@coopcli/specsketch 2026.826.3 → 2026.831.1

package/dist/cli/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // server/cli.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname6, extname, join as join11, normalize as normalize2, resolve as resolve4 } from "node:path";
+import { dirname as dirname6, extname, join as join12, normalize as normalize2, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs as parseArgs2 } from "node:util";
 import { serve } from "@hono/node-server";
@@ -16,6 +16,20 @@ import { join } from "node:path";
 var ModelAuthError = class extends Error {
 };
 var API_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+var THIRD_PARTY_ROUTING_KEYS = [
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY",
+  "CLAUDE_CODE_USE_MANTLE",
+  "CLAUDE_CODE_USE_GATEWAY",
+  "CLAUDE_CODE_USE_ANTHROPIC_AWS",
+  "CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD",
+  "ANTHROPIC_BASE_URL"
+];
+var SUBSCRIPTION_STRIPPED_ENV_KEYS = [
+  ...API_ENV_KEYS,
+  ...THIRD_PARTY_ROUTING_KEYS
+];
 function hasAntAuthProfile(home) {
   try {
     return readdirSync(join(home, ".config", "anthropic", "credentials")).some(
@@ -40,7 +54,7 @@ function resolveModelCredential(opts = {}) {
   }
   if (hasSubscription) {
     const subprocessEnv = { ...env };
-    for (const k of API_ENV_KEYS) delete subprocessEnv[k];
+    for (const k of SUBSCRIPTION_STRIPPED_ENV_KEYS) delete subprocessEnv[k];
     return {
       path: "subscription",
       billsApiCredits: false,
@@ -117,9 +131,38 @@ function destructiveBashHook(profile) {
     ]
   };
 }
-function* mapMessage(message, expectStructuredOutput) {
+var KNOWN_CATEGORIES = {
+  authentication_failed: true,
+  oauth_org_not_allowed: true,
+  billing_error: true,
+  rate_limit: true,
+  overloaded: true,
+  invalid_request: true,
+  model_not_found: true,
+  server_error: true,
+  unknown: true,
+  max_output_tokens: true
+};
+var ABSENT_CATEGORY = "(none reported)";
+function classifyFailure(category) {
+  if (typeof category !== "string" || category === "") {
+    return { category: ABSENT_CATEGORY, recognised: false };
+  }
+  return { category, recognised: Object.hasOwn(KNOWN_CATEGORIES, category) };
+}
+function* mapMessage(message, ctx) {
   switch (message.type) {
     case "system": {
+      if (message.subtype === "api_retry") {
+        yield {
+          type: "retry",
+          failure: classifyFailure(message.error),
+          attempt: message.attempt,
+          maxRetries: message.max_retries,
+          retryDelayMs: message.retry_delay_ms
+        };
+        return;
+      }
       if (message.subtype === "init") {
         yield {
           type: "start",
@@ -131,8 +174,11 @@ function* mapMessage(message, expectStructuredOutput) {
     }
     case "assistant": {
       const assistant = message;
+      if (assistant.error !== void 0) ctx.lastFailure = classifyFailure(assistant.error);
       for (const block of assistant.message.content) {
         if (block.type === "text") {
+          ctx.partialText += ctx.partialText ? `
+${block.text}` : block.text;
           yield { type: "text", text: block.text };
         } else if (block.type === "thinking") {
           yield { type: "thinking", text: block.thinking };
@@ -160,20 +206,37 @@ function* mapMessage(message, expectStructuredOutput) {
     }
     case "result": {
       if (message.subtype === "success") {
-        const missingStructured = expectStructuredOutput && message.structured_output === void 0;
+        const missingStructured = ctx.expectStructuredOutput && message.structured_output === void 0;
+        const isError = message.is_error || missingStructured;
         yield {
           type: "result",
           text: message.result,
           costUsd: message.total_cost_usd,
-          isError: message.is_error || missingStructured,
+          isError,
+          outcome: isError ? "failed" : "answered",
+          turns: message.num_turns,
+          ...isError && ctx.lastFailure ? { failure: ctx.lastFailure } : {},
           ...message.structured_output !== void 0 ? { structuredOutput: message.structured_output } : {}
         };
+      } else if (message.subtype === "error_max_turns") {
+        yield {
+          type: "result",
+          text: ctx.partialText || message.errors.join("\n"),
+          costUsd: message.total_cost_usd,
+          isError: true,
+          outcome: "cut_short",
+          turns: message.num_turns,
+          ...ctx.lastFailure ? { failure: ctx.lastFailure } : {}
+        };
       } else {
         yield {
           type: "result",
           text: message.errors.join("\n"),
           costUsd: message.total_cost_usd,
-          isError: true
+          isError: true,
+          outcome: "failed",
+          turns: message.num_turns,
+          ...ctx.lastFailure ? { failure: ctx.lastFailure } : {}
         };
       }
       return;
@@ -206,6 +269,12 @@ function buildOptions(input, resolved) {
     // path, so the subprocess cannot prefer an API key over the login.
     env: resolved.subprocessEnv
   };
+  if (input.systemPrompt !== void 0) {
+    options.systemPrompt = input.systemPrompt;
+  }
+  if (input.maxTurns !== void 0) {
+    options.maxTurns = input.maxTurns;
+  }
   if (profile.disallowedTools) {
     options.disallowedTools = profile.disallowedTools;
   }
@@ -261,14 +330,17 @@ function createClaudeHarness(deps) {
       const notify = input.onNotice ?? ((message) => console.error(message));
       notify(resolved.notice);
       const queryFn = deps?.queryFn ?? await loadSdkQuery(deps?.sdkLoader);
-      const expectStructuredOutput = input.outputSchema !== void 0;
+      const ctx = {
+        expectStructuredOutput: input.outputSchema !== void 0,
+        partialText: ""
+      };
       try {
         const stream = queryFn({ prompt: input.prompt, options: buildOptions(input, resolved) });
         for await (const message of stream) {
           if (message.type === "system" && message.subtype === "init") {
             verifyBilling(resolved, message.apiKeySource, notify);
           }
-          yield* mapMessage(message, expectStructuredOutput);
+          yield* mapMessage(message, ctx);
         }
       } catch (error) {
         if (isSdkAbsence(error)) throw new Error(SDK_UNAVAILABLE_MESSAGE, { cause: error });
@@ -334,6 +406,17 @@ function lifeOSProfile(identity, mcpServers) {
   }
   return profile;
 }
+function readMostlyProfile(identity) {
+  return {
+    allowedTools: ["Read", "Grep", "Glob", "WebFetch", "WebSearch"],
+    gatedTools: [...SIDE_EFFECT_GATED_TOOLS],
+    allowGated: false,
+    blockedBashPatterns: blockedBashPatterns(),
+    permissionMode: "default",
+    settingSources: [],
+    identity
+  };
+}
 
 // server/cli.ts
 import "ws";
@@ -964,9 +1047,12 @@ ${refContext}` : "");
       let resultError = false;
       try {
         for await (const ev of harness.run({
-          prompt: `${system}
-
-${prompt}`,
+          // System instructions ride their OWN channel — the harness
+          // forwards them to the SDK's system-prompt option. They are
+          // never joined to the prompt (they used to be, because
+          // HarnessRunInput had nowhere else to put them).
+          systemPrompt: system,
+          prompt,
           cwd: refRoot ?? process.cwd(),
           session: workspace?.changeName ?? "specsketch-generate",
           profile: generateProfile,
@@ -1040,9 +1126,7 @@ ${prompt}`,
     const refContext = renderReferenceContext(refs);
     const history = conversation.map((m) => `[${m.role === "user" ? "user" : "assistant"}]
 ${m.text}`).join("\n\n");
-    const prompt = `${CHAT_SYSTEM}
-
-${renderBundleContext(bundle)}` + (history ? `
+    const prompt = `${renderBundleContext(bundle)}` + (history ? `
 
 Conversation so far:
 
@@ -1059,6 +1143,7 @@ ${refContext}` : "");
     let resultError = false;
     try {
       for await (const ev of harness.run({
+        systemPrompt: CHAT_SYSTEM,
         prompt,
         cwd: refRoot ?? process.cwd(),
         session: workspace?.changeName ?? bundle.changeName ?? "specsketch-review",
@@ -2150,9 +2235,8 @@ var ChangeWorkspace = class {
 };
 
 // server/workbench-host.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname5, join as join10, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname5, join as join11, resolve as resolve3 } from "node:path";
 
 // src/workbench/core/capability-store.ts
 import { readFileSync as readFileSync4, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
@@ -2285,7 +2369,7 @@ var SPEC_FILE = "spec.md";
 function validateCapabilityName(name) {
   if (name.length === 0) return "a capability name cannot be empty";
   if (!CAPABILITY_NAME.test(name)) {
-    return `\`${name}\` is not a capability name: expected lowercase kebab-case, e.g. \`specsketch-delta-derivation\``;
+    return `\`${name}\` is not a capability name: expected lowercase kebab-case, e.g. \`specsketch-workbench-host\``;
   }
   return null;
 }
@@ -2332,1567 +2416,892 @@ function createFoldedSpecReader(repoRoot) {
   return Object.freeze({ specsDir, listCapabilities, readCapability, openCapability });
 }
 
-// src/workbench/approve/approve.ts
-import { execFileSync } from "node:child_process";
-import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync5, rmSync, statSync as statSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join7 } from "node:path";
+// src/workbench/core/citation.ts
+var REQUIREMENT_HEADING2 = /^###[ \t]+Requirement:[ \t]*(.+?)[ \t]*$/gm;
+function citableRequirements(specs) {
+  return specs.flatMap(
+    (spec) => [...spec.content.matchAll(REQUIREMENT_HEADING2)].map((match) => ({
+      capability: spec.capability,
+      key: match[1]
+    }))
+  );
+}
 
