@cleocode/cleo 2026.5.134 → 2026.6.0

package/dist/cli/index.js

@@ -2259,8 +2259,8 @@ var init_db_inventory = __esm({
           role: "signaldock-project",
           tier: "project",
           filePathTemplate: "<projectRoot>/.cleo/signaldock.db",
-          drizzleSchemaPath: "packages/core/src/store/schema/signaldock-schema.ts",
-          migrationsDir: "packages/core/migrations/drizzle-signaldock/",
+          drizzleSchemaPath: "packages/core/src/store/schema/agent-registry-schema.ts",
+          migrationsDir: "packages/core/migrations/drizzle-agent-registry/",
           ownerPackage: "@cleocode/core",
           openedVia: "HISTORICAL \u2014 project-tier signaldock.db was migrated into conduit.db post-T310/ADR-037. No live opener; charter row retained for migration provenance and legacy backup detection.",
           concurrency: "single-writer",
@@ -2272,8 +2272,8 @@ var init_db_inventory = __esm({
           role: "signaldock-global",
           tier: "global",
           filePathTemplate: "$XDG_DATA_HOME/cleo/signaldock.db",
-          drizzleSchemaPath: "packages/core/src/store/schema/signaldock-schema.ts",
-          migrationsDir: "packages/core/migrations/drizzle-signaldock/",
+          drizzleSchemaPath: "packages/core/src/store/schema/agent-registry-schema.ts",
+          migrationsDir: "packages/core/migrations/drizzle-agent-registry/",
           ownerPackage: "@cleocode/core",
           openedVia: "openCleoDb('signaldock')",
           concurrency: "single-writer",
@@ -5378,6 +5378,50 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      {
+        // T11575 — the handler (dispatch/domains/tasks.ts 'relates.add-batch') and
+        // CLI command (cli/commands/relates.ts add-batch) shipped, but no
+        // OperationDef existed here, so `resolve()` returned undefined and the
+        // dispatcher rejected the call with E_INVALID_OPERATION before it ever
+        // reached the handler. Registering the op (gateway:'mutate') closes the gap.
+        gateway: "mutate",
+        domain: "tasks",
+        operation: "relates.add-batch",
+        description: "tasks.relates.add-batch (mutate) \u2014 bulk-add advisory relation edges from a JSON payload ({relations:[...]} or {edges:[...]}); use dryRun to preview without writing.",
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        // Neither `relations` nor `edges` is individually required — the handler
+        // accepts either shape and validates emptiness in core — so no param is
+        // declared required at the dispatch boundary.
+        requiredParams: [],
+        params: [
+          {
+            name: "relations",
+            type: "array",
+            required: false,
+            description: "Array of relation edges ({from|taskId, to|relatedId, type, reason})"
+          },
+          {
+            name: "edges",
+            type: "array",
+            required: false,
+            description: "Alias for `relations` \u2014 array of relation edges"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Validate and report what would be created without writing"
+          },
+          {
+            name: "reasonWaiver",
+            type: "string",
+            required: false,
+            description: "Explicit audit waiver text for edges without per-edge reasons"
+          }
+        ]
+      },
       {
         gateway: "mutate",
         domain: "tasks",
@@ -11554,6 +11598,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["DECISION_VALIDATOR_FAILED"] = 106] = "DECISION_VALIDATOR_FAILED";
       ExitCode2[ExitCode2["LEAD_BYPASS_DETECTED"] = 107] = "LEAD_BYPASS_DETECTED";
       ExitCode2[ExitCode2["AC_COVERAGE_INCOMPLETE"] = 108] = "AC_COVERAGE_INCOMPLETE";
+      ExitCode2[ExitCode2["CANCELLED_CHILD_NO_WAIVER"] = 109] = "CANCELLED_CHILD_NO_WAIVER";
       return ExitCode2;
     })(ExitCode || {});
   }
@@ -12264,6 +12309,13 @@ var init_observe = __esm({
   }
 });
 
+// packages/contracts/src/migration-parity.ts
+var init_migration_parity = __esm({
+  "packages/contracts/src/migration-parity.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/mvi.ts
 var init_mvi = __esm({
   "packages/contracts/src/mvi.ts"() {
@@ -14173,6 +14225,7 @@ var init_src2 = __esm({
     init_lafs();
     init_plugin_llm();
     init_observe();
+    init_migration_parity();
     init_mvi();
     init_operation_envelope_validation();
     init_docs();
@@ -18036,10 +18089,9 @@ async function listenTopicImpl(topicName, agentId, limit, since) {
     apiBaseUrl: credential.apiBaseUrl
   });
   try {
-    const sinceUnix = since ? Math.floor(new Date(since).getTime() / 1e3) : 0;
     const messages = await transport.pollTopic(topicName, {
       limit: limit ?? 50,
-      since: sinceUnix
+      since: since ?? ""
     });
     return {
       success: true,
@@ -18760,7 +18812,9 @@ Recovery command: cleo docs update {slug} --file <your-file>`;
             description: void 0,
             labels: void 0,
             createdAt: doc.createdAt,
-            refCount: 0,
+            // Surface the real attachment ref_count (T11572) so `docs list` agrees
+            // with the `docs add` response — both now read the same source of truth.
