@cleocode/cleo 2026.5.87 → 2026.5.89

package/dist/cli/index.js

@@ -1538,6 +1538,45 @@ var init_branch_lock = __esm({
   }
 });
 
+// packages/contracts/src/changesets.ts
+import { z as z3 } from "zod";
+var CHANGESET_KINDS, TASK_ID_RE, ChangesetEntrySchema;
+var init_changesets = __esm({
+  "packages/contracts/src/changesets.ts"() {
+    "use strict";
+    CHANGESET_KINDS = [
+      "feat",
+      "fix",
+      "perf",
+      "refactor",
+      "docs",
+      "test",
+      "chore",
+      "breaking"
+    ];
+    TASK_ID_RE = /^(T\d+(-[A-Z][A-Za-z0-9]*)?|E-\d+(-[A-Z][A-Za-z0-9]*)?)$/;
+    ChangesetEntrySchema = z3.object({
+      /** Filename slug (without the `.md` extension). */
+      id: z3.string().min(1, "id must be non-empty").regex(/^[a-z0-9][a-z0-9-]*$/, "id must be kebab-case (lowercase, digits, hyphens)"),
+      /** One or more CLEO task IDs this change is anchored to. */
+      tasks: z3.array(z3.string().regex(TASK_ID_RE, "task ID must match T#### or E-#### format")).min(1, "tasks must contain at least one task ID"),
+      /** Type of change. */
+      kind: z3.enum(CHANGESET_KINDS),
+      /** Single-line user-facing description. */
+      summary: z3.string().min(1, "summary must be non-empty"),
+      /** Linked PR numbers, when known. */
+      prs: z3.array(z3.number().int().positive()).optional(),
+      /** Markdown body — longer-form explanation. */
+      notes: z3.string().optional(),
+      /** Migration note. Required iff `kind === 'breaking'`. */
+      breaking: z3.string().optional()
+    }).refine((entry) => entry.kind !== "breaking" || (entry.breaking?.length ?? 0) > 0, {
+      message: "breaking entries must include a non-empty `breaking` migration note",
+      path: ["breaking"]
+    });
+  }
+});
+
 // packages/contracts/src/credentials.ts
 var init_credentials = __esm({
   "packages/contracts/src/credentials.ts"() {
@@ -1679,58 +1718,58 @@ var init_errors = __esm({
 });
 
 // packages/contracts/src/evidence-record-schema.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var evidenceBaseSchema, implDiffRecordSchema, validateSpecCheckRecordSchema, testOutputRecordSchema, lintReportRecordSchema, commandOutputRecordSchema, evidenceRecordSchema;
 var init_evidence_record_schema = __esm({
   "packages/contracts/src/evidence-record-schema.ts"() {
     "use strict";
-    evidenceBaseSchema = z3.object({
+    evidenceBaseSchema = z4.object({
       /** Identity string of the agent that produced this record. */
-      agentIdentity: z3.string().min(1),
+      agentIdentity: z4.string().min(1),
       /** SHA-256 hex digest (64 chars) of the attached artifact. */
-      attachmentSha256: z3.string().length(64),
+      attachmentSha256: z4.string().length(64),
       /** ISO 8601 timestamp at which the action ran. */
-      ranAt: z3.string().datetime(),
+      ranAt: z4.string().datetime(),
       /** Wall-clock duration of the action in milliseconds. */
-      durationMs: z3.number().nonnegative()
+      durationMs: z4.number().nonnegative()
     });
     implDiffRecordSchema = evidenceBaseSchema.extend({
-      kind: z3.literal("impl-diff"),
-      phase: z3.literal("implement"),
-      filesChanged: z3.array(z3.string().min(1)).min(1),
-      linesAdded: z3.number().int().nonnegative(),
-      linesRemoved: z3.number().int().nonnegative()
+      kind: z4.literal("impl-diff"),
+      phase: z4.literal("implement"),
+      filesChanged: z4.array(z4.string().min(1)).min(1),
+      linesAdded: z4.number().int().nonnegative(),
+      linesRemoved: z4.number().int().nonnegative()
     });
     validateSpecCheckRecordSchema = evidenceBaseSchema.extend({
-      kind: z3.literal("validate-spec-check"),
-      phase: z3.literal("validate"),
-      reqIdsChecked: z3.array(z3.string().min(1)).min(1),
-      passed: z3.boolean(),
-      details: z3.string().min(1)
+      kind: z4.literal("validate-spec-check"),
+      phase: z4.literal("validate"),
+      reqIdsChecked: z4.array(z4.string().min(1)).min(1),
+      passed: z4.boolean(),
+      details: z4.string().min(1)
     });
     testOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z3.literal("test-output"),
-      phase: z3.literal("test"),
-      command: z3.string().min(1),
-      exitCode: z3.number().int(),
-      testsPassed: z3.number().int().nonnegative(),
-      testsFailed: z3.number().int().nonnegative()
+      kind: z4.literal("test-output"),
+      phase: z4.literal("test"),
+      command: z4.string().min(1),
+      exitCode: z4.number().int(),
+      testsPassed: z4.number().int().nonnegative(),
+      testsFailed: z4.number().int().nonnegative()
     });
     lintReportRecordSchema = evidenceBaseSchema.extend({
-      kind: z3.literal("lint-report"),
-      phase: z3.enum(["implement", "test"]),
-      tool: z3.string().min(1),
-      passed: z3.boolean(),
-      warnings: z3.number().int().nonnegative(),
-      errors: z3.number().int().nonnegative()
+      kind: z4.literal("lint-report"),
+      phase: z4.enum(["implement", "test"]),
+      tool: z4.string().min(1),
+      passed: z4.boolean(),
+      warnings: z4.number().int().nonnegative(),
+      errors: z4.number().int().nonnegative()
     });
     commandOutputRecordSchema = evidenceBaseSchema.extend({
-      kind: z3.literal("command-output"),
-      phase: z3.enum(["implement", "validate", "test"]),
-      cmd: z3.string().min(1),
-      exitCode: z3.number().int()
+      kind: z4.literal("command-output"),
+      phase: z4.enum(["implement", "validate", "test"]),
+      cmd: z4.string().min(1),
+      exitCode: z4.number().int()
     });
-    evidenceRecordSchema = z3.discriminatedUnion("kind", [
+    evidenceRecordSchema = z4.discriminatedUnion("kind", [
       implDiffRecordSchema,
       validateSpecCheckRecordSchema,
       testOutputRecordSchema,
@@ -2544,7 +2583,7 @@ var init_peer = __esm({
 });
 
 // packages/contracts/src/release/plan.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var RELEASE_CHANNEL, RELEASE_SCHEME, RELEASE_KIND, RELEASE_STATUS, GATE_STATUS, GATE_NAME, PLATFORM_TUPLE, PUBLISHER, TASK_KIND, IMPACT, RESOLVED_SOURCE, ReleaseChannelSchema, ReleaseSchemeSchema, ReleaseKindSchema, ReleaseStatusSchema, GateStatusSchema, GateNameSchema, PlatformTupleSchema, PublisherSchema, TaskKindSchema, ImpactSchema, ResolvedSourceSchema, Iso8601, NonEmptyString, ReleasePlanTaskSchema, ReleaseGateSchema, ReleasePlatformMatrixEntrySchema, ReleasePreflightSummarySchema, ReleasePlanChangelogSchema, ReleasePlanMetaSchema, ReleasePlanSchema;
 var init_plan = __esm({
   "packages/contracts/src/release/plan.ts"() {
@@ -2587,20 +2626,20 @@ var init_plan = __esm({
     ];
     IMPACT = ["major", "minor", "patch"];
     RESOLVED_SOURCE = ["project-context", "language-default", "legacy-alias"];
-    ReleaseChannelSchema = z4.enum(RELEASE_CHANNEL);
-    ReleaseSchemeSchema = z4.enum(RELEASE_SCHEME);
