseResolveScope2(raw) {
+  const value = raw ?? "merged";
+  if (value === "global" || value === "project" || value === "merged") {
+    return value;
+  }
+  return null;
+}
+var configShowCommand;
+var init_show = __esm({
+  "packages/cleo/src/cli/commands/config/show.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    configShowCommand = defineCommand({
+      meta: {
+        name: "show",
+        description: "Print the resolved CleoConfig envelope (default scope: merged)"
+      },
+      args: {
+        scope: {
+          type: "string",
+          description: "Cascade scope to read: global | project | merged (default merged)",
+          default: "merged"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const scope = parseResolveScope2(args["scope"]);
+        if (scope === null) {
+          cliError(
+            `config show failed: invalid --scope (must be global|project|merged)`,
+            1 /* GENERAL_ERROR */,
+            { name: "E_CONFIG_SHOW_FAILED" }
+          );
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        try {
+          const projectRoot = getProjectRoot34();
+          const config = await resolveCleoConfig({ scope, projectRoot });
+          const result = { scope, config };
+          cliOutput(result, {
+            command: "config-show",
+            operation: "config.show"
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`config show failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_CONFIG_SHOW_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+        }
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/config/validate.ts
+import { getProjectRoot as getProjectRoot35 } from "@cleocode/core";
+import { validateConfig as validateConfig3 } from "@cleocode/core/config/registry";
+function parseValidateScope(raw) {
+  const value = raw ?? "project";
+  if (value === "global" || value === "project") {
+    return value;
+  }
+  return null;
+}
+var configValidateCommand;
+var init_validate2 = __esm({
+  "packages/cleo/src/cli/commands/config/validate.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    configValidateCommand = defineCommand({
+      meta: {
+        name: "validate",
+        description: "Validate a scoped config file against its schema (default scope: project)"
+      },
+      args: {
+        scope: {
+          type: "string",
+          description: "Scope to validate: global | project (default project)",
+          default: "project"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const scope = parseValidateScope(args["scope"]);
+        if (scope === null) {
+          cliError(
+            `config validate failed: invalid --scope (must be global|project)`,
+            1 /* GENERAL_ERROR */,
+            { name: "E_CONFIG_VALIDATE_FAILED" }
+          );
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        let validate;
+        try {
+          const projectRoot = getProjectRoot35();
+          validate = await validateConfig3(scope, projectRoot);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`config validate failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_CONFIG_VALIDATE_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const result = {
+          scope,
+          ok: validate.ok,
+          issues: validate.issues
+        };
+        cliOutput(result, {
+          command: "config-validate",
+          operation: "config.validate"
+        });
+        if (!validate.ok) {
+          process.exit(6 /* VALIDATION_ERROR */);
+        }
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/config/index.ts
+var init_config2 = __esm({
+  "packages/cleo/src/cli/commands/config/index.ts"() {
+    "use strict";
+    init_drift_check();
+    init_get();
+    init_set();
+    init_show();
+    init_validate2();
+  }
+});
+
+// packages/cleo/src/cli/commands/config.ts
+var config_exports = {};
+__export(config_exports, {
+  configCommand: () => configCommand
+});
+import { CleoError as CleoError2, loadConfig as loadConfig2 } from "@cleocode/core";
+var PRESET_DESCRIPTIONS, setPresetCommand, presetsCommand, listCommand7, configCommand;
+var init_config3 = __esm({
+  "packages/cleo/src/cli/commands/config.ts"() {
+    "use strict";
+    init_dist();
+    init_cli();
+    init_define_cli_command();
+    init_renderers();
+    init_config2();
+    PRESET_DESCRIPTIONS = {
+      strict: "Block on missing AC, require session notes, enforce lifecycle pipeline.",
+      standard: "Warn on missing AC, optional session notes, advisory lifecycle pipeline.",
+      minimal: "No AC checking, no session requirement, lifecycle pipeline off."
+    };
     setPresetCommand = defineCommand({
       meta: {
         name: "set-preset",
@@ -40416,7 +41433,7 @@ var init_config2 = __esm({
           cliOutput({ config: resolved }, { command: "config" });
         } catch (err) {
           if (err instanceof CleoError2) {
-            cliError(formatError4(err), err.code, { name: "E_CONFIG_LOAD" });
+            cliError(`config list failed: ${err.message}`, err.code, { name: "E_CONFIG_LOAD" });
             process.exit(err.code);
           }
           throw err;
@@ -40424,10 +41441,16 @@ var init_config2 = __esm({
       }
     });
     configCommand = defineCommand({
-      meta: { name: "config", description: "Configuration management" },
+      meta: {
+        name: "config",
+        description: "CleoConfig SSoT registry surface (show, get, set, validate, drift-check) + legacy presets/list"
+      },
       subCommands: {
-        get: getCommand2,
-        set: setCommand,
+        show: configShowCommand,
+        get: configGetCommand,
+        set: configSetCommand,
+        validate: configValidateCommand,
+        "drift-check": configDriftCheckCommand,
         "set-preset": setPresetCommand,
         presets: presetsCommand,
         list: listCommand7
@@ -42697,7 +43720,7 @@ import { dirname as dirname7, join as join19, normalize, resolve as resolve4 } f
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import {
   createAttachmentStore as createAttachmentStore5,
-  getProjectRoot as getProjectRoot31,
+  getProjectRoot as getProjectRoot36,
   searchAllProjectDocs
 } from "@cleocode/core/internal";
 function getViewerAssetsDir() {
@@ -42757,7 +43780,7 @@ async function serveStatic(res, assetsDir, relPath) {
   }
 }