-// src/workbench/core/emit.ts
-var PROPOSAL_SECTIONS = Object.freeze([
-  { id: "why", title: "Why", level: 2, required: true, skippable: false },
-  { id: "what-changes", title: "What Changes", level: 2, required: true, skippable: false },
-  { id: "system-context", title: "System context", level: 3, required: true, skippable: true },
-  { id: "containers", title: "Containers", level: 3, required: true, skippable: true },
-  { id: "components", title: "Components", level: 3, required: true, skippable: true },
-  { id: "code", title: "Code", level: 3, required: false, skippable: true },
-  { id: "impact", title: "Impact", level: 2, required: true, skippable: false }
-]);
-function emptyProposal() {
+// src/workbench/agent/credentials.ts
+var CREDENTIAL_SOURCES = [
+  "subscription",
+  "api-key",
+  "ant-auth"
+];
+var CREDENTIAL_LABELS = {
+  subscription: "Claude Code subscription login",
+  "api-key": "ANTHROPIC_API_KEY",
+  "ant-auth": "ant auth token"
+};
+var CREDENTIAL_BILLS = {
+  subscription: "bills your Max/Pro subscription",
+  "api-key": "bills API credits",
+  "ant-auth": "bills API credits, NOT your subscription"
+};
+function unavailableDetail(id, reason) {
+  switch (reason) {
+    case "not-installed":
+      return id === "subscription" ? "Claude Code is not installed on this machine" : id === "api-key" ? "ANTHROPIC_API_KEY is not set in this environment" : "no ant auth token or credentials profile is present";
+    case "installed-not-authenticated":
+      return id === "subscription" ? "Claude Code is installed but not logged in \u2014 run `claude login`" : id === "api-key" ? "ANTHROPIC_API_KEY is set but empty" : "an ant auth profile exists but holds no usable token \u2014 run `ant auth login`";
+    case "present-but-rejected":
+      return "a credential is present but the last run was rejected \u2014 investigate before reusing it";
+  }
+}
+function sourceRow(id, status) {
   return {
-    why: { state: "empty" },
-    "what-changes": { state: "empty" },
-    "system-context": { state: "empty" },
-    containers: { state: "empty" },
-    components: { state: "empty" },
-    code: { state: "empty" },
-    impact: { state: "empty" }
+    id,
+    label: CREDENTIAL_LABELS[id],
+    status,
+    detail: status.kind === "available" ? CREDENTIAL_BILLS[id] : unavailableDetail(id, status.reason)
   };
 }
-var DESIGN_FENCES = Object.freeze({
-  mermaid: "mermaid",
-  sketch: "specsketch-sketch"
-});
-function numberTasks(groups) {
-  return groups.map((group, g) => ({
-    ...group,
-    number: `${g + 1}`,
-    title: group.title,
-    tasks: group.tasks.map((task, t) => ({ ...task, number: `${g + 1}.${t + 1}` }))
-  }));
-}
-var SCENARIO_HEADING = /^####[ \t]+Scenario:[ \t]*(.*)$/;
-var ANY_HEADING = /^#{1,6}[ \t]/;
-function probe2(line) {
-  return line.endsWith("\r") ? line.slice(0, -1) : line;
-}
-function parseScenarios(block) {
-  const scenarios = [];
-  let open = null;
-  for (const line of block.bodyLines) {
-    const p = probe2(line);
-    const heading = SCENARIO_HEADING.exec(p);
-    if (heading) {
-      if (open) scenarios.push(open);
-      open = { name: (heading[1] ?? "").trim(), steps: [] };
-      continue;
+function resolveRailCredential(machine, selection) {
+  if (selection !== null) {
+    const row = machine.rows.find((r) => r.id === selection);
+    if (row && row.status.kind === "available") {
+      return { kind: "in-use", source: selection, reason: { kind: "explicit-selection" } };
     }
-    if (ANY_HEADING.test(p)) {
-      if (open) scenarios.push(open);
-      open = null;
-      continue;
+    if (machine.defaultPick !== null) {
+      return {
+        kind: "in-use",
+        source: machine.defaultPick,
+        reason: { kind: "selection-unavailable", selected: selection }
+      };
     }
-    if (open && p.trim() !== "") open.steps.push(p);
+    return { kind: "no-model", droppedSelection: selection };
+  }
+  if (machine.defaultPick !== null) {
+    return { kind: "in-use", source: machine.defaultPick, reason: { kind: "default-precedence" } };
   }
-  if (open) scenarios.push(open);
-  return scenarios;
+  return { kind: "no-model", droppedSelection: null };
 }
-function requirementProse(block) {
-  const prose = [];
-  for (const line of block.bodyLines) {
-    const p = probe2(line);
-    if (SCENARIO_HEADING.test(p) || ANY_HEADING.test(p)) break;
-    prose.push(p);
-  }
-  return prose.join("\n").trim();
+function sourceFromApiKeySource(apiKeySource) {
+  if (apiKeySource === "none") return "subscription";
+  if (apiKeySource === "oauth") return "ant-auth";
+  return "api-key";
 }
-function draftBlockOf(delta) {
-  return delta.operation === "REMOVED" ? null : delta.block;
+function servedSourceFromRun(selected, apiKeySource) {
+  if (apiKeySource === void 0) return { kind: "unobserved" };
+  const serving = sourceFromApiKeySource(apiKeySource);
+  return serving === selected ? { kind: "served", source: serving } : { kind: "diverged", selected, serving };
 }
-function deltasOf(entry) {
-  return entry.derivation.outcome === "derived" ? entry.derivation.deltas : [];
+function servedSentence(served) {
+  switch (served.kind) {
+    case "served":
+      return `served by ${CREDENTIAL_LABELS[served.source]} \u2014 ${CREDENTIAL_BILLS[served.source]}`;
+    case "diverged":
+      return `served by ${CREDENTIAL_LABELS[served.serving]}, NOT the selected ${CREDENTIAL_LABELS[served.selected]} \u2014 ${CREDENTIAL_BILLS[served.serving]}`;
+    case "unobserved":
+      return "the run carried no billing signal \u2014 which credential served this turn is unknown";
+    case "fixture":
+      return "answered by the workbench fixture \u2014 no model served this turn";
+  }
 }
-function emitsDeltaSpec(entry) {
-  return deltasOf(entry).length > 0;
+
+// src/workbench/agent/profile.ts
+var AGENT_RAIL_IDENTITY = "specsketch-workbench-agent";
+function agentRailProfile() {
+  return readMostlyProfile(AGENT_RAIL_IDENTITY);
 }
-function testingRows(capabilities) {
-  const rows = [];
-  for (const entry of capabilities) {
-    for (const delta of deltasOf(entry)) {
-      const block = draftBlockOf(delta);
-      if (!block) continue;
-      for (const scenario of parseScenarios(block)) {
-        rows.push({
-          index: rows.length + 1,
-          capability: entry.capability,
-          requirement: block.name,
-          scenario: scenario.name
-        });
-      }
+
+// src/workbench/agent/credential-probe.ts
+import { existsSync as existsSync5, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { delimiter, join as join7 } from "node:path";
+function claudeOnPath(env) {
+  const path = env["PATH"];
+  if (path === void 0 || path === "") return false;
+  for (const dir of path.split(delimiter)) {
+    if (dir === "") continue;
+    try {
+      if (statSync3(join7(dir, "claude")).isFile()) return true;
+    } catch {
     }
   }
-  return rows;
+  return false;
 }
-function citableRequirements(capabilities) {
-  const citable = [];
-  for (const entry of capabilities) {
-    for (const delta of deltasOf(entry)) {
-      citable.push({ capability: entry.capability, key: delta.key });
-    }
+function antAuthProfile(home) {
+  const dir = join7(home, ".config", "anthropic", "credentials");
+  try {
+    return readdirSync6(dir).some((f) => f.endsWith(".json")) ? "token" : "empty-profile";
+  } catch {
+    return "absent";
   }
-  return citable;
 }
-function purposeOf(entry) {
-  if (entry.derivation.outcome !== "derived") return null;
-  if (entry.derivation.foldedComparison.kind !== "no-folded-counterpart") return null;
-  return readPurposeBody(entry);
+function subscriptionStatus(home, installed) {
+  if (existsSync5(join7(home, ".claude", ".credentials.json"))) return { kind: "available" };
+  return {
+    kind: "unavailable",
+    reason: installed ? "installed-not-authenticated" : "not-installed"
+  };
 }
-var PURPOSE_HEADING = /^##[ \t]+Purpose[ \t]*$/;
-function readPurposeBody(entry) {
-  const body = [];
-  let inPurpose = false;
-  for (const line of entry.draft.split("\n")) {
-    const p = probe2(line);
-    if (PURPOSE_HEADING.test(p)) {
-      inPurpose = true;
-      continue;
-    }
-    if (inPurpose && ANY_HEADING.test(p)) break;
-    if (inPurpose) body.push(p);
+function apiKeyStatus(env) {
+  const value = env["ANTHROPIC_API_KEY"];
+  if (value === void 0) return { kind: "unavailable", reason: "not-installed" };
+  if (value === "") return { kind: "unavailable", reason: "installed-not-authenticated" };
+  return { kind: "available" };
+}
+function antAuthStatus(env, home) {
+  const token = env["ANTHROPIC_AUTH_TOKEN"];
+  if (token !== void 0 && token !== "") return { kind: "available" };
+  switch (antAuthProfile(home)) {
+    case "token":
+      return { kind: "available" };
+    case "empty-profile":
+      return { kind: "unavailable", reason: "installed-not-authenticated" };
+    case "absent":
+      return {
+        kind: "unavailable",
+        reason: token === "" ? "installed-not-authenticated" : "not-installed"
+      };
   }
-  const text = body.join("\n").trim();
-  return text === "" ? null : text;
 }
-function deltaSpecDocument(entry) {
-  const deltas = deltasOf(entry);
-  return {
-    capability: entry.capability,
-    purpose: purposeOf(entry),
-    added: deltas.filter((d) => d.operation === "ADDED").map((d) => blockText(d)),
-    // A declared rename whose body also changed emits RENAMED *and* MODIFIED: the
-    // rename names the heading change, the modification carries the body change
-    // with the folded block as its base. Emitting only the rename would discard a
-    // body edit the author made; refusing would make a legitimate edit and a
-    // legitimate rename mutually exclusive. See `docs/specsketch-workbench-issues.md` #8.
-    modified: deltas.filter((d) => d.operation === "MODIFIED" || d.operation === "RENAMED" && d.bodyChanged).map((d) => blockText(d)),
-    removed: deltas.filter((d) => d.operation === "REMOVED").map((d) => d.base.name),
-    renamed: deltas.filter((d) => d.operation === "RENAMED").map((d) => ({ from: d.base.name, to: d.block.name }))
+function probeMachineCredentials(input = {}) {
+  const env = input.env ?? process.env;
+  const home = input.home ?? homedir3();
+  const installed = input.claudeInstalled ?? claudeOnPath(env);
+  const rejected = new Set(input.rejected ?? []);
+  const statuses = {
+    subscription: subscriptionStatus(home, installed),
+    "api-key": apiKeyStatus(env),
+    "ant-auth": antAuthStatus(env, home)
   };
+  for (const id of CREDENTIAL_SOURCES) {
+    if (rejected.has(id) && statuses[id].kind === "available") {
+      statuses[id] = { kind: "unavailable", reason: "present-but-rejected" };
+    }
+  }
+  const rows = CREDENTIAL_SOURCES.map((id) => sourceRow(id, statuses[id]));
+  return { rows, defaultPick: defaultPick(env, home, statuses) };
+}
+function defaultPick(env, home, statuses) {
+  try {
+    const pick = resolveModelCredential({ env, home }).path;
+    return statuses[pick].kind === "available" ? pick : null;
+  } catch (error) {
+    if (error instanceof ModelAuthError) return null;
+    throw error;
+  }
 }
-function blockText(delta) {
-  const block = draftBlockOf(delta);
-  if (!block) throw new RangeError(`no draft block for ${delta.operation} delta \`${delta.key}\``);
-  return block.text;
+
+// src/workbench/agent/live-run.ts
+function harnessInputsFor(source, env) {
+  if (source === "subscription") return { env, useApi: false };
+  if (source === "api-key") return { env, useApi: true };
+  const withheld = { ...env };
+  delete withheld["ANTHROPIC_API_KEY"];
+  return { env: withheld, useApi: true };
 }
-function changeDocument(change) {
+async function runRailTurn(input, deps = {}) {
+  const env = deps.env ?? process.env;
+  const machine = deps.machine ?? probeMachineCredentials({
+    env,
+    ...deps.home !== void 0 ? { home: deps.home } : {},
+    ...deps.probe ?? {}
+  });
+  const credential = resolveRailCredential(machine, input.selection ?? null);
+  if (credential.kind === "no-model") return { kind: "no-model", credential };
+  const inputs = harnessInputsFor(credential.source, env);
+  const harness = (deps.createHarness ?? ((d) => createClaudeHarness(d)))({
+    env: inputs.env,
+    home: deps.home
+  });
+  const runInput = {
+    prompt: input.prompt,
+    cwd: input.cwd,
+    session: input.session,
+    // Read-only by construction — the live run carries the SAME profile the
+    // canned rail always declared (issue #53).
+    profile: agentRailProfile(),
+    useApi: inputs.useApi,
+    ...input.systemPrompt !== void 0 ? { systemPrompt: input.systemPrompt } : {},
+    ...input.maxTurns !== void 0 ? { maxTurns: input.maxTurns } : {},
+    ...input.outputSchema !== void 0 ? { outputSchema: input.outputSchema } : {},
+    ...deps.onNotice ? { onNotice: deps.onNotice } : {}
+  };
+  let apiKeySource;
+  let answer = "";
+  let isError = false;
+  let outcome;
+  let turns;
+  let failure;
+  let structuredOutput;
+  let sawStructuredOutput = false;
+  for await (const event of harness.run(runInput)) {
+    if (event.type === "start") {
+      apiKeySource = event.apiKeySource;
+    } else if (event.type === "result") {
+      answer = event.text;
+      isError = event.isError;
+      outcome = event.outcome;
+      turns = event.turns;
+      failure = event.failure;
+      if ("structuredOutput" in event) {
+        structuredOutput = event.structuredOutput;
+        sawStructuredOutput = true;
+      }
+    }
+  }
   return {
-    id: change.id,
-    proposal: change.proposal,
-    design: change.design,
-    groups: numberTasks(change.tasks),
-    testing: testingRows(change.capabilities),
-    proposalExtras: change.proposalExtras,
-    deltaSpecs: change.capabilities.filter(emitsDeltaSpec).map(deltaSpecDocument).sort((a, b) => a.capability < b.capability ? -1 : a.capability > b.capability ? 1 : 0)
+    kind: "turn",
+    turn: {
+      answer,
+      served: servedSourceFromRun(credential.source, apiKeySource),
+      selected: credential.source,
+      isError,
+      ...outcome !== void 0 ? { outcome } : {},
+      ...turns !== void 0 ? { turns } : {},
+      ...failure !== void 0 ? { failure } : {},
+      ...sawStructuredOutput ? { structuredOutput } : {}
+    }
   };
 }
-var SKIPPED_MARKER = "_Skipped._";
-var UNSATISFIED_MARKER = "_Unsatisfied \u2014 this section has no body and no recorded skip._";
-function renderProposalSection(spec, section2) {
-  const heading = `${"#".repeat(spec.level)} ${spec.title}`;
-  switch (section2.state) {
-    case "authored":
-      return `${heading}
-
-${section2.body}
-`;
-    case "skipped":
-      return `${heading}
-
-${SKIPPED_MARKER} ${section2.reason.trim()}
-`;
-    case "empty":
-      return `${heading}
 