+            refCount: doc.refCount,
             ...doc.slug ? { slug: doc.slug } : {},
             ...doc.kind ? { type: doc.kind } : {},
             ownerId: doc.ownerId,
@@ -18808,7 +18862,8 @@ Recovery command: cleo docs update {slug} --file <your-file>`;
           description: void 0,
           labels: void 0,
           createdAt: doc.createdAt,
-          refCount: 0,
+          // Surface the real attachment ref_count (T11572) — see project-scope note.
+          refCount: doc.refCount,
           ...doc.slug ? { slug: doc.slug } : {},
           ...doc.kind ? { type: doc.kind } : {}
         }));
@@ -22402,22 +22457,24 @@ function handleTopEntriesFromNexus(operation, params, startTime, db, limit) {
   let rows = [];
   try {
     const sql = kind === null ? `SELECT r.source_id,
-                  SUM(COALESCE(r.weight, 0)) AS totalWeight,
+                  SUM(COALESCE(w.weight, 0)) AS totalWeight,
                   COUNT(*)                   AS edgeCount,
                   n.label,
                   n.kind,
                   n.file_path
              FROM nexus_relations r
+             LEFT JOIN nexus_relation_weights w ON w.relation_id = r.id
              LEFT JOIN nexus_nodes n ON n.id = r.source_id
             GROUP BY r.source_id
             ORDER BY totalWeight DESC, edgeCount DESC
             LIMIT ?` : `SELECT r.source_id,
-                  SUM(COALESCE(r.weight, 0)) AS totalWeight,
+                  SUM(COALESCE(w.weight, 0)) AS totalWeight,
                   COUNT(*)                   AS edgeCount,
                   n.label,
                   n.kind,
                   n.file_path
              FROM nexus_relations r
+             LEFT JOIN nexus_relation_weights w ON w.relation_id = r.id
              LEFT JOIN nexus_nodes n ON n.id = r.source_id
             WHERE n.kind = ?
             GROUP BY r.source_id
@@ -22514,11 +22571,10 @@ async function handleImpact(operation, params, startTime) {
     let allNodes = [];
     try {
       const rawRows = db.prepare(
-        `SELECT id, label, kind, file_path, name, project_id
+        `SELECT id, label, kind, file_path, name
              FROM nexus_nodes
-            WHERE project_id = ?
-              AND kind NOT IN ('community','process','file','folder')`
-      ).all(projectId);
+            WHERE kind NOT IN ('community','process','file','folder')`
+      ).all();
       allNodes = rawRows.map((raw) => {
         const r = raw;
         return {
@@ -22526,8 +22582,7 @@ async function handleImpact(operation, params, startTime) {
           label: r["label"] != null ? String(r["label"]) : null,
           kind: r["kind"] != null ? String(r["kind"]) : null,
           file_path: r["file_path"] != null ? String(r["file_path"]) : null,
-          name: r["name"] != null ? String(r["name"]) : null,
-          project_id: String(r["project_id"] ?? "")
+          name: r["name"] != null ? String(r["name"]) : null
         };
       });
     } catch {
@@ -22572,11 +22627,11 @@ async function handleImpact(operation, params, startTime) {
     let allRelations = [];
     try {
       const rawRows = db.prepare(
-        `SELECT source_id, target_id, type, weight
-             FROM nexus_relations
-            WHERE project_id = ?