 function buildViewerHandler(opts = {}) {
-  const projectRoot = opts.projectRoot ?? getProjectRoot31();
+  const projectRoot = opts.projectRoot ?? getProjectRoot36();
   const assetsDir = getViewerAssetsDir();
   const store = createAttachmentStore5();
   return async (req, res) => {
@@ -42935,7 +43958,7 @@ import { spawn } from "node:child_process";
 import { open as fsOpen } from "node:fs/promises";
 import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { getCleoHome as getCleoHome3, getProjectRoot as getProjectRoot32 } from "@cleocode/core";
+import { getCleoHome as getCleoHome3, getProjectRoot as getProjectRoot37 } from "@cleocode/core";
 function getCleoBinPath() {
   const thisFile = fileURLToPath5(import.meta.url);
   return join20(thisFile, "..", "..", "index.js");
@@ -42986,7 +44009,7 @@ async function spawnDetachedServer(opts) {
     detached: true,
     stdio,
     env: { ...process.env, [DETACHED_CHILD_ENV]: "1" },
-    cwd: getProjectRoot32()
+    cwd: getProjectRoot37()
   });
   child.unref();
   if (handle) await handle.close();
@@ -43138,7 +44161,7 @@ var init_docs_viewer = __esm({
           pid: process.pid,
           port: handle.port,
           host: handle.host,
-          projectRoot: getProjectRoot32(),
+          projectRoot: getProjectRoot37(),
           startedAt: Date.now()
         };
         await writeViewerPidFile(record);
@@ -43426,7 +44449,7 @@ import {
   detectStrayCleoDb as detectStrayCleoDb2,
   exportDocument,
   getAgentOutputsAbsolute,
-  getProjectRoot as getProjectRoot33,
+  getProjectRoot as getProjectRoot38,
   listDocVersions,
   makeClassifierForScanRoot,
   mergeDocs,
@@ -43584,6 +44607,10 @@ var init_docs3 = __esm({
         "allow-similar": {
           type: "boolean",
           description: "Bypass the T10361 slug-similarity check. Use when you really do mean to add a new doc with a near-duplicate slug (e.g. intentional fork). Every bypass is logged to .cleo/audit/similar-bypass.jsonl."
+        },
+        strict: {
+          type: "boolean",
+          description: "Enforce body-schema validation against the kind's requiredSections (T10160). When set, a missing H2 section fails the write with E_DOC_SCHEMA_MISMATCH. Default (advisory) surfaces missing sections as a W_DOC_SCHEMA_MISMATCH warning."
         }
       },
       async run({ args, rawArgs }) {
@@ -43635,7 +44662,7 @@ var init_docs3 = __esm({
           resolvedFile = resolveWorktreeFilePath(String(fileArg), routing);
         }
         if (args.slug && args.type) {
-          const projectRoot = await getProjectRoot33();
+          const projectRoot = await getProjectRoot38();
           let warnThreshold = DEFAULT_SIMILARITY_THRESHOLD;
           let mode = DEFAULT_SIMILARITY_MODE;
           try {
@@ -43724,7 +44751,8 @@ var init_docs3 = __esm({
             ...args.labels ? { labels: args.labels } : {},
             ...args["attached-by"] ? { attachedBy: args["attached-by"] } : {},
             ...args.slug ? { slug: args.slug } : {},
-            ...args.type ? { type: args.type } : {}
+            ...args.type ? { type: args.type } : {},
+            ...args.strict === true ? { strict: true } : {}
           },
           { command: "docs add" }
         );
@@ -43935,7 +44963,7 @@ var init_docs3 = __esm({
         const taskId = String(args.task);
         const includeAttachments = args["include-attachments"] !== false;
         const includeMemoryRefs = args["include-memory-refs"] === true;
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         try {
           const result = await exportDocument({
             taskId,
@@ -44001,7 +45029,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         const limit = args.limit ? Number.parseInt(String(args.limit), 10) : 10;
         try {
           const result = args.owner ? await searchDocs2(String(args.query), {
@@ -44057,7 +45085,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         const rawStrategy = args.strategy ?? "three-way";
         const strategy = rawStrategy === "cherry-pick" || rawStrategy === "multi-diff" ? rawStrategy : "three-way";
         try {
@@ -44106,7 +45134,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         const fmt = args.format ?? "mermaid";
         try {
           const result = await buildDocsGraph({ ownerId: String(args.for), projectRoot });
@@ -44175,7 +45203,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         try {
           const result = await rankDocs({
             ownerId: String(args.for),
@@ -44213,7 +45241,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         try {
           const result = await listDocVersions({
             ownerId: String(args.for),
@@ -44256,7 +45284,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         try {
           const result = await publishDocs({
             ownerId: String(args.for),
@@ -44380,7 +45408,7 @@ var init_docs3 = __esm({
       },
       async run({ args }) {
         if (args.from) {
-          const projectRoot = getProjectRoot33();
+          const projectRoot = getProjectRoot38();
           const ownerId = args.for ?? void 0;
           if (!ownerId) {
             cliError(
@@ -44447,7 +45475,7 @@ var init_docs3 = __esm({
         }
       },
       async run() {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         try {
           const result = await statusDocs({ projectRoot });
           cliOutput(result, { command: "docs status", operation: "docs.status" });
@@ -44532,7 +45560,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         const dirArg = String(args.dir);
         const scanRoot = isAbsolute2(dirArg) ? dirArg : resolve5(projectRoot, dirArg);
         const dryRun = args["dry-run"] === true;
@@ -44606,7 +45634,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         const { registry, configError } = loadCliRegistry(projectRoot);
         const kinds = registry.list().map(toWireKind);
         const extensionsCount = kinds.filter((k) => k.isExtension).length;
@@ -44650,7 +45678,7 @@ var init_docs3 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot38();
         const { registry, configError } = loadCliRegistry(projectRoot);
         const kinds = registry.list().map(toWireKind);
         let counts2;
@@ -44733,7 +45761,7 @@ var doctor_db_substrate_exports = {};