-    ReleaseKindSchema = z4.enum(RELEASE_KIND);
-    ReleaseStatusSchema = z4.enum(RELEASE_STATUS);
-    GateStatusSchema = z4.enum(GATE_STATUS);
-    GateNameSchema = z4.enum(GATE_NAME);
-    PlatformTupleSchema = z4.enum(PLATFORM_TUPLE);
-    PublisherSchema = z4.enum(PUBLISHER);
-    TaskKindSchema = z4.enum(TASK_KIND);
-    ImpactSchema = z4.enum(IMPACT);
-    ResolvedSourceSchema = z4.enum(RESOLVED_SOURCE);
-    Iso8601 = z4.iso.datetime({ offset: true });
-    NonEmptyString = z4.string().min(1);
-    ReleasePlanTaskSchema = z4.object({
+    ReleaseChannelSchema = z5.enum(RELEASE_CHANNEL);
+    ReleaseSchemeSchema = z5.enum(RELEASE_SCHEME);
+    ReleaseKindSchema = z5.enum(RELEASE_KIND);
+    ReleaseStatusSchema = z5.enum(RELEASE_STATUS);
+    GateStatusSchema = z5.enum(GATE_STATUS);
+    GateNameSchema = z5.enum(GATE_NAME);
+    PlatformTupleSchema = z5.enum(PLATFORM_TUPLE);
+    PublisherSchema = z5.enum(PUBLISHER);
+    TaskKindSchema = z5.enum(TASK_KIND);
+    ImpactSchema = z5.enum(IMPACT);
+    ResolvedSourceSchema = z5.enum(RESOLVED_SOURCE);
+    Iso8601 = z5.iso.datetime({ offset: true });
+    NonEmptyString = z5.string().min(1);
+    ReleasePlanTaskSchema = z5.object({
       /** Task ID (e.g. "T10001"). Format intentionally loose so historical IDs validate. */
       id: NonEmptyString,
       /** Conventional-commit-aligned task classification. */
@@ -2608,20 +2647,20 @@ var init_plan = __esm({
       /** SemVer impact classification. */
       impact: ImpactSchema,
       /** Human-readable changelog line for this task. */
-      userFacingSummary: z4.string(),
+      userFacingSummary: z5.string(),
       /**
        * ADR-051 evidence atoms attesting the task's gate results. Format is
        * `kind:value` (e.g. `commit:abc123`, `test-run:vitest.json`). The contract
        * accepts empty arrays so legacy plans validate; `cleo release plan`
        * enforces non-empty via R-301.
        */
-      evidenceAtoms: z4.array(NonEmptyString),
+      evidenceAtoms: z5.array(NonEmptyString),
       /** IVTR phase at plan time — informational only per R-316. */
-      ivtrPhaseAtPlan: z4.string().optional(),
+      ivtrPhaseAtPlan: z5.string().optional(),
       /** Epic this task rolls up to, locked at plan time per R-303. */
       epicAncestor: NonEmptyString
     });
-    ReleaseGateSchema = z4.object({
+    ReleaseGateSchema = z5.object({
       /** Canonical gate name. */
       name: GateNameSchema,
       /** ADR-051 atom string identifying the resolved tool (e.g. `tool:test`). */
@@ -2631,11 +2670,11 @@ var init_plan = __esm({
       /** ISO-8601 timestamp the gate was last verified. */
       lastVerifiedAt: Iso8601,
       /** Resolved shell command (e.g. `pnpm run test`). Optional for unresolved gates. */
-      resolvedCommand: z4.string().optional(),
+      resolvedCommand: z5.string().optional(),
       /** Provenance of the resolved command. Optional for unresolved gates. */
       resolvedSource: ResolvedSourceSchema.optional()
     });
-    ReleasePlatformMatrixEntrySchema = z4.object({
+    ReleasePlatformMatrixEntrySchema = z5.object({
       /** Target platform tuple. */
       platform: PlatformTupleSchema,
       /** Distribution backend. */
@@ -2643,47 +2682,47 @@ var init_plan = __esm({
       /** Package identifier on the target backend (e.g. `@cleocode/cleo`). */
       package: NonEmptyString,
       /** Whether to run the GHA smoke job for this matrix entry. */
-      smoke: z4.boolean().default(true).optional()
+      smoke: z5.boolean().default(true).optional()
     });
-    ReleasePreflightSummarySchema = z4.object({
+    ReleasePreflightSummarySchema = z5.object({
       /** True if esbuild externals are out of sync with package.json. */
-      esbuildExternalsDrift: z4.boolean(),
+      esbuildExternalsDrift: z5.boolean(),
       /** True if `pnpm-lock.yaml` diverges from the workspace manifest. */
-      lockfileDrift: z4.boolean(),
+      lockfileDrift: z5.boolean(),
       /** True if all epic children are in terminal lifecycle states. */
-      epicCompletenessClean: z4.boolean(),
+      epicCompletenessClean: z5.boolean(),
       /** True if no task appears in multiple in-flight release plans. */
-      doubleListingClean: z4.boolean(),
+      doubleListingClean: z5.boolean(),
       /** Non-fatal preflight warnings (e.g. unresolved tools per R-024). */
-      preflightWarnings: z4.array(z4.string()).default([]).optional()
+      preflightWarnings: z5.array(z5.string()).default([]).optional()
     });
-    ReleasePlanChangelogSchema = z4.object({
+    ReleasePlanChangelogSchema = z5.object({
       /** `kind=feat` tasks. */
-      features: z4.array(NonEmptyString).default([]),
+      features: z5.array(NonEmptyString).default([]),
       /** `kind=fix` or `kind=hotfix` tasks. */
-      fixes: z4.array(NonEmptyString).default([]),
+      fixes: z5.array(NonEmptyString).default([]),
       /** `kind=chore`, `docs`, `refactor`, `test`, `perf` tasks. */
-      chores: z4.array(NonEmptyString).default([]),
+      chores: z5.array(NonEmptyString).default([]),
       /** `kind=breaking` or `kind=revert` tasks. */
-      breaking: z4.array(NonEmptyString).default([])
+      breaking: z5.array(NonEmptyString).default([])
     });
-    ReleasePlanMetaSchema = z4.object({
+    ReleasePlanMetaSchema = z5.object({
       /** True if this is the project's first ever release. */
-      firstEverRelease: z4.boolean().optional(),
+      firstEverRelease: z5.boolean().optional(),
       /** Canonical tool names that could not be resolved at plan time. */
-      unresolvedTools: z4.array(z4.string()).optional(),
+      unresolvedTools: z5.array(z5.string()).optional(),
       /** Project archetype detected at plan time. */
-      archetype: z4.string().optional()
-    }).catchall(z4.unknown());
-    ReleasePlanSchema = z4.object({
+      archetype: z5.string().optional()
+    }).catchall(z5.unknown());
+    ReleasePlanSchema = z5.object({
       /** Schema URL for this plan version. */
-      $schema: z4.string().optional(),
+      $schema: z5.string().optional(),
       /** Requested version string (e.g. "v2026.6.0"). Includes the leading `v`. */
       version: NonEmptyString,
       /** Resolved version string after suffix application (e.g. "v2026.6.0.2"). */
       resolvedVersion: NonEmptyString,
       /** True if a `calver-suffix` was applied to disambiguate a same-day hotfix. */
-      suffixApplied: z4.boolean(),
+      suffixApplied: z5.boolean(),
       /** Versioning scheme governing `version` / `resolvedVersion`. */
       scheme: ReleaseSchemeSchema,
       /** npm dist-tag channel for this release. */
@@ -2700,27 +2739,27 @@ var init_plan = __esm({
        * Version of the previous release on the same channel. MUST be `null` only
        * for first-ever releases (R-300, enforced at the verb layer).