-              AND type IN ('calls','imports','accesses')`
-      ).all(projectId);
+        `SELECT r.source_id AS source_id, r.target_id AS target_id, r.type AS type, w.weight AS weight
+             FROM nexus_relations r
+        LEFT JOIN nexus_relation_weights w ON w.relation_id = r.id
+            WHERE r.type IN ('calls','imports','accesses')`
+      ).all();
       allRelations = rawRows.map((raw) => {
         const r = raw;
         return {
@@ -28118,37 +28173,44 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
-  const { getProjectRoot: getProjectRoot58 } = await import("@cleocode/core/internal");
+  const { getProjectRoot: getProjectRoot58, createToolGuard, runSkillNodeOrSpawn } = await import("@cleocode/core/internal");
   const projectRoot = getProjectRoot58();
+  const tools = createToolGuard({ allowedRoots: [projectRoot] });
+  const spawn5 = async (input2) => {
+    const result = await orchestrateSpawnExecute2(
+      input2.taskId,
+      /* adapterId */
+      void 0,
+      /* protocolType */
+      void 0,
+      projectRoot,
+      /* tier */
+      void 0
+    );
+    if (result.success) {
+      return {
+        status: "success",
+        output: {
+          [`${input2.nodeId}_spawn`]: true,
+          nodeId: input2.nodeId,
+          agentId: input2.agentId,
+          dispatchData: result.data ?? null
+        }
+      };
+    }
+    return {
+      status: "failure",
+      output: {},
+      error: result.error?.message ?? `spawn failed for ${input2.agentId}`
+    };
+  };
   return {
     async dispatch(input2) {
       try {
-        const result = await orchestrateSpawnExecute2(
-          input2.taskId,
-          /* adapterId */
-          void 0,
-          /* protocolType */
-          void 0,
-          projectRoot,
-          /* tier */
-          void 0
+        return await runSkillNodeOrSpawn(
+          { nodeId: input2.nodeId, agentId: input2.agentId, context: input2.context },
+          { tools, cwd: projectRoot, subprocessSpawn: () => spawn5(input2) }
         );
-        if (result.success) {
-          return {
-            status: "success",
-            output: {
-              [`${input2.nodeId}_spawn`]: true,
-              nodeId: input2.nodeId,
-              agentId: input2.agentId,
-              dispatchData: result.data ?? null
-            }
-          };
-        }
-        return {
-          status: "failure",
-          output: {},
-          error: result.error?.message ?? `spawn failed for ${input2.agentId}`
-        };
       } catch (err) {
         return {
           status: "failure",
@@ -32604,7 +32666,9 @@ var init_tasks3 = __esm({
           acknowledgeRisk: params.acknowledgeRisk,
           // T10509 — AC-coverage gate waiver path
           waiveAc: params.waiveAc,
-          waiveReason: params.waiveReason
+          waiveReason: params.waiveReason,
+          // T10538 — cancelled-child waiver (PM-Core V2 agent-trust)
+          cancelledChildWaiverReason: params.cancelledChildWaiverReason
         });
         setImmediate(async () => {
           try {
@@ -32784,6 +32848,10 @@ var init_tasks3 = __esm({
       "reparent",
       "reorder",
       "relates.add",
+      // T11575 — without this entry the domain mutate() gate rejects the op with
+      // E_INVALID_OPERATION even though the handler exists below. Mirrors the
+      // OperationDef registered in @cleocode/contracts operations-registry.
+      "relates.add-batch",
       "relates.remove",
       "start",
       "stop",
@@ -36902,7 +36970,7 @@ var init_agent = __esm({
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const agentId = args.id;
           const displayName = args.name;
@@ -37019,7 +37087,7 @@ agent ${agentId}:
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
           if (!credential) {
@@ -37106,7 +37174,7 @@ agent ${agentId}:
           const { createRuntime } = await import("@cleocode/runtime");
           const { existsSync: existsSync21, readFileSync: readFileSync22 } = await import("node:fs");
           const { join: join38 } = await import("node:path");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
           if (!credential) {
@@ -37224,7 +37292,7 @@ agent ${agentId}:
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
           if (!credential) {
@@ -37280,7 +37348,7 @@ agent ${agentId}:
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           if (args.agentId) {
             const credential = await registry.get(args.agentId);
@@ -37355,7 +37423,7 @@ agent ${agentId}:
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const active = await registry.getActive();
           if (!active) {