 __export(doctor_db_substrate_exports, {
   doctorDbSubstrateCommand: () => doctorDbSubstrateCommand
 });
-import { getProjectRoot as getProjectRoot34, pushWarning as pushWarning2 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot39, pushWarning as pushWarning3 } from "@cleocode/core";
 import { surveyDbSubstrate, surveyFleetDbSubstrate } from "@cleocode/core/doctor/db-substrate.js";
 function pushSubstrateWarnings(result) {
   for (const warning of result.warnings) {
@@ -44745,7 +45773,7 @@ function pushSubstrateWarnings(result) {
     if (warning.kind === "orphan-project-root") {
       context["parentWorkspace"] = warning.parentWorkspace ?? null;
     }
-    pushWarning2({
+    pushWarning3({
       code: warning.kind === "orphan-project-root" ? "W_DB_SUBSTRATE_ORPHAN_PROJECT_ROOT" : "W_DB_SUBSTRATE_NESTED_NEXUS_DUPLICATE",
       message: warning.kind === "orphan-project-root" ? `Orphan project-root .cleo/ at ${warning.path} (T9550 regression class \u2014 review then remove)` + (warning.parentWorkspace ? ` \u2014 attributed to workspace: ${warning.parentWorkspace}` : "") : `Nested-nexus duplicate at ${warning.path} (structural duplicate of the canonical flat layout)`,
       severity: "warn",
@@ -44756,7 +45784,7 @@ function pushSubstrateWarnings(result) {
     for (const [role, entry] of Object.entries(projectSurvey.dbs)) {
       if (entry.pragmaDrift === null || entry.pragmaDrift.length === 0) continue;
       for (const drift of entry.pragmaDrift) {
-        pushWarning2({
+        pushWarning3({
           code: "W_DB_SUBSTRATE_PRAGMA_DRIFT",
           message: `Pragma drift on ${role} (${entry.filePath}): expected ${drift.pragma}=${drift.expected}, actual=${drift.actual ?? "<unmeasurable>"}`,
           severity: "warn",
@@ -44773,7 +45801,7 @@ function pushSubstrateWarnings(result) {
   }
   for (const report of result.crossDbOrphans) {
     if (report.skipped || report.orphanCount === 0) continue;
-    pushWarning2({
+    pushWarning3({
       code: `W_DB_SUBSTRATE_CROSS_DB_${report.invariant}`,
       message: `${report.invariant}: ${report.orphanCount} orphan row${report.orphanCount === 1 ? "" : "s"} \u2014 ${report.description}. ${report.suggestedFix}`,
       severity: "warn",
@@ -44790,7 +45818,7 @@ function pushPerDbWarnings(result) {
   for (const projectSurvey of result.projects) {
     for (const [role, dbEntry] of Object.entries(projectSurvey.dbs)) {
       if (dbEntry.quarantinedTo !== null) {
-        pushWarning2({
+        pushWarning3({
           code: "W_DB_SUBSTRATE_AUTO_QUARANTINED",
           message: `Auto-quarantined corrupt ${role} DB at ${dbEntry.filePath} \u2192 ${dbEntry.quarantinedTo}. Recover via: cleo backup recover ${role}`,
           severity: "warn",
@@ -44803,7 +45831,7 @@ function pushPerDbWarnings(result) {
         });
       }
       if (dbEntry.timedOut) {
-        pushWarning2({
+        pushWarning3({
           code: "W_DB_SUBSTRATE_INTEGRITY_TIMEOUT",
           message: `integrity_check on ${role} DB at ${dbEntry.filePath} took ${dbEntry.integrityCheckMs}ms \u2014 slow substrate flagged for operator attention`,
           severity: "warn",
@@ -44866,7 +45894,7 @@ var init_doctor_db_substrate = __esm({
         const result = isFleet ? surveyFleetDbSubstrate(
           typeof args["fleet-root"] === "string" && args["fleet-root"].length > 0 ? args["fleet-root"] : DEFAULT_FLEET_ROOT,
           options
-        ) : surveyDbSubstrate(getProjectRoot34(), options);
+        ) : surveyDbSubstrate(getProjectRoot39(), options);
         pushSubstrateWarnings(result);
         pushPerDbWarnings(result);
         cliOutput(result, {
@@ -44886,7 +45914,7 @@ var doctor_legacy_backups_exports = {};
 __export(doctor_legacy_backups_exports, {
   doctorLegacyBackupsCommand: () => doctorLegacyBackupsCommand
 });
-import { getProjectRoot as getProjectRoot35 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot40 } from "@cleocode/core";
 import { pruneLegacyBackups, scanLegacyBackups } from "@cleocode/core/doctor/legacy-backups.js";
 function parsePositiveInt(raw, fallback) {
   if (raw === void 0 || raw === null) return fallback;
@@ -44930,7 +45958,7 @@ var init_doctor_legacy_backups = __esm({
       async run({ args }) {
         const softRetentionDays = parsePositiveInt(args["soft-retention-days"], 30);
         const hardRetentionDays = parsePositiveInt(args["hard-retention-days"], 90);
-        const projectRoot = getProjectRoot35();
+        const projectRoot = getProjectRoot40();
         let result;
         if (args.prune === true) {
           const dryRun = args["dry-run"] !== false;
@@ -45233,7 +46261,7 @@ __export(migrate_agents_v2_exports, {
 import { createHash as createHash2 } from "node:crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync14 } from "node:fs";
 import { join as join22 } from "node:path";
-import { getProjectRoot as getProjectRoot36, installAgentFromCant } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot41, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb as openCleoDb2 } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
   return createHash2("sha256").update(bytes).digest("hex");
@@ -45420,7 +46448,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot36();
+        const projectRoot = getProjectRoot41();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -45464,7 +46492,8 @@ __export(doctor_exports, {
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join23 } from "node:path";
-import { getProjectRoot as getProjectRoot37, pushWarning as pushWarning3 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot42, pushWarning as pushWarning4 } from "@cleocode/core";
+import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
   quarantineRogueCleoDir,
   scanRogueCleoDirs
@@ -45565,6 +46594,11 @@ Provider Hook Matrix (CAAMP ${caampVersion} canonical taxonomy)
   humanLine(`Coverage: ${coverageParts.join(", ")}
 `);
 }
+function renderInvariantAuditHuman(result) {
+  for (const line of renderInvariantAuditLines(result)) {
+    humanLine(line);
+  }
+}
 var FIXTURE_ID_PATTERNS, FIXTURE_TITLE_KEYWORDS, doctorCommand2;
 var init_doctor = __esm({
   "packages/cleo/src/cli/commands/doctor.ts"() {
@@ -45686,13 +46720,36 @@ var init_doctor = __esm({
          * auto-close drift. Read-only; non-zero exit when any I-invariant
          * fails so the check is CI-gateable.