        */
-      previousVersion: z4.string().nullable(),
+      previousVersion: z5.string().nullable(),
       /** Git tag of the previous release (typically `previousVersion` prefixed). */
-      previousTag: z4.string().nullable(),
+      previousTag: z5.string().nullable(),
       /** ISO-8601 timestamp the previous release was published. */
       previousShippedAt: Iso8601.nullable(),
       /** Tasks rolled into this release. */
-      tasks: z4.array(ReleasePlanTaskSchema),
+      tasks: z5.array(ReleasePlanTaskSchema),
       /** Bucketed changelog. */
       changelog: ReleasePlanChangelogSchema,
       /** Per-gate verification status. */
-      gates: z4.array(ReleaseGateSchema),
+      gates: z5.array(ReleaseGateSchema),
       /** Platform / publisher matrix. */
-      platformMatrix: z4.array(ReleasePlatformMatrixEntrySchema),
+      platformMatrix: z5.array(ReleasePlatformMatrixEntrySchema),
       /** Preflight summary from `cleo release plan`. */
       preflightSummary: ReleasePreflightSummarySchema,
       /** URL of the GHA workflow run (populated by `release-prepare.yml`). */
-      workflowRunUrl: z4.string().nullable(),
+      workflowRunUrl: z5.string().nullable(),
       /** URL of the bump PR (populated by `cleo release open`). */
-      prUrl: z4.string().nullable(),
+      prUrl: z5.string().nullable(),
       /** Merge commit SHA on `main` (populated by `release-publish.yml`). */
-      mergeCommitSha: z4.string().nullable(),
+      mergeCommitSha: z5.string().nullable(),
       /** Current FSM state per R-302. */
       status: ReleaseStatusSchema,
       /** Informational / forward-compat metadata. */
@@ -2737,52 +2776,52 @@ var init_session2 = __esm({
 });
 
 // packages/contracts/src/session-journal.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var SESSION_JOURNAL_SCHEMA_VERSION, sessionJournalDoctorSummarySchema, sessionJournalDebriefSummarySchema, sessionJournalEntrySchema;
 var init_session_journal = __esm({
   "packages/contracts/src/session-journal.ts"() {
     "use strict";
     SESSION_JOURNAL_SCHEMA_VERSION = "1.0";
-    sessionJournalDoctorSummarySchema = z5.object({
+    sessionJournalDoctorSummarySchema = z6.object({
       /** `true` when zero noise patterns were detected. */
-      isClean: z5.boolean(),
+      isClean: z6.boolean(),
       /** Total number of noise findings across all patterns. */
-      findingsCount: z5.number().int().nonnegative(),
+      findingsCount: z6.number().int().nonnegative(),
       /** Pattern names that were detected (empty when isClean). */
-      patterns: z5.array(z5.string()),
+      patterns: z6.array(z6.string()),
       /** Total brain entries scanned. `0` = empty or unavailable. */
-      totalScanned: z5.number().int().nonnegative()
+      totalScanned: z6.number().int().nonnegative()
     });
-    sessionJournalDebriefSummarySchema = z5.object({
+    sessionJournalDebriefSummarySchema = z6.object({
       /** First 200 characters of the session end note (if provided). */
-      noteExcerpt: z5.string().max(200).optional(),
+      noteExcerpt: z6.string().max(200).optional(),
       /** Number of tasks completed during the session. */
-      tasksCompletedCount: z5.number().int().nonnegative(),
+      tasksCompletedCount: z6.number().int().nonnegative(),
       /** Up to 5 task IDs (not titles) that were the focus of the session. */
-      tasksFocused: z5.array(z5.string()).max(5).optional()
+      tasksFocused: z6.array(z6.string()).max(5).optional()
     });
-    sessionJournalEntrySchema = z5.object({
+    sessionJournalEntrySchema = z6.object({
       // Identity
       /** Schema version for forward-compatibility. Always `'1.0'` in this release. */
-      schemaVersion: z5.literal(SESSION_JOURNAL_SCHEMA_VERSION),
+      schemaVersion: z6.literal(SESSION_JOURNAL_SCHEMA_VERSION),
       /** ISO 8601 timestamp when the entry was written. */
-      timestamp: z5.string(),
+      timestamp: z6.string(),
       /** CLEO session ID (e.g. `ses_20260424055456_ede571`). */
-      sessionId: z5.string(),
+      sessionId: z6.string(),
       /** Event type that triggered this journal entry. */
-      eventType: z5.enum(["session_start", "session_end", "observation", "decision", "error"]),
+      eventType: z6.enum(["session_start", "session_end", "observation", "decision", "error"]),
       // Session metadata (set on session_start / session_end)
       /** Agent identifier (e.g. `cleo-prime`, `claude-code`). */
-      agentIdentifier: z5.string().optional(),
+      agentIdentifier: z6.string().optional(),
       /** Provider adapter ID active for this session. */
-      providerId: z5.string().optional(),
+      providerId: z6.string().optional(),
       /** Session scope string (e.g. `'global'` or `'epic:T1263'`). */
-      scope: z5.string().optional(),
+      scope: z6.string().optional(),
       // Session-end fields
       /** Duration of the session in seconds (session_end only). */
-      duration: z5.number().int().nonnegative().optional(),
+      duration: z6.number().int().nonnegative().optional(),
       /** Task IDs (not titles) completed during the session. */
-      tasksCompleted: z5.array(z5.string()).optional(),
+      tasksCompleted: z6.array(z6.string()).optional(),
       // Doctor summary (T1262 absorbed)
       /** Compact result of `scanBrainNoise` run at session-end. */
       doctorSummary: sessionJournalDoctorSummarySchema.optional(),
@@ -2791,7 +2830,7 @@ var init_session_journal = __esm({
       debriefSummary: sessionJournalDebriefSummarySchema.optional(),
       // Optional hash chain
       /** SHA-256 hex of the previous entry's raw JSON string (for integrity chain). */
-      prevEntryHash: z5.string().optional()
+      prevEntryHash: z6.string().optional()
     });
   }
 });
@@ -2837,52 +2876,52 @@ var init_task = __esm({
 });
 
 // packages/contracts/src/task-evidence.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var fileEvidenceSchema, logEvidenceSchema, screenshotEvidenceSchema, testOutputEvidenceSchema, commandOutputEvidenceSchema, taskEvidenceSchema;
 var init_task_evidence = __esm({
   "packages/contracts/src/task-evidence.ts"() {
     "use strict";
-    fileEvidenceSchema = z6.object({
-      kind: z6.literal("file"),
-      sha256: z6.string().length(64),
-      timestamp: z6.string().datetime(),
-      path: z6.string().min(1),
-      mime: z6.string().optional(),
-      description: z6.string().optional()
-    });
-    logEvidenceSchema = z6.object({
-      kind: z6.literal("log"),
-      sha256: z6.string().length(64),
-      timestamp: z6.string().datetime(),
-      source: z6.string().min(1),
-      description: z6.string().optional()
-    });
-    screenshotEvidenceSchema = z6.object({
-      kind: z6.literal("screenshot"),
-      sha256: z6.string().length(64),