@@ -37411,7 +37479,7 @@ Assigned task ${args.taskId}. Run: cleo show ${args.taskId} && cleo start ${args
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const active = await registry.getActive();
           if (!active) {
@@ -37476,7 +37544,7 @@ You are idle. Check your queue: cleo current || cleo next. Report status immedia
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const role = args.role;
           const taskId = args.task;
@@ -37540,7 +37608,7 @@ You are idle. Check your queue: cleo current || cleo next. Report status immedia
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const active = await registry.getActive();
           if (!active) {
@@ -37583,7 +37651,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run() {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const agents = await registry.list({ active: true });
           let stopped = 0;
@@ -37652,7 +37720,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const { createRuntime } = await import("@cleocode/runtime");
           const { existsSync: existsSync21 } = await import("node:fs");
           const { join: join38 } = await import("node:path");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
           if (!credential) {
@@ -37754,27 +37822,24 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { listAgentsForProject } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const includeGlobal = args.global === true;
           const includeDisabled = args["include-disabled"] === true;
-          const agents = listAgentsForProject(getProjectRoot24(), {
+          const agents = await listAgentsForProject(getProjectRoot24(), {
             includeGlobal,
             includeDisabled
           });
           const filtered = !includeGlobal && args.active ? agents.filter((a) => a.isActive) : agents;
           cliOutput(
-            {
-              success: true,
-              data: filtered.map((a) => ({
-                agentId: a.agentId,
-                name: a.displayName,
-                classification: a.classification ?? null,
-                transportType: a.transportType,
-                isActive: a.isActive,
-                lastUsedAt: a.lastUsedAt ?? null,
-                attachment: a.projectRef ? a.projectRef.enabled === 1 ? "[attached]" : "[disabled]" : "[global]"
-              }))
-            },
+            filtered.map((a) => ({
+              agentId: a.agentId,
+              name: a.displayName,
+              classification: a.classification ?? null,
+              transportType: a.transportType,
+              isActive: a.isActive,
+              lastUsedAt: a.lastUsedAt ?? null,
+              attachment: a.projectRef ? a.projectRef.enabled === 1 ? "[attached]" : "[disabled]" : "[global]"
+            })),
             { command: "agent list" }
           );
         } catch (err) {
@@ -37805,9 +37870,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { lookupAgent } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const includeGlobal = args.global === true;
-          const agent = lookupAgent(getProjectRoot24(), args.agentId, { includeGlobal });
+          const agent = await lookupAgent(getProjectRoot24(), args.agentId, { includeGlobal });
           if (!agent) {
             cliOutput(
               {
@@ -37871,11 +37936,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, attachAgentToProject, lookupAgent } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const projectRoot = getProjectRoot24();
           const _registry = new AgentRegistryAccessor(projectRoot);
           void _registry;
-          const globalAgent = lookupAgent(projectRoot, args.agentId, { includeGlobal: true });
+          const globalAgent = await lookupAgent(projectRoot, args.agentId, { includeGlobal: true });
           if (!globalAgent) {
             cliOutput(
               {
@@ -37926,7 +37991,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, detachAgentFromProject, getProjectAgentRef } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const projectRoot = getProjectRoot24();
           const _registry = new AgentRegistryAccessor(projectRoot);
           void _registry;
@@ -37982,7 +38047,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, detachAgentFromProject, getProjectAgentRef } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const projectRoot = getProjectRoot24();
           if (!args.global) {
             const _registry = new AgentRegistryAccessor(projectRoot);
@@ -38063,7 +38128,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const result = await registry.rotateKey(args.agentId);
           cliOutput(
@@ -38101,7 +38166,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