          *
+         * As of T10340 (R6), `--audit-sagas` is a focused alias on top of
+         * `--audit-invariants` — it filters the registry walk to ADR-073
+         * only. The implementation re-uses the central walker so the two
+         * surfaces stay in lock-step.
+         *
          * @task T10119
+         * @task T10340
          * @saga T10113
          * @epic T10209
          */
         "audit-sagas": {
           type: "boolean",
-          description: "Audit every Saga for ADR-073 \xA71.2 invariant violations (I5/I7/depth) + auto-close drift (T10119)"
+          description: "Audit every Saga for ADR-073 \xA71.2 invariant violations (I5/I7/depth) + auto-close drift \u2014 focused alias on top of --audit-invariants (T10119, T10340)"
+        },
+        /**
+         * T10340: walk the central `INVARIANTS_REGISTRY` and audit every
+         * registered invariant against the project's current state.
+         *
+         * Output groups violations by ADR + severity and includes an
+         * actionable repair command per violation. Supports `--json` for
+         * machine consumption. Exit code is non-zero when any
+         * `severity:'error'` violation is observed.
+         *
+         * @task T10340 — R6
+         * @epic T10327 — E-INVARIANT-REGISTRY-SSOT
+         * @saga T10326 — SG-SUBSTRATE-RECONCILIATION
+         */
+        "audit-invariants": {
+          type: "boolean",
+          description: "Walk the central INVARIANTS_REGISTRY and audit every registered invariant \u2014 groups by ADR + severity with repair commands (T10340 / Saga T10326 R6)"
         },
         /**
          * T9983: migrate the worktree-include file location from
@@ -45759,7 +46816,7 @@ var init_doctor = __esm({
         try {
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -45768,7 +46825,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -45856,7 +46913,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -45865,7 +46922,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -45919,7 +46976,7 @@ var init_doctor = __esm({
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
             const { getCleoHome: getCleoHome6 } = await import("@cleocode/core");
             const cleoHome = getCleoHome6();
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -45952,7 +47009,7 @@ var init_doctor = __esm({
           } else if (args["audit-worktree-orphans"]) {
             progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
             const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -45966,7 +47023,7 @@ var init_doctor = __esm({
             const legacyOrphans = legacyScanResult.orphans;
             const totalAnomalies = comprehensive.count;
             if (legacyScanResult.softWarnMessage) {
-              pushWarning3({
+              pushWarning4({
                 code: "W_DOCTOR_SCAN_SOFT_WARN",
                 message: legacyScanResult.softWarnMessage,
                 severity: "warn"
@@ -45974,7 +47031,7 @@ var init_doctor = __esm({
             }
             if (legacyScanResult.isPartial) {
               const reason = legacyScanResult.partialReason === "timeout" ? `timed out after ${timeoutSecs}s (use --timeout <seconds> to adjust)` : `per-level entry cap of ${maxEntriesPerLevel} exceeded (use --max-entries-per-level <n> to adjust)`;
-              pushWarning3({
+              pushWarning4({
                 code: "W_DOCTOR_SCAN_PARTIAL",
                 message: `legacy orphan scan is PARTIAL \u2014 ${reason}. Results may be incomplete.`,
                 severity: "warn",
@@ -46009,7 +47066,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
             );
             const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -46018,7 +47075,7 @@ var init_doctor = __esm({
               maxEntriesPerLevel: Number.isFinite(maxEntriesPerLevel) ? maxEntriesPerLevel : 500
             });
             if (scanResult.softWarnMessage) {
-              pushWarning3({
+              pushWarning4({
                 code: "W_DOCTOR_SCAN_SOFT_WARN",
                 message: scanResult.softWarnMessage,
                 severity: "warn"
@@ -46026,7 +47083,7 @@ var init_doctor = __esm({
             }
             if (scanResult.isPartial) {
               const reason = scanResult.partialReason === "timeout" ? `timed out after ${timeoutSecs}s (use --timeout <seconds> to adjust)` : `per-level entry cap of ${maxEntriesPerLevel} exceeded (use --max-entries-per-level <n> to adjust)`;
-              pushWarning3({
+              pushWarning4({
                 code: "W_DOCTOR_SCAN_PARTIAL",
                 message: `orphan scan is PARTIAL \u2014 ${reason}. Only orphans found before abort will be pruned.`,
                 severity: "warn",
@@ -46088,7 +47145,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
             );
             const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
-            const projectRoot = getProjectRoot37();
+            const projectRoot = getProjectRoot42();
             const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
             progress.complete(`Migration ${result.action}`);
             cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
@@ -46101,15 +47158,22 @@ var init_doctor = __esm({
             if (checkResult.details?.["orphans"] && checkResult.details["orphans"].length > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
               process.exitCode = 2;
             }
-          } else if (args["audit-sagas"]) {
-            progress.step(0, "Auditing Saga hierarchy for ADR-073 invariants");
-            const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
-            const projectRoot = getProjectRoot37();
-            const result = await auditSagaHierarchy(projectRoot);
-            const summary = `Saga audit complete \u2014 ${result.sagas.length} saga(s) inspected, ${result.count} invariant violation(s), ${result.driftCount} drift warning(s)`;
+          } else if (args["audit-invariants"] || args["audit-sagas"]) {
+            const isFocusedAlias = args["audit-sagas"] === true && args["audit-invariants"] !== true;
+            const adrFilter = isFocusedAlias ? "ADR-073" : void 0;
+            const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
+            progress.step(0, stepLabel);
+            const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
+            const projectRoot = getProjectRoot42();
+            const result = await auditInvariantRegistry(projectRoot, { adrFilter });
+            const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
+            const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
             progress.complete(summary);