-      timestamp: z6.string().datetime(),
-      mime: z6.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
-      description: z6.string().optional()
-    });
-    testOutputEvidenceSchema = z6.object({
-      kind: z6.literal("test-output"),
-      sha256: z6.string().length(64),
-      timestamp: z6.string().datetime(),
-      passed: z6.number().int().nonnegative(),
-      failed: z6.number().int().nonnegative(),
-      skipped: z6.number().int().nonnegative(),
-      exitCode: z6.number().int(),
-      description: z6.string().optional()
-    });
-    commandOutputEvidenceSchema = z6.object({
-      kind: z6.literal("command-output"),
-      sha256: z6.string().length(64),
-      timestamp: z6.string().datetime(),
-      cmd: z6.string().min(1),
-      exitCode: z6.number().int(),
-      description: z6.string().optional()
-    });
-    taskEvidenceSchema = z6.discriminatedUnion("kind", [
+    fileEvidenceSchema = z7.object({
+      kind: z7.literal("file"),
+      sha256: z7.string().length(64),
+      timestamp: z7.string().datetime(),
+      path: z7.string().min(1),
+      mime: z7.string().optional(),
+      description: z7.string().optional()
+    });
+    logEvidenceSchema = z7.object({
+      kind: z7.literal("log"),
+      sha256: z7.string().length(64),
+      timestamp: z7.string().datetime(),
+      source: z7.string().min(1),
+      description: z7.string().optional()
+    });
+    screenshotEvidenceSchema = z7.object({
+      kind: z7.literal("screenshot"),
+      sha256: z7.string().length(64),
+      timestamp: z7.string().datetime(),
+      mime: z7.enum(["image/png", "image/jpeg", "image/webp"]).optional(),
+      description: z7.string().optional()
+    });
+    testOutputEvidenceSchema = z7.object({
+      kind: z7.literal("test-output"),
+      sha256: z7.string().length(64),
+      timestamp: z7.string().datetime(),
+      passed: z7.number().int().nonnegative(),
+      failed: z7.number().int().nonnegative(),
+      skipped: z7.number().int().nonnegative(),
+      exitCode: z7.number().int(),
+      description: z7.string().optional()
+    });
+    commandOutputEvidenceSchema = z7.object({
+      kind: z7.literal("command-output"),
+      sha256: z7.string().length(64),
+      timestamp: z7.string().datetime(),
+      cmd: z7.string().min(1),
+      exitCode: z7.number().int(),
+      description: z7.string().optional()
+    });
+    taskEvidenceSchema = z7.discriminatedUnion("kind", [
       fileEvidenceSchema,
       logEvidenceSchema,
       screenshotEvidenceSchema,
@@ -2893,12 +2932,12 @@ var init_task_evidence = __esm({
 });
 
 // packages/contracts/src/tasks/archive.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var ArchiveReason, ARCHIVE_REASON_VALUES;
 var init_archive = __esm({
   "packages/contracts/src/tasks/archive.ts"() {
     "use strict";
-    ArchiveReason = z7.enum([
+    ArchiveReason = z8.enum([
       "verified",
       "reconciled",
       "superseded",
@@ -2916,6 +2955,7 @@ var init_src2 = __esm({
     init_acceptance_gate_schema();
     init_attachment_schema();
     init_branch_lock();
+    init_changesets();
     init_credentials();
     init_engine_result();
     init_errors();
@@ -7284,6 +7324,31 @@ var init_registry = __esm({
           }
         ]
       },
+      // T9742 — skill.migrate: legacy XDG store → ~/.cleo/skills/
+      {
+        gateway: "mutate",
+        domain: "tools",
+        operation: "skill.migrate",
+        description: "tools.skill.migrate (mutate) \u2014 migrate ~/.local/share/agents/skills into ~/.cleo/skills (SSoT); supports --dry-run preview + --rollback restore",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Preview the plan without writing anything"
+          },
+          {
+            name: "rollback",
+            type: "boolean",
+            required: false,
+            description: "Restore the legacy tree from the most recent backup tarball"
+          }
+        ]
+      },
       // T9690 — skill.stats: Sphere B telemetry rollup
       {
         gateway: "query",
@@ -25997,16 +26062,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync19, readdirSync: readdirSync4, existsSync: existsSync18 } = await import("node:fs");
+    const { readFileSync: readFileSync18, readdirSync: readdirSync4, existsSync: existsSync17 } = await import("node:fs");
     const { join: join33 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync18(workflowsDir)) {
+    if (existsSync17(workflowsDir)) {
       const files = readdirSync4(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync19(join33(workflowsDir, file), "utf-8");
+          const src = readFileSync18(join33(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -26022,11 +26087,11 @@ async function orchestrateClassify(request, context, projectRoot) {
       }
     }
     const localCantDir = join33(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync18(localCantDir)) {
+    if (existsSync17(localCantDir)) {
       const files = readdirSync4(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync19(join33(localCantDir, file), "utf-8");
+          const src = readFileSync18(join33(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -29873,6 +29938,7 @@ import {
   toolsSkillImportHermes,
   toolsSkillInstall,
   toolsSkillList,
+  toolsSkillMigrate,
   toolsSkillPrecedenceResolve,
   toolsSkillPrecedenceShow,
   toolsSkillPruneTelemetry,
@@ -29976,6 +30042,7 @@ var init_tools = __esm({
             "skill.uninstall",
             "skill.refresh",
             "skill.import.hermes",
+            "skill.migrate",
             "skill.prune.telemetry",
             // provider
             "provider.inject",
@@ -30261,6 +30328,14 @@ var init_tools = __esm({
             const result = await toolsSkillImportHermes({ hermesHome, dryRun });
             return wrapResult(result, "mutate", "tools", "skill.import.hermes", startTime);
           }
+          // T9742 — skill.migrate: legacy XDG store → ~/.cleo/skills/ (SSoT)
+          case "migrate": {
+            const result = await toolsSkillMigrate({
+              dryRun: params?.dryRun === true,
+              rollback: params?.rollback === true
+            });
+            return wrapResult(result, "mutate", "tools", "skill.migrate", startTime);
+          }
           // T9693 — skill.prune.telemetry: retention sweep on skill_usage
           case "prune.telemetry": {
             const olderThanDays = typeof params?.olderThanDays === "number" ? params.olderThanDays : void 0;
@@ -33188,12 +33263,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync18, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { existsSync: existsSync17, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
           const { join: join33 } = await import("node:path");
           const cantDir = join33(CLEO_DIR_NAME, AGENTS_SUBDIR);