           if (!credential) {
@@ -38175,7 +38240,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const groupIds = args.group ? args.group.split(",").map((s) => s.trim()) : void 0;
           const handle = await createRuntime(registry, {
@@ -38257,7 +38322,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const agentId = args.agent;
           const conduit = await createConduit(registry, agentId);
@@ -38308,7 +38373,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
-          await openCleoDb("tasks");
+          await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const agentId = args.agent;
           const to = args.to;
@@ -38497,9 +38562,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const { cantPath, tempDir: resolvedTempDir } = resolved;
           tempDir = resolvedTempDir;
           const { installAgentFromCant: installAgentFromCant2, attachAgentToProject } = await import("@cleocode/core/agents");
-          const { openCleoDb: openCleoDb3 } = await import("@cleocode/core/store/open-cleo-db");
-          const { db: _sdDb } = await openCleoDb3("signaldock");
-          const db = _sdDb;
+          const { ensureGlobalAgentRegistryDb: ensureGlobalAgentRegistryDb2, getGlobalAgentRegistryNativeDb: getGlobalAgentRegistryNativeDb2 } = await import("@cleocode/core/internal");
+          await ensureGlobalAgentRegistryDb2();
+          const db = getGlobalAgentRegistryNativeDb2();
           const isGlobal = args.global === true;
           const targetTier = isGlobal ? "global" : "project";
           const projectRoot = getProjectRoot24();
@@ -38840,7 +38905,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           let registered = false;
           try {
             const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
-            await openCleoDb("tasks");
+            await openCleoDb("project");
             const registry = new AgentRegistryAccessor(getProjectRoot24());
             const existing = await registry.get(name);
             if (!existing) {
@@ -38978,9 +39043,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { buildDoctorReport, reconcileDoctor } = await import("@cleocode/core/agents");
-          const { openCleoDb: openCleoDb3 } = await import("@cleocode/core/store/open-cleo-db");
-          const { db: _sdDb2 } = await openCleoDb3("signaldock");
-          const db = _sdDb2;
+          const { ensureGlobalAgentRegistryDb: ensureGlobalAgentRegistryDb2, getGlobalAgentRegistryNativeDb: getGlobalAgentRegistryNativeDb2 } = await import("@cleocode/core/internal");
+          await ensureGlobalAgentRegistryDb2();
+          const db = getGlobalAgentRegistryNativeDb2();
           try {
             const report = await buildDoctorReport(db, {});
             const d002 = report.findings.filter((f) => f.code === "D-002");
@@ -39044,9 +39109,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         try {
           const { buildDoctorReport, reconcileDoctor } = await import("@cleocode/core/agents");
-          const { openCleoDb: openCleoDb3 } = await import("@cleocode/core/store/open-cleo-db");
-          const { db: _sdDb3 } = await openCleoDb3("signaldock");
-          const db = _sdDb3;
+          const { ensureGlobalAgentRegistryDb: ensureGlobalAgentRegistryDb2, getGlobalAgentRegistryNativeDb: getGlobalAgentRegistryNativeDb2 } = await import("@cleocode/core/internal");
+          await ensureGlobalAgentRegistryDb2();
+          const db = getGlobalAgentRegistryNativeDb2();
           try {
             const report = await buildDoctorReport(db, { projectRoot: getProjectRoot24() });
             const repairFlag = args.repair === true;
@@ -43587,6 +43652,11 @@ var init_complete = __esm({
         "waive-reason": {
           type: "string",
           description: "Mandatory justification text for --waive-ac. Captured verbatim in the audit row."
+        },
+        // T10538 — cancelled-child waiver gate (PM-Core V2 agent-trust)
+        "waive-cancelled-children": {
+          type: "string",
+          description: "Reason for completing a parent that has cancelled children. Cancelled work does not silently satisfy completion; the reason is audited to .cleo/audit/cancelled-child-waiver.jsonl."
         }
       },
       async run({ args }) {
@@ -43599,7 +43669,9 @@ var init_complete = __esm({
           overrideReason: args["override-reason"],
           // T10509 — AC-coverage gate waiver path
           waiveAc: args["waive-ac"],
-          waiveReason: args["waive-reason"]
+          waiveReason: args["waive-reason"],
+          // T10538 — cancelled-child waiver (PM-Core V2 agent-trust)
+          cancelledChildWaiverReason: args["waive-cancelled-children"]