-            cliOutput(result, { command: "doctor", operation: "doctor.audit-sagas" });
-            if (result.count > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+            if (isHuman && args.json !== true) {
+              renderInvariantAuditHuman(result);
+            }
+            cliOutput(result, { command: "doctor", operation });
+            if (result.errorCount > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
               process.exitCode = 2;
             }
           } else {
@@ -46122,7 +47186,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot37();
+              const projectRoot = getProjectRoot42();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -46153,7 +47217,7 @@ var init_doctor = __esm({
               progress.complete("Health check complete");
             }
             try {
-              const projectRoot = getProjectRoot37();
+              const projectRoot = getProjectRoot42();
               const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
               const sagaAudit = await auditSagaHierarchy(projectRoot);
               if (sagaAudit.sagas.length === 0) {
@@ -48365,7 +49429,7 @@ import { join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import {
   CleoError as CleoError4,
-  formatError as formatError5,
+  formatError as formatError4,
   getWorkflowTemplatesDir as getCoreWorkflowTemplatesDir,
   initProject as initProject2,
   scaffoldWorkflows
@@ -48485,7 +49549,7 @@ var init_init = __esm({
           );
         } catch (err) {
           if (err instanceof CleoError4) {
-            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError4(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -49300,7 +50364,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot38 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot43 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -49373,7 +50437,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot38(process.cwd());
+        const projectRoot = getProjectRoot43(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -50014,7 +51078,7 @@ var llm_exports = {};
 __export(llm_exports, {
   llmCommand: () => llmCommand
 });
-import { pushWarning as pushWarning4 } from "@cleocode/core";
+import { pushWarning as pushWarning5 } from "@cleocode/core";
 async function getListProviders() {
   const { listProviders } = await import(
     /* webpackIgnore: true */
@@ -50145,7 +51209,7 @@ var init_llm3 = __esm({
           apiKey = envValue;
           source = "env";
         } else if (typeof a["api-key"] === "string" && a["api-key"]) {
-          pushWarning4({
+          pushWarning5({
             code: "W_DEPRECATED_FLAG",
             message: API_KEY_FLAG_DEPRECATION,
             deprecated: "--api-key=<value>",
@@ -50575,7 +51639,7 @@ async function readStdin() {
   });
 }
 var showCommand7, listCommand13, findCommand4, statsCommand3, appendCommand, archiveCommand2, manifestCommand;
-var init_manifest = __esm({
+var init_manifest3 = __esm({
   "packages/cleo/src/cli/commands/manifest.ts"() {
     "use strict";
     init_dist();
@@ -50920,7 +51984,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot39 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot44 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -51844,7 +52908,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -51868,7 +52932,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -51905,7 +52969,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -51945,7 +53009,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -51991,7 +53055,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot39();
+        const projectRoot = getProjectRoot44();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -52142,7 +53206,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -52185,7 +53249,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -52251,7 +53315,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot39();
+        const root = getProjectRoot44();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -52711,7 +53775,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot40, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot45, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -52774,7 +53838,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot40();
+        const root = getProjectRoot45();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -52823,7 +53887,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot40();
+        const projectRoot = getProjectRoot45();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -52927,7 +53991,7 @@ __export(nexus_exports, {
 import { appendFile as appendFile2, mkdir as mkdir3 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot41 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import { exportNexusGraph } from "@cleocode/core/nexus/export.js";
@@ -53042,7 +54106,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const startTime = Date.now();
         try {
           const [{ getNexusDb, nexusSchema }, { getIndexStats }] = await Promise.all([
@@ -53557,7 +54621,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -53601,7 +54665,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -53644,7 +54708,7 @@ var init_nexus3 = __esm({
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot41();
+        const repoPath = getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -53707,7 +54771,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot41();
+        const repoPath = getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -53779,7 +54843,7 @@ var init_nexus3 = __esm({
         const projectIdOverride = args["project-id"];
         const isIncremental = !!args.incremental;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
         if (!isIncremental) humanInfo("[nexus] Clearing existing index for project...");
         try {
@@ -53882,7 +54946,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -54240,7 +55304,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -54346,7 +55410,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -54464,7 +55528,7 @@ var init_nexus3 = __esm({
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -54520,7 +55584,7 @@ var init_nexus3 = __esm({
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -54910,7 +55974,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -55014,7 +56078,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot41();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot46();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -55095,7 +56159,7 @@ var init_nexus3 = __esm({
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot41(),