           const cantPath = join33(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync18(cantPath)) {
+          if (!existsSync17(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -33253,7 +33328,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync18(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync17(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -33374,7 +33449,7 @@ agent ${agentId}:
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync18, readFileSync: readFileSync19 } = await import("node:fs");
+          const { existsSync: existsSync17, readFileSync: readFileSync18 } = await import("node:fs");
           const { join: join33 } = await import("node:path");
           await getDb3();
           const registry = new AgentRegistryAccessor(getProjectRoot23());
@@ -33396,8 +33471,8 @@ agent ${agentId}:
           let profile = null;
           let cantValidation = null;
           const cantPath = args.cant ?? join33(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync18(cantPath)) {
-            profile = readFileSync19(cantPath, "utf-8");
+          if (existsSync17(cantPath)) {
+            profile = readFileSync18(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
               const validate = "validate" in cantModule ? cantModule.validate : null;
@@ -33928,7 +34003,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync18 } = await import("node:fs");
+          const { existsSync: existsSync17 } = await import("node:fs");
           const { join: join33 } = await import("node:path");
           const { execFile: execFile2 } = await import("node:child_process");
           const { promisify: promisify2 } = await import("node:util");
@@ -33950,7 +34025,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
           const cantPath = join33(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync18(cantPath);
+          const hasProfile = existsSync17(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -34808,11 +34883,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync18, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
+          const { existsSync: existsSync17, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
           const { join: join33, basename, resolve: resolve9, extname } = await import("node:path");
           const { tmpdir: tmpdir2 } = await import("node:os");
           const resolvedPath = resolve9(args.path);
-          if (!existsSync18(resolvedPath)) {
+          if (!existsSync17(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -34832,11 +34907,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           if (stat3.isFile() && ext === ".cant") {
             cantPath = resolvedPath;
           } else if (stat3.isFile() && ext === ".cantz") {
-            const { execFileSync: execFileSync6 } = await import("node:child_process");
+            const { execFileSync: execFileSync5 } = await import("node:child_process");
             tempDir = join33(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync7(tempDir, { recursive: true });
             try {
-              execFileSync6("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
+              execFileSync5("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
                 encoding: "utf-8",
                 timeout: 3e4
               });
@@ -34873,7 +34948,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             }
             const agentName = topLevel[0];
             const personaPath = join33(tempDir, agentName, "persona.cant");
-            if (!existsSync18(personaPath)) {
+            if (!existsSync17(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -34892,7 +34967,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           } else if (stat3.isDirectory()) {
             const agentName = basename(resolvedPath);
             const personaPath = join33(resolvedPath, "persona.cant");
-            if (!existsSync18(personaPath)) {
+            if (!existsSync17(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -35027,11 +35102,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync18, statSync } = await import("node:fs");
+          const { existsSync: existsSync17, statSync } = await import("node:fs");
           const { resolve: resolve9, basename, dirname: dirname13 } = await import("node:path");
-          const { execFileSync: execFileSync6 } = await import("node:child_process");
+          const { execFileSync: execFileSync5 } = await import("node:child_process");
           const resolvedDir = resolve9(args.dir);
-          if (!existsSync18(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          if (!existsSync17(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -35047,7 +35122,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const { join: join33 } = await import("node:path");
           const personaPath = join33(resolvedDir, "persona.cant");
-          if (!existsSync18(personaPath)) {
+          if (!existsSync17(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -35066,7 +35141,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           const archivePath = resolve9(archiveName);
           const parentDir = dirname13(resolvedDir);
           try {
-            execFileSync6("zip", ["-r", archivePath, agentName], {
+            execFileSync5("zip", ["-r", archivePath, agentName], {
               cwd: parentDir,
               encoding: "utf-8",
               timeout: 3e4
@@ -35163,7 +35238,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync18, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { existsSync: existsSync17, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
           const { join: join33 } = await import("node:path");
           const { homedir: homedir8 } = await import("node:os");
           const name = args.name;
@@ -35230,7 +35305,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             targetRoot = join33(getProjectRoot23(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
           }
           const agentDir = join33(targetRoot, name);
-          if (existsSync18(agentDir)) {
+          if (existsSync17(agentDir)) {
             cliOutput(
               {
                 success: false,
@@ -35375,15 +35450,15 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync18, readFileSync: readFileSync19, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { existsSync: existsSync17, readFileSync: readFileSync18, mkdirSync: mkdirSync7 } = await import("node:fs");
           const { resolve: resolve9, join: join33 } = await import("node:path");
           const specPath = resolve9(args.spec);
-          if (!existsSync18(specPath)) {
+          if (!existsSync17(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