         });
         if (!response.success) {
           handleRawError(response, { command: "complete", operation: "tasks.complete" });
@@ -50624,8 +50696,12 @@ __export(migrate_agents_v2_exports, {
 import { createHash as createHash2 } from "node:crypto";
 import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
 import { join as join23 } from "node:path";
-import { getProjectRoot as getProjectRoot41, installAgentFromCant } from "@cleocode/core/internal";
-import { openCleoDb as openCleoDb2 } from "@cleocode/core/store/open-cleo-db";
+import {
+  ensureGlobalAgentRegistryDb,
+  getGlobalAgentRegistryNativeDb,
+  getProjectRoot as getProjectRoot41,
+  installAgentFromCant
+} from "@cleocode/core/internal";
 function sha256Hex(bytes) {
   return createHash2("sha256").update(bytes).digest("hex");
 }
@@ -50689,7 +50765,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
       summary.errors++;
       continue;
     }
-    const existingRow = db.prepare("SELECT cant_sha256 FROM agents WHERE agent_id = ?").get(agentName);
+    const existingRow = db.prepare("SELECT cant_sha256 FROM agent_registry_agents WHERE agent_id = ?").get(agentName);
     if (existingRow) {
       const existingSha256 = existingRow.cant_sha256 ?? "";
       if (existingSha256 === newSha256) {
@@ -50756,8 +50832,8 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
 }
 async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const summary = { registered: 0, skipped: 0, conflicts: 0, errors: 0 };
-  const { db: _sdDb } = await openCleoDb2("signaldock");
-  const db = _sdDb;
+  await ensureGlobalAgentRegistryDb();
+  const db = getGlobalAgentRegistryNativeDb();
   try {
     const canonicalDir = join23(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
@@ -52828,10 +52904,40 @@ var init_format_bytes = __esm({
   }
 });
 
+// packages/utils/src/redact.ts
+var ANTHROPIC_KEY_RE, OPENAI_KEY_RE, GENERIC_SK_RE, SLACK_BOT_RE, JWT_RE, BEARER_RE, HEX_SECRET_RE, JSON_PASSWORD_RE, ENV_ASSIGNMENT_RE, SECRET_PATH_RE, SIMPLE_PATTERNS, ALL_PATTERNS;
+var init_redact = __esm({
+  "packages/utils/src/redact.ts"() {
+    "use strict";
+    ANTHROPIC_KEY_RE = /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g;
+    OPENAI_KEY_RE = /\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}\b|\bsk-[A-Za-z0-9]{32,}\b/g;
+    GENERIC_SK_RE = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+    SLACK_BOT_RE = /\bxoxb-[A-Za-z0-9_-]+\b/g;
+    JWT_RE = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
+    BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+    HEX_SECRET_RE = /\b(?:key|token|secret|password|passwd|pwd)=([0-9a-f]{32,})\b/gi;
+    JSON_PASSWORD_RE = /"(?:password|passwd|secret|token|apiKey|api_key|authToken|auth_token)"\s*:\s*"[^"]{4,}"/gi;
+    ENV_ASSIGNMENT_RE = /\b(ANTHROPIC_API_KEY|OPENAI_API_KEY|GITHUB_TOKEN|NPM_TOKEN|AWS_(?:SECRET_)?ACCESS_KEY(?:_ID)?|GCP_(?:SERVICE_ACCOUNT_)?KEY|AZURE_(?:CLIENT_SECRET|ACCESS_KEY)|DATABASE_URL|REDIS_URL|SECRET(?:_KEY)?|API_(?:KEY|TOKEN|SECRET)|AUTH_(?:TOKEN|SECRET)|PRIVATE_KEY|ACCESS_(?:TOKEN|KEY)|BEARER_TOKEN|JWT_SECRET|ENCRYPTION_KEY|SIGNING_KEY|WEBHOOK_SECRET)(\s*=\s*)['"]?[^\s'"]{8,}['"]?/gi;
+    SECRET_PATH_RE = /(?:(?:~|\/)[^\s'"]*\/)?(?:\.env(?:\.[A-Za-z0-9._-]+)?|id_rsa(?:_[A-Za-z0-9_-]*)?|[A-Za-z0-9_-]+\.(?:pem|key|p8|p12|pfx|jks|keystore))(?=[\s'"$]|$)/gi;
+    SIMPLE_PATTERNS = [
+      ANTHROPIC_KEY_RE,
+      OPENAI_KEY_RE,
+      GENERIC_SK_RE,
+      SLACK_BOT_RE,
+      JWT_RE,
+      BEARER_RE,
+      HEX_SECRET_RE,
+      JSON_PASSWORD_RE
+    ];
+    ALL_PATTERNS = [...SIMPLE_PATTERNS, ENV_ASSIGNMENT_RE, SECRET_PATH_RE];
+  }
+});
+
 // packages/utils/src/index.ts
 var init_src4 = __esm({
   "packages/utils/src/index.ts"() {
     init_format_bytes();
+    init_redact();
   }
 });
 
@@ -75907,6 +76013,9 @@ async function runMainWithLafsEnvelope(cmd, rawArgs, showUsage2) {
       const message = err instanceof Error ? err.message : String(err);
       cliError2(message, 1, { name: "E_CLI_UNCAUGHT" });
       process.exit(1);
+    } finally {
+      const { shutdownCliRuntime } = await import("@cleocode/core/internal");
+      await shutdownCliRuntime();
     }
   });
 }
@@ -75947,7 +76056,7 @@ async function runStartupMaintenance() {
     try {
       const _projectRootForMigration = getProjectRoot58();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
-        const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
+        const migrationResult = await migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {
           _startupLog.error(
             { errors: migrationResult.errors, projectRoot: _projectRootForMigration },