+            projectRoot: getProjectRoot46(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -56346,7 +57410,7 @@ __export(otel_exports, {
 import {
   CleoError as CleoError5,
   clearOtelData,
-  formatError as formatError6,
+  formatError as formatError5,
   getOtelSessions,
   getOtelSpawns,
   getOtelStatus,
@@ -56367,7 +57431,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError6(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -56382,7 +57446,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError6(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -56410,7 +57474,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError6(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -56438,7 +57502,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError6(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -56466,7 +57530,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError6(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -56481,7 +57545,7 @@ var init_otel = __esm({
           cliOutput(result, { command: "otel" });
         } catch (err) {
           if (err instanceof CleoError5) {
-            cliError(formatError6(err), err.code, { name: "E_INTERNAL" });
+            cliError(formatError5(err), err.code, { name: "E_INTERNAL" });
             process.exit(err.code);
           }
           throw err;
@@ -56515,7 +57579,7 @@ var phase_exports = {};
 __export(phase_exports, {
   phaseCommand: () => phaseCommand
 });
-var showCommand9, listCommand15, setCommand2, startCommand6, completeCommand3, advanceCommand2, renameCommand, deleteCommand2, phaseCommand;
+var showCommand9, listCommand15, setCommand, startCommand6, completeCommand3, advanceCommand2, renameCommand, deleteCommand2, phaseCommand;
 var init_phase = __esm({
   "packages/cleo/src/cli/commands/phase.ts"() {
     "use strict";
@@ -56541,7 +57605,7 @@ var init_phase = __esm({
         await dispatchFromCli("query", "pipeline", "phase.list", {}, { command: "phase" });
       }
     });
-    setCommand2 = defineCommand({
+    setCommand = defineCommand({
       meta: { name: "set", description: "Set current phase" },
       args: {
         slug: {
@@ -56694,7 +57758,7 @@ var init_phase = __esm({
       subCommands: {
         show: showCommand9,
         list: listCommand15,
-        set: setCommand2,
+        set: setCommand,
         start: startCommand6,
         complete: completeCommand3,
         advance: advanceCommand2,
@@ -57042,7 +58106,7 @@ __export(provenance_exports, {
   provenanceCommand: () => provenanceCommand
 });
 var backfillCommand3, verifyCommand2, provenanceCommand;
-var init_provenance2 = __esm({
+var init_provenance3 = __esm({
   "packages/cleo/src/cli/commands/provenance.ts"() {
     "use strict";
     init_dist();
@@ -57522,7 +58586,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot42 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -57535,7 +58599,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot42();
+        const projectDir = getProjectRoot47();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -58936,7 +60000,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError7,
-  getProjectRoot as getProjectRoot43,
+  getProjectRoot as getProjectRoot48,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -58957,7 +60021,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot43();
+        const projectRoot = getProjectRoot48();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -59889,6 +60953,7 @@ var schema_exports = {};
 __export(schema_exports, {
   schemaCommand: () => schemaCommand2
 });
+import { getInputContract } from "@cleocode/core";
 import { describeOperation } from "@cleocode/lafs";
 function resolveOperationDef(operationArg) {
   const dotIdx = operationArg.indexOf(".");
@@ -59936,6 +61001,16 @@ var init_schema = __esm({
           type: "boolean",
           description: "Include usage examples in output (default: false)",
           default: false
+        },
+        input: {
+          type: "boolean",
+          description: "Return the JSON Schema (draft-07) for the operation input payload, from OperationInputContract.schema (T9918)",
+          default: false
+        },
+        examples: {
+          type: "boolean",
+          description: "Return canned example payloads from OperationInputContract.examples \u2014 pipeline: `cleo schema <op> --examples | jq '.examples[0].value' | cleo <verb> --params -` (T9918)",
+          default: false
         }
       },
       async run({ args, cmd }) {
@@ -59946,6 +61021,8 @@ var init_schema = __esm({
         const format = args.format ?? "json";
         const includeGates = args["include-gates"] !== false;
         const includeExamples = args["include-examples"] === true;
+        const wantInput = args.input === true;
+        const wantExamples = args.examples === true;
         if (format === "human") {
           setFormatContext({ format: "human", source: "flag", quiet: false });
         }
@@ -59962,6 +61039,57 @@ var init_schema = __esm({
           process.exit(4);
           return;
         }
+        if (wantInput || wantExamples) {
+          const contract = getInputContract(args.operation);
+          if (contract === null) {
+            cliOutput(
+              {
+                operation: args.operation,
+                schema: null,
+                examples: []
+              },
+              {
+                command: "schema",
+                operation: `schema.${args.operation}`,
+                message: `No OperationInputContract registered for ${args.operation}`,
+                extensions: {
+                  hint: `No OperationInputContract registered for ${args.operation}. Use plain flag-based invocation.`
+                }
+              }
+            );
+            return;
+          }
+          if (wantInput) {
+            cliOutput(
+              {
+                operation: contract.operation,
+                schema: contract.schema
+              },
+              {
+                command: "schema",
+                operation: `schema.${args.operation}`,
+                message: `Input schema for ${contract.operation}`
+              }
+            );
+            return;
+          }
+          cliOutput(
+            {
+              operation: contract.operation,
+              examples: contract.examples.map((ex) => ({
+                name: ex.name,
+                value: ex.value,
+                ...ex.description !== void 0 ? { description: ex.description } : {}
+              }))
+            },
+            {
+              command: "schema",
+              operation: `schema.${args.operation}`,
+              message: `Examples for ${contract.operation}`
+            }