-          const specContent = readFileSync19(specPath, "utf-8");
+          const specContent = readFileSync18(specPath, "utf-8");
           const projectRoot = getProjectRoot23();
           const outputDir = args["output-dir"] ? resolve9(args["output-dir"]) : join33(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
@@ -37911,11 +37986,11 @@ var init_caamp = __esm({
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync18 } = await import("node:fs");
+          const { existsSync: existsSync17 } = await import("node:fs");
           const { readFile: readFile7 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync18(filePath)) {
+            if (!existsSync17(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -38462,10 +38537,10 @@ var init_check2 = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync19 } = await import("node:fs");
+        const { readFileSync: readFileSync18 } = await import("node:fs");
         let chain;
         try {
-          chain = JSON.parse(readFileSync19(args.file, "utf8"));
+          chain = JSON.parse(readFileSync18(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse chain file: ${message}`, 2, {
@@ -38674,7 +38749,7 @@ var init_check2 = __esm({
           process.exit(1);
         }
         const lines = logOutput.trim().split("\n").filter(Boolean);
-        const TASK_ID_RE = /T[0-9]+/;
+        const TASK_ID_RE2 = /T[0-9]+/;
         const EXEMPT_RE = /^(Merge |Revert |fixup! |squash! |amend! )/;
         const untagged = [];
         const total = lines.length;
@@ -38684,7 +38759,7 @@ var init_check2 = __esm({
           const sha = line.slice(0, tabIdx).trim();
           const subject = line.slice(tabIdx + 1).trim();
           if (EXEMPT_RE.test(subject)) continue;
-          if (!TASK_ID_RE.test(subject)) {
+          if (!TASK_ID_RE2.test(subject)) {
             untagged.push({ sha: sha.slice(0, 12), subject });
           }
         }
@@ -44623,8 +44698,8 @@ var init_event = __esm({
           }
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
-            const { readFileSync: readFileSync19 } = await import("node:fs");
-            const content = readFileSync19(join21(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync18 } = await import("node:fs");
+            const content = readFileSync18(join21(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -44719,8 +44794,8 @@ var init_event = __esm({
         const printAgentLog = async (file) => {
           const agentId = file.replace(".jsonl", "");
           try {
-            const { readFileSync: readFileSync19 } = await import("node:fs");
-            const content = readFileSync19(join21(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync18 } = await import("node:fs");
+            const content = readFileSync18(join21(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -59104,6 +59179,12 @@ import {
 import { safeRunProposeTick } from "@cleocode/core/sentient/propose-tick.js";
 import { patchSentientState, readSentientState as readSentientState2 } from "@cleocode/core/sentient/state.js";
 import { safeRunTick } from "@cleocode/core/sentient/tick.js";
+import {
+  getSkillPatch,
+  getSkillReview,
+  listSkillReviews,
+  markSkillPatchRejected
+} from "@cleocode/core/store/skills-store.js";
 function resolveProjectRoot6(arg) {
   return arg && arg.length > 0 ? arg : processCwd3();
 }
@@ -59767,29 +59848,7 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
         const limit = args.limit ? Number.parseInt(args.limit, 10) : 50;
         const pendingOnly = args.pending === true;
         try {
-          const { openSkillsDb } = await import("@cleocode/core/store/skills-db.js");
-          const { skills: skills2, skillReviews, skillPatches } = await import("@cleocode/core/store/skills-schema.js");
-          const db = await openSkillsDb();
-          const reviews = db.select().from(skillReviews).orderBy(skillReviews.reviewedAt).limit(Number.isInteger(limit) && limit > 0 ? limit : 50).all();
-          const entries = [];
-          for (const review of reviews) {
-            const { eq: eq2, desc } = await import("drizzle-orm");
-            const skillRow = db.select().from(skills2).where(eq2(skills2.name, review.skillName)).limit(1).all()[0];
-            const latestPatch = db.select().from(skillPatches).where(eq2(skillPatches.skillName, review.skillName)).orderBy(desc(skillPatches.proposedAt)).limit(1).all()[0];
-            if (pendingOnly && latestPatch?.status !== "proposed") {
-              continue;
-            }
-            entries.push({
-              reviewId: review.id,
-              skillName: review.skillName,
-              reviewedAt: review.reviewedAt,
-              outcome: review.outcome,
-              summary: review.summary ?? null,
-              patchId: latestPatch?.id ?? null,
-              patchStatus: latestPatch?.status ?? null,
-              isCanonical: skillRow?.sourceType === "canonical"
-            });
-          }
+          const entries = await listSkillReviews({ pendingOnly, limit });
           emitSuccess2(
             { entries, count: entries.length, pendingOnly },
             jsonMode,
@@ -59832,12 +59891,8 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
           return;
         }
         try {
-          const { openSkillsDb } = await import("@cleocode/core/store/skills-db.js");
-          const { skills: skills2, skillReviews, skillPatches } = await import("@cleocode/core/store/skills-schema.js");
-          const { eq: eq2 } = await import("drizzle-orm");
-          const db = await openSkillsDb();
-          const review = db.select().from(skillReviews).where(eq2(skillReviews.id, reviewId)).get();
-          if (!review) {
+          const detail = await getSkillReview(reviewId);
+          if (!detail.review) {
             emitFailure3(
               "E_NOT_FOUND",
               `No skill_reviews row for id=${reviewId}`,
@@ -59846,17 +59901,15 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
             );
             return;
           }
-          const skillRow = db.select().from(skills2).where(eq2(skills2.name, review.skillName)).limit(1).all()[0];
-          const patches = db.select().from(skillPatches).where(eq2(skillPatches.reviewId, reviewId)).all();
           emitSuccess2(
             {
-              review,
-              patches,
-              isCanonical: skillRow?.sourceType === "canonical",
-              skillRow: skillRow ?? null
+              review: detail.review,
+              patches: detail.patches,
+              isCanonical: detail.isCanonical,
+              skillRow: detail.skillRow
             },
             jsonMode,
-            `Review ${reviewId} for ${review.skillName}: ${review.outcome}`,
+            `Review ${reviewId} for ${detail.review.skillName}: ${detail.review.outcome}`,
             "sentient.review-status.show"
           );
         } catch (err) {
@@ -59895,11 +59948,8 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
           return;
         }
         try {
-          const { openSkillsDb } = await import("@cleocode/core/store/skills-db.js");
-          const { skills: skills2, skillPatches } = await import("@cleocode/core/store/skills-schema.js");
-          const { eq: eq2 } = await import("drizzle-orm");
-          const db = await openSkillsDb();
-          const patch = db.select().from(skillPatches).where(eq2(skillPatches.id, patchId)).get();
+          const detail = await getSkillPatch(patchId);
+          const patch = detail.patch;
           if (!patch) {
             emitFailure3(
               "E_NOT_FOUND",
@@ -59918,7 +59968,7 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
             );
             return;
           }
-          const skillRow = db.select().from(skills2).where(eq2(skills2.name, patch.skillName)).limit(1).all()[0];
+          const skillRow = detail.skillRow;
           if (!skillRow) {
             emitFailure3(
               "E_NOT_FOUND",
@@ -59996,12 +60046,8 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
           return;
         }
         try {
-          const { openSkillsDb } = await import("@cleocode/core/store/skills-db.js");
-          const { skillPatches } = await import("@cleocode/core/store/skills-schema.js");
-          const { eq: eq2 } = await import("drizzle-orm");
-          const db = await openSkillsDb();
-          const patch = db.select().from(skillPatches).where(eq2(skillPatches.id, patchId)).get();
-          if (!patch) {
+          const detail = await getSkillPatch(patchId);
+          if (!detail.patch) {
             emitFailure3(
               "E_NOT_FOUND",
               `No skill_patches row for id=${patchId}`,
@@ -60010,19 +60056,19 @@ ${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
             );
             return;
           }
-          if (patch.status !== "proposed") {
+          if (detail.patch.status !== "proposed") {
             emitFailure3(
               "E_VALIDATION",
-              `patch ${patchId} is not in 'proposed' state (status='${patch.status}')`,
+              `patch ${patchId} is not in 'proposed' state (status='${detail.patch.status}')`,
               jsonMode,
               "sentient.review-status.reject"
             );
             return;
           }
-          db.update(skillPatches).set({ status: "rejected" }).where(eq2(skillPatches.id, patchId)).run();
+          await markSkillPatchRejected(patchId);
           const reason = args.reason ?? "rejected by operator";
           emitSuccess2(
-            { patchId, skillName: patch.skillName, status: "rejected", reason },
+            { patchId, skillName: detail.patch.skillName, status: "rejected", reason },
             jsonMode,
             `Patch ${patchId} rejected (${reason})`,
             "sentient.review-status.reject"
@@ -61450,12 +61496,12 @@ var skills_exports = {};
 __export(skills_exports, {
   skillsCommand: () => skillsCommand2
 });
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
-import { resolve as resolvePath2 } from "node:path";
-import { cwd as processCwd4 } from "node:process";
-import { AgentsSkillsRealDirError, runDoctorAdopt, runDoctorBridge } from "@cleocode/caamp";
-import { withProvenance } from "@cleocode/core/sentient";
+import {
+  AgentsSkillsRealDirError,
+  skills as coreSkills,
+  runDoctorAdopt,
+  runDoctorBridge
+} from "@cleocode/core";
 function buildSkillsDoctorAdoptAdapters() {
   return {
     loadRegisteredNames: async () => {
@@ -61482,7 +61528,7 @@ function buildSkillsDoctorAdoptAdapters() {
     }
   };
 }
-var listCommand23, searchCommand4, findCommand7, validateCommand8, infoCommand, installCommand3, uninstallCommand2, enableCommand2, disableCommand2, refreshCommand, dispatchCommand, catalogCommand, precedenceCommand, depsCommand4, doctorBridgeCommand, doctorAdoptOrphansCommand, statsCommand6, importHermesCommand, pruneTelemetryCommand, spawnProvidersCommand, doctorDiagnoseCommand, doctorCommand4, proposePatchCommand, skillsCommand2;
+var listCommand23, searchCommand4, findCommand7, validateCommand8, infoCommand, installCommand3, uninstallCommand2, enableCommand2, disableCommand2, refreshCommand, dispatchCommand, catalogCommand, precedenceCommand, depsCommand4, doctorBridgeCommand, doctorAdoptOrphansCommand, statsCommand6, importHermesCommand, migrateCommand2, pruneTelemetryCommand, spawnProvidersCommand, doctorDiagnoseCommand, doctorCommand4, proposePatchCommand, skillsCommand2;
 var init_skills2 = __esm({
   "packages/cleo/src/cli/commands/skills.ts"() {
     "use strict";
@@ -61994,6 +62040,42 @@ var init_skills2 = __esm({
         );
       }
     });
+    migrateCommand2 = defineCommand({
+      meta: {
+        name: "migrate",
+        description: "Migrate legacy skills (~/.local/share/agents/skills) into ~/.cleo/skills (SSoT)"
+      },
+      args: {
+        "dry-run": {
+          type: "boolean",
+          description: "Preview the plan without writing anything"
+        },
+        rollback: {
+          type: "boolean",
+          description: "Restore from the most recent backup tarball"
+        },
+        json: {
+          type: "boolean",
+          description: "Emit LAFS JSON envelope (default)"
+        },
+        human: {
+          type: "boolean",
+          description: "Emit a coloured human-readable summary instead of JSON"
+        }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "mutate",
+          "tools",
+          "skill.migrate",
+          {
+            dryRun: args["dry-run"] === true,
+            rollback: args.rollback === true
+          },
+          { command: "skills", operation: "tools.skill.migrate" }
+        );
+      }
+    });
     pruneTelemetryCommand = defineCommand({
       meta: {
         name: "prune-telemetry",
@@ -62128,119 +62210,60 @@ var init_skills2 = __esm({
       async run({ args }) {
         const skillName = String(args["skill-name"]);
         const diffPath = String(args.diff);
-        const title = typeof args.title === "string" && args.title.length > 0 ? args.title : `skill(${skillName}): proposed patch`;
-        const body = typeof args.body === "string" && args.body.length > 0 ? args.body : [
-          `Auto-improve patch for canonical skill **${skillName}**.`,
-          "",
-          `Diff source: \`${diffPath}\``,
-          "",
-          "This PR was opened via `cleo skill propose-patch` (T9714).",
-          "Sphere A canonical skills are owner-CI-only \u2014 the local",
-          "sentient daemon CANNOT mutate them in place; this PR is the",
-          "audited path for incorporating a council-approved patch."
