@cleocode/cleo 2026.5.53 → 2026.5.56

package/dist/cli/index.js

@@ -6466,7 +6466,7 @@ var init_registry = __esm({
             type: "string",
             required: false,
             description: "Task type",
-            enum: ["epic", "task", "subtask", "bug"],
+            enum: ["epic", "task", "subtask"],
             cli: { flag: "type", short: "-t" }
           },
           {
@@ -12685,7 +12685,6 @@ import {
   fileRestore,
   findAdrs,
   generateInjection,
-  getAccessor,
   getContextWindow,
   getDashboard,
   getDefaultSnapshotPath,
@@ -12697,6 +12696,7 @@ import {
   getRuntimeDiagnostics,
   getSystemHealth,
   getSystemPaths,
+  getTaskAccessor,
   importSnapshot,
   importTasks,
   importTasksPackage,
@@ -12985,8 +12985,8 @@ var init_admin2 = __esm({
         const projectRoot = getProjectRoot2();
         const taskId = params.taskId;
         try {
-          const { getAccessor: getAccessor4, getLastHandoff, retrieveWithBudget } = await import("@cleocode/core/internal");
-          const accessor = await getAccessor4(projectRoot);
+          const { getTaskAccessor: getTaskAccessor4, getLastHandoff, retrieveWithBudget } = await import("@cleocode/core/internal");
+          const accessor = await getTaskAccessor4(projectRoot);
           const task = await accessor.loadSingleTask(taskId);
           if (!task) {
             return lafsError("E_NOT_FOUND", `Task ${taskId} not found`, "context.pull");
@@ -13103,7 +13103,7 @@ var init_admin2 = __esm({
       dash: async (params) => {
         const projectRoot = getProjectRoot2();
         try {
-          const accessor = await getAccessor(projectRoot);
+          const accessor = await getTaskAccessor(projectRoot);
           const raw = await getDashboard(
             { cwd: projectRoot, blockedTasksLimit: params.blockedTasksLimit },
             accessor
@@ -13313,7 +13313,7 @@ var init_admin2 = __esm({
       roadmap: async (params) => {
         const projectRoot = getProjectRoot2();
         try {
-          const accessor = await getAccessor(projectRoot);
+          const accessor = await getTaskAccessor(projectRoot);
           const data = await getRoadmap(
             {
               includeHistory: params.includeHistory,
@@ -13570,7 +13570,7 @@ var init_admin2 = __esm({
       "inject.generate": async (_params) => {
         const projectRoot = getProjectRoot2();
         try {
-          const accessor = await getAccessor(projectRoot);
+          const accessor = await getTaskAccessor(projectRoot);
           const data = await generateInjection(projectRoot, accessor);
           return lafsSuccess(data, "inject.generate");
         } catch (err) {
@@ -15701,7 +15701,7 @@ var init_docs2 = __esm({
 });
 
 // packages/cleo/src/dispatch/domains/intelligence.ts
-import { getAccessor as getAccessor2, getLogger as getLogger5, getProjectRoot as getProjectRoot5 } from "@cleocode/core";
+import { getLogger as getLogger5, getProjectRoot as getProjectRoot5, getTaskAccessor as getTaskAccessor2 } from "@cleocode/core";
 import {
   calculateTaskRisk,
   extractPatternsFromHistory,
@@ -15741,7 +15741,7 @@ var init_intelligence2 = __esm({
                 );
               }
               const [accessor, brain] = await Promise.all([
-                getAccessor2(projectRoot),
+                getTaskAccessor2(projectRoot),
                 getBrainAccessor(projectRoot)
               ]);
               const stage = params?.stage;
@@ -15780,7 +15780,7 @@ var init_intelligence2 = __esm({
                 );
               }
               const [accessor, brain] = await Promise.all([
-                getAccessor2(projectRoot),
+                getTaskAccessor2(projectRoot),
                 getBrainAccessor(projectRoot)
               ]);
               const result = await suggestGateFocus(taskId, accessor, brain);
@@ -15797,7 +15797,7 @@ var init_intelligence2 = __esm({
             // ------------------------------------------------------------------
             case "learn-errors": {
               const [accessor, brain] = await Promise.all([
-                getAccessor2(projectRoot),
+                getTaskAccessor2(projectRoot),
                 getBrainAccessor(projectRoot)
               ]);
               const limit = typeof params?.limit === "number" ? params.limit : void 0;
@@ -15826,7 +15826,7 @@ var init_intelligence2 = __esm({
                 );
               }
               const [accessor, brain] = await Promise.all([
-                getAccessor2(projectRoot),
+                getTaskAccessor2(projectRoot),
                 getBrainAccessor(projectRoot)
               ]);
               const task = await accessor.loadSingleTask(taskId);
@@ -15876,7 +15876,7 @@ var init_intelligence2 = __esm({
                 );
               }
               const [accessor, brain] = await Promise.all([
-                getAccessor2(projectRoot),
+                getTaskAccessor2(projectRoot),
                 getBrainAccessor(projectRoot)
               ]);
               const result = await matchPatterns(taskId, accessor, brain);
@@ -24010,16 +24010,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync16, readdirSync: readdirSync4, existsSync: existsSync14 } = await import("node:fs");
-    const { join: join24 } = await import("node:path");
+    const { readFileSync: readFileSync16, readdirSync: readdirSync4, existsSync: existsSync13 } = await import("node:fs");
+    const { join: join23 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync14(workflowsDir)) {
+    if (existsSync13(workflowsDir)) {
       const files = readdirSync4(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync16(join24(workflowsDir, file), "utf-8");
+          const src = readFileSync16(join23(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -24034,12 +24034,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join24(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync14(localCantDir)) {
+    const localCantDir = join23(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync13(localCantDir)) {
       const files = readdirSync4(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync16(join24(localCantDir, file), "utf-8");
+          const src = readFileSync16(join23(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -24181,8 +24181,8 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
       return !closureA.has(b) && !closureB.has(a);
     };
     var transitiveClose = transitiveClose2, parallelSafe = parallelSafe2;
-    const { getAccessor: getAccessor4 } = await import("@cleocode/core/internal");
-    const accessor = await getAccessor4(projectRoot);
+    const { getTaskAccessor: getTaskAccessor4 } = await import("@cleocode/core/internal");
+    const accessor = await getTaskAccessor4(projectRoot);
     const result = await accessor.queryTasks({});
     const allTasks = result?.tasks ?? [];
     const depMap = /* @__PURE__ */ new Map();
@@ -27025,8 +27025,8 @@ var init_tasks3 = __esm({
             offset: params.offset,
             fields: params.fields,
             verbose: params.verbose,
-            // T944: role filter
-            role: params.role
+            // T944/T9072: kind filter
+            kind: params.kind
           }),
           "find"
         );
@@ -27158,8 +27158,8 @@ var init_tasks3 = __esm({
             files: params.files,
             dryRun: params.dryRun,
             parentSearch: params.parentSearch,
-            // T944: orthogonal axes — role is the canonical wire field (ADR-057 D2)
-            role: params.role,
+            // T944/T9072: orthogonal axes — kind is the canonical wire field
+            kind: params.kind,
             scope: params.scope,
             severity: params.severity,
             // T1633: BRAIN duplicate-bypass flag
@@ -27191,7 +27191,14 @@ var init_tasks3 = __esm({
             // T1014: wire --files through dispatch to engine (parity with add).
             files: params.files,
             // T834 / ADR-051 Decision 4: wire --pipelineStage end-to-end.
-            pipelineStage: params.pipelineStage
+            pipelineStage: params.pipelineStage,
+            // T944/T9072: kind axis (renamed from role)
+            kind: params.kind,
+            scope: params.scope,
+            // T9073: severity — orthogonal to priority, valid for any kind
+            severity: params.severity,
+            // T1590: AC-immutability override reason
+            reason: params.reason
           }),
           "update"
         );
@@ -29221,7 +29228,11 @@ var add_exports = {};
 __export(add_exports, {
   addCommand: () => addCommand
 });
-import { getProjectRoot as getProjectRoot18, inferTaskAddParams } from "@cleocode/core";
+import {
+  appendSignedSeverityAttestation,
+  getProjectRoot as getProjectRoot18,
+  inferTaskAddParams
+} from "@cleocode/core";
 var addCommand;
 var init_add = __esm({
   "packages/cleo/src/cli/commands/add.ts"() {
@@ -29253,7 +29264,7 @@ var init_add = __esm({
         type: {
           type: "string",
           alias: "t",
-          description: "Task type (epic | task | subtask | bug)"
+          description: "Task type (epic | task | subtask)"
         },
         parent: {
           type: "string",
@@ -29328,21 +29339,14 @@ var init_add = __esm({
           description: "Show what would be created without making changes"
         },
         /**
-         * Task role axis — intent of work.
+         * Task kind axis — intent of work.
          * Values: work | research | experiment | bug | spike | release
          * @task T944
-         */
-        role: {
-          type: "string",
-          description: "Task role / intent axis (work|research|experiment|bug|spike|release) \u2014 orthogonal to --type (T944)"
-        },
-        /**
-         * Backward-compatible alias for --role (fractal-ontology spec used "kind").
-         * @task T944
+         * @task T9072
          */
         kind: {
           type: "string",
-          description: "Alias for --role (T944 fractal-ontology compat)"
+          description: "Task kind / intent axis (work|research|experiment|bug|spike|release) \u2014 orthogonal to --type (T944)"
         },
         /**
          * Task scope axis — granularity of work.
@@ -29354,13 +29358,16 @@ var init_add = __esm({
           description: "Task scope / granularity axis (project|feature|unit) \u2014 orthogonal to --type (T944)"
         },
         /**
-         * Bug severity. Only valid when --role bug.
+         * Severity level for any task kind (not just bug).
          * Values: P0 | P1 | P2 | P3
+         * Orthogonal to --priority — does NOT auto-map priority.
+         * Appends a signed attestation to .cleo/audit/severity-attestation.jsonl (T9071/T9073).
          * @task T944
+         * @task T9073
          */
         severity: {
           type: "string",
-          description: "Bug severity (P0|P1|P2|P3) \u2014 only valid with --role bug (T944)"
+          description: "Severity level (P0|P1|P2|P3) \u2014 valid for any --kind (T9073). Orthogonal to priority. Appends signed attestation."
         },
         /**
          * Bypass the E_DUPLICATE_TASK_LIKELY rejection guard.
@@ -29418,9 +29425,7 @@ var init_add = __esm({
           params["position"] = Number.parseInt(args.position, 10);
         if (args["dry-run"] !== void 0) params["dryRun"] = args["dry-run"];
         if (args["parent-search"] !== void 0) params["parentSearch"] = args["parent-search"];
-        if (args.role !== void 0) params["role"] = args.role;
-        if (args.kind !== void 0)
-          params["role"] = params["role"] ?? args.kind;
+        if (args.kind !== void 0) params["kind"] = args.kind;
         if (args.scope !== void 0) params["scope"] = args.scope;
         if (args.severity !== void 0) params["severity"] = args.severity;
         if (args["force-duplicate"] !== void 0) params["forceDuplicate"] = args["force-duplicate"];
@@ -29458,6 +29463,23 @@ var init_add = __esm({
           params["parent"] = inferred.inferredParent;
           humanInfo(`[cleo add] inferred --parent from current task: ${inferred.inferredParent}`);
         }
+        if (args.severity !== void 0 && !args["dry-run"]) {
+          try {
+            await appendSignedSeverityAttestation({
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              title: args.title,
+              severity: args.severity,
+              ...params["parent"] !== void 0 ? { epic: params["parent"] } : {}
+            });
+          } catch (err) {
+            const code = err.code;
+            if (code === "E_OWNER_ONLY") {
+              cliError(err.message, 72, { name: "E_OWNER_ONLY" });
+              process.exit(72);
+              return;
+            }
+          }
+        }
         const response = await dispatchRaw("mutate", "tasks", "add", params);
         if (!response.success) {
           handleRawError(response, { command: "add", operation: "tasks.add" });
@@ -29978,6 +30000,7 @@ __export(agent_exports, {
   agentCommand: () => agentCommand
 });
 import {
+  applyPerfPragmas,
   checkAgentHealth,
   detectCrashedAgents,
   detectStaleAgents,
@@ -30385,12 +30408,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync14, mkdirSync: mkdirSync6, writeFileSync: writeFileSync5 } = await import("node:fs");
-          const { join: join24 } = await import("node:path");
-          const cantDir = join24(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join24(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync13, mkdirSync: mkdirSync6, writeFileSync: writeFileSync5 } = await import("node:fs");
+          const { join: join23 } = await import("node:path");
+          const cantDir = join23(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join23(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync14(cantPath)) {
+          if (!existsSync13(cantPath)) {
             mkdirSync6(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -30450,7 +30473,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync14(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync13(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -30569,8 +30592,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync14, readFileSync: readFileSync16 } = await import("node:fs");
-          const { join: join24 } = await import("node:path");
+          const { existsSync: existsSync13, readFileSync: readFileSync16 } = await import("node:fs");
+          const { join: join23 } = await import("node:path");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const credential = await registry.get(args.agentId);
@@ -30590,8 +30613,8 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join24(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync14(cantPath)) {
+          const cantPath = args.cant ?? join23(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync13(cantPath)) {
             profile = readFileSync16(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
@@ -31115,8 +31138,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync14 } = await import("node:fs");
-          const { join: join24 } = await import("node:path");
+          const { existsSync: existsSync13 } = await import("node:fs");
+          const { join: join23 } = await import("node:path");
           const { execFile: execFile2 } = await import("node:child_process");
           const { promisify: promisify2 } = await import("node:util");
           const execFileAsync = promisify2(execFile2);
@@ -31136,8 +31159,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join24(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync14(cantPath);
+          const cantPath = join23(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync13(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -31985,11 +32008,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync14, mkdirSync: mkdirSync6, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
-          const { join: join24, basename, resolve: resolve5, extname } = await import("node:path");
-          const { tmpdir } = await import("node:os");
+          const { existsSync: existsSync13, mkdirSync: mkdirSync6, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
+          const { join: join23, basename, resolve: resolve5, extname } = await import("node:path");
+          const { tmpdir: tmpdir2 } = await import("node:os");
           const resolvedPath = resolve5(args.path);
-          if (!existsSync14(resolvedPath)) {
+          if (!existsSync13(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -32010,7 +32033,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             cantPath = resolvedPath;
           } else if (stat2.isFile() && ext === ".cantz") {
             const { execFileSync: execFileSync5 } = await import("node:child_process");
-            tempDir = join24(tmpdir(), `cleo-agent-install-${Date.now()}`);
+            tempDir = join23(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync6(tempDir, { recursive: true });
             try {
               execFileSync5("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
@@ -32032,7 +32055,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               return;
             }
             const topLevel = readdirSync4(tempDir).filter(
-              (entry) => statSync(join24(tempDir, entry)).isDirectory()
+              (entry) => statSync(join23(tempDir, entry)).isDirectory()
             );
             if (topLevel.length !== 1) {
               cliOutput(
@@ -32049,8 +32072,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               return;
             }
             const agentName = topLevel[0];
-            const personaPath = join24(tempDir, agentName, "persona.cant");
-            if (!existsSync14(personaPath)) {
+            const personaPath = join23(tempDir, agentName, "persona.cant");
+            if (!existsSync13(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -32064,12 +32087,12 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               process.exitCode = 6;
               return;
             }
-            cantPath = join24(tempDir, `${agentName}.cant`);
+            cantPath = join23(tempDir, `${agentName}.cant`);
             copyFileSync(personaPath, cantPath);
           } else if (stat2.isDirectory()) {
             const agentName = basename(resolvedPath);
-            const personaPath = join24(resolvedPath, "persona.cant");
-            if (!existsSync14(personaPath)) {
+            const personaPath = join23(resolvedPath, "persona.cant");
+            if (!existsSync13(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -32083,9 +32106,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               process.exitCode = 6;
               return;
             }
-            tempDir = join24(tmpdir(), `cleo-agent-install-${Date.now()}`);
+            tempDir = join23(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync6(tempDir, { recursive: true });
-            cantPath = join24(tempDir, `${agentName}.cant`);
+            cantPath = join23(tempDir, `${agentName}.cant`);
             copyFileSync(personaPath, cantPath);
           } else {
             cliOutput(
@@ -32111,8 +32134,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           ensureGlobalSignaldockDb2();
           const dbPath = getGlobalSignaldockDbPath2();
           const db = new DatabaseSync2(dbPath);
-          db.exec("PRAGMA foreign_keys = ON");
-          db.exec("PRAGMA journal_mode = WAL");
+          applyPerfPragmas(db);
           const isGlobal = args.global === true;
           const targetTier = isGlobal ? "global" : "project";
           const projectRoot = process.cwd();
@@ -32212,11 +32234,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync14, statSync } = await import("node:fs");
-          const { resolve: resolve5, basename, dirname: dirname10 } = await import("node:path");
+          const { existsSync: existsSync13, statSync } = await import("node:fs");
+          const { resolve: resolve5, basename, dirname: dirname9 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
           const resolvedDir = resolve5(args.dir);
-          if (!existsSync14(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          if (!existsSync13(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -32230,9 +32252,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join24 } = await import("node:path");
-          const personaPath = join24(resolvedDir, "persona.cant");
-          if (!existsSync14(personaPath)) {
+          const { join: join23 } = await import("node:path");
+          const personaPath = join23(resolvedDir, "persona.cant");
+          if (!existsSync13(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -32249,7 +32271,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const agentName = basename(resolvedDir);
           const archiveName = `${agentName}.cantz`;
           const archivePath = resolve5(archiveName);
-          const parentDir = dirname10(resolvedDir);
+          const parentDir = dirname9(resolvedDir);
           try {
             execFileSync5("zip", ["-r", archivePath, agentName], {
               cwd: parentDir,
@@ -32279,7 +32301,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join24(dirPath, entry.name));
+                countFiles(join23(dirPath, entry.name));
               }
             }
           };
@@ -32348,8 +32370,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync14, mkdirSync: mkdirSync6, writeFileSync: writeFileSync5 } = await import("node:fs");
-          const { join: join24 } = await import("node:path");
+          const { existsSync: existsSync13, mkdirSync: mkdirSync6, writeFileSync: writeFileSync5 } = await import("node:fs");
+          const { join: join23 } = await import("node:path");
           const { homedir: homedir7 } = await import("node:os");
           const name = args.name;
           const role = args.role;
@@ -32409,13 +32431,13 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           let targetRoot;
           if (isGlobal) {
             const home = homedir7();
-            const xdgData = process.env["XDG_DATA_HOME"] ?? join24(home, ".local", "share");
-            targetRoot = join24(xdgData, "cleo", "cant", "agents");
+            const xdgData = process.env["XDG_DATA_HOME"] ?? join23(home, ".local", "share");
+            targetRoot = join23(xdgData, "cleo", "cant", "agents");
           } else {
-            targetRoot = join24(process.cwd(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
+            targetRoot = join23(process.cwd(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
           }
-          const agentDir = join24(targetRoot, name);
-          if (existsSync14(agentDir)) {
+          const agentDir = join23(targetRoot, name);
+          if (existsSync13(agentDir)) {
             cliOutput(
               {
                 success: false,
@@ -32439,29 +32461,29 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             domain,
             parent
           });
-          writeFileSync5(join24(agentDir, "persona.cant"), personaContent, "utf-8");
+          writeFileSync5(join23(agentDir, "persona.cant"), personaContent, "utf-8");
           const manifest = generateManifest({ name, role, tier, domain });
           writeFileSync5(
-            join24(agentDir, "manifest.json"),
+            join23(agentDir, "manifest.json"),
             `${JSON.stringify(manifest, null, 2)}
 `,
             "utf-8"
           );
           const createdFiles = [
-            join24(agentDir, "persona.cant"),
-            join24(agentDir, "manifest.json")
+            join23(agentDir, "persona.cant"),
+            join23(agentDir, "manifest.json")
           ];
           if (team) {
             const teamConfigContent = generateTeamConfig(name, role, team);
-            writeFileSync5(join24(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
-            createdFiles.push(join24(agentDir, "team-config.cant"));
+            writeFileSync5(join23(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
+            createdFiles.push(join23(agentDir, "team-config.cant"));
           }
           if (seedBrain) {
-            const expertiseDir = join24(agentDir, "expertise");
+            const expertiseDir = join23(agentDir, "expertise");
             mkdirSync6(expertiseDir, { recursive: true });
             const seedContent = generateMentalModelSeed(name, role, domain);
-            writeFileSync5(join24(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
-            createdFiles.push(join24(expertiseDir, "mental-model-seed.md"));
+            writeFileSync5(join23(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
+            createdFiles.push(join23(expertiseDir, "mental-model-seed.md"));
             try {
               const { execFile: execFile2 } = await import("node:child_process");
               const { promisify: promisify2 } = await import("node:util");
@@ -32559,10 +32581,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync14, readFileSync: readFileSync16, mkdirSync: mkdirSync6 } = await import("node:fs");
-          const { resolve: resolve5, join: join24 } = await import("node:path");
+          const { existsSync: existsSync13, readFileSync: readFileSync16, mkdirSync: mkdirSync6 } = await import("node:fs");
+          const { resolve: resolve5, join: join23 } = await import("node:path");
           const specPath = resolve5(args.spec);
-          if (!existsSync14(specPath)) {
+          if (!existsSync13(specPath)) {
             if (args.json) {
               const errEnv = {
                 success: false,
@@ -32578,7 +32600,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const specContent = readFileSync16(specPath, "utf-8");
           const projectRoot = process.cwd();
-          const outputDir = args["output-dir"] ? resolve5(args["output-dir"]) : join24(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve5(args["output-dir"]) : join23(projectRoot, ".cleo", "cant", "agents");
           mkdirSync6(outputDir, { recursive: true });
           if (args["dry-run"]) {
             const preview = {
@@ -32669,7 +32691,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           );
           await ensureGlobalSignaldockDb2();
           const db = new DatabaseSync2(getGlobalSignaldockDbPath2());
-          db.exec("PRAGMA foreign_keys = ON");
+          applyPerfPragmas(db);
           try {
             const report = await buildDoctorReport(db, {});
             const d002 = report.findings.filter((f) => f.code === "D-002");
@@ -32746,7 +32768,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           await ensureGlobalSignaldockDb2();
           const dbPath = getGlobalSignaldockDbPath2();
           const db = new DatabaseSync2(dbPath);
-          db.exec("PRAGMA foreign_keys = ON");
+          applyPerfPragmas(db);
           try {
             const report = await buildDoctorReport(db, { projectRoot: process.cwd() });
             const repairFlag = args.repair === true;
@@ -34389,57 +34411,7 @@ var bug_exports = {};
 __export(bug_exports, {
   bugCommand: () => bugCommand
 });
-import { existsSync as existsSync6 } from "node:fs";
-import { appendFile, mkdir, readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname4, join as join7 } from "node:path";
-import { getCleoDirAbsolute as getCleoDirAbsolute2, getCleoIdentity, getConfigPath, signAuditLine } from "@cleocode/core";
-async function loadOwnerPubkeys() {
-  const configPath = getConfigPath();
-  if (!existsSync6(configPath)) {
-    return [];
-  }
-  try {
-    const raw = await readFile2(configPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null) {
-      return [];
-    }
-    const list = parsed.ownerPubkeys;
-    if (!Array.isArray(list)) {
-      return [];
-    }
-    return list.filter((v) => typeof v === "string" && v.length === 64);
-  } catch {
-    return [];
-  }
-}
-function canonicalAttestationJson(record) {
-  const sortedKeys = Object.keys(record).sort();
-  const ordered = {};
-  for (const key of sortedKeys) {
-    ordered[key] = record[key];
-  }
-  return JSON.stringify(ordered);
-}
-async function appendSignedBugSeverity(record) {
-  const id = await getCleoIdentity();
-  const owners = await loadOwnerPubkeys();
-  if (owners.length > 0 && !owners.includes(id.pubkeyHex)) {
-    const err = new Error(
-      `E_OWNER_ONLY: severity attestation requires an owner-allowlisted identity (pub=${id.pubkeyHex.slice(0, 8)}\u2026). Add your public key to .cleo/config.json "ownerPubkeys" array to authorise.`
-    );
-    err.code = "E_OWNER_ONLY";
-    throw err;
-  }
-  const full = { ...record, signerPub: id.pubkeyHex };
-  const canonical = canonicalAttestationJson(full);
-  const sig = await signAuditLine(id, canonical);
-  const line = `${JSON.stringify({ ...full, _sig: sig })}
-`;
-  const auditPath = join7(getCleoDirAbsolute2(), "audit", "bug-severity.jsonl");
-  await mkdir(dirname4(auditPath), { recursive: true });
-  await appendFile(auditPath, line, { encoding: "utf-8" });
-}
+import { appendSignedSeverityAttestation as appendSignedSeverityAttestation2 } from "@cleocode/core";
 var SEVERITY_MAP, VALID_SEVERITIES, bugCommand;
 var init_bug = __esm({
   "packages/cleo/src/cli/commands/bug.ts"() {
@@ -34514,7 +34486,7 @@ var init_bug = __esm({
         }
         if (!args["dry-run"]) {
           try {
-            await appendSignedBugSeverity({
+            await appendSignedSeverityAttestation2({
               timestamp: (/* @__PURE__ */ new Date()).toISOString(),
               title: args.title,
               severity,
@@ -34540,7 +34512,7 @@ __export(caamp_exports, {
   caampCommand: () => caampCommand
 });
 import { homedir as homedir2 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join7 } from "node:path";
 var dedupeCommand, caampCommand;
 var init_caamp = __esm({
   "packages/cleo/src/cli/commands/caamp.ts"() {
@@ -34577,22 +34549,22 @@ var init_caamp = __esm({
         } else {
           const home = homedir2();
           filePaths = [
-            join8(home, ".agents", "AGENTS.md"),
+            join7(home, ".agents", "AGENTS.md"),
             // project-level AGENTS.md in cwd
-            join8(process.cwd(), "AGENTS.md")
+            join7(process.cwd(), "AGENTS.md")
           ];
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync14 } = await import("node:fs");
-          const { readFile: readFile7 } = await import("node:fs/promises");
+          const { existsSync: existsSync13 } = await import("node:fs");
+          const { readFile: readFile6 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync14(filePath)) {
+            if (!existsSync13(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
-            const content = await readFile7(filePath, "utf-8");
+            const content = await readFile6(filePath, "utf-8");
             const blocks = parseCaampBlocks(content);
             const uniqueContents = new Set(blocks.map((b) => b.content));
             const wouldRemove = blocks.length - uniqueContents.size;
@@ -34722,13 +34694,13 @@ var cant_exports = {};
 __export(cant_exports, {
   cantCommand: () => cantCommand
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, isAbsolute, join as join9, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname4, isAbsolute, join as join8, resolve as resolve3 } from "node:path";
 function resolveFilePath(file) {
   return isAbsolute(file) ? file : resolve3(process.cwd(), file);
 }
 function ensureExists(filePath, operation) {
-  if (existsSync7(filePath)) return true;
+  if (existsSync6(filePath)) return true;
   cliError(`File not found: ${filePath}`, "E_FILE_READ");
   process.exitCode = 3;
   if (process.env["CLEO_DEBUG"]) humanWarn(`(operation: ${operation})`);
@@ -34888,8 +34860,8 @@ var init_cant = __esm({
             const projectRoot = process.cwd();
             let written = 0;
             for (const outputFile of result.outputFiles) {
-              const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join9(projectRoot, outputFile.path);
-              mkdirSync2(dirname5(outputPath), { recursive: true });
+              const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join8(projectRoot, outputFile.path);
+              mkdirSync2(dirname4(outputPath), { recursive: true });
               writeFileSync2(outputPath, outputFile.content, "utf-8");
               written++;
             }
@@ -35562,9 +35534,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join24 } = await import("node:path");
+            const { join: join23 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join24(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join23(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -35655,9 +35627,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join24 } = await import("node:path");
+            const { join: join23 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join24(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join23(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -36799,9 +36771,9 @@ var daemon_exports = {};
 __export(daemon_exports, {
   daemonCommand: () => daemonCommand
 });
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { getGCDaemonStatus, spawnGCDaemon, stopGCDaemon } from "@cleocode/core/gc/daemon.js";
 import {
@@ -36866,9 +36838,9 @@ async function showDaemonStatus(cleoDir, projectRoot) {
 }
 function resolveDaemonInstallerScript() {
   const filePath = fileURLToPath3(import.meta.url);
-  const candidate1 = join10(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
-  if (existsSync8(candidate1)) return candidate1;
-  const candidate2 = join10(
+  const candidate1 = join9(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
+  if (existsSync7(candidate1)) return candidate1;
+  const candidate2 = join9(
     filePath,
     "..",
     "..",
@@ -36903,7 +36875,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join10(homedir3(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join9(homedir3(), ".cleo");
         const foreground = args.foreground ?? false;
         if (foreground) {
           const projectRoot = process.cwd();
@@ -36940,13 +36912,13 @@ var init_daemon = __esm({
             {
               pid,
               cleoDir,
-              logs: join10(cleoDir, "logs", "gc.log"),
+              logs: join9(cleoDir, "logs", "gc.log"),
               message: `GC daemon started (PID ${pid})`
             },
             {
               command: "daemon",
               operation: "daemon.start",
-              message: `GC daemon started (PID ${pid}) \u2014 Logs: ${join10(cleoDir, "logs", "gc.log")}`
+              message: `GC daemon started (PID ${pid}) \u2014 Logs: ${join9(cleoDir, "logs", "gc.log")}`
             }
           );
         } catch (err) {
@@ -36976,7 +36948,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join10(homedir3(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join9(homedir3(), ".cleo");
         try {
           const stopResult = await stopGCDaemon(cleoDir);
           cliOutput(stopResult, {
@@ -37014,7 +36986,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join10(homedir3(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join9(homedir3(), ".cleo");
         await showDaemonStatus(cleoDir, process.cwd());
       }
     });
@@ -37112,7 +37084,7 @@ var init_daemon = __esm({
       },
       async run({ args, cmd, rawArgs }) {
         if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
-        const cleoDir = args["cleo-dir"] ?? join10(homedir3(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join9(homedir3(), ".cleo");
         await showDaemonStatus(cleoDir, process.cwd());
       }
     });
@@ -37575,15 +37547,15 @@ var detect_drift_exports = {};
 __export(detect_drift_exports, {
   detectDriftCommand: () => detectDriftCommand
 });
-import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname6, join as join11 } from "node:path";
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync9 } from "node:fs";
+import { dirname as dirname5, join as join10 } from "node:path";
 function findProjectRoot() {
   let currentDir = process.cwd();
   while (currentDir !== "/") {
-    if (existsSync9(join11(currentDir, "package.json"))) {
+    if (existsSync8(join10(currentDir, "package.json"))) {
       return currentDir;
     }
-    const parent = dirname6(currentDir);
+    const parent = dirname5(currentDir);
     if (parent === currentDir) break;
     currentDir = parent;
   }
@@ -37604,8 +37576,8 @@ var init_detect_drift = __esm({
       },
       async run() {
         const projectRoot = findProjectRoot();
-        const isCleoRepo = existsSync9(join11(projectRoot, "packages", "cleo", "src"));
-        const cleoSrcRoot = isCleoRepo ? join11(projectRoot, "packages", "cleo", "src") : join11(projectRoot, "src");
+        const isCleoRepo = existsSync8(join10(projectRoot, "packages", "cleo", "src"));
+        const cleoSrcRoot = isCleoRepo ? join10(projectRoot, "packages", "cleo", "src") : join10(projectRoot, "src");
         const safeRead = (filePath) => {
           try {
             return readFileSync9(filePath, "utf-8");
@@ -37619,8 +37591,8 @@ var init_detect_drift = __esm({
             checks: [],
             recommendations: []
           };
-          const injPath = join11(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (existsSync9(injPath)) {
+          const injPath = join10(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
+          if (existsSync8(injPath)) {
             const content = safeRead(injPath);
             userResult.checks.push({
               name: "Agent injection",
@@ -37671,10 +37643,10 @@ var init_detect_drift = __esm({
           }
         };
         try {
-          const specPath = join11(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
-          const registryPath = join11(cleoSrcRoot, "dispatch", "registry.ts");
-          const dispatchDomainsDir = join11(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync9(specPath)) {
+          const specPath = join10(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
+          const registryPath = join10(cleoSrcRoot, "dispatch", "registry.ts");
+          const dispatchDomainsDir = join10(cleoSrcRoot, "dispatch", "domains");
+          if (!existsSync8(specPath)) {
             addCheck("Gateway-to-spec sync", "fail", "CLEO-OPERATION-CONSTITUTION.md missing", [
               {
                 severity: "error",
@@ -37684,7 +37656,7 @@ var init_detect_drift = __esm({
                 recommendation: "Create docs/specs/CLEO-OPERATION-CONSTITUTION.md with canonical operation definitions"
               }
             ]);
-          } else if (!existsSync9(registryPath) || !existsSync9(dispatchDomainsDir)) {
+          } else if (!existsSync8(registryPath) || !existsSync8(dispatchDomainsDir)) {
             addCheck("Gateway-to-spec sync", "fail", "Dispatch registry or domains missing", [
               {
                 severity: "error",
@@ -37742,9 +37714,9 @@ var init_detect_drift = __esm({
           ]);
         }
         try {
-          const cliDir = join11(cleoSrcRoot, "cli", "commands");
-          const coreDir = isCleoRepo ? join11(projectRoot, "packages", "core", "src") : join11(projectRoot, "src", "core");
-          if (!existsSync9(cliDir)) {
+          const cliDir = join10(cleoSrcRoot, "cli", "commands");
+          const coreDir = isCleoRepo ? join10(projectRoot, "packages", "core", "src") : join10(projectRoot, "src", "core");
+          if (!existsSync8(cliDir)) {
             addCheck("CLI-to-core sync", "fail", "CLI commands directory missing", [
               {
                 severity: "error",
@@ -37753,7 +37725,7 @@ var init_detect_drift = __esm({
                 recommendation: "Verify TypeScript source structure is intact"
               }
             ]);
-          } else if (!existsSync9(coreDir)) {
+          } else if (!existsSync8(coreDir)) {
             addCheck("CLI-to-core sync", "fail", "Core directory missing", [
               {
                 severity: "error",
@@ -37770,8 +37742,8 @@ var init_detect_drift = __esm({
           addCheck("CLI-to-core sync", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const domainsDir = join11(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync9(domainsDir)) {
+          const domainsDir = join10(cleoSrcRoot, "dispatch", "domains");
+          if (!existsSync8(domainsDir)) {
             addCheck("Domain handler coverage", "fail", "Dispatch domains directory missing", [
               {
                 severity: "error",
@@ -37788,8 +37760,8 @@ var init_detect_drift = __esm({
           addCheck("Domain handler coverage", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const matrixPath = join11(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
-          if (!existsSync9(matrixPath)) {
+          const matrixPath = join10(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
+          if (!existsSync8(matrixPath)) {
             addCheck("Capability matrix", "fail", "Capability matrix missing", [
               {
                 severity: "error",
@@ -37805,8 +37777,8 @@ var init_detect_drift = __esm({
           addCheck("Capability matrix", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const schemaPath = join11(projectRoot, "src", "store", "schema.ts");
-          if (!existsSync9(schemaPath)) {
+          const schemaPath = join10(projectRoot, "src", "store", "schema.ts");
+          if (!existsSync8(schemaPath)) {
             addCheck("Schema validation", "fail", "Schema definition missing", [
               {
                 severity: "error",
@@ -37840,10 +37812,10 @@ var init_detect_drift = __esm({
           addCheck("Schema validation", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const visionPath = join11(projectRoot, "docs", "concepts", "CLEO-VISION.md");
-          const specPath = join11(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
+          const visionPath = join10(projectRoot, "docs", "concepts", "CLEO-VISION.md");
+          const specPath = join10(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
           const issues = [];
-          if (!existsSync9(visionPath)) {
+          if (!existsSync8(visionPath)) {
             issues.push({
               severity: "error",
               category: "vision",
@@ -37852,7 +37824,7 @@ var init_detect_drift = __esm({
               recommendation: "Create docs/concepts/CLEO-VISION.md with project vision"
             });
           }
-          if (!existsSync9(specPath)) {
+          if (!existsSync8(specPath)) {
             issues.push({
               severity: "error",
               category: "spec",
@@ -37896,8 +37868,8 @@ var init_detect_drift = __esm({
           addCheck("Canonical identity", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const injectionPath = join11(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (!existsSync9(injectionPath)) {
+          const injectionPath = join10(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
+          if (!existsSync8(injectionPath)) {
             addCheck("Agent injection", "fail", "Agent injection template missing", [
               {
                 severity: "error",
@@ -37926,8 +37898,8 @@ var init_detect_drift = __esm({
           addCheck("Agent injection", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const exitCodesPath = join11(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
-          if (!existsSync9(exitCodesPath)) {
+          const exitCodesPath = join10(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
+          if (!existsSync8(exitCodesPath)) {
             addCheck("Exit codes", "fail", "Exit codes definition missing", [
               {
                 severity: "error",
@@ -38100,8 +38072,8 @@ var docs_exports = {};
 __export(docs_exports, {
   docsCommand: () => docsCommand
 });
-import { mkdir as mkdir2, readdir, readFile as readFile3, writeFile } from "node:fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute2, join as join12, resolve as resolve4 } from "node:path";
+import { mkdir, readdir, readFile as readFile2, writeFile } from "node:fs/promises";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join11, resolve as resolve4 } from "node:path";
 import {
   buildDocsGraph,
   CleoError as CleoError3,
@@ -38117,7 +38089,7 @@ import {
   searchDocs
 } from "@cleocode/core/internal";
 async function getScriptNames(projectRoot) {
-  const scriptsDir = join12(projectRoot, "scripts");
+  const scriptsDir = join11(projectRoot, "scripts");
   try {
     const files = await readdir(scriptsDir);
     return files.filter((f) => f.endsWith(".sh")).map((f) => f.replace(".sh", "")).sort();
@@ -38126,7 +38098,7 @@ async function getScriptNames(projectRoot) {
   }
 }
 async function getIndexedCommands(projectRoot) {
-  const indexPath = join12(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
+  const indexPath = join11(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
   const index = await readJson(indexPath);
   if (!index) return [];
   return index.commands.map((c) => c.name).sort();
@@ -38159,8 +38131,8 @@ async function runGapCheck(_projectRoot, filterId) {
     const reviewFiles = files.filter((f) => f.endsWith(".md"));
     for (const file of reviewFiles) {
       if (filterId && !file.includes(filterId)) continue;
-      const filePath = join12(reviewDir, file);
-      const content = await readFile3(filePath, "utf-8");
+      const filePath = join11(reviewDir, file);
+      const content = await readFile2(filePath, "utf-8");
       const taskMatch = file.match(/^(T\d+)/);
       const taskId = taskMatch ? taskMatch[1] : "UNKNOWN";
       const gaps = [];
@@ -38415,7 +38387,7 @@ var init_docs3 = __esm({
           let writtenPath;
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
-            await mkdir2(dirname7(outPath), { recursive: true });
+            await mkdir(dirname6(outPath), { recursive: true });
             await writeFile(outPath, result.markdown, "utf8");
             writtenPath = outPath;
           }
@@ -38529,7 +38501,7 @@ var init_docs3 = __esm({
           });
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
-            await mkdir2(dirname7(outPath), { recursive: true });
+            await mkdir(dirname6(outPath), { recursive: true });
             await writeFile(outPath, result.merged, "utf8");
             humanInfo(`Wrote merged content to ${outPath}`);
           }
@@ -38600,7 +38572,7 @@ var init_docs3 = __esm({
           }
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
-            await mkdir2(dirname7(outPath), { recursive: true });
+            await mkdir(dirname6(outPath), { recursive: true });
             await writeFile(outPath, output, "utf8");
             humanInfo(`Wrote graph to ${outPath}`);
           }
@@ -39123,10 +39095,11 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync10 } from "node:fs";
-import { join as join13 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync10 } from "node:fs";
+import { join as join12 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import {
+  applyPerfPragmas as applyPerfPragmas2,
   ensureGlobalSignaldockDb,
   getGlobalSignaldockDbPath,
   getProjectRoot as getProjectRoot23,
@@ -39149,15 +39122,15 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join13(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join13(auditPath, "..");
-  if (!existsSync10(auditDir)) {
+  const auditPath = join12(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join12(auditPath, "..");
+  if (!existsSync9(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync10(scanDir)) return;
+  if (!existsSync9(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -39168,7 +39141,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join13(scanDir, filename);
+    const cantPath = join12(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
@@ -39264,12 +39237,11 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const summary = { registered: 0, skipped: 0, conflicts: 0, errors: 0 };
   await ensureGlobalSignaldockDb();
   const db = new DatabaseSync(getGlobalSignaldockDbPath());
-  db.exec("PRAGMA foreign_keys = ON");
-  db.exec("PRAGMA journal_mode = WAL");
+  applyPerfPragmas2(db);
   try {
-    const canonicalDir = join13(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join12(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join13(projectRoot, ".cleo", "agents");
+    const legacyDir = join12(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -39277,8 +39249,8 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join13(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync10(auditPath)) return [];
+  const auditPath = join12(projectRoot, AUDIT_LOG_RELATIVE);
+  if (!existsSync9(auditPath)) return [];
   let raw;
   try {
     raw = readFileSync10(auditPath, "utf8");
@@ -39480,6 +39452,14 @@ var init_doctor = __esm({
           type: "boolean",
           description: "Scan ~/.local/share/cleo/ for orphaned nexus.db files and print report (T9052)"
         },
+        "audit-worktrees": {
+          type: "boolean",
+          description: "Audit orphaned agent worktree directories and report what cleo gc --worktrees would remove (T9043)"
+        },
+        "audit-temp": {
+          type: "boolean",
+          description: "Audit orphaned CLEO-generated temp directories and report what cleo gc --temp would remove (T9043)"
+        },
         "dry-run": {
           type: "boolean",
           description: "With --quarantine-rogue-cleo-dirs or --scan-stray-nexus-dbs: print what would be done without acting"
@@ -39717,6 +39697,56 @@ Stray nexus.db scan (${isDryRun ? "DRY RUN \u2014 no files touched" : "live"})`)
               );
               humanLine("");
             }
+          } else if (args["audit-worktrees"]) {
+            progress.step(0, "Auditing orphaned agent worktrees");
+            const { auditOrphanWorktrees } = await import("@cleocode/core/internal");
+            const checkResult = auditOrphanWorktrees();
+            progress.complete(`Worktree audit complete \u2014 ${checkResult.status}`);
+            if (args.json) {
+              process.stdout.write(
+                JSON.stringify({ success: true, data: checkResult }, null, 2) + "\n"
+              );
+            } else {
+              humanLine(`
+Worktree orphan audit: ${checkResult.message}`);
+              const orphans = checkResult.details?.["orphans"];
+              if (orphans && orphans.length > 0) {
+                for (const o of orphans) {
+                  humanLine(`  ${o.path}  (${o.ageLabel} old)`);
+                }
+                humanLine("\nRun: cleo gc --worktrees to remove orphaned worktrees.\n");
+                if (process.exitCode === void 0 || process.exitCode === 0) {
+                  process.exitCode = 2;
+                }
+              } else {
+                humanLine("  No orphaned worktrees found.\n");
+              }
+            }
+          } else if (args["audit-temp"]) {
+            progress.step(0, "Auditing orphaned CLEO temp directories");
+            const { auditOrphanTempDirs } = await import("@cleocode/core/internal");
+            const checkResult = await auditOrphanTempDirs();
+            progress.complete(`Temp audit complete \u2014 ${checkResult.status}`);
+            if (args.json) {
+              process.stdout.write(
+                JSON.stringify({ success: true, data: checkResult }, null, 2) + "\n"
+              );
+            } else {
+              humanLine(`
+Temp dir orphan audit: ${checkResult.message}`);
+              const orphans = checkResult.details?.["orphans"];
+              if (orphans && orphans.length > 0) {
+                for (const o of orphans) {
+                  humanLine(`  ${o.path}  (${o.age} old)`);
+                }
+                humanLine("\nRun: cleo gc --temp to remove orphaned temp directories.\n");
+                if (process.exitCode === void 0 || process.exitCode === 0) {
+                  process.exitCode = 2;
+                }
+              } else {
+                humanLine("  No orphaned CLEO temp directories found.\n");
+              }
+            }
           } else {
             progress.step(0, "Checking CLEO directory");
             await dispatchFromCli(
@@ -40016,12 +40046,12 @@ var init_find = __esm({
         fields: { type: "string", description: "Comma-separated additional fields to include" },
         verbose: { type: "boolean", description: "Include all task fields", alias: "v" },
         /**
-         * Filter by task role axis (T944).
+         * Filter by task kind axis (T944/T9072).
          * Values: work | research | experiment | bug | spike | release
          */
-        role: {
+        kind: {
           type: "string",
-          description: "Filter by role axis (work|research|experiment|bug|spike|release) \u2014 T944"
+          description: "Filter by kind axis (work|research|experiment|bug|spike|release) \u2014 T944"
         }
       },
       async run({ args }) {
@@ -40038,7 +40068,7 @@ var init_find = __esm({
         if (offset !== void 0) params["offset"] = offset;
         if (args.fields !== void 0) params["fields"] = args.fields;
         if (args.verbose !== void 0) params["verbose"] = args.verbose;
-        if (args.role !== void 0) params["role"] = args.role;
+        if (args.kind !== void 0) params["kind"] = args.kind;
         const response = await dispatchRaw("query", "tasks", "find", params);
         if (!response.success) {
           handleRawError(response, { command: "find", operation: "tasks.find" });
@@ -40068,8 +40098,9 @@ var gc_exports = {};
 __export(gc_exports, {
   gcCommand: () => gcCommand
 });
-import { homedir as homedir4 } from "node:os";
-import { join as join14 } from "node:path";
+import { homedir as homedir4, tmpdir } from "node:os";
+import { join as join13 } from "node:path";
+import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
 function formatBytes(bytes) {
@@ -40079,7 +40110,7 @@ function formatBytes(bytes) {
   const value = bytes / 1024 ** exp;
   return `${value.toFixed(exp === 0 ? 0 : 1)} ${units[exp] ?? "B"}`;
 }
-var runCommand2, statusCommand6, gcCommand;
+var runCommand2, statusCommand6, worktreesCommand, tempCommand, gcCommand;
 var init_gc = __esm({
   "packages/cleo/src/cli/commands/gc.ts"() {
     "use strict";
@@ -40107,7 +40138,7 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join14(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join13(homedir4(), ".cleo");
         const dryRun = args["dry-run"];
         try {
           const gcResult = await runGC({ cleoDir, dryRun });
@@ -40149,8 +40180,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join14(homedir4(), ".cleo");
-        const statePath = join14(cleoDir, "gc-state.json");
+        const cleoDir = args["cleo-dir"] ?? join13(homedir4(), ".cleo");
+        const statePath = join13(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -40173,6 +40204,121 @@ var init_gc = __esm({
         }
       }
     });
+    worktreesCommand = defineCommand({
+      meta: {
+        name: "worktrees",
+        description: "Prune orphaned agent worktree directories (task IDs no longer active)"
+      },
+      args: {
+        "worktrees-root": {
+          type: "string",
+          description: "Override the worktrees root directory"
+        },
+        "project-hash": {
+          type: "string",
+          description: "Scope pruning to a single project hash"
+        },
+        "preserve-tasks": {
+          type: "string",
+          description: "Comma-separated list of task IDs to preserve (default: none)"
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Report what would be pruned without deleting anything",
+          default: false
+        },
+        json: {
+          type: "boolean",
+          description: "Output result as JSON",
+          default: false
+        }
+      },
+      async run({ args }) {
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join13(homedir4(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join13(xdgData, "cleo", "worktrees");
+        const projectHash = args["project-hash"];
+        const dryRun = args["dry-run"];
+        const preserveRaw = args["preserve-tasks"];
+        const activeTaskIds = new Set(
+          preserveRaw ? preserveRaw.split(",").map((s) => s.trim()).filter(Boolean) : []
+        );
+        try {
+          const result = pruneOrphanWorktrees({
+            worktreesRoot,
+            projectHash,
+            activeTaskIds,
+            dryRun
+          });
+          const dryLabel = dryRun ? " (dry run)" : "";
+          const humanMsg = `GC worktrees${dryLabel} \u2014 ${dryRun ? "Would remove" : "Removed"}: ${result.removed} director${result.removed === 1 ? "y" : "ies"}` + (result.errors.length > 0 ? `, ${result.errors.length} error(s)` : "");
+          cliOutput(result, {
+            command: "gc",
+            operation: "gc.worktrees",
+            message: humanMsg
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(
+            `GC worktrees failed: ${message}`,
+            "E_INTERNAL",
+            { name: "E_INTERNAL" },
+            { operation: "gc.worktrees" }
+          );
+          process.exit(1);
+        }
+      }
+    });
+    tempCommand = defineCommand({
+      meta: {
+        name: "temp",
+        description: "Prune orphaned CLEO-generated temp directories from os.tmpdir()"
+      },
+      args: {
+        "max-age-hours": {
+          type: "string",
+          description: "Maximum age (hours) before a temp dir is eligible for pruning (default: 2)"
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Report what would be pruned without deleting anything",
+          default: false
+        },
+        json: {
+          type: "boolean",
+          description: "Output result as JSON",
+          default: false
+        }
+      },
+      async run({ args }) {
+        const maxAgeHoursRaw = args["max-age-hours"];
+        const maxAgeHours = maxAgeHoursRaw !== void 0 ? Number(maxAgeHoursRaw) : 2;
+        const maxAgeMs = maxAgeHours * 60 * 60 * 1e3;
+        const dryRun = args["dry-run"];
+        try {
+          const result = pruneOrphanTempDirs({
+            maxAgeMs,
+            tempDir: tmpdir(),
+            dryRun
+          });
+          const dryLabel = dryRun ? " (dry run)" : "";
+          const humanMsg = `GC temp${dryLabel} \u2014 ${dryRun ? "Would remove" : "Removed"}: ${result.removed} director${result.removed === 1 ? "y" : "ies"}, skipped: ${result.skipped}` + (result.errors.length > 0 ? `, ${result.errors.length} error(s)` : "");
+          cliOutput(result, {
+            command: "gc",
+            operation: "gc.temp",
+            message: humanMsg
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(
+            `GC temp failed: ${message}`,
+            "E_INTERNAL",
+            { name: "E_INTERNAL" },
+            { operation: "gc.temp" }
+          );
+          process.exit(1);
+        }
+      }
+    });
     gcCommand = defineCommand({
       meta: {
         name: "gc",
@@ -40180,7 +40326,9 @@ var init_gc = __esm({
       },
       subCommands: {
         run: runCommand2,
-        status: statusCommand6
+        status: statusCommand6,
+        worktrees: worktreesCommand,
+        temp: tempCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -40197,11 +40345,11 @@ __export(generate_changelog_exports, {
   generateChangelogCommand: () => generateChangelogCommand
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname8, join as join15 } from "node:path";
-import { CleoError as CleoError4, formatError as formatError6, getConfigPath as getConfigPath2, getProjectRoot as getProjectRoot25 } from "@cleocode/core";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname7, join as join14 } from "node:path";
+import { CleoError as CleoError4, formatError as formatError6, getConfigPath, getProjectRoot as getProjectRoot25 } from "@cleocode/core";
 function getChangelogSource(cwd) {
-  const configPath = getConfigPath2(cwd);
+  const configPath = getConfigPath(cwd);
   try {
     const config = JSON.parse(readFileSync11(configPath, "utf-8"));
     return config?.release?.changelog?.source ?? "CHANGELOG.md";
@@ -40210,7 +40358,7 @@ function getChangelogSource(cwd) {
   }
 }
 function getEnabledPlatforms(cwd) {
-  const configPath = getConfigPath2(cwd);
+  const configPath = getConfigPath(cwd);
   try {
     const config = JSON.parse(readFileSync11(configPath, "utf-8"));
     const outputs = config?.release?.changelog?.outputs ?? [];
@@ -40363,8 +40511,8 @@ var init_generate_changelog = __esm({
           const targetPlatform = args.platform;
           const dryRun = args["dry-run"] === true;
           const sourceFile = getChangelogSource();
-          const sourcePath = join15(getProjectRoot25(), sourceFile);
-          if (!existsSync11(sourcePath)) {
+          const sourcePath = join14(getProjectRoot25(), sourceFile);
+          if (!existsSync10(sourcePath)) {
             throw new CleoError4(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
           }
           const sourceContent = readFileSync11(sourcePath, "utf-8");
@@ -40376,8 +40524,8 @@ var init_generate_changelog = __esm({
             const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
             const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
             if (!dryRun) {
-              const fullPath = join15(getProjectRoot25(), outputPath);
-              mkdirSync4(dirname8(fullPath), { recursive: true });
+              const fullPath = join14(getProjectRoot25(), outputPath);
+              mkdirSync4(dirname7(fullPath), { recursive: true });
               writeFileSync3(fullPath, content, "utf-8");
             }
             results.push({ platform: targetPlatform, path: outputPath, written: !dryRun });
@@ -40397,8 +40545,8 @@ var init_generate_changelog = __esm({
                 limit
               );
               if (!dryRun) {
-                const fullPath = join15(getProjectRoot25(), platformConfig.path);
-                mkdirSync4(dirname8(fullPath), { recursive: true });
+                const fullPath = join14(getProjectRoot25(), platformConfig.path);
+                mkdirSync4(dirname7(fullPath), { recursive: true });
                 writeFileSync3(fullPath, content, "utf-8");
               }
               results.push({
@@ -40694,18 +40842,18 @@ __export(init_exports, {
   getGitignoreTemplate: () => getGitignoreTemplate,
   initCommand: () => initCommand
 });
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "node:fs";
+import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { CleoError as CleoError5, formatError as formatError7, initProject as initProject2 } from "@cleocode/core";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath4(import.meta.url);
-    const packageRoot = join16(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join16(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join16(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync12(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync12(templatePath)) {
+    const packageRoot = join15(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join15(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join15(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const templatePath = existsSync11(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync11(templatePath)) {
       return readFileSync12(templatePath, "utf-8");
     }
   } catch {
@@ -42012,9 +42160,9 @@ __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readdirSync as readdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join16 } from "node:path";
 import {
   getBrainDb as getBrainDb2,
   getBrainNativeDb as getBrainNativeDb3,
@@ -42054,7 +42202,7 @@ ${body}`).digest("hex").slice(0, 16);
 }
 function loadImportHashes(stateFile) {
   try {
-    if (!existsSync13(stateFile)) return /* @__PURE__ */ new Set();
+    if (!existsSync12(stateFile)) return /* @__PURE__ */ new Set();
     const raw = readFileSync13(stateFile, "utf-8");
     const parsed = JSON.parse(raw);
     return new Set(parsed.hashes);
@@ -42064,7 +42212,7 @@ function loadImportHashes(stateFile) {
 }
 function saveImportHashes(stateFile, hashes) {
   const dir = stateFile.slice(0, stateFile.lastIndexOf("/"));
-  if (!existsSync13(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync12(dir)) mkdirSync5(dir, { recursive: true });
   writeFileSync4(stateFile, JSON.stringify({ hashes: [...hashes] }, null, 2), "utf-8");
 }
 function makeMemorySubcommand(opts) {
@@ -43156,16 +43304,16 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const sourceDir = args.from ?? join17(homedir5(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
+        const sourceDir = args.from ?? join16(homedir5(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
         const isDryRun = !!args["dry-run"];
         const projectRoot = getProjectRoot26();
-        const stateFile = join17(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
-        if (!existsSync13(sourceDir)) {
+        const stateFile = join16(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
+        if (!existsSync12(sourceDir)) {
           cliError(`Source directory not found: ${sourceDir}`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
           process.exit(1);
           return;
         }
-        const files = readdirSync3(sourceDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").map((f) => join17(sourceDir, f));
+        const files = readdirSync3(sourceDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").map((f) => join16(sourceDir, f));
         const importedHashes = isDryRun ? /* @__PURE__ */ new Set() : loadImportHashes(stateFile);
         const stats = { total: files.length, imported: 0, skipped: 0, errors: 0 };
         const importedEntries = [];
@@ -50123,7 +50271,7 @@ __export(restore_exports, {
 });
 import fs3 from "node:fs";
 import path4 from "node:path";
-import { CleoError as CleoError8, getAccessor as getAccessor3 } from "@cleocode/core";
+import { CleoError as CleoError8, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core";
 import { getProjectRoot as getProjectRoot29 } from "@cleocode/core/internal";
 function parseMarkdownValue(raw) {
   const trimmed = raw.trim();
@@ -50422,7 +50570,7 @@ var init_restore = __esm({
           if (!idPattern.test(taskId)) {
             throw new CleoError8(2 /* INVALID_INPUT */, `Invalid task ID: ${taskId}`);
           }
-          const accessor = await getAccessor3();
+          const accessor = await getTaskAccessor3();
           const activeTask = await accessor.loadSingleTask(taskId);
           if (activeTask) {
             if (activeTask.status === "cancelled") {
@@ -50609,8 +50757,8 @@ var revert_exports = {};
 __export(revert_exports, {
   revertCommand: () => revertCommand
 });
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join17 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -50647,7 +50795,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   let raw;
   if (attestationFilePath) {
     try {
-      raw = await readFile4(attestationFilePath, "utf-8");
+      raw = await readFile3(attestationFilePath, "utf-8");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       throw new Error(`Failed to read attestation file "${attestationFilePath}": ${message}`);
@@ -50674,10 +50822,10 @@ async function loadOwnerAttestation(attestationFilePath) {
   }
   return obj;
 }
-async function loadOwnerPubkeys2(projectRoot) {
-  const path5 = join18(projectRoot, OWNER_PUBKEYS_FILE);
+async function loadOwnerPubkeys(projectRoot) {
+  const path5 = join17(projectRoot, OWNER_PUBKEYS_FILE);
   try {
-    const raw = await readFile4(path5, "utf-8");
+    const raw = await readFile3(path5, "utf-8");
     const parsed = JSON.parse(raw);
     if (Array.isArray(parsed)) {
       return new Set(parsed.filter((k) => typeof k === "string"));
@@ -50754,11 +50902,11 @@ var init_revert = __esm({
             jsonMode
           );
         }
-        const allowedPubkeys = await loadOwnerPubkeys2(projectRoot);
+        const allowedPubkeys = await loadOwnerPubkeys(projectRoot);
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join18(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join17(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -50811,7 +50959,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join18(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join17(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -51045,8 +51193,8 @@ __export(self_update_exports, {
   selfUpdateCommand: () => selfUpdateCommand
 });
 import { execFile } from "node:child_process";
-import { readFile as readFile5 } from "node:fs/promises";
-import { join as join19 } from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join18 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -51061,7 +51209,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome();
   try {
-    const content = await readFile5(join19(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile4(join18(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -51114,8 +51262,8 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
     `installed=${(/* @__PURE__ */ new Date()).toISOString()}`
   ];
   await import("node:fs/promises").then(
-    ({ writeFile: writeFile3, mkdir: mkdir4 }) => mkdir4(cleoHome, { recursive: true }).then(
-      () => writeFile3(join19(cleoHome, "VERSION"), `${lines.join("\n")}
+    ({ writeFile: writeFile3, mkdir: mkdir3 }) => mkdir3(cleoHome, { recursive: true }).then(
+      () => writeFile3(join18(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -51526,7 +51674,7 @@ var sentient_exports = {};
 __export(sentient_exports, {
   sentientCommand: () => sentientCommand
 });
-import { join as join20 } from "node:path";
+import { join as join19 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import {
   getSentientDaemonStatus as getSentientDaemonStatus2,
@@ -51592,7 +51740,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join20(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join19(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -51708,7 +51856,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -51777,7 +51925,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -51829,7 +51977,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -51874,7 +52022,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -51894,7 +52042,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -51913,7 +52061,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -51944,7 +52092,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot5(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join19(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -53264,8 +53412,8 @@ var init_snapshot = __esm({
           handleRawError(response, { command: "snapshot", operation: "admin.export" });
           const data = response.data;
           if (data?.outputPath) {
-            const { readFile: readFile7 } = await import("node:fs/promises");
-            const content = await readFile7(data.outputPath, "utf-8");
+            const { readFile: readFile6 } = await import("node:fs/promises");
+            const content = await readFile6(data.outputPath, "utf-8");
             process.stdout.write(content);
             if (!content.endsWith("\n")) process.stdout.write("\n");
           }
@@ -54242,7 +54390,7 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir6 } from "node:os";
-import { join as join21 } from "node:path";
+import { join as join20 } from "node:path";
 import { getProjectRoot as getProjectRoot32 } from "@cleocode/core";
 import {
   parseDurationMs,
@@ -54296,7 +54444,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join21(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join20(homedir6(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -54602,7 +54750,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join21(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join20(homedir6(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -54661,6 +54809,7 @@ var update_exports = {};
 __export(update_exports, {
   updateCommand: () => updateCommand2
 });
+import { appendSignedSeverityAttestation as appendSignedSeverityAttestation3 } from "@cleocode/core";
 var updateCommand2;
 var init_update = __esm({
   "packages/cleo/src/cli/commands/update.ts"() {
@@ -54692,7 +54841,7 @@ var init_update = __esm({
         },
         type: {
           type: "string",
-          description: "New type (task|epic|subtask|bug)",
+          description: "New type (task|epic|subtask)",
           alias: "t"
         },
         size: {
@@ -54772,21 +54921,14 @@ var init_update = __esm({
           description: "Set pipeline stage (forward-only: research|consensus|architecture_decision|specification|decomposition|implementation|validation|testing|release|contribution)"
         },
         /**
-         * Task role axis — intent of work.
+         * Task kind axis — intent of work.
          * Values: work | research | experiment | bug | spike | release
          * @task T944
-         */
-        role: {
-          type: "string",
-          description: "Task role / intent axis (work|research|experiment|bug|spike|release) \u2014 orthogonal to --type (T944)"
-        },
-        /**
-         * Backward-compatible alias for --role (fractal-ontology spec used "kind").
-         * @task T1472
+         * @task T9072
          */
         kind: {
           type: "string",
-          description: "Alias for --role (T944 fractal-ontology compat)"
+          description: "Task kind / intent axis (work|research|experiment|bug|spike|release) \u2014 orthogonal to --type (T944)"
         },
         /**
          * Task scope axis — granularity of work.
@@ -54797,6 +54939,17 @@ var init_update = __esm({
           type: "string",
           description: "Task scope / granularity axis (project|feature|unit) \u2014 orthogonal to --type (T944)"
         },
+        /**
+         * Severity level — valid for any role (not just bug).
+         * Values: P0 | P1 | P2 | P3
+         * Orthogonal to --priority — does NOT auto-map priority.
+         * Appends a signed attestation to .cleo/audit/severity-attestation.jsonl (T9071/T9073).
+         * @task T9073
+         */
+        severity: {
+          type: "string",
+          description: "Severity level (P0|P1|P2|P3) \u2014 valid for any --role (T9073). Orthogonal to priority. Appends signed attestation."
+        },
         /**
          * Operator-supplied justification required to override the
          * acceptance-criteria immutability guard once a task has entered the
@@ -54858,9 +55011,9 @@ var init_update = __esm({
         if (args["parent-id"] !== void 0) params["parent"] = params["parent"] ?? args["parent-id"];
         if (args["no-auto-complete"] === true) params["noAutoComplete"] = true;
         if (args["pipeline-stage"] !== void 0) params["pipelineStage"] = args["pipeline-stage"];
-        if (args.role !== void 0) params["role"] = args.role;
-        if (args.kind !== void 0) params["role"] = params["role"] ?? args.kind;
+        if (args.kind !== void 0) params["kind"] = args.kind;
         if (args.scope !== void 0) params["scope"] = args.scope;
+        if (args.severity !== void 0) params["severity"] = args.severity;
         if (args.reason !== void 0) params["reason"] = args.reason;
         if (args.priority === "critical" && !args.depends && !args["add-depends"] && args["depends-waiver"] === void 0) {
           const showResponse = await dispatchRaw("query", "tasks", "show", {
@@ -54884,6 +55037,23 @@ var init_update = __esm({
           }
         }
         if (args["depends-waiver"] !== void 0) params["dependsWaiver"] = args["depends-waiver"];
+        if (args.severity !== void 0) {
+          try {
+            await appendSignedSeverityAttestation3({
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              title: String(args.taskId),
+              severity: args.severity,
+              taskId: String(args.taskId)
+            });
+          } catch (err) {
+            const code = err.code;
+            if (code === "E_OWNER_ONLY") {
+              cliError(err.message, 72, { name: "E_OWNER_ONLY" });
+              process.exit(72);
+              return;
+            }
+          }
+        }
         await dispatchFromCli("mutate", "tasks", "update", params, { command: "update" });
       }
     });
@@ -55122,16 +55292,16 @@ __export(web_exports, {
   webCommand: () => webCommand
 });
 import { execFileSync as execFileSync4, spawn } from "node:child_process";
-import { mkdir as mkdir3, open, readFile as readFile6, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { mkdir as mkdir2, open, readFile as readFile5, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join21 } from "node:path";
 import { CleoError as CleoError12, formatError as formatError9, getCleoHome as getCleoHome2 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome2();
   return {
-    pidFile: join22(cleoHome, "web-server.pid"),
-    configFile: join22(cleoHome, "web-server.json"),
-    logDir: join22(cleoHome, "logs"),
-    logFile: join22(cleoHome, "logs", "web-server.log")
+    pidFile: join21(cleoHome, "web-server.pid"),
+    configFile: join21(cleoHome, "web-server.json"),
+    logDir: join21(cleoHome, "logs"),
+    logFile: join21(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -55145,7 +55315,7 @@ function isProcessRunning(pid) {
 async function getStatus() {
   const { pidFile, configFile } = getWebPaths();
   try {
-    const pidStr = (await readFile6(pidFile, "utf-8")).trim();
+    const pidStr = (await readFile5(pidFile, "utf-8")).trim();
     const pid = Number.parseInt(pidStr, 10);
     if (Number.isNaN(pid) || !isProcessRunning(pid)) {
       return { running: false, pid: null, port: null, host: null, url: null };
@@ -55153,7 +55323,7 @@ async function getStatus() {
     let port = DEFAULT_PORT;
     let host = DEFAULT_HOST;
     try {
-      const config = JSON.parse(await readFile6(configFile, "utf-8"));
+      const config = JSON.parse(await readFile5(configFile, "utf-8"));
       port = config.port ?? DEFAULT_PORT;
       host = config.host ?? DEFAULT_HOST;
     } catch {
@@ -55170,8 +55340,8 @@ async function startWebServer(port, host) {
     throw new CleoError12(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join22(projectRoot, "packages", "studio", "build");
-  await mkdir3(logDir, { recursive: true });
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join21(projectRoot, "packages", "studio", "build");
+  await mkdir2(logDir, { recursive: true });
   await writeFile2(
     configFile,
     JSON.stringify({
@@ -55180,7 +55350,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join22(studioDir, "index.js");
+  const webIndexPath = join21(studioDir, "index.js");
   try {
     await stat(webIndexPath);
   } catch {
@@ -55452,7 +55622,7 @@ init_dist();
 init_field_context();
 init_format_context();
 import { readFileSync as readFileSync15 } from "node:fs";
-import { dirname as dirname9, join as join23 } from "node:path";
+import { dirname as dirname8, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -56511,7 +56681,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join23(dirname9(fileURLToPath5(import.meta.url)), "../../package.json");
+  const pkgPath = join22(dirname8(fileURLToPath5(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
   return pkg.version;
 }