+          );
+          return;
+        }
         const schema2 = describeOperation(def, {
           includeGates,
           includeExamples
@@ -61448,7 +62576,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot44 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot49 } from "@cleocode/core/internal";
 var showCommand12, checkCommand6, repairCommand2, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -61484,7 +62612,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot44();
+        const projectRoot = getProjectRoot49();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -61939,8 +63067,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot48 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot48();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot53 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot53();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -62642,7 +63770,7 @@ __export(show_exports, {
   showCommand: () => showCommand14
 });
 var showCommand14;
-var init_show = __esm({
+var init_show2 = __esm({
   "packages/cleo/src/cli/commands/show.ts"() {
     "use strict";
     init_dist();
@@ -64476,23 +65604,23 @@ __export(telemetry_exports, {
   telemetryCommand: () => telemetryCommand
 });
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { getConfigValue, setConfigValue } from "@cleocode/core";
+import { getConfigValue as getConfigValue2, setConfigValue as setConfigValue2 } from "@cleocode/core";
 async function readTelemetryConfig() {
-  const enabledResolved = await getConfigValue("telemetry.enabled");
-  const periodResolved = await getConfigValue("telemetry.period");
-  const installIdResolved = await getConfigValue("telemetry.installId");
+  const enabledResolved = await getConfigValue2("telemetry.enabled");
+  const periodResolved = await getConfigValue2("telemetry.period");
+  const installIdResolved = await getConfigValue2("telemetry.installId");
   const enabled = enabledResolved.value === true;
   const period = periodResolved.value === "monthly" ? "monthly" : "monthly";
   const installId = typeof installIdResolved.value === "string" ? installIdResolved.value : void 0;
   return { enabled, period, installId };
 }
 async function ensureInstallId() {
-  const existing = await getConfigValue("telemetry.installId");
+  const existing = await getConfigValue2("telemetry.installId");
   if (typeof existing.value === "string" && existing.value.length > 0) {
     return existing.value;
   }
   const newId = randomUUID6();
-  await setConfigValue("telemetry.installId", newId, void 0, { global: true });
+  await setConfigValue2("telemetry.installId", newId, void 0, { global: true });
   return newId;
 }
 var enableSub, disableSub, statusSub2, telemetryCommand;
@@ -64508,8 +65636,8 @@ var init_telemetry2 = __esm({
         description: "Enable anonymous skills-usage telemetry (default-on for new installs)"
       },
       async run() {
-        await setConfigValue("telemetry.enabled", true, void 0, { global: true });
-        await setConfigValue("telemetry.period", "monthly", void 0, { global: true });
+        await setConfigValue2("telemetry.enabled", true, void 0, { global: true });
+        await setConfigValue2("telemetry.period", "monthly", void 0, { global: true });
         const installId = await ensureInstallId();
         const config = await readTelemetryConfig();
         cliOutput(
@@ -64528,7 +65656,7 @@ var init_telemetry2 = __esm({
         description: "Disable anonymous skills-usage telemetry"
       },
       async run() {
-        await setConfigValue("telemetry.enabled", false, void 0, { global: true });
+        await setConfigValue2("telemetry.enabled", false, void 0, { global: true });
         const config = await readTelemetryConfig();
         cliOutput(config, {
           command: "telemetry",
@@ -64706,7 +65834,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync16 } from "node:fs";
-import { getProjectRoot as getProjectRoot45, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot50, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -64870,7 +65998,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot45(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot50(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -64906,7 +66034,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir6 } from "node:os";
 import { join as join30 } from "node:path";
-import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot51 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -64936,7 +66064,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot46();
+            const projectRoot = getProjectRoot51();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -65033,7 +66161,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot46();
+        const projectRoot = getProjectRoot51();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -65145,7 +66273,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot46();
+        const projectRoot = getProjectRoot51();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -65324,11 +66452,18 @@ var update_exports = {};
 __export(update_exports, {
   updateCommand: () => updateCommand2
 });
-import { appendSignedSeverityAttestation as appendSignedSeverityAttestation2, parseAcceptanceCriteria as parseAcceptanceCriteria2 } from "@cleocode/core";
+import {
+  appendSignedSeverityAttestation as appendSignedSeverityAttestation2,
+  isPipelineTransitionForward,
+  isValidPipelineStage,
+  parseAcceptanceCriteria as parseAcceptanceCriteria2,
+  TASK_PIPELINE_STAGES
+} from "@cleocode/core";
 var updateCommand2;
 var init_update = __esm({
   "packages/cleo/src/cli/commands/update.ts"() {
     "use strict";
+    init_src2();
     init_dist();
     init_cli();
     init_renderers();
@@ -65540,6 +66675,58 @@ var init_update = __esm({
           await showUsage(cmd);
           return;
         }
+        if (args.severity !== void 0 && !TASK_SEVERITIES.includes(args.severity)) {
+          const valid = TASK_SEVERITIES.join(", ");
+          cliError(
+            `severity must be one of: ${valid} \u2014 got '${args.severity}'`,
+            6,
+            {
+              name: "E_INVALID_SEVERITY_VALUE",
+              fix: `Pass --severity with one of: ${valid}`
+            },
+            { operation: "tasks.update" }
+          );
+          process.exit(6);
+          return;
+        }
+        if (args["pipeline-stage"] !== void 0) {
+          const requestedStage = String(args["pipeline-stage"]);
+          if (!isValidPipelineStage(requestedStage)) {
+            const valid = TASK_PIPELINE_STAGES.join(", ");
+            cliError(
+              `pipeline-stage must be one of: ${valid} \u2014 got '${requestedStage}'`,