-${UNSATISFIED_MARKER}
-`;
+// src/workbench/agent/tools.ts
+import { z as z5 } from "zod";
+var ROOT_ARTIFACTS = ["proposal.md", "design.md", "tasks.md"];
+var SPEC_ARTIFACT = /^specs\/([a-z0-9]+(?:-[a-z0-9]+)*)\/spec\.md$/;
+var AGENT_PROPOSAL_TOOLS = [
+  {
+    name: "edit_artifact",
+    description: "Propose a markdown edit to one artifact of this change. `artifact` is one of `proposal.md`, `design.md`, `tasks.md`, or `specs/<capability>/spec.md` \u2014 it must be an artifact the change already has. `text` is the markdown, exactly as it should sit in the file. `mode` is `replace` for the whole file or `append` to add at the end."
+  },
+  {
+    name: "add_task_group",
+    description: "Propose a group of implementation tasks, appended to `tasks.md`. `title` and `tasks` are required; one group per coherent area, each task a single concrete action. `capability` + `requirement` are optional and go together \u2014 name both to cite the requirement the group implements, or neither for a chore group."
+  },
+  {
+    name: "add_requirement",
+    description: "Propose a requirement, appended to a delta spec. `capability` must be one the change already has a delta spec for. `block` must be full markdown: a `### Requirement:` heading, RFC-2119 SHALL text, and at least one `#### Scenario:` with WHEN/THEN steps."
   }
-}
-function renderProposal(doc) {
-  const extras = doc.proposalExtras ?? [];
-  const after = (id) => extras.filter((e) => e.afterSection === id).map((e) => `${e.text.trimEnd()}
-`);
-  const parts = [`# ${doc.id}
-`, ...after(null)];
-  for (const spec of PROPOSAL_SECTIONS) {
-    parts.push(renderProposalSection(spec, doc.proposal[spec.id]));
-    parts.push(...after(spec.id));
+];
+var proposalCall = z5.object({
+  tool: z5.enum(AGENT_PROPOSAL_TOOLS.map((t) => t.name)).describe("Which kind of edit to propose."),
+  artifact: z5.string().optional().describe("edit_artifact: the artifact this edit is against."),
+  mode: z5.string().optional().describe("edit_artifact: `replace` or `append`. Defaults to append."),
+  text: z5.string().optional().describe("edit_artifact: the markdown, exactly as it should read."),
+  title: z5.string().optional().describe("add_task_group: the group heading."),
+  tasks: z5.array(z5.string()).optional().describe("add_task_group: task titles, one per task, each one concrete action."),
+  capability: z5.string().optional().describe("add_requirement: the delta spec\u2019s capability. add_task_group: the citation\u2019s."),
+  requirement: z5.string().optional().describe("add_task_group: the exact requirement name, as it appears after `### Requirement:`."),
+  block: z5.string().optional().describe("add_requirement: the complete requirement block, in markdown.")
+});
+var agentTurnResult = z5.object({
+  answer: z5.string().describe("Brief prose for the author: what you proposed and why, or your answer if nothing."),
+  proposals: z5.array(proposalCall).describe("The edits to propose. Empty when the turn only answers.")
+});
+var AGENT_TURN_SCHEMA = z5.toJSONSchema(agentTurnResult, {
+  target: "draft-7"
+});
+function knownArtifacts(shape) {
+  if (shape.artifacts !== void 0) return shape.artifacts;
+  if (shape.buffers !== void 0) return Object.keys(shape.buffers);
+  if (shape.openCapabilities !== void 0) {
+    return [...ROOT_ARTIFACTS, ...shape.openCapabilities.map((c) => `specs/${c}/spec.md`)];
   }
-  return `${parts.join("\n")}`;
+  return null;
 }
-function renderDesign(doc) {
-  const parts = [`# Design \u2014 ${doc.id}
-`];
-  for (const block of doc.design) {
-    const title = (block.title ?? "").trim();
-    const heading = title === "" ? "" : `## ${title}
-
-`;
-    if (block.kind === "markdown") {
-      parts.push(`${heading}${block.text.trim()}
-`);
-      continue;
-    }
-    const info = block.kind === "mermaid" ? DESIGN_FENCES.mermaid : DESIGN_FENCES.sketch;
-    parts.push(`${heading}\`\`\`${info}
-${block.text.trim()}
-\`\`\`
-`);
-  }
-  return parts.join("\n");
+function changeHas(shape, artifact) {
+  const known = knownArtifacts(shape);
+  return known === null ? true : known.includes(artifact);
 }
-function cell(text) {
-  return text.replace(/\\/g, "\\\\").replace(/\|/g, "\\|");
+function stripLeadingNumber(text) {
+  return text.replace(/^\s*\d+(?:\.\d+)*[.)]?\s+/, "").trim();
 }
-function uncell(text) {
-  return text.replace(/\\\|/g, "|").replace(/\\\\/g, "\\");
+function renderTaskGroup(title, tasks, cites) {
+  const heading = cites ? `## ${title} \u2014 implements \`${cites.capability}\`: \`${cites.key}\`` : `## ${title}`;
+  return [heading, "", ...tasks.map((task) => `- [ ] ${task}`)].join("\n");
 }
-function renderTasks(doc) {
-  const parts = [`# Tasks \u2014 ${doc.id}
-`];
-  for (const group of doc.groups) {
-    const citation = group.cites ? ` \u2014 implements \`${group.cites.capability}\`: \`${group.cites.key}\`` : "";
-    const lines = [`## ${group.number}. ${group.title}${citation}
-`];
-    for (const task of group.tasks) {
-      const box = task.done ? "x" : " ";
-      lines.push(`- [${box}] ${task.number} ${task.title.split("\n").join(`
-${TASK_CONTINUATION}`)}`);
+function proposalFromToolCall(name, args, shape) {
+  switch (name) {
+    case "edit_artifact": {
+      const artifact = String(args["artifact"] ?? "").trim();
+      const shaped = ROOT_ARTIFACTS.includes(artifact) || SPEC_ARTIFACT.test(artifact);
+      if (!shaped) {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: `\`${artifact}\` is not an artifact of an OpenSpec change`
+        };
+      }
+      if (!changeHas(shape, artifact)) {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: `this change has no \`${artifact}\``
+        };
+      }
+      const text = String(args["text"] ?? "");
+      if (text.trim() === "") {
+        return { kind: "refused", tool: name, missing: "the markdown to write" };
+      }
+      const mode = String(args["mode"] ?? "").trim() === "replace" ? "replace" : "append";
+      return { kind: "artifact-edit", artifact, mode, text, tool: name };
     }
-    parts.push(`${lines.join("\n")}
-`);
+    case "add_task_group": {
+      if (!changeHas(shape, "tasks.md")) {
+        return { kind: "refused", tool: name, missing: "this change has no `tasks.md`" };
+      }
+      const title = stripLeadingNumber(String(args["title"] ?? ""));
+      const tasks = Array.isArray(args["tasks"]) ? args["tasks"].map((t) => stripLeadingNumber(String(t))).filter((t) => t !== "") : [];
+      if (title === "" || tasks.length === 0) {
+        return { kind: "refused", tool: name, missing: "a title and at least one task" };
+      }
+      const capability = String(args["capability"] ?? "").trim();
+      const key = String(args["requirement"] ?? "").trim();
+      if (capability === "" && key === "") {
+        return {
+          kind: "artifact-edit",
+          artifact: "tasks.md",
+          mode: "append",
+          text: renderTaskGroup(title, tasks, null),
+          tool: name
+        };
+      }
+      if (capability === "" || key === "") {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: "both a capability and a requirement name, or neither"
+        };
+      }
+      if (shape.citable !== void 0 && !shape.citable.some((c) => c.capability === capability && c.key === key)) {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: `\`${key}\` in \`${capability}\` is not a requirement this change declares`
+        };
+      }
+      const cites = { capability, key };
+      return {
+        kind: "artifact-edit",
+        artifact: "tasks.md",
+        mode: "append",
+        text: renderTaskGroup(title, tasks, cites),
+        tool: name,
+        cites
+      };
+    }
+    case "add_requirement": {
+      const capability = String(args["capability"] ?? "").trim();
+      const artifact = `specs/${capability}/spec.md`;
+      if (capability === "" || !SPEC_ARTIFACT.test(artifact)) {
+        return { kind: "refused", tool: name, missing: "a capability name" };
+      }
+      if (!changeHas(shape, artifact)) {
+        return {
+          kind: "refused",
+          tool: name,
+          missing: `this change has no delta spec for \`${capability}\``
+        };
+      }
+      const block = String(args["block"] ?? "").trim();
+      if (!/^###[ \t]+Requirement:/m.test(block)) {
+        return { kind: "refused", tool: name, missing: "a `### Requirement:` heading" };
+      }
+      return { kind: "artifact-edit", artifact, mode: "append", text: block, tool: name };
+    }
+    default:
+      return { kind: "refused", tool: name, missing: `no such tool \`${name}\`` };
   }
-  parts.push(renderTestingTable(doc.testing));
-  return parts.join("\n");
 }
-function renderTestingTable(rows) {
-  const lines = [
-    "## Testing",
-    "",
-    "One test per scenario. This table is derived from the change's deltas \u2014 it is not",
-    "editable text, and its row count is the change's scenario count.",
-    "",
-    "| # | Capability | Requirement | Scenario |",
-    "|---:|---|---|---|"
-  ];
-  for (const row of rows) {
-    lines.push(
-      `| ${row.index} | \`${cell(row.capability)}\` | ${cell(row.requirement)} | ${cell(row.scenario)} |`
-    );
-  }
-  if (rows.length === 0) lines.push("| \u2014 | \u2014 | \u2014 | \u2014 |");
-  return `${lines.join("\n")}
-`;
+function proposalsFromStructuredOutput(value, shape) {
+  const parsed = agentTurnResult.safeParse(value);
+  if (!parsed.success) return null;
+  return {
+    answer: parsed.data.answer,
+    proposals: parsed.data.proposals.map((call) => {
+      const { tool, ...args } = call;
+      return proposalFromToolCall(tool, args, shape);
+    })
+  };
 }
-function renderDeltaSpec(doc, changeId) {
-  const parts = [`# ${doc.capability} (delta) \u2014 ${changeId}
-`];
-  if (doc.purpose !== null) parts.push(`## Purpose
 
-${doc.purpose}
-`);
-  if (doc.added.length > 0) parts.push(section("## ADDED Requirements", doc.added));
-  if (doc.modified.length > 0) parts.push(section("## MODIFIED Requirements", doc.modified));
-  if (doc.removed.length > 0) {
-    parts.push(
-      section(
-        "## REMOVED Requirements",
-        doc.removed.map((name) => `### Requirement: ${name}`)
-      )
-    );
+// src/workbench/agent/agent-turn.ts
+var AGENT_TURN_MAX_TURNS = 12;
+function noCredentialReason(credential) {
+  if (credential.kind !== "no-model") return "no model is available";
+  return credential.droppedSelection === null ? "no model is available \u2014 no credential source on this machine is usable" : `no model is available \u2014 the selected ${credential.droppedSelection} source is not usable, and nothing else resolved`;
+}
+function servedLabel(served) {
+  return servedSentence(served);
+}
+async function runAgentTurn(input, deps = {}) {
+  const run = await runRailTurn(
+    {
+      prompt: input.prompt,
+      systemPrompt: input.systemPrompt,
+      cwd: input.cwd,
+      session: input.session,
+      maxTurns: AGENT_TURN_MAX_TURNS,
+      // The turn needs structure, so it asks for it. The harness validates against
+      // this schema and treats a "successful" run without conforming output as a
+      // failure, which is why nothing below needs a prose fallback.
+      outputSchema: AGENT_TURN_SCHEMA,
+      ...input.selection !== void 0 ? { selection: input.selection } : {}
+    },
+    deps
+  );
+  if (run.kind === "no-model") {
+    return { outcome: { kind: "no-credential", reason: noCredentialReason(run.credential) }, proposals: [] };
   }
-  if (doc.renamed.length > 0) {
-    const pairs = doc.renamed.map(
-      (pair) => `- FROM: \`### Requirement: ${pair.from}\`
-- TO: \`### Requirement: ${pair.to}\``
-    );
-    parts.push(`## RENAMED Requirements
-
-${pairs.join("\n\n")}
-`);
+  const turn = run.turn;
+  const served = servedLabel(turn.served);
+  if (turn.outcome === "failed" || turn.outcome === void 0 && turn.isError) {
+    return {
+      outcome: {
+        kind: "failed",
+        reason: turn.failure !== void 0 ? `${turn.failure.category}${turn.failure.recognised ? "" : " (unrecognised category)"}: ${turn.answer || "the model returned an error"}` : turn.answer || "the model returned an error",
+        served
+      },
+      proposals: []
+    };
+  }
+  const decoded = proposalsFromStructuredOutput(turn.structuredOutput, input.shape);
+  if (turn.outcome === "cut_short") {
+    return {
+      outcome: {
+        kind: "cut-short",
+        answer: decoded?.answer ?? turn.answer,
+        served,
+        selected: turn.selected
+      },
+      proposals: decoded?.proposals ?? []
+    };
+  }
+  if (decoded === null) {
+    return {
+      outcome: {
+        kind: "failed",
+        reason: "the turn returned no structured output to read proposals from",
+        served
+      },
+      proposals: []
+    };
   }
-  return parts.join("\n");
+  return {
+    outcome: { kind: "answered", answer: decoded.answer, served, selected: turn.selected },
+    proposals: decoded.proposals
+  };
 }
-function section(heading, blocks) {
-  return `${heading}
 
-${blocks.map((b) => b.trimEnd()).join("\n\n")}
-`;
-}
-function renderChangeDocument(doc) {
-  const files = [
-    { path: "proposal.md", content: renderProposal(doc) },
-    { path: "design.md", content: renderDesign(doc) },
-    { path: "tasks.md", content: renderTasks(doc) }
-  ];
-  for (const spec of doc.deltaSpecs) {
-    files.push({
-      path: `specs/${spec.capability}/spec.md`,
-      content: renderDeltaSpec(spec, doc.id)
-    });
+// server/change-files.ts
+import { createHash as createHash3 } from "node:crypto";
+import {
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync7,
+  statSync as statSync4,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { dirname as dirname4, join as join8 } from "node:path";
+
+// src/workbench/shell/lifecycle.ts
+var SPEC_DRIVEN = Object.freeze({
+  name: "spec-driven",
+  artifacts: Object.freeze([
+    Object.freeze({ id: "proposal", generates: "proposal.md", requires: Object.freeze([]) }),
+    Object.freeze({
+      id: "specs",
+      generates: "specs/**/*.md",
+      requires: Object.freeze(["proposal"])
+    }),
+    Object.freeze({ id: "design", generates: "design.md", requires: Object.freeze(["proposal"]) }),
+    Object.freeze({
+      id: "tasks",
+      generates: "tasks.md",
+      requires: Object.freeze(["specs", "design"])
+    })
+  ])
+});
+function parseSchemaName(yamlText) {
+  for (const raw of yamlText.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("#")) continue;
+    const match = /^schema:\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))\s*(?:#.*)?$/.exec(line);
+    if (!match) continue;
+    const value = (match[1] ?? match[2] ?? match[3] ?? "").trim();
+    return value === "" ? null : value;
   }
-  return { id: doc.id, files };
+  return null;
 }
-function emitChange(change) {
-  return renderChangeDocument(changeDocument(change));
+function resolveSchema(yamlText, known = [SPEC_DRIVEN]) {
+  const name = parseSchemaName(yamlText);
+  if (name === null) return { kind: "unknown-schema", name: "" };
+  const schema = known.find((candidate) => candidate.name === name);
+  return schema ? { kind: "resolved", schema } : { kind: "unknown-schema", name };
 }
-var TASK_LINE = /^- \[([ xX])\] (\d+\.\d+) (.*)$/;
-var TASK_CONTINUATION = "  ";
-var TASK_CONTINUATION_LINE = /^ {2}(.*)$/;
-var GROUP_CITATION = /^(.*) — implements `([^`]+)`: `([^`]+)`$/;
-var GROUP_HEADING = /^## (\d+)\. (.*)$/;
-var FENCE = /^```(\S*)\s*$/;
-function parseChangeDocument(emitted) {
-  const byPath = new Map(emitted.files.map((f) => [f.path, f.content]));
-  const proposalSrc = byPath.get("proposal.md") ?? "";
-  const designSrc = byPath.get("design.md") ?? "";
-  const tasksSrc = byPath.get("tasks.md") ?? "";
-  const parsedProposal = parseProposalFile(proposalSrc);
-  const groups = parseTasksFile(tasksSrc);
-  const deltaSpecs = emitted.files.filter((f) => f.path.startsWith("specs/") && f.path.endsWith("/spec.md")).map((f) => parseDeltaSpecFile(capabilityOfPath(f.path), f.content));
-  return {
-    id: emitted.id,
-    proposal: parsedProposal.draft,
-    proposalExtras: parsedProposal.extras,
-    design: parseDesignFile(designSrc),
-    groups: numberTasks(groups),
-    testing: parseTestingTable(tasksSrc),
-    deltaSpecs
-  };
+
+// server/change-files.ts
+function changeDirectory(repoRoot, changeId) {
+  return join8(repoRoot, "openspec", "changes", changeId);
 }
-function capabilityOfPath(path) {
-  const parts = path.split("/");
-  return parts[1] ?? "";
+var ROOT_ARTIFACTS2 = Object.freeze(["proposal.md", "design.md", "tasks.md"]);
+var CAPABILITY = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var SPEC_ARTIFACT2 = /^specs\/([^/]+)\/spec\.md$/;
+function resolveArtifact(name) {
+  if (name === "" || name !== name.trim()) return null;
+  if (name.includes("\\") || name.includes("\0")) return null;
+  if (name.startsWith("/") || /^[A-Za-z]:/.test(name)) return null;
+  if (name.split("/").some((part) => part === ".." || part === "." || part === "")) return null;
+  if (ROOT_ARTIFACTS2.includes(name)) return name;
+  const spec = SPEC_ARTIFACT2.exec(name);
+  if (spec && CAPABILITY.test(spec[1])) return name;
+  return null;
 }
-function parseProposalFile(src) {
-  const lines = src.split("\n");
-  const bodies = /* @__PURE__ */ new Map();
-  let current = null;
-  const extras = [];
-  let extra = null;
-  let lastFixed = null;
-  const flushExtra = () => {
-    if (!extra) return;
-    const text = extra.lines.join("\n").trimEnd();
-    if (text !== "") extras.push({ afterSection: extra.afterSection, text });
-    extra = null;
+var REAL_IO = { readText: (path) => readFileSync5(path, "utf8") };
+function stateOf(path, content) {
+  const stat = statSync4(path);
+  return {
+    size: stat.size,
+    mtimeMs: stat.mtimeMs,
+    hash: createHash3("sha256").update(Buffer.from(content, "utf8")).digest("hex")
   };
-  for (const line of lines) {
-    const p = probe2(line);
-    const spec = PROPOSAL_SECTIONS.find(
-      (s) => p === `${"#".repeat(s.level)} ${s.title}`
-    );
-    if (spec) {
-      flushExtra();
-      current = spec.id;
-      lastFixed = spec.id;
-      bodies.set(spec.id, []);
-      continue;
-    }
-    if (ANY_HEADING.test(p)) {
-      flushExtra();
-      current = null;
-      if (/^#[ \t]/.test(p) && !/^##/.test(p)) continue;
-      extra = { afterSection: lastFixed, lines: [p] };
-      continue;
-    }
-    if (current) bodies.get(current).push(p);
-    else if (extra) extra.lines.push(p);
-  }
-  flushExtra();
-  const draft = emptyProposal();
-  for (const spec of PROPOSAL_SECTIONS) {
-    const collected = [...bodies.get(spec.id) ?? []];
-    if (collected[0] === "") collected.shift();
-    if (collected.length > 0 && collected[collected.length - 1] === "") collected.pop();
-    const body = collected.join("\n");
-    if (body === "" || body === UNSATISFIED_MARKER) {
-      draft[spec.id] = { state: "empty" };
-      continue;
-    }
-    if (body.startsWith(SKIPPED_MARKER)) {
-      draft[spec.id] = { state: "skipped", reason: body.slice(SKIPPED_MARKER.length).trim() };
-      continue;
-    }
-    draft[spec.id] = { state: "authored", body };
-  }
-  return { draft, extras };
 }
-var DESIGN_HEADING = /^##[ \t]+(.*)$/;
-function parseDesignFile(src) {
-  const lines = src.split("\n");
-  const blocks = [];
-  let markdown = [];
-  let title = null;
-  let fence = null;
-  const withTitle = (block) => {
-    if (title === null) return block;
-    const titled = { ...block, title };
-    title = null;
-    return titled;
-  };
-  const flushMarkdown = () => {
-    const text = markdown.join("\n").trim();
-    if (text !== "" || title !== null) blocks.push(withTitle({ kind: "markdown", text }));
-    markdown = [];
-  };
-  for (const [i, line] of lines.entries()) {
-    const p = probe2(line);
-    const fenceMatch = FENCE.exec(p);
-    if (fence) {
-      if (p === "```") {
-        const kind = fence.info === DESIGN_FENCES.mermaid ? "mermaid" : "sketch";
-        blocks.push(withTitle({ kind, text: fence.lines.join("\n").trim() }));
-        fence = null;
-        continue;
-      }
-      fence.lines.push(p);
-      continue;
-    }
-    if (fenceMatch && isDesignFence(fenceMatch[1] ?? "")) {
-      if (markdown.join("\n").trim() !== "") flushMarkdown();
-      markdown = [];
-      fence = { info: fenceMatch[1], lines: [] };
-      continue;
-    }
-    const heading = DESIGN_HEADING.exec(p);
-    if (heading) {
-      flushMarkdown();
-      title = (heading[1] ?? "").trim();
-      continue;
-    }
-    if (i === 0 && p.startsWith("# Design \u2014 ")) continue;
-    markdown.push(p);
+function currentState(path) {
+  try {
+    return stateOf(path, readFileSync5(path, "utf8"));
+  } catch {
+    return null;
   }
-  flushMarkdown();
-  return blocks;
-}
-function isDesignFence(info) {
-  return info === DESIGN_FENCES.mermaid || info === DESIGN_FENCES.sketch;
 }
-function parseTasksFile(src) {
-  const groups = [];
-  let open = null;
-  for (const line of src.split("\n")) {
-    const p = probe2(line);
-    const heading = GROUP_HEADING.exec(p);
-    if (heading) {
-      if (open) groups.push(open);
-      const text = (heading[2] ?? "").trim();
-      const cited = GROUP_CITATION.exec(text);
-      open = cited ? {
-        title: (cited[1] ?? "").trim(),
-        tasks: [],
-        cites: { capability: cited[2], key: cited[3] }
-      } : { title: text, tasks: [] };
-      continue;
-    }
-    if (/^##[ \t]/.test(p)) {
-      if (open) groups.push(open);
-      open = null;
-      continue;
-    }
-    const task = TASK_LINE.exec(p);
-    if (task && open) {
-      const done = (task[1] ?? " ").toLowerCase() === "x";
-      open.tasks.push({ title: task[3] ?? "", done });
-      continue;
-    }
-    const continuation = TASK_CONTINUATION_LINE.exec(p);
-    if (continuation && open && open.tasks.length > 0) {
-      const last = open.tasks[open.tasks.length - 1];
-      open.tasks[open.tasks.length - 1] = {
-        ...last,
-        title: `${last.title}
-${continuation[1] ?? ""}`
+function readArtifact(changeDir, name, io = REAL_IO) {
+  const artifact = resolveArtifact(name);
+  if (artifact === null) {
+    return { outcome: "refused", artifact: name, reason: notAnArtifact(name) };
+  }
+  const path = join8(changeDir, artifact);
+  let size;
+  try {
+    const stat = statSync4(path);
+    if (!stat.isFile()) {
+      return {
+        outcome: "unreadable",
+        artifact,
+        reason: `\`${artifact}\` is not a file \u2014 the change directory holds something else under that name`
       };
     }
+    size = stat.size;
+  } catch (err) {
+    if (err.code === "ENOENT") return { outcome: "absent", artifact };
+    return { outcome: "unreadable", artifact, reason: describeErrno(artifact, err) };
   }
-  if (open) groups.push(open);
-  return groups;
-}
-function parseTestingTable(src) {
-  const rows = [];
-  let inTable = false;
-  for (const line of src.split("\n")) {
-    const p = probe2(line);
-    if (p.startsWith("| # | Capability |")) {
-      inTable = true;
-      continue;
-    }
-    if (!inTable) continue;
-    if (!p.startsWith("|")) break;
-    if (/^\|[-: |]+\|$/.test(p)) continue;
-    const cells = splitRow(p);
-    if (cells.length !== 4) continue;
-    const index = Number.parseInt(cells[0], 10);
-    if (!Number.isFinite(index)) continue;
-    rows.push({
-      index,
-      capability: cells[1].replace(/^`|`$/g, ""),
-      requirement: cells[2],
-      scenario: cells[3]
-    });
-  }
-  return rows;
-}
-function splitRow(line) {
-  const cells = [];
-  let buffer = "";
-  let escaped = false;
-  for (const char of line.slice(1, line.lastIndexOf("|"))) {
-    if (escaped) {
-      buffer += `\\${char}`;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\") {
-      escaped = true;
-      continue;
-    }
-    if (char === "|") {
-      cells.push(uncell(buffer.trim()));
-      buffer = "";
-      continue;
-    }
-    buffer += char;
-  }
-  cells.push(uncell(buffer.trim()));
-  return cells;
-}
-var DELTA_SECTION = /^## (ADDED|MODIFIED|REMOVED|RENAMED) Requirements[ \t]*$/;
-var REQUIREMENT_HEADING2 = /^###[ \t]+Requirement:[ \t]*(.*)$/;
-var RENAME_FROM = /^-[ \t]+FROM:[ \t]*`###[ \t]*Requirement:[ \t]*(.+?)`[ \t]*$/;
-var RENAME_TO = /^-[ \t]+TO:[ \t]*`###[ \t]*Requirement:[ \t]*(.+?)`[ \t]*$/;
-function parseDeltaSpecFile(capability, src) {
-  const added = [];
-  const modified = [];
-  const removed = [];
-  const renamed = [];
-  const purposeLines = [];
-  let operation = null;
-  let block = null;
-  let pendingFrom = null;
-  const flushBlock = () => {
-    if (!block) return;
-    const text = block.join("\n").trimEnd();
-    if (operation === "ADDED") added.push(text);
-    if (operation === "MODIFIED") modified.push(text);
-    block = null;
-  };
-  for (const line of src.split("\n")) {
-    const p = probe2(line);
-    const sectionHeading = DELTA_SECTION.exec(p);
-    if (sectionHeading) {
-      flushBlock();
-      operation = sectionHeading[1];
-      continue;
-    }
-    if (PURPOSE_HEADING.test(p)) {
-      flushBlock();
-      operation = "PURPOSE";
-      continue;
-    }
-    if (/^##(?!#)[ \t]/.test(p)) {
-      flushBlock();
-      operation = null;
-      continue;
-    }
-    if (operation === "PURPOSE") {
-      purposeLines.push(p);
-      continue;
-    }
-    const requirementHeading = REQUIREMENT_HEADING2.exec(p);
-    if (requirementHeading) {
-      flushBlock();
-      if (operation === "REMOVED") {
-        removed.push((requirementHeading[1] ?? "").trim());
-        continue;
-      }
-      if (operation === "ADDED" || operation === "MODIFIED") block = [p];
-      continue;
-    }
-    if (operation === "RENAMED") {
-      const from = RENAME_FROM.exec(p);
-      if (from) {
-        pendingFrom = (from[1] ?? "").trim();
-        continue;
-      }
-      const to = RENAME_TO.exec(p);
-      if (to && pendingFrom !== null) {
-        renamed.push({ from: pendingFrom, to: (to[1] ?? "").trim() });
-        pendingFrom = null;
-      }
-      continue;
-    }
-    if (block) block.push(p);
+  let content;
+  try {
+    content = io.readText(path);
+  } catch (err) {
+    return { outcome: "unreadable", artifact, reason: describeErrno(artifact, err) };
   }
-  flushBlock();
-  const purpose = purposeLines.join("\n").trim();
-  return {
-    capability,
-    purpose: purpose === "" ? null : purpose,
-    added,
-    modified,
-    removed,
-    renamed
-  };
-}
-
-// src/workbench/core/validate.ts
-var SHALL_OR_MUST = /\b(SHALL|MUST)\b/;
-function validateChange(change) {
-  const findings = [
-    ...validateProposal(change),
-    ...validateDesign(change),
-    ...validateCapabilities(change),
-    ...validateTasks(change)
-  ];
-  return report(findings);
-}
-function report(findings) {
-  const errors = findings.filter((f) => f.severity === "error");
-  const warnings = findings.filter((f) => f.severity === "warning");
-  return { findings, errors, warnings, valid: errors.length === 0 };
-}
-function validateProposal(change) {
-  const findings = [];
-  for (const spec of PROPOSAL_SECTIONS) {
-    const section2 = change.proposal[spec.id];
-    const subject = {
-      kind: "proposal-section",
-      section: spec.id,
-      title: spec.title
+  if (content === "" && size > 0) {
+    return {
+      outcome: "unreadable",
+      artifact,
+      reason: `\`${artifact}\` holds ${size} bytes on disk but read back empty \u2014 this is a read failure, not an empty artifact. Nothing has been shown to you, so do not save over it.`
     };
-    if (section2.state === "skipped") {
-      findings.push(...validateSkip(spec, section2.reason, subject));
-      continue;
-    }
-    if (section2.state === "empty" && spec.required) {
-      findings.push({
-        severity: "error",
-        kind: "proposal-section-unsatisfied",
-        subject,
-        message: `\`${spec.title}\` has no body and no recorded skip, and is required.`
-      });
-    }
   }
-  return findings;
+  return { outcome: "read", artifact, content, state: stateOf(path, content) };
 }
-function validateSkip(spec, reason, subject) {
-  if (!spec.skippable) {
-    return [
-      {
-        severity: "error",
-        kind: "proposal-section-not-skippable",
-        subject,
-        message: `\`${spec.title}\` is not skippable \u2014 only the C4 levels are.`
-      }
-    ];
+function listArtifacts(changeDir) {
+  const found = [];
+  for (const name of ROOT_ARTIFACTS2) {
+    if (existsSync6(join8(changeDir, name))) found.push(name);
   }
-  if (reason.trim() === "") {
-    return [
-      {
-        severity: "error",
-        kind: "proposal-skip-without-reason",
-        subject,
-        message: `\`${spec.title}\` is skipped with no recorded reason; a skip requires one.`
-      }
-    ];
+  let capabilities = [];
+  try {
+    capabilities = readdirSync7(join8(changeDir, "specs"), { withFileTypes: true }).filter((e) => e.isDirectory() && CAPABILITY.test(e.name)).map((e) => e.name).sort();
+  } catch {
+    capabilities = [];
   }
-  return [];
-}
-function validateDesign(change) {
-  if (change.design.length === 0) {
-    return [
-      {
-        severity: "warning",
-        kind: "design-empty",
-        subject: { kind: "change", change: change.id },
-        message: "`design.md` carries no blocks; the change will emit a title and nothing else."
-      }
-    ];
+  for (const capability of capabilities) {
+    const artifact = `specs/${capability}/spec.md`;
+    if (existsSync6(join8(changeDir, artifact))) found.push(artifact);
   }
-  const findings = [];
-  change.design.forEach((block, index) => {
-    if ((block.title ?? "").trim() !== "") return;
-    findings.push({
-      severity: "error",
-      kind: "design-block-untitled",
-      // An untitled block has no name to be reported under, so it is named by where
-      // it is and what it is — the two things the author can find it by.
-      subject: { kind: "design-block", index, blockKind: block.kind },
-      message: `Design block ${index + 1} (\`${block.kind}\`) carries no title, and a block's title is emitted as its \`##\` heading.`
-    });
-  });
-  return findings;
-}
-function draftIsWholeAgain(entry) {
-  const declared = entry.declaredRequirements ?? [];
-  if (declared.length === 0) return false;
-  return declared.every(
-    (name) => new RegExp(`^###[ \\t]+Requirement:[ \\t]*${escapeForRegExp(name)}\\s*$`, "m").test(entry.draft)
-  );
-}
-function escapeForRegExp(text) {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return found;
 }
-function validateCapabilities(change) {
-  const findings = [];
-  let derivedDeltas = 0;
-  for (const entry of change.capabilities) {
-    if (entry.reconstructed === false && !draftIsWholeAgain(entry)) {
-      findings.push({
-        severity: "error",
-        kind: "capability-draft-unreconstructed",
-        subject: { kind: "capability", capability: entry.capability },
-        message: `\`${entry.capability}\`'s draft could not be rebuilt from this change's delta and opened from the folded text instead${entry.reconstructionReason ? ` (${entry.reconstructionReason})` : ""}. Emitting from it would derive a delta without whatever this change had already added. Restore the draft before emitting.`
-      });
-      continue;
-    }
-    if (entry.derivation.outcome === "refused") {
-      findings.push(...refusalFindings(entry));
-      continue;
-    }
-    const deltas = deltasOf(entry);
-    derivedDeltas += deltas.length;
-    findings.push(...emptyDerivationFindings(entry));
-    findings.push(...conditionFindings(entry));
-    findings.push(...requirementFindings(entry));
-    findings.push(...duplicateIdentityFindings(entry));
-  }
-  if (derivedDeltas === 0) {
-    findings.push({
-      severity: "error",
-      kind: "no-delta-derived",
-      subject: { kind: "change", change: change.id },
-      message: "the change derives no delta at all, so it alters nothing \u2014 there is no operation to fold."
-    });
+function writeArtifact(changeDir, name, content, options = {}) {
+  const artifact = resolveArtifact(name);
+  if (artifact === null) {
+    return { outcome: "refused", artifact: name, reason: notAnArtifact(name) };
   }
-  return findings;
+  const path = join8(changeDir, artifact);
+  if (options.expected !== void 0 && options.overwrite !== true) {
+    const conflict = conflictWith(path, artifact, options.expected);
+    if (conflict) return conflict;
+  }
+  const materialised = !existsSync6(changeDir);
+  try {
+    mkdirSync3(dirname4(path), { recursive: true });
+    writeFileSync3(path, Buffer.from(content, "utf8"));
+    writeSchemaFile(changeDir);
+  } catch (err) {
+    return { outcome: "refused", artifact, reason: describeErrno(artifact, err) };
+  }
+  return { outcome: "written", artifact, path, state: stateOf(path, content), materialised };
 }
-function refusalFindings(entry) {
-  if (entry.derivation.outcome !== "refused") return [];
-  return entry.derivation.refusals.map((refusal) => {
-    if (refusal.kind === "duplicate-identity") {
-      const keys = refusal.collisions.map((c) => `\`${c.key}\``).join(", ");
-      return {
-        severity: "error",
-        kind: "duplicate-requirement-identity",
-        subject: { kind: "capability", capability: entry.capability },
-        message: `two requirements in the ${refusal.side} \`${entry.capability}\` claim one identity: ${keys}. One of them would derive nothing.`
-      };
-    }
-    if (refusal.kind === "unterminated-fence") {
-      return {
-        severity: "error",
-        kind: "capability-derivation-refused",
-        subject: { kind: "capability", capability: entry.capability },
-        message: `the ${refusal.side} \`${entry.capability}\` opens a fence on line ${refusal.openLine + 1} (\`${refusal.openText.trim()}\`) and never closes it, so everything after it sits inside the requirement above.`
-      };
-    }
+function conflictWith(path, artifact, expected) {
+  const current = currentState(path);
+  if (expected === null) {
+    if (current === null) return null;
     return {
-      severity: "error",
-      kind: "capability-derivation-refused",
-      subject: { kind: "capability", capability: entry.capability },
-      message: `\`${entry.capability}\` derives nothing: ${refusal.kind}.`
+      outcome: "changed-underneath",
+      artifact,
+      reason: `\`${artifact}\` was created underneath the buffer \u2014 the buffer was opened on a change that did not have this file, and something has written one since. Nothing was written.`,
+      current
     };
-  });
-}
-function emptyDerivationFindings(entry) {
-  if (entry.derivation.outcome !== "derived") return [];
-  if (entry.derivation.deltas.length > 0) return [];
-  const subject = { kind: "capability", capability: entry.capability };
-  switch (entry.derivation.foldedComparison.kind) {
-    case "identical":
-      return [
-        {
-          severity: "warning",
-          kind: "capability-unchanged",
-          subject,
-          message: `\`${entry.capability}\` is open but byte-identical to its folded file; no delta spec is emitted for it.`
-        }
-      ];
-    case "differs-outside-requirements":
-      return [
-        {
-          severity: "error",
-          kind: "capability-changed-outside-requirements",
-          subject,
-          message: `\`${entry.capability}\` differs from its folded file only outside its requirements (its \`## Purpose\` or head). OpenSpec has no operation for that edit \u2014 a delta file carrying no operation cannot fold. Edit \`openspec/specs/${entry.capability}/spec.md\` directly, or revert the edit.`
-        }
-      ];
-    case "differs-in-requirement-order":
-      return [
-        {
-          severity: "error",
-          kind: "capability-requirements-reordered",
-          subject,
-          message: `\`${entry.capability}\`'s requirements are reordered and otherwise unchanged. OpenSpec has no move operation, so the reordering cannot be folded and would be lost.`
-        }
-      ];
-    case "no-folded-counterpart":
-      return [
-        {
-          severity: "error",
-          kind: "new-capability-declares-no-requirement",
-          subject,
-          message: `\`${entry.capability}\` is a new capability that declares no requirement; there is nothing to add.`
-        }
-      ];
-    case "differs":
-      return [
-        {
-          severity: "error",
-          kind: "capability-differs-without-delta",
-          subject,
-          message: `\`${entry.capability}\` differs from its folded file but derives no delta; the derivation and the comparison disagree about the same two documents.`
-        }
-      ];
-  }
-}
-function conditionFindings(entry) {
-  if (entry.derivation.outcome !== "derived") return [];
-  const findings = [];
-  const isNew = entry.derivation.foldedComparison.kind === "no-folded-counterpart";
-  const subject = { kind: "capability", capability: entry.capability };
-  for (const condition of entry.derivation.conditions) {
-    if (isNew && (condition.kind === "purpose-empty" || condition.kind === "purpose-missing")) {
-      findings.push({
-        severity: "error",
-        kind: "new-capability-purpose-empty",
-        subject,
-        message: `new capability \`${entry.capability}\` has ${condition.kind === "purpose-missing" ? "no `## Purpose` heading" : "an empty `## Purpose`"}; it seeds the folded spec's Purpose, which cannot be left blank.`
-      });
-    }
-    if (condition.kind === "identity-scheme-changed") {
-      findings.push({
-        severity: "warning",
-        kind: "identity-scheme-changed",
-        subject,
-        message: `\`${entry.capability}\`'s folded file resolves on ${condition.foldedScheme} identity and its draft on ${condition.draftScheme}, so no key matches across them: every requirement derives as a removal plus an addition. Declare the renames if that is not what you meant.`
-      });
-    }
   }
-  return findings;
-}
-function requirementFindings(entry) {
-  const findings = [];
-  for (const delta of deltasOf(entry)) {
-    const block = draftBlockOf(delta);
-    if (!block) continue;
-    const subject = {
-      kind: "requirement",
-      capability: entry.capability,
-      requirement: block.name
+  if (current === null) {
+    return {
+      outcome: "changed-underneath",
+      artifact,
+      reason: `\`${artifact}\` has gone from disk underneath the buffer \u2014 it was deleted or the change directory was moved (\`openspec archive\` moves the whole directory). Nothing was written.`,
+      current: null
     };
-    if (!SHALL_OR_MUST.test(requirementProse(block))) {
-      findings.push({
-        severity: "error",
-        kind: "requirement-without-shall",
-        subject,
-        message: `\`${block.name}\` in \`${entry.capability}\` states no obligation: its text carries neither SHALL nor MUST.`
-      });
-    }
-    const scenarios = parseScenarios(block);
-    if (scenarios.length === 0) {
-      findings.push({
-        severity: "error",
-        kind: "requirement-without-scenario",
-        subject,
-        message: `\`${block.name}\` in \`${entry.capability}\` has no \`#### Scenario:\`; a requirement is not testable without one.`
-      });
-    }
-    for (const scenario of scenarios) {
-      if (scenario.steps.length > 0) continue;
-      findings.push({
-        severity: "error",
-        kind: "scenario-without-steps",
-        subject: {
-          kind: "scenario",
-          capability: entry.capability,
-          requirement: block.name,
-          scenario: scenario.name
-        },
-        message: `scenario \`${scenario.name}\` of \`${block.name}\` in \`${entry.capability}\` has no steps.`
-      });
-    }
   }
-  return findings;
+  if (current.hash === expected.hash) return null;
+  return {
+    outcome: "changed-underneath",
+    artifact,
+    reason: `\`${artifact}\` changed underneath the buffer \u2014 the file on disk is no longer the one this buffer was read from. Nothing was written, and your edits are still here: choose whether to overwrite the file with the buffer or discard the buffer and reload the file.`,
+    current
+  };
 }
-function duplicateIdentityFindings(entry) {
-  const findings = [];
-  const seen = /* @__PURE__ */ new Map();
-  for (const delta of deltasOf(entry)) {
-    const block = draftBlockOf(delta);
-    const name = block ? block.name : delta.operation === "REMOVED" ? delta.base.name : delta.key;
-    const section2 = delta.operation === "RENAMED" ? "MODIFIED" : delta.operation;
-    const slot = `${section2} ${name}`;
-    seen.set(slot, { name, count: (seen.get(slot)?.count ?? 0) + 1 });
-  }
-  for (const { name, count } of seen.values()) {
-    if (count < 2) continue;
-    findings.push({
-      severity: "error",
-      kind: "duplicate-requirement-identity",
-      subject: { kind: "requirement", capability: entry.capability, requirement: name },
-      message: `\`${name}\` appears ${count} times in \`${entry.capability}\`'s deltas; one of them would be invisible after the fold.`
-    });
-  }
-  return findings;
+function writeSchemaFile(changeDir) {
+  const path = join8(changeDir, ".openspec.yaml");
+  if (existsSync6(path)) return;
+  writeFileSync3(path, `schema: ${SPEC_DRIVEN.name}
+`, "utf8");
 }
-function validateTasks(change) {
-  const findings = [];
-  const citable = new Set(
-    citableRequirements(change.capabilities).map((c) => `${c.capability} ${c.key}`)
-  );
-  for (const group of numberTasks(change.tasks)) {
-    if (group.tasks.length === 0) {
-      findings.push({
-        severity: "error",
-        kind: "task-group-empty",
-        subject: { kind: "task-group", number: group.number, title: group.title },
-        message: `Task group ${group.number} (\`${group.title}\`) carries no tasks.`
-      });
-    }
-    const cites = group.cites;
-    if (cites) {
-      const subject = {
-        kind: "task-group",
-        number: group.number,
-        title: group.title
-      };
-      if (cites.capability.includes("`") || cites.key.includes("`") || group.title.includes("`")) {
-        findings.push({
-          severity: "error",
-          kind: "task-citation-unrepresentable",
-          subject,
-          message: `task group ${group.number} carries a backtick in its title or citation; the emitted citation could not be read back unambiguously.`
-        });
-      } else if (!citable.has(`${cites.capability} ${cites.key}`)) {
-        findings.push({
-          severity: "error",
-          kind: "task-cites-absent-requirement",
-          subject,
-          message: `task group ${group.number} cites \`${cites.key}\` in \`${cites.capability}\`, which this change no longer declares.`
-        });
-      }
-    }
-  }
-  return findings;
+function notAnArtifact(name) {
+  return `\`${name}\` is not an artifact of this change. The workbench writes exactly the OpenSpec layout \u2014 \`proposal.md\`, \`design.md\`, \`tasks.md\` and \`specs/<capability>/spec.md\` \u2014 within the one open change, and reaches nothing else.`;
+}
+function describeErrno(artifact, err) {
+  const e = err;
+  const code = e.code ?? "unknown";
+  const why = {
+    EACCES: "permission denied",
+    EPERM: "the operation is not permitted",
+    EROFS: "the filesystem is read-only",
+    ENOSPC: "the filesystem is full",
+    ENOENT: "the change directory has gone",
+    EISDIR: "a directory is in the way",
+    ENOTDIR: "a file is in the way of the directory it needs"
+  };
+  return `\`${artifact}\`: ${why[code] ?? e.message ?? String(err)} (${code})`;
 }
 
-// src/workbench/shell/provenance.ts
-var NO_ISSUE = Object.freeze({ kind: "none" });
-function provenanceValue(provenance) {
-  return provenance.kind === "issue" ? String(provenance.issue) : "none";
-}
-function provenanceFrontmatter(provenance) {
-  return `---
-issue: ${provenanceValue(provenance)}
----
-`;
-}
-function emitChangeWithProvenance(change, provenance) {
-  const emitted = emitChange(change);
+// server/openspec-validate.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join9 } from "node:path";
+
+// src/workbench/core/validate.ts
+var QUOTED_SUBJECT = /"([^"]+)"/;
+var SCENARIO_IN_MESSAGE = /scenario\s+"([^"]+)"/i;
+function severityOf(level) {
+  return level.trim().toUpperCase() === "WARNING" ? "warning" : "error";
+}
+function capabilityOfIssuePath(path) {
+  if (path === void 0) return null;
+  return /(?:^|\/)([^/]+)\/spec\.md$/.exec(path)?.[1] ?? null;
+}
+function openSpecFinding(issue, changeId = "") {
+  const capability = capabilityOfIssuePath(issue.path);
+  const named = QUOTED_SUBJECT.exec(issue.message)?.[1];
+  const scenario = SCENARIO_IN_MESSAGE.exec(issue.message)?.[1];
+  let subject = { kind: "change", change: changeId };
+  if (capability !== null && named !== void 0 && scenario !== void 0) {
+    subject = { kind: "scenario", capability, requirement: named, scenario };
+  } else if (capability !== null && named !== void 0) {
+    subject = { kind: "requirement", capability, requirement: named };
+  } else if (capability !== null) {
+    subject = { kind: "capability", capability };
+  }
   return {
-    id: emitted.id,
-    files: emitted.files.map(
-      (file) => file.path === "proposal.md" ? { path: file.path, content: `${provenanceFrontmatter(provenance)}
-${file.content}` } : file
-    )
+    severity: severityOf(issue.level),
+    kind: "openspec-reported",
+    subject,
+    message: issue.message
   };
 }
-
-// src/workbench/approve/approve.ts
-var ARCHIVE_FLAGS = Object.freeze(["--json", "--yes"]);
-var FLAGS_APPROVAL_NEVER_PASSES = Object.freeze([
-  "--skip-specs",
-  "--no-validate"
-]);
-function archiveArgv(changeId) {
-  return ["archive", changeId, ...ARCHIVE_FLAGS];
-}
-function changeDirectoryOf(repoRoot, changeId) {
-  return join7(repoRoot, "openspec", "changes", changeId);
+function openSpecFindings(issues, changeId = "") {
+  return issues.map((issue) => openSpecFinding(issue, changeId));
 }
-function approveChange(repoRoot, change, provenance, options = {}) {
-  const directory = changeDirectoryOf(repoRoot, change.id);
-  const report2 = validateChange(change);
-  if (!report2.valid) {
-    return { outcome: "refused-validation", errors: report2.errors, warnings: report2.warnings };
-  }
-  const emitted = emitChangeWithProvenance(change, provenance);
-  if (!existsSync5(directory)) return { outcome: "refused-not-emitted", directory };
-  const differing = emittedDifferences(directory, emitted);
-  if (differing.length > 0) return { outcome: "refused-emission-stale", directory, differing };
-  const foldedCapabilities = emitted.files.filter((f) => f.path.startsWith("specs/") && f.path.endsWith("/spec.md")).map((f) => f.path.split("/")[1]);
-  const snapshot = takeSnapshot(repoRoot);
-  try {
-    const archive = runArchive(repoRoot, change.id, options);
-    if (archive.kind === "failed") {
-      return {
-        outcome: "refused-fold-failed",
-        code: archive.code,
-        message: archive.message,
-        rollback: restore(repoRoot, snapshot)
-      };
-    }
-    const incomplete = incompleteness(repoRoot, change.id, archive, foldedCapabilities);
-    if (incomplete) {
-      return {
-        outcome: "refused-fold-incomplete",
-        reason: incomplete,
-        rollback: restore(repoRoot, snapshot)
-      };
-    }
+
+// server/openspec-validate.ts
+var runOpenSpecValidate = (repoRoot, changeId) => {
+  const local = join9(repoRoot, "node_modules", ".bin", "openspec");
+  const command = existsSync7(local) ? local : "openspec";
+  const run = spawnSync(command, ["validate", changeId, "--strict", "--json", "--no-interactive"], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    // A validator is not allowed to hang the surface that recomputes on every edit.
+    timeout: 2e4
+  });
+  if (run.error) {
     return {
-      outcome: "approved",
-      archivedAs: archive.archivedAs,
-      archivePath: archive.path,
-      foldedCapabilities,
-      totals: archive.totals,
-      warnings: report2.warnings
+      stdout: "",
+      stderr: "",
+      failed: run.error.code === "ENOENT" ? `\`openspec\` could not be run from ${repoRoot} \u2014 the tool this workbench validates through is not installed there` : run.error.message
     };
-  } finally {
-    discardSnapshot(snapshot);
-  }
-}
-function emittedDifferences(directory, emitted) {
-  const differing = [];
-  for (const file of emitted.files) {
-    const target = join7(directory, file.path);
-    let onDisk;
-    try {
-      onDisk = readFileSync5(target, "utf8");
-    } catch {
-      differing.push(file.path);
-      continue;
-    }
-    if (onDisk !== file.content) differing.push(file.path);
-  }
-  return differing;
-}
-var SNAPSHOT_TREES = Object.freeze(["specs", "changes"]);
-function takeSnapshot(repoRoot) {
-  const directory = mkdtempSync(join7(tmpdir(), "specsketch-approve-"));
-  const present = [];
-  for (const tree of SNAPSHOT_TREES) {
-    const source = join7(repoRoot, "openspec", tree);
-    if (!existsSync5(source)) continue;
-    cpSync(source, join7(directory, tree), { recursive: true });
-    present.push(tree);
-  }
-  return { root: repoRoot, present, directory };
-}
-function restore(repoRoot, snapshot) {
-  try {
-    for (const tree of SNAPSHOT_TREES) {
-      const target = join7(repoRoot, "openspec", tree);
-      rmSync(target, { recursive: true, force: true });
-      if (!snapshot.present.includes(tree)) continue;
-      mkdirSync3(join7(repoRoot, "openspec"), { recursive: true });
-      cpSync(join7(snapshot.directory, tree), target, { recursive: true });
-    }
-    return { kind: "restored" };
-  } catch (error) {
-    return { kind: "restore-failed", error: error instanceof Error ? error.message : String(error) };
   }
-}
-function discardSnapshot(snapshot) {
-  rmSync(snapshot.directory, { recursive: true, force: true });
-}
-function resolveOpenspecBinary(repoRoot) {
-  const local = join7(repoRoot, "node_modules", ".bin", "openspec");
-  return existsSync5(local) ? local : "openspec";
-}
-var NO_TOTALS = Object.freeze({ added: 0, modified: 0, removed: 0, renamed: 0 });
-function runArchive(repoRoot, changeId, options) {
-  const bin = options.openspecBin ?? resolveOpenspecBinary(repoRoot);
-  let stdout;
-  try {
-    stdout = execFileSync(bin, [...archiveArgv(changeId)], {
-      cwd: repoRoot,
-      encoding: "utf8"
-    });
-  } catch (error) {
-    const captured = error.stdout;
-    if (typeof captured === "string" && captured.trim() !== "") stdout = captured;
-    else {
-      return {
-        kind: "failed",
-        code: "archive_not_run",
-        message: error instanceof Error ? error.message : String(error)
-      };
-    }
-  }
-  return readArchiveJson(stdout);
-}
-function readArchiveJson(stdout) {
+  return { stdout: run.stdout ?? "", stderr: run.stderr ?? "" };
+};
+function validateChangeOnDisk(repoRoot, changeId, run = runOpenSpecValidate) {
+  const result = run(repoRoot, changeId);
+  if (result.failed !== void 0) return { outcome: "unavailable", reason: result.failed };
   let parsed;
   try {
-    parsed = JSON.parse(stdout);
+    parsed = JSON.parse(result.stdout);
   } catch {
-    return { kind: "failed", code: "archive_output_unreadable", message: stdout.trim() };
+    const detail = (result.stderr || result.stdout).trim().split("\n")[0] ?? "";
+    return {
+      outcome: "unavailable",
+      reason: `\`openspec validate\` did not answer with JSON${detail === "" ? "" : `: ${detail}`}`
+    };
   }
-  if (!parsed.archive) {
-    const diagnostic = parsed.status?.[0];
+  const item = parsed.items?.find((i) => i.id === changeId) ?? parsed.items?.[0];
+  if (!item) {
     return {
-      kind: "failed",
-      code: diagnostic?.code ?? "archive_failed",
-      message: diagnostic?.message ?? "openspec archive reported no result and no diagnostic."
+      outcome: "unavailable",
+      reason: `\`openspec validate\` reported nothing for \`${changeId}\``
     };
   }
-  const totals = parsed.archive.totals;
+  const findings = openSpecFindings(item.issues ?? []);
+  const errors = findings.filter((f) => f.severity === "error");
+  const warnings = findings.filter((f) => f.severity === "warning");
   return {
-    kind: "archived",
-    archivedAs: parsed.archive.archivedAs ?? "",
-    path: parsed.archive.path ?? "",
-    specsUpdated: parsed.archive.specsUpdated === true,
-    totals: totals ? {
-      added: totals.added ?? 0,
-      modified: totals.modified ?? 0,
-      removed: totals.removed ?? 0,
-      renamed: totals.renamed ?? 0
-    } : NO_TOTALS
+    outcome: "validated",
+    // The tool's own verdict, not one recomputed from the issue list — under
+    // `--strict` a warning fails, and re-deriving that rule here would be the second
+    // implementation this module exists to avoid.
+    valid: item.valid === true,
+    errors,
+    warnings
   };
 }
-function incompleteness(repoRoot, changeId, archive, foldedCapabilities) {
-  if (!archive.specsUpdated) return { kind: "no-spec-updated" };
-  const folded = archive.totals.added + archive.totals.modified + archive.totals.removed + archive.totals.renamed;
-  if (folded === 0) return { kind: "nothing-folded" };
-  for (const capability of foldedCapabilities) {
-    if (!existsSync5(join7(repoRoot, "openspec", "specs", capability, "spec.md"))) {
-      return { kind: "capability-not-folded", capability };
+
+// server/approvals.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join10 } from "node:path";
+var SIDECAR = ".specsketch.json";
+var OVERLAY_DECLARATION = "authoring-overlay \u2014 specsketch only, never lifecycle truth";
+var STAGE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var REAL_IO2 = { readText: (path) => readFileSync6(path, "utf8") };
+function readApprovals(changeDir, io = REAL_IO2) {
+  const path = join10(changeDir, SIDECAR);
+  let size;
+  try {
+    const stat = statSync5(path);
+    if (!stat.isFile()) {
+      return { outcome: "unreadable", reason: `\`${SIDECAR}\` is not a file` };
     }
+    size = stat.size;
+  } catch (err) {
+    if (err.code === "ENOENT") return { outcome: "absent" };
+    return { outcome: "unreadable", reason: describe(err) };
   }
-  if (existsSync5(changeDirectoryOf(repoRoot, changeId))) return { kind: "change-still-in-changes" };
-  const archived = join7(repoRoot, "openspec", "changes", "archive", archive.archivedAs);
-  if (archive.archivedAs === "" || !isDirectory(archived)) {
-    return { kind: "archive-directory-missing", expected: archived };
-  }
-  return null;
-}
-function isDirectory(path) {
+  let text;
   try {
-    return statSync3(path).isDirectory();
-  } catch {
-    return false;
+    text = io.readText(path);
+  } catch (err) {
+    return { outcome: "unreadable", reason: describe(err) };
   }
-}
-
-// src/workbench/write/write-change.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync as readdirSync6, statSync as statSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
-
-// src/workbench/shell/lifecycle.ts
-var SPEC_DRIVEN = Object.freeze({
-  name: "spec-driven",
-  artifacts: Object.freeze(["proposal", "specs", "design", "tasks"])
-});
-
-// src/workbench/write/write-change.ts
-function changeDirectory(repoRoot, changeId) {
-  return join8(repoRoot, "openspec", "changes", changeId);
-}
-function writeChange(repoRoot, change, provenance, options = {}) {
-  const directory = changeDirectory(repoRoot, change.id);
-  const report2 = validateChange(change);
-  if (!report2.valid) {
+  if (text === "" && size > 0) {
     return {
-      outcome: "validation-failed",
-      directory,
-      errors: report2.errors,
-      warnings: report2.warnings
+      outcome: "unreadable",
+      reason: `\`${SIDECAR}\` holds ${size} bytes on disk but read back empty \u2014 this is a read failure, not an absence of approvals`
     };
   }
-  if (!options.overwrite && isNonEmptyDirectory(directory)) {
-    return { outcome: "directory-exists", directory };
-  }
-  const emitted = emitChangeWithProvenance(change, provenance);
-  writeEmitted(directory, emitted);
-  writeSchemaFile(directory);
-  return {
-    outcome: "written",
-    directory,
-    files: emitted.files.map((f) => f.path),
-    warnings: report2.warnings
-  };
-}
-function isNonEmptyDirectory(directory) {
-  try {
-    if (!statSync4(directory).isDirectory()) return true;
-    return readdirSync6(directory).length > 0;
-  } catch {
-    return false;
-  }
-}
-function readEmittedChange(directory, id) {
-  const files = [];
-  for (const name of ["proposal.md", "design.md", "tasks.md"]) {
-    files.push({ path: name, content: readFileSync6(join8(directory, name), "utf8") });
-  }
-  const specsDir = join8(directory, "specs");
-  let capabilities = [];
+  let parsed;
   try {
-    capabilities = readdirSync6(specsDir).filter((name) => statSync4(join8(specsDir, name)).isDirectory()).sort();
-  } catch {
-    capabilities = [];
-  }
-  for (const capability of capabilities) {
-    files.push({
-      path: `specs/${capability}/spec.md`,
-      content: readFileSync6(join8(specsDir, capability, "spec.md"), "utf8")
-    });
-  }
-  return { id, files };
-}
-function writeSchemaFile(directory) {
-  const path = join8(directory, ".openspec.yaml");
-  if (existsSync6(path)) return;
-  writeFileSync3(path, `schema: ${SPEC_DRIVEN.name}
-`, "utf8");
-}
-function writeEmitted(directory, emitted) {
-  mkdirSync4(directory, { recursive: true });
-  for (const file of emitted.files) {
-    const target = join8(directory, file.path);
-    mkdirSync4(dirname4(target), { recursive: true });
-    writeFileSync3(target, file.content, "utf8");
-  }
-}
-
-// src/workbench/core/reconstruct.ts
-function headingName(block) {
-  const match = /^###[ \t]+Requirement:[ \t]*(.*)$/m.exec(block);
-  return match?.[1]?.trim() ?? null;
-}
-function reconstructDraft(folded, delta) {
-  const capability = delta.capability;
-  if (folded.trim() === "") {
-    const purpose = delta.purpose === null ? "" : `
-## Purpose
-${delta.purpose}
-`;
-    const head = `# ${capability} Specification
-${purpose}
-## Requirements
-
-`;
+    parsed = JSON.parse(text);
+  } catch (err) {
     return {
-      outcome: "reconstructed",
-      capability,
-      draft: `${head}${delta.added.map((b) => b.trimEnd()).join("\n\n")}
-`
+      outcome: "unreadable",
+      reason: `\`${SIDECAR}\` is not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 the approvals it holds cannot be read, and this is not an absence of approvals`
     };
   }
-  const parsed = parseSpecFile(folded);
-  if (parsed.outside.length > 0) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { outcome: "unreadable", reason: `\`${SIDECAR}\` is not an approval store` };
+  }
+  const raw = parsed.approvals;
+  if (raw === void 0) {
     return {
-      outcome: "unreconstructable",
-      capability,
-      reason: "the folded spec carries content outside its requirement blocks, which a rebuild would drop",
-      draft: folded
+      outcome: "unreadable",
+      reason: `\`${SIDECAR}\` carries no \`approvals\` map \u2014 it is not the file this workbench wrote`
     };
   }
-  const blocks = /* @__PURE__ */ new Map();
-  const order = [];
-  for (const requirement of parsed.requirements) {
-    blocks.set(requirement.name, requirement.text);
-    order.push(requirement.name);
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { outcome: "unreadable", reason: `\`${SIDECAR}\`'s \`approvals\` is not a map of stages` };
   }
-  for (const pair of delta.renamed) {
-    const existing = blocks.get(pair.from);
-    if (existing === void 0) {
-      return {
-        outcome: "unreconstructable",
-        capability,
-        reason: `the delta renames \`${pair.from}\`, which the folded spec does not declare`,
-        draft: folded
-      };
+  const approvals = {};
+  for (const [stage, value] of Object.entries(raw)) {
+    if (!STAGE.test(stage)) {
+      return { outcome: "unreadable", reason: `\`${SIDECAR}\` records \`${stage}\`, which is not a stage` };
     }
-    blocks.delete(pair.from);
-    blocks.set(pair.to, existing.replace(pair.from, pair.to));
-    order[order.indexOf(pair.from)] = pair.to;
-  }
-  for (const name of delta.removed) {
-    if (!blocks.delete(name)) {
+    const approvedAt = value?.approvedAt;
+    if (typeof approvedAt !== "string" || approvedAt === "") {
       return {
-        outcome: "unreconstructable",
-        capability,
-        reason: `the delta removes \`${name}\`, which the folded spec does not declare`,
-        draft: folded
+        outcome: "unreadable",
+        reason: `\`${SIDECAR}\`'s entry for \`${stage}\` carries no \`approvedAt\` \u2014 the store is corrupt, not empty`
       };
     }
-    order.splice(order.indexOf(name), 1);
+    approvals[stage] = { approvedAt };
   }
-  for (const block of delta.modified) {
-    const name = headingName(block);
-    if (name === null || !blocks.has(name)) {
-      return {
-        outcome: "unreconstructable",
-        capability,
-        reason: name === null ? "the delta modifies a block with no readable heading" : `the delta modifies \`${name}\`, which is not in the folded spec after renames and removals`,
-        draft: folded
-      };
-    }
-    blocks.set(name, block.trimEnd());
+  return { outcome: "read", approvals };
+}
+function setApproval(changeDir, stage, approved, now = /* @__PURE__ */ new Date()) {
+  if (!STAGE.test(stage)) {
+    return { outcome: "failed", reason: `\`${stage}\` is not a stage of this change` };
   }
-  for (const block of delta.added) {
-    const name = headingName(block);
-    if (name === null) {
-      return {
-        outcome: "unreconstructable",
-        capability,
-        reason: "the delta adds a block with no readable heading",
-        draft: folded
-      };
-    }
-    if (!blocks.has(name)) order.push(name);
-    blocks.set(name, block.trimEnd());
+  if (!existsSync8(changeDir)) {
+    return {
+      outcome: "failed",
+      reason: `the change directory does not exist yet \u2014 save an artifact before approving a stage`
+    };
   }
-  const body = order.map((name) => blocks.get(name).trimEnd()).join("\n\n");
-  return {
-    outcome: "reconstructed",
-    capability,
-    draft: `${parsed.headText.trimEnd()}
-
-${body}
-`
+  const current = readApprovals(changeDir);
+  if (current.outcome === "unreadable") {
+    return {
+      outcome: "failed",
+      reason: `the approval store could not be read, so it was not written: ${current.reason}`
+    };
+  }
+  const next = {
+    ...current.outcome === "read" ? current.approvals : {}
   };
-}
-
-// src/workbench/agent/credential-probe.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync7, statSync as statSync5 } from "node:fs";
-import { delimiter, join as join9 } from "node:path";
-function readSubscriptionToken(home) {
-  const path = join9(home, ".claude", ".credentials.json");
-  if (!existsSync7(path)) return null;
+  if (approved) next[stage] = { approvedAt: now.toISOString() };
+  else delete next[stage];
   try {
-    const parsed = JSON.parse(readFileSync7(path, "utf8"));
-    const token = parsed.claudeAiOauth?.accessToken;
-    if (typeof token !== "string" || token === "") return null;
-    const expiresAt = parsed.claudeAiOauth?.expiresAt;
-    if (typeof expiresAt === "number" && expiresAt <= Date.now()) return null;
-    return token;
-  } catch {
-    return null;
-  }
-}
-
-// src/workbench/agent/model-boundary.ts
-import { builtinModels } from "@earendil-works/pi-ai/providers/all";
-var MAX_TOOL_ROUNDS = 6;
-var DEFAULT_PROVIDER = "anthropic";
-var DEFAULT_MODEL2 = "claude-opus-4-5";
-async function runTurn(input, deps = {}) {
-  const provider = deps.provider ?? DEFAULT_PROVIDER;
-  const modelId = deps.modelId ?? DEFAULT_MODEL2;
-  const maxRounds = deps.maxRounds ?? MAX_TOOL_ROUNDS;
-  if (deps.oauthToken) process.env.ANTHROPIC_OAUTH_TOKEN = deps.oauthToken;
-  else if (deps.apiKey) process.env.ANTHROPIC_API_KEY = deps.apiKey;
-  const models = deps.models ?? builtinModels();
-  const model = models.getModel(provider, modelId);
-  if (!model) return { kind: "failed", reason: `no such model: ${provider}/${modelId}` };
-  const messages = [
-    { role: "user", content: input.prompt, timestamp: Date.now() }
-  ];
-  const context = {
-    systemPrompt: input.systemPrompt,
-    messages,
-    tools: [...input.tools]
+    writeFileSync4(
+      join10(changeDir, SIDECAR),
+      `${JSON.stringify({ overlay: OVERLAY_DECLARATION, approvals: next }, null, "	")}
+`,
+      "utf8"
+    );
+  } catch (err) {
+    return { outcome: "failed", reason: `the approval could not be stored \u2014 ${describe(err)}` };
+  }
+  return { outcome: "written", approvals: next };
+}
+function describe(err) {
+  const e = err;
+  const why = {
+    EACCES: "permission denied",
+    EPERM: "the operation is not permitted",
+    EROFS: "the filesystem is read-only",
+    ENOSPC: "the filesystem is full",
+    ENOENT: "the change directory has gone",
+    EISDIR: "a directory is in the way"
   };
-  const calls = [];
-  const served = `${provider}/${modelId}`;
-  let answer = "";
-  for (let round = 0; round < maxRounds; round += 1) {
-    const stream = models.stream(model, context);
-    const pending = [];
-    let message;
-    try {
-      for await (const event of stream) {
-        if (event.type === "toolcall_end") pending.push(event.toolCall);
-      }
-      message = await stream.result();
-    } catch (err) {
-      return { kind: "failed", reason: err instanceof Error ? err.message : String(err) };
-    }
-    if (message.stopReason === "error") {
-      return { kind: "failed", reason: message.errorMessage ?? "the model returned an error" };
-    }
-    answer = textOf2(message);
-    context.messages.push(message);
-    if (pending.length === 0) return { kind: "answered", answer, calls, served };
-    for (const call of pending) {
-      const result = await input.execute(call.name, call.arguments);
-      calls.push({ name: call.name, arguments: call.arguments, result });
-      context.messages.push({
-        role: "toolResult",
-        toolCallId: call.id,
-        toolName: call.name,
-        content: [{ type: "text", text: result }],
-        // The executor reports a refusal as ordinary text — a refused proposal is a
-        // normal outcome the model should reason about, not a transport error.
-        isError: false,
-        timestamp: Date.now()
-      });
-    }
-  }
-  return { kind: "cut-short", answer, calls, served, rounds: maxRounds };
-}
-function textOf2(message) {
-  return message.content.filter((block) => block.type === "text").map((block) => block.text).join("").trim();
-}
-
-// src/workbench/agent/tools.ts
-import { Type } from "@earendil-works/pi-ai";
-var AGENT_TOOLS = [
-  {
-    name: "add_task_group",
-    description: "Propose a group of implementation tasks for this change. Use for planning the work; one group per coherent area, each task a single concrete action.",
-    parameters: Type.Object({
-      title: Type.String({ description: 'Short group title, e.g. "Search" or "Byte-safe writes"' }),
-      tasks: Type.Array(Type.String(), {
-        description: "Task titles, one per task. Each states one concrete action."
-      }),
-      capability: Type.Optional(
-        Type.String({
-          description: "Optional. The capability of the requirement this group implements \u2014 omit for a chore group that implements none."
-        })
-      ),
-      requirement: Type.Optional(
-        Type.String({
-          description: "Optional. The exact requirement name this group implements, as it appears after `### Requirement:`."
-        })
-      )
-    })
-  },
-  {
-    name: "add_requirement",
-    description: "Propose a requirement to draft into an open capability. The block must be full markdown: a `### Requirement:` heading, RFC-2119 SHALL text, and at least one `#### Scenario:` with WHEN/THEN steps.",
-    parameters: Type.Object({
-      capability: Type.String({ description: "A capability already open in this change" }),
-      block: Type.String({ description: "The complete requirement block, in markdown" })
-    })
-  },
-  {
-    name: "set_proposal_section",
-    description: "Propose the body of one proposal section.",
-    parameters: Type.Object({
-      section: Type.String({
-        description: `One of: ${PROPOSAL_SECTIONS.map((s) => s.id).join(", ")}`
-      }),
-      body: Type.String({ description: "The section body, in markdown" })
-    })
-  },
-  {
-    name: "add_design_block",
-    description: "Propose a design block. Use `mermaid` for a diagram (C4Context / C4Container / C4Component / C4Dynamic render as diagrams), `markdown` for prose.",
-    parameters: Type.Object({
-      kind: Type.String({ description: "markdown | mermaid | sketch" }),
-      title: Type.String({ description: "The block's heading" }),
-      text: Type.String({ description: "The block body" })
-    })
-  }
-];
-var DESIGN_KINDS = /* @__PURE__ */ new Set(["markdown", "mermaid", "sketch"]);
-function stripLeadingNumber(text) {
-  return text.replace(/^\s*\d+(?:\.\d+)*[.)]?\s+/, "").trim();
-}
-function proposalFromToolCall(name, args, shape) {
-  switch (name) {
-    case "add_task_group": {
-      const title = stripLeadingNumber(String(args["title"] ?? ""));
-      const tasks = Array.isArray(args["tasks"]) ? args["tasks"].map((t) => stripLeadingNumber(String(t))).filter((t) => t !== "") : [];
-      if (title === "" || tasks.length === 0) {
-        return { kind: "refused", tool: name, missing: "a title and at least one task" };
-      }
-      const capability = String(args["capability"] ?? "").trim();
-      const key = String(args["requirement"] ?? "").trim();
-      if (capability === "" && key === "") return { kind: "task-group", title, tasks };
-      if (capability === "" || key === "") {
-        return {
-          kind: "refused",
-          tool: name,
-          missing: "both a capability and a requirement name, or neither"
-        };
-      }
-      if (shape.citable !== void 0 && !shape.citable.some((c) => c.capability === capability && c.key === key)) {
-        return {
-          kind: "refused",
-          tool: name,
-          missing: `\`${key}\` in \`${capability}\` is not a requirement this change declares`
-        };
-      }
-      return { kind: "task-group", title, tasks, cites: { capability, key } };
-    }
-    case "add_requirement": {
-      const capability = String(args["capability"] ?? "").trim();
-      const block = String(args["block"] ?? "").trim();
-      if (!shape.openCapabilities.includes(capability)) {
-        return {
-          kind: "refused",
-          tool: name,
-          missing: `capability \`${capability}\` is not open in this change`
-        };
-      }
-      if (!/^###[ \t]+Requirement:/m.test(block)) {
-        return { kind: "refused", tool: name, missing: "a `### Requirement:` heading" };
-      }
-      return { kind: "requirement", capability, block };
-    }
-    case "set_proposal_section": {
-      const section2 = String(args["section"] ?? "").trim();
-      const known = PROPOSAL_SECTIONS.find((s) => s.id === section2);
-      if (!known) {
-        return { kind: "refused", tool: name, missing: `no proposal section \`${section2}\`` };
-      }
-      return {
-        kind: "proposal-section",
-        section: known.id,
-        body: String(args["body"] ?? "")
-      };
-    }
-    case "add_design_block": {
-      const blockKind = String(args["kind"] ?? "").trim();
-      if (!DESIGN_KINDS.has(blockKind)) {
-        return { kind: "refused", tool: name, missing: `no design block kind \`${blockKind}\`` };
-      }
-      const title = String(args["title"] ?? "").trim();
-      if (title === "") return { kind: "refused", tool: name, missing: "a block title" };
-      return {
-        kind: "design-block",
-        blockKind,
-        title,
-        text: String(args["text"] ?? "")
-      };
-    }
-    default:
-      return { kind: "refused", tool: name, missing: `no such tool \`${name}\`` };
-  }
-}
-function toolResultFor(proposal) {
-  switch (proposal.kind) {
-    case "task-group":
-      return `Proposed task group "${proposal.title}" with ${proposal.tasks.length} task(s)${proposal.cites ? `, implementing \`${proposal.cites.key}\`` : ", implementing no requirement"}. Awaiting the author's apply; nothing is written yet.`;
-    case "requirement":
-      return `Proposed a requirement for \`${proposal.capability}\`. Awaiting the author's apply; nothing is written yet.`;
-    case "proposal-section":
-      return `Proposed a body for the \`${proposal.section}\` section. Awaiting the author's apply; nothing is written yet.`;
-    case "design-block":
-      return `Proposed a ${proposal.blockKind} design block "${proposal.title}". Awaiting the author's apply; nothing is written yet.`;
-    case "refused":
-      return `Refused: ${proposal.tool} needs ${proposal.missing}. Nothing was proposed.`;
-  }
+  return `\`${SIDECAR}\`: ${why[e.code ?? ""] ?? e.message ?? String(err)} (${e.code ?? "unknown"})`;
 }
 
 // server/workbench-host.ts
@@ -3900,44 +3309,45 @@ var CHANGE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function changeContextFor(target, source) {
   const read = [];
   let changeText = "";
-  if (source.change) {
-    for (const file of emitChange({ ...source.change, id: target.changeId }).files) {
-      if (file.content.replace(/^#[ \t].*$/m, "").trim() === "") continue;
-      changeText += `
-
-===== ${file.path} (unsaved draft \u2014 what the author is looking at) =====
-${file.content}`;
-      read.push(`${file.path} (draft)`);
-    }
-    return { read, changeText };
-  }
   if (!target.resuming) return { read, changeText };
   for (const name of ["proposal.md", "tasks.md"]) {
-    const file = join10(target.changeDir, name);
-    if (!existsSync8(file)) continue;
+    const file = join11(target.changeDir, name);
+    if (!existsSync9(file)) continue;
     changeText += `
 
 ===== ${name} =====
-${readFileSync8(file, "utf8")}`;
+${readFileSync7(file, "utf8")}`;
     read.push(name);
   }
   for (const capability of source.openCapabilities ?? []) {
-    const file = join10(target.changeDir, "specs", capability, "spec.md");
-    if (!existsSync8(file)) continue;
+    const file = join11(target.changeDir, "specs", capability, "spec.md");
+    if (!existsSync9(file)) continue;
     changeText += `
 
 ===== specs/${capability}/spec.md (the change's deltas) =====
-${readFileSync8(file, "utf8")}`;
+${readFileSync7(file, "utf8")}`;
     read.push(`specs/${capability}/spec.md`);
   }
   return { read, changeText };
 }
+function citableOnDisk(target) {
+  if (!target.resuming) return [];
+  const specs = [];
+  for (const artifact of listArtifacts(target.changeDir)) {
+    const capability = /^specs\/([^/]+)\/spec\.md$/.exec(artifact)?.[1];
+    if (capability === void 0) continue;
+    const read = readArtifact(target.changeDir, artifact);
+    if (read.outcome !== "read") continue;
+    specs.push({ capability, content: read.content });
+  }
+  return citableRequirements(specs);
+}
 var WorkbenchHostError = class extends Error {
 };
 function findRepoRoot(start) {
   let dir = resolve3(start);
   for (; ; ) {
-    if (existsSync8(join10(dir, "openspec"))) return dir;
+    if (existsSync9(join11(dir, "openspec"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -3959,41 +3369,20 @@ function resolveTarget(cwd, changeId) {
     );
   }
   const changeDir = changeDirectory(repoRoot, changeId);
-  return { repoRoot, changeId, changeDir, resuming: existsSync8(changeDir) };
+  return { repoRoot, changeId, changeDir, resuming: existsSync9(changeDir) };
+}
+function readSchema(target) {
+  try {
+    return resolveSchema(readFileSync7(join11(target.changeDir, ".openspec.yaml"), "utf8"));
+  } catch {
+    return { kind: "unknown-schema", name: "" };
+  }
 }
 function mountWorkbenchHost(app, options) {
   const { target } = options;
   const reader = createFoldedSpecReader(target.repoRoot);
   app.get("/api/workbench/context", (c) => {
-    let document = null;
-    let deltaCapabilities = [];
-    const capabilities = [];
-    if (target.resuming) {
-      try {
-        const emitted = readEmittedChange(target.changeDir, target.changeId);
-        document = parseChangeDocument(emitted);
-        deltaCapabilities = emitted.files.map((f) => /^specs\/([^/]+)\/spec\.md$/.exec(f.path)?.[1]).filter((n) => n !== void 0);
-        for (const spec of document.deltaSpecs) {
-          const folded = reader.readCapability(spec.capability);
-          const rebuilt = reconstructDraft(folded ?? "", spec);
-          capabilities.push({
-            capability: spec.capability,
-            folded,
-            draft: rebuilt.draft,
-            reconstructed: rebuilt.outcome === "reconstructed",
-            ...rebuilt.outcome === "unreconstructable" ? { reason: rebuilt.reason } : {},
-            // The requirement names the EMITTED delta declares. Carried so the
-            // emission gate can ask whether the draft is whole NOW, rather than
-            // only whether it loaded whole — otherwise an author who restores a
-            // requirement by hand stays blocked with no way forward inside the
-            // tool, which is a lock rather than a guard.
-            declared: [...spec.added, ...spec.modified].map((b) => /^###[ \t]+Requirement:[ \t]*(.*)$/m.exec(b)?.[1]?.trim()).filter((n) => n !== void 0 && n !== "")
-          });
-        }
-      } catch {
-        document = null;
-      }
-    }
+    const artifacts = target.resuming ? listArtifacts(target.changeDir).map((name) => readArtifact(target.changeDir, name)) : [];
     return c.json({
       repoRoot: target.repoRoot,
       changeId: target.changeId,
@@ -4001,12 +3390,16 @@ function mountWorkbenchHost(app, options) {
       resuming: target.resuming,
       fixture: options.fixture === true,
       specsDir: reader.specsDir,
-      document,
-      deltaCapabilities,
-      capabilities,
-      // True when every delta this change carries was rebuilt. A capability that
-      // failed is listed with its reason rather than appearing to carry no edits.
-      draftsRestorable: capabilities.every((c2) => c2.reconstructed)
+      // The schema the change's own `.openspec.yaml` names — the rail's stages come
+      // from it, never from a default this host picked. A change with no such file
+      // resolves to `unknown-schema`, which is a fact to report, not one to paper over.
+      schema: readSchema(target),
+      artifacts,
+      // The approval overlay, so a reopened change comes back with the stages the
+      // author already gated still gated. Carried as its own outcome: an
+      // unreadable store must reach the surface as unreadable, never as an
+      // absence of approvals that would silently re-lock every stage.
+      approvals: readApprovals(target.changeDir)
     });
   });
   app.get("/api/workbench/capabilities", (c) => {
@@ -4025,52 +3418,69 @@ function mountWorkbenchHost(app, options) {
       throw err;
     }
   });
-  app.post("/api/workbench/emit", async (c) => {
+  app.get(
+    "/api/workbench/artifacts",
+    (c) => c.json({
+      changeDir: target.changeDir,
+      exists: existsSync9(target.changeDir),
+      artifacts: listArtifacts(target.changeDir)
+    })
+  );
+  app.get("/api/workbench/artifact", (c) => {
+    const name = c.req.query("artifact") ?? "";
+    const result = readArtifact(target.changeDir, name);
+    return c.json({ result }, result.outcome === "refused" ? 400 : 200);
+  });
+  app.post("/api/workbench/artifact", async (c) => {
     const body = await c.req.json();
-    if (!body.change) return c.json({ error: "missing-change" }, 400);
-    const result = writeChange(
-      target.repoRoot,
-      { ...body.change, id: target.changeId },
-      options.provenance ?? NO_ISSUE,
-      body.overwrite === true ? { overwrite: true } : {}
-    );
+    if (typeof body.artifact !== "string" || typeof body.content !== "string") {
+      return c.json({ error: "missing-artifact" }, 400);
+    }
+    const result = writeArtifact(target.changeDir, body.artifact, body.content, {
+      ...body.expected === void 0 ? {} : { expected: body.expected },
+      // Never a default. An overwrite after a changed-underneath refusal is the
+      // author's explicit answer, and taking it unasked is the whole of what that
+      // refusal exists to prevent.
+      ...body.overwrite === true ? { overwrite: true } : {}
+    });
     return c.json({ result }, result.outcome === "written" ? 200 : 409);
   });
-  app.post("/api/workbench/archive", async (c) => {
+  app.get(
+    "/api/workbench/validity",
+    (c) => c.json({ result: validateChangeOnDisk(target.repoRoot, target.changeId) })
+  );
+  app.get("/api/workbench/approvals", (c) => c.json({ result: readApprovals(target.changeDir) }));
+  app.post("/api/workbench/approvals", async (c) => {
     const body = await c.req.json();
-    if (!body.change) return c.json({ error: "missing-change" }, 400);
-    const result = approveChange(
-      target.repoRoot,
-      { ...body.change, id: target.changeId },
-      options.provenance ?? NO_ISSUE
-    );
-    return c.json({ result }, result.outcome === "approved" ? 200 : 409);
+    if (typeof body.stage !== "string" || typeof body.approved !== "boolean") {
+      return c.json({ error: "missing-stage" }, 400);
+    }
+    const result = setApproval(target.changeDir, body.stage, body.approved);
+    return c.json({ result }, result.outcome === "written" ? 200 : 409);
   });
   app.post("/api/workbench/agent/turn", async (c) => {
     const body = await c.req.json();
     const prompt = (body.prompt ?? "").trim();
     if (prompt === "") return c.json({ error: "missing-prompt" }, 400);
-    const token = readSubscriptionToken(options.home ?? homedir3());
-    if (!token && !process.env["ANTHROPIC_API_KEY"]) {
-      return c.json({ outcome: { kind: "no-credential" } }, 200);
-    }
+    const citable = citableOnDisk(target);
     const shape = {
       openCapabilities: body.openCapabilities ?? [],
-      ...body.change ? { citable: citableRequirements(body.change.capabilities) } : {}
+      ...citable.length === 0 ? {} : { citable }
     };
     const { read, changeText } = changeContextFor(target, body);
-    const proposals = [];
-    const outcome = await runTurn(
+    const { outcome, proposals } = await runAgentTurn(
       {
+        // Standing instructions on their OWN channel, forwarded to the harness's
+        // system-prompt option — never joined to the prompt.
         systemPrompt: [
           "You are helping author an OpenSpec change in the SpecSketch workbench.",
           `The change is \`${target.changeId}\`, in the repository at ${target.repoRoot}.`,
           shape.openCapabilities.length > 0 ? `Capabilities open in this change: ${shape.openCapabilities.join(", ")}.` : "No capability is open in this change yet.",
           body.scope ? `The author is looking at ${body.scope}.` : "",
           "",
-          "Use the tools to propose concrete items. Everything you propose is reviewed and",
-          "applied by the author \u2014 you never write to the change yourself, so propose freely",
-          "and say briefly what you proposed and why.",
+          "Return your proposals as the structured result. Everything you propose is",
+          "reviewed and applied by the author \u2014 you never write to the change yourself, so",
+          "propose freely and say briefly in `answer` what you proposed and why.",
           "",
           "Ground every proposal in the change below. Use its own vocabulary: if it says",
           '"changes", do not write "plans". Do not invent states, sections or files it does',
@@ -4079,21 +3489,18 @@ function mountWorkbenchHost(app, options) {
           changeText === "" ? "(This change has nothing written yet.)" : changeText
         ].filter((line) => line !== "").join("\n"),
         prompt,
-        tools: AGENT_TOOLS,
-        execute: (name, args) => {
-          const proposal = proposalFromToolCall(name, args, shape);
-          proposals.push(proposal);
-          return toolResultFor(proposal);
-        }
+        cwd: target.repoRoot,
+        session: `specsketch-workbench-${target.changeId}`,
+        shape
       },
-      { oauthToken: token ?? void 0 }
+      options.home !== void 0 ? { home: options.home } : {}
     );
     return c.json({ outcome, proposals, read });
   });
 }
 
 // server/cli.ts
-var CLI_VERSION = true ? "2026.08.26.3" : "dev";
+var CLI_VERSION = true ? "2026.08.31.1" : "dev";
 var USAGE = `Usage: specsketch <change-id> [--port <n>] [--fixture]
        specsketch login [--profile <name>] [--web-url <url>]
        specsketch --version
@@ -4168,13 +3575,13 @@ var MIME = {
 function resolveClientDir(moduleUrl) {
   const here = dirname6(fileURLToPath(moduleUrl));
   const candidates = [
-    join11(here, "..", "client"),
+    join12(here, "..", "client"),
     // packed: dist/cli -> dist/client
-    join11(here, "..", "dist", "client")
+    join12(here, "..", "dist", "client")
     // repo: server/ -> dist/client
   ];
   for (const dir of candidates) {
-    if (existsSync9(join11(dir, "index.html"))) return dir;
+    if (existsSync10(join12(dir, "index.html"))) return dir;
   }
   return null;
 }
@@ -4182,9 +3589,9 @@ function staticResponse(clientDir, pathname) {
   const rel = normalize2(decodeURIComponent(pathname)).replace(/^\/+/, "");
   const target = resolve4(clientDir, rel === "" ? "index.html" : rel);
   if (!target.startsWith(resolve4(clientDir))) return null;
-  const file = existsSync9(target) && extname(target) ? target : join11(clientDir, "index.html");
-  if (!existsSync9(file)) return null;
-  return new Response(readFileSync9(file), {
+  const file = existsSync10(target) && extname(target) ? target : join12(clientDir, "index.html");
+  if (!existsSync10(file)) return null;
+  return new Response(readFileSync8(file), {
     headers: { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" }
   });
 }
@@ -4200,7 +3607,7 @@ function detectCredentialSource(env = process.env, home = homedir4()) {
   if (env.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY";
   if (env.ANTHROPIC_AUTH_TOKEN) return "ANTHROPIC_AUTH_TOKEN";
   try {
-    const dir = join11(home, ".config", "anthropic", "credentials");
+    const dir = join12(home, ".config", "anthropic", "credentials");
     if (readdirSync8(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
   } catch {
   }