-        ].join("\n");
-        const base = typeof args.base === "string" && args.base.length > 0 ? args.base : "main";
+        const title = typeof args.title === "string" ? args.title : void 0;
+        const body = typeof args.body === "string" ? args.body : void 0;
+        const base = typeof args.base === "string" ? args.base : void 0;
         const dryRun = args["dry-run"] === true;
-        const jsonMode = args.json === true;
-        const resolvedDiff = resolvePath2(processCwd4(), diffPath);
-        if (!existsSync16(resolvedDiff)) {
-          cliError(
-            `Diff file not found at '${resolvedDiff}'`,
-            "E_NOT_FOUND",
-            { name: "E_NOT_FOUND" },
-            { operation: "tools.skill.propose-patch" }
-          );
-          process.exit(1);
-          return;
-        }
-        const diffBytes = readFileSync16(resolvedDiff, "utf8");
-        if (diffBytes.length === 0) {
+        void (args.json === true);
+        const result = await coreSkills.proposeCanonicalPatch({
+          skillName,
+          diffPath,
+          title,
+          body,
+          base,
+          dryRun
+        });
+        if (result.kind === "error") {
           cliError(
-            `Diff file '${resolvedDiff}' is empty`,
-            "E_PATCH_EMPTY",
-            { name: "E_PATCH_EMPTY" },
+            result.message,
+            result.code,
+            { name: result.code },
             { operation: "tools.skill.propose-patch" }
           );
           process.exit(1);
           return;
         }
-        if (!dryRun) {
-          try {
-            execFileSync4("gh", ["--version"], { stdio: "pipe" });
-          } catch {
-            cliError(
-              "gh CLI not found or not authenticated \u2014 install gh and run `gh auth login`",
-              "E_GH_UNAVAILABLE",
-              { name: "E_GH_UNAVAILABLE" },
-              { operation: "tools.skill.propose-patch" }
-            );
-            process.exit(1);
-            return;
-          }
-        }
-        const timestamp2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        const branchName = `propose-patch/skill-${skillName}-${timestamp2}`;
-        const steps = [
-          `git checkout -b ${branchName}`,
-          `git apply ${resolvedDiff}`,
-          `git add -A`,
-          `git commit -m "skill(${skillName}): propose patch"`,
-          `git push -u origin ${branchName}`,
-          `gh pr create --base ${base} --head ${branchName} --title "${title}" --body <stdin>`
-        ];
-        if (dryRun) {
+        if (result.kind === "dry-run") {
           cliOutput(
             {
-              skillName,
-              diffPath: resolvedDiff,
-              branchName,
-              base,
-              steps,
+              skillName: result.skillName,
+              diffPath: result.diffPath,
+              branchName: result.branchName,
+              base: result.base,
+              steps: result.steps,
               dryRun: true
             },
             {
               command: "skills",
-              message: `[dry-run] would open PR for ${skillName} on branch ${branchName}`,
+              message: `[dry-run] would open PR for ${result.skillName} on branch ${result.branchName}`,
               operation: "tools.skill.propose-patch"
             }
           );
           return;
         }
-        try {
-          const result = await withProvenance("pr-generator", async () => {
-            execFileSync4("git", ["checkout", "-b", branchName], { stdio: "pipe" });
-            execFileSync4("git", ["apply", resolvedDiff], { stdio: "pipe" });
-            execFileSync4("git", ["add", "-A"], { stdio: "pipe" });
-            execFileSync4("git", ["commit", "-m", `skill(${skillName}): propose patch`], {
-              stdio: "pipe"
-            });
-            execFileSync4("git", ["push", "-u", "origin", branchName], { stdio: "pipe" });
-            const prUrl = execFileSync4(
-              "gh",
-              ["pr", "create", "--base", base, "--head", branchName, "--title", title, "--body", body],
-              { stdio: "pipe" }
-            ).toString("utf8").trim();
-            return { prUrl, branchName };
-          });
-          cliOutput(
-            { skillName, prUrl: result.prUrl, branchName: result.branchName, base },
-            {
-              command: "skills",
-              message: `Opened PR ${result.prUrl}`,
-              operation: "tools.skill.propose-patch"
-            }
-          );
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
-          cliError(
-            `propose-patch failed: ${message}`,
-            "E_PROPOSE_PATCH_FAILED",
-            { name: "E_PROPOSE_PATCH_FAILED" },
-            { operation: "tools.skill.propose-patch" }
-          );
-          process.exit(1);
-        }
-        void jsonMode;
+        cliOutput(
+          {
+            skillName: result.skillName,
+            prUrl: result.prUrl,
+            branchName: result.branchName,
+            base: result.base
+          },
+          {
+            command: "skills",
+            message: `Opened PR ${result.prUrl}`,
+            operation: "tools.skill.propose-patch"
+          }
+        );
       }
     });
     skillsCommand2 = defineCommand({
@@ -62265,6 +62288,7 @@ var init_skills2 = __esm({
         "propose-patch": proposePatchCommand,
         stats: statsCommand6,
         "import-hermes": importHermesCommand,
+        migrate: migrateCommand2,
         "prune-telemetry": pruneTelemetryCommand
       },
       async run({ cmd, rawArgs }) {
@@ -63045,10 +63069,10 @@ var init_sync = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync19 } = await import("node:fs");
+        const { readFileSync: readFileSync18 } = await import("node:fs");
         let externalTasks;
         try {
-          externalTasks = JSON.parse(readFileSync19(args.file, "utf8"));
+          externalTasks = JSON.parse(readFileSync18(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse external tasks file: ${message}`, 2, {
@@ -63434,12 +63458,12 @@ var token_exports = {};
 __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { getProjectRoot as getProjectRoot40, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
-  if (file) return readFileSync17(file, "utf-8");
+  if (file) return readFileSync16(file, "utf-8");
   return text;
 }
 var filterArgs, summaryCommand3, listCommand25, showCommand16, deleteCommand3, clearCommand2, estimateCommand, tokenCommand;
@@ -63641,7 +63665,7 @@ import {
   pruneTranscripts,
   scanTranscripts
 } from "@cleocode/core/gc/transcript.js";
-var scanCommand, extractCommand, migrateCommand2, pruneCommand2, transcriptCommand;
+var scanCommand, extractCommand, migrateCommand3, pruneCommand2, transcriptCommand;
 var init_transcript = __esm({
   "packages/cleo/src/cli/commands/transcript.ts"() {
     "use strict";
@@ -63840,7 +63864,7 @@ var init_transcript = __esm({
         }
       }
     });
-    migrateCommand2 = defineCommand({
+    migrateCommand3 = defineCommand({
       meta: {
         name: "migrate",
         description: "Backfill extraction from existing ~/.claude/projects/ session JSONLs (T733)"
@@ -64036,7 +64060,7 @@ var init_transcript = __esm({
       subCommands: {
         scan: scanCommand,
         extract: extractCommand,
-        migrate: migrateCommand2,
+        migrate: migrateCommand3,
         prune: pruneCommand2
       },
       async run({ cmd, rawArgs }) {
@@ -64657,7 +64681,7 @@ var web_exports = {};
 __export(web_exports, {
   webCommand: () => webCommand
 });
-import { execFileSync as execFileSync5, spawn as spawn3 } from "node:child_process";
+import { execFileSync as execFileSync4, spawn as spawn3 } from "node:child_process";
 import { mkdir as mkdir4, open, readFile as readFile6, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join30 } from "node:path";
 import { CleoError as CleoError12, formatError as formatError9, getCleoHome as getCleoHome5 } from "@cleocode/core";
@@ -64721,7 +64745,7 @@ async function startWebServer(port, host) {
     await stat2(webIndexPath);
   } catch {
     try {
-      execFileSync5("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
+      execFileSync4("pnpm", ["--filter", "@cleocode/studio", "run", "build"], {
         cwd: projectRoot,
         stdio: "ignore"
       });
@@ -65222,7 +65246,7 @@ var init_worktree3 = __esm({
 init_dist();
 init_field_context();
 init_format_context();
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { dirname as dirname12, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 
@@ -66348,14 +66372,14 @@ function didYouMean(input2, candidates, maxDistance = 2) {
 }
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync17 } from "node:fs";
+import { existsSync as existsSync16 } from "node:fs";
 import { join as join31 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
   const configPath = join31(getCleoPlatformPaths().config, "config.json");
-  if (existsSync17(configPath)) return false;
+  if (existsSync16(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();
@@ -66444,7 +66468,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
 }
 function getPackageVersion() {
   const pkgPath = join32(dirname12(fileURLToPath8(import.meta.url)), "../../package.json");
-  const pkg = JSON.parse(readFileSync18(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
   return pkg.version;
 }
 var CLI_VERSION = getPackageVersion();