+              6,
+              {
+                name: "E_INVALID_PIPELINE_STAGE",
+                fix: `Pass --pipeline-stage with one of: ${valid}`
+              },
+              { operation: "tasks.update" }
+            );
+            process.exit(6);
+            return;
+          }
+          const showResponse = await dispatchRaw("query", "tasks", "show", {
+            taskId: args.taskId
+          });
+          const existingTask = showResponse.success ? showResponse.data : void 0;
+          const currentStage = typeof existingTask?.["pipelineStage"] === "string" ? existingTask["pipelineStage"] : null;
+          if (currentStage && !isPipelineTransitionForward(currentStage, requestedStage)) {
+            const validForward = TASK_PIPELINE_STAGES.filter((s) => {
+              return isPipelineTransitionForward(currentStage, s);
+            }).join(", ");
+            cliError(
+              `pipeline-stage transition rejected: cannot move backward from '${currentStage}' to '${requestedStage}'. Pipeline stages are forward-only.`,
+              6,
+              {
+                name: "E_INVALID_PIPELINE_STAGE",
+                fix: `Pass --pipeline-stage with a stage at or after '${currentStage}'. Valid forward stages: ${validForward}`
+              },
+              { operation: "tasks.update" }
+            );
+            process.exit(6);
+            return;
+          }
+        }
         const params = { taskId: args.taskId };
         if (args.title !== void 0) params["title"] = args.title;
         if (args.status !== void 0) params["status"] = args.status;
@@ -65943,7 +67130,7 @@ __export(web_exports, {
 import { execFileSync as execFileSync3, spawn as spawn3 } from "node:child_process";
 import { mkdir as mkdir4, open, readFile as readFile6, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join31 } from "node:path";
-import { CleoError as CleoError11, formatError as formatError7, getCleoHome as getCleoHome5 } from "@cleocode/core";
+import { CleoError as CleoError11, formatError as formatError6, getCleoHome as getCleoHome5 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome5();
   return {
@@ -66096,7 +67283,7 @@ var init_web = __esm({
           await startWebServer(Number.parseInt(args.port, 10), args.host);
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError7(err));
+            console.error(formatError6(err));
             process.exit(err.code);
           }
           throw err;
@@ -66140,7 +67327,7 @@ var init_web = __esm({
           cliOutput({ stopped: true }, { command: "web", message: "CLEO Web UI stopped" });
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError7(err));
+            console.error(formatError6(err));
             process.exit(err.code);
           }
           throw err;
@@ -66193,7 +67380,7 @@ var init_web = __esm({
           await startWebServer(Number.parseInt(args.port, 10), args.host);
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError7(err));
+            console.error(formatError6(err));
             process.exit(err.code);
           }
           throw err;
@@ -66208,7 +67395,7 @@ var init_web = __esm({
           cliOutput(status, { command: "web" });
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError7(err));
+            console.error(formatError6(err));
             process.exit(err.code);
           }
           throw err;
@@ -66241,7 +67428,7 @@ var init_web = __esm({
           cliOutput({ url }, { command: "web", message: `Open browser to: ${url}` });
         } catch (err) {
           if (err instanceof CleoError11) {
-            console.error(formatError7(err));
+            console.error(formatError6(err));
             process.exit(err.code);
           }
           throw err;
@@ -66272,7 +67459,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot47, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot52, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve7) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -66377,7 +67564,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot47();
+        const projectRoot = getProjectRoot52();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -66819,8 +68006,8 @@ var COMMAND_MANIFEST = [
   {
     exportName: "configCommand",
     name: "config",
-    description: "Configuration management",
-    load: async () => (await Promise.resolve().then(() => (init_config2(), config_exports))).configCommand
+    description: "CleoConfig SSoT registry surface (show, get, set, validate, drift-check) + legacy presets/list",
+    load: async () => (await Promise.resolve().then(() => (init_config3(), config_exports))).configCommand
   },
   {
     exportName: "consensusCommand",
@@ -67102,7 +68289,7 @@ var COMMAND_MANIFEST = [
     exportName: "manifestCommand",
     name: "manifest",
     description: "Manifest operations (pipeline_manifest table)",
-    load: async () => (await Promise.resolve().then(() => (init_manifest(), manifest_exports))).manifestCommand
+    load: async () => (await Promise.resolve().then(() => (init_manifest3(), manifest_exports))).manifestCommand
   },
   {
     exportName: "mapCommand",
@@ -67192,7 +68379,7 @@ var COMMAND_MANIFEST = [
     exportName: "provenanceCommand",
     name: "provenance",
     description: "Provenance-graph maintenance: backfill, verify, repair",
-    load: async () => (await Promise.resolve().then(() => (init_provenance2(), provenance_exports))).provenanceCommand
+    load: async () => (await Promise.resolve().then(() => (init_provenance3(), provenance_exports))).provenanceCommand
   },
   {
     exportName: "providerCommand",
@@ -67342,7 +68529,7 @@ var COMMAND_MANIFEST = [
     exportName: "showCommand",
     name: "show",
     description: "Show full task details by ID (returns complete task record with metadata, verification, lifecycle)",
-    load: async () => (await Promise.resolve().then(() => (init_show(), show_exports))).showCommand
+    load: async () => (await Promise.resolve().then(() => (init_show2(), show_exports))).showCommand
   },
   {
     exportName: "skillCommand",
@@ -67895,7 +69082,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger21,
-    getProjectRoot: getProjectRoot48,
+    getProjectRoot: getProjectRoot53,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -67904,7 +69091,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot48();
+    projectRootForCleanup = getProjectRoot53();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -67924,7 +69111,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot48();
+      const _projectRootForMigration = getProjectRoot53();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {