@f-o-h/cli 0.1.86 → 0.1.88

package/dist/foh.js

@@ -6046,7 +6046,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve15.call(this, root, ref);
+      let _sch = resolve16.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a2 = root.localRefs) === null || _a2 === void 0 ? void 0 : _a2[ref];
         const { schemaId } = this.opts;
@@ -6073,7 +6073,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve15(root, ref) {
+    function resolve16(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -6648,7 +6648,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve15(baseURI, relativeURI, options) {
+    function resolve16(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -6875,7 +6875,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve15,
+      resolve: resolve16,
       resolveComponent,
       equal,
       serialize,
@@ -10183,21 +10183,21 @@ async function promptLine(label, {
   allowEmpty = false,
   defaultValue
 } = {}) {
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve16) => {
     const suffix = defaultValue ? ` [${defaultValue}]` : "";
     const rl = (0, import_readline.createInterface)({ input: process.stdin, output: process.stdout, terminal: true });
     rl.question(`${label}${suffix}: `, (answer) => {
       rl.close();
       const value = String(answer ?? "").trim();
       if (!value && typeof defaultValue === "string") {
-        resolve15(defaultValue);
+        resolve16(defaultValue);
         return;
       }
       if (!value && !allowEmpty) {
-        resolve15("");
+        resolve16("");
         return;
       }
-      resolve15(value);
+      resolve16(value);
     });
   });
 }
@@ -10205,7 +10205,7 @@ async function promptSecret(label) {
   if (!process.stdin.isTTY || !process.stdout.isTTY || typeof process.stdin.setRawMode !== "function") {
     return await promptLine(label);
   }
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve16) => {
     const stdin = process.stdin;
     const stdout = process.stdout;
     const wasRaw = Boolean(stdin.isRaw);
@@ -10219,7 +10219,7 @@ async function promptSecret(label) {
     const finish = () => {
       cleanup();
       stdout.write("\n");
-      resolve15(value);
+      resolve16(value);
     };
     const onData = (chunk) => {
       const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -10228,7 +10228,7 @@ async function promptSecret(label) {
           cleanup();
           process.exitCode = 130;
           stdout.write("\n");
-          return resolve15("");
+          return resolve16("");
         }
         if (char === "\r" || char === "\n") {
           finish();
@@ -10583,7 +10583,7 @@ async function storeAuthenticatedSession(params) {
   return output;
 }
 function sleep(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 function hasExplicitTimeoutFlag(argv = process.argv) {
   return argv.some((arg) => arg === "--timeout-seconds" || arg.startsWith("--timeout-seconds="));
@@ -11141,7 +11141,7 @@ async function pollUntil(check2, opts) {
   }
 }
 function sleep2(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve16) => setTimeout(resolve16, ms));
 }
 
 // src/commands/compliance.ts
@@ -14265,8 +14265,8 @@ function registerAgentGuardrailCommands(agent) {
     try {
       rule = JSON.parse(opts.rule);
     } catch {
-      const { readFileSync: readFileSync19 } = await import("fs");
-      rule = JSON.parse(readFileSync19(opts.rule, "utf-8"));
+      const { readFileSync: readFileSync20 } = await import("fs");
+      rule = JSON.parse(readFileSync20(opts.rule, "utf-8"));
     }
     const data = await apiFetch(`/v1/console/agents/${opts.agent}/guardrails`, {
       method: "POST",
@@ -14835,9 +14835,9 @@ function registerAgent(program3) {
       process.stdout.write(yaml);
       return;
     }
-    const { writeFileSync: writeFileSync15 } = await import("fs");
+    const { writeFileSync: writeFileSync16 } = await import("fs");
     const outputPath = opts.output ?? "tenant.yaml";
-    writeFileSync15(
+    writeFileSync16(
       outputPath,
       `# tenant.yaml - Front Of House agent manifest
 # Edit this file and run: foh plan tenant.yaml
@@ -15186,6 +15186,10 @@ var SMOKE_TURNS = [
   "I am interested in buying a 3-bedroom house in the area",
   "Can I book a viewing for this week?"
 ];
+function isGenericTroubleReply(reply) {
+  const normalized = reply.trim().toLowerCase();
+  return /\bi'?m sorry\b/.test(normalized) && /having trouble|try again|something went wrong|unable to help right now/.test(normalized);
+}
 async function resolveChannelPublicKey(agentId, orgId, apiUrlOverride) {
   const data = await apiFetch(
     "/v1/console/channels/widget/ensure",
@@ -15227,12 +15231,17 @@ async function runWidgetSmoke(publicKey, apiUrlOverride) {
       conversationId = data.conversationId;
       if (data.trace_id) traceIds.push(data.trace_id);
       if (data.correlation_id) correlationIds.push(data.correlation_id);
+      const genericTroubleReply = isGenericTroubleReply(data.reply);
       turns.push({
         turn: i + 1,
         message,
-        ok: true,
+        ok: !genericTroubleReply,
         latency_ms: latencyMs,
         reply: data.reply,
+        ...genericTroubleReply ? {
+          reason_code: "widget_generic_trouble_reply",
+          error: "Widget returned a generic trouble reply instead of advancing the customer request."
+        } : {},
         conversation_id: data.conversationId,
         trace_id: data.trace_id ?? null,
         correlation_id: data.correlation_id ?? null,
@@ -15368,9 +15377,6 @@ function registerInstagramChannelCommands(instagram, addCommonOptions) {
   }));
 }
 
-// src/commands/channel-whatsapp.ts
-var import_node_fs2 = require("node:fs");
-
 // src/commands/channel-whatsapp-helpers.ts
 function parsePositiveNumber(value, fallback) {
   if (value === void 0 || value === null || String(value).trim() === "") return fallback;
@@ -15403,7 +15409,7 @@ function buildReasonedNextSteps({
   const verifyTokenValue = verifyToken || "<verify_token>";
   if (has("whatsapp_channel_not_ready") || has("whatsapp_access_token_missing") || has("whatsapp_verify_token_missing") || has("whatsapp_app_secret_missing")) {
     steps.push(
-      "Connect/update channel credentials: foh channel whatsapp connect --phone-number-id <meta_phone_number_id> --access-token <meta_access_token> --verify-token <verify_token> --app-secret <meta_app_secret>"
+      "Connect/update channel credentials: foh channel whatsapp onboard --phone-number-id <meta_phone_number_id> --access-token <meta_access_token> --verify-token <verify_token> --app-secret <meta_app_secret>"
     );
   }
   if (has("whatsapp_verify_check_failed") || has("whatsapp_webhook_challenge_failed")) {
@@ -15549,6 +15555,9 @@ function resolveLiveProof({
   };
 }
 
+// src/commands/channel-whatsapp-onboarding.ts
+var import_node_fs2 = require("node:fs");
+
 // src/commands/channel-whatsapp-setup.ts
 var import_node_crypto = require("node:crypto");
 var WHATSAPP_WEBHOOK_CHALLENGE_TIMEOUT_MS = 1e4;
@@ -15657,7 +15666,7 @@ function assertProofPass(strict, reasons) {
   }
 }
 
-// src/commands/channel-whatsapp.ts
+// src/commands/channel-whatsapp-onboarding.ts
 async function runWhatsAppOnboardingSession(params) {
   return await apiFetch("/v1/console/channels/whatsapp/onboarding-session", {
     method: "POST",
@@ -15676,24 +15685,6 @@ async function runWhatsAppOnboardingSession(params) {
     apiUrlOverride: params.apiUrl
   });
 }
-function emitLegacyCommandNotice({
-  command,
-  canonical,
-  jsonMode
-}) {
-  if (!jsonMode) {
-    process.stderr.write(
-      `[deprecated] foh channel whatsapp ${command} is a compatibility wrapper.
-Use: ${canonical}
-`
-    );
-  }
-  return {
-    command,
-    canonical,
-    status: "deprecated_compat_wrapper"
-  };
-}
 function parseBatchManifest(manifestPathRaw) {
   const manifestPath = String(manifestPathRaw || "").trim();
   if (!manifestPath) {
@@ -15765,11 +15756,11 @@ async function runWhatsAppOnboardingWizard(opts) {
       }
     ]
   });
-  let accessToken = String(wizardState.accessToken || "").trim();
+  const accessToken = String(wizardState.accessToken || "").trim();
   let wabaId = String(opts.wabaId || "").trim();
   let phoneNumberId = String(opts.phoneNumberId || "").trim();
-  let verifyToken = String(opts.verifyToken || "").trim();
-  let appSecret = String(wizardState.appSecret || "").trim();
+  const verifyToken = String(opts.verifyToken || "").trim();
+  const appSecret = String(wizardState.appSecret || "").trim();
   if (!accessToken) {
     throw new FohError({
       step: "channel.whatsapp.onboard",
@@ -15843,51 +15834,10 @@ async function runWhatsAppOnboardingWizard(opts) {
   throw new FohError({
     step: "channel.whatsapp.onboard",
     error: "Unable to complete WhatsApp onboarding after guided retries.",
-    remediation: "Run again with --phone-number-id and --waba-id, or use `foh channel whatsapp start` for deterministic next steps."
+    remediation: "Run again with --phone-number-id and --waba-id, or use `foh channel whatsapp guide` for deterministic next steps."
   });
 }
-function registerWhatsAppChannelCommands(whatsapp, addCommonOptions) {
-  addCommonOptions(
-    whatsapp.command("start").description("[Deprecated wrapper] Start onboarding using the canonical session flow")
-  ).option("--access-token <token>", "Meta access token with WhatsApp Business access").option("--waba-id <id>", "Optional explicit WhatsApp Business Account id when /me discovery is restricted").option("--phone-number-id <id>", "Optional explicit phone number id when discovery returns multiple candidates").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--verify-token <token>", "Optional webhook verify token (auto-generated when omitted)").option("--app-secret <secret>", "Optional Meta app secret (required for full signature-ready closure)").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)", "true").option("--wizard", "Run guided onboarding with automatic recovery prompts").action(async (opts) => withCommandErrorHandling(async () => {
-    const accessToken = String(opts.accessToken || "").trim();
-    const useWizard = Boolean(opts.wizard) || !accessToken;
-    const legacy = emitLegacyCommandNotice({
-      command: "start",
-      canonical: "foh channel whatsapp onboard --wizard",
-      jsonMode: Boolean(opts.json)
-    });
-    const data = useWizard ? await runWhatsAppOnboardingWizard({
-      ...opts,
-      dryRun: true
-    }) : await runWhatsAppOnboardingSession({
-      orgId: opts.org,
-      apiUrl: opts.apiUrl,
-      accessToken,
-      wabaId: String(opts.wabaId || "").trim() || void 0,
-      phoneNumberId: String(opts.phoneNumberId || "").trim() || void 0,
-      verifyToken: String(opts.verifyToken || "").trim() || void 0,
-      appSecret: String(opts.appSecret || "").trim() || void 0,
-      agentId: opts.agentId,
-      businessSlug: opts.businessSlug,
-      audioEnabled: parseBooleanOption({
-        value: opts.audioEnabled,
-        fallback: true,
-        optionName: "--audio-enabled",
-        step: "channel.whatsapp.start"
-      }),
-      dryRun: true
-    });
-    format({
-      ...data,
-      legacy_wrapper: legacy,
-      next_steps: dedupeSteps([
-        "Run canonical onboarding apply flow: foh channel whatsapp onboard --wizard",
-        "Run deterministic closure: foh channel whatsapp proof --strict",
-        "Capture live provider evidence: corepack pnpm ops:whatsapp:proof:live"
-      ])
-    }, { json: opts.json ?? false });
-  }));
+function registerWhatsAppOnboardingCommands(whatsapp, addCommonOptions) {
   addCommonOptions(
     whatsapp.command("onboard").description("Run one-session WhatsApp onboarding (discover -> bind -> verify -> prove)")
   ).option("--access-token <token>", "Meta access token with WhatsApp Business access").option("--waba-id <id>", "Optional explicit WhatsApp Business Account id when /me discovery is restricted").option("--phone-number-id <id>", "Optional explicit phone number id when discovery returns multiple candidates").option("--verify-token <token>", "Optional webhook verify token (auto-generated when omitted)").option("--app-secret <secret>", "Optional Meta app secret (required for full signature-ready closure)").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)", "true").option("--dry-run", "Run discovery/binding preflight without writing channel config").option("--wizard", "Run guided onboarding with automatic recovery prompts").action(async (opts) => withCommandErrorHandling(async () => {
@@ -15993,75 +15943,11 @@ function registerWhatsAppChannelCommands(whatsapp, addCommonOptions) {
       results
     }, { json: opts.json ?? false });
   }));
-  addCommonOptions(
-    whatsapp.command("setup").description("[Deprecated wrapper] Use canonical onboarding session flow")
-  ).option("--phone-number-id <id>", "Meta WhatsApp phone number id").option("--access-token <token>", "Meta access token").option("--verify-token <token>", "Webhook verify token").option("--app-secret <secret>", "Meta app secret for signature verification").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)").option("--generate-verify-token", "Generate webhook verify token automatically when missing").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--wizard", "Run guided setup wizard prompts").action(async (opts) => withCommandErrorHandling(async () => {
-    const legacy = emitLegacyCommandNotice({
-      command: "setup",
-      canonical: "foh channel whatsapp onboard --wizard",
-      jsonMode: Boolean(opts.json)
-    });
-    const useWizard = Boolean(opts.wizard) || !String(opts.accessToken || "").trim();
-    const generatedVerifyToken = String(opts.verifyToken || "").trim() || (Boolean(opts.generateVerifyToken) ? generateVerifyToken() : "");
-    const data = useWizard ? await runWhatsAppOnboardingWizard({
-      ...opts,
-      verifyToken: generatedVerifyToken || void 0,
-      dryRun: false
-    }) : await runWhatsAppOnboardingSession({
-      orgId: opts.org,
-      apiUrl: opts.apiUrl,
-      accessToken: String(opts.accessToken || "").trim(),
-      wabaId: void 0,
-      phoneNumberId: String(opts.phoneNumberId || "").trim() || void 0,
-      verifyToken: generatedVerifyToken || void 0,
-      appSecret: String(opts.appSecret || "").trim() || void 0,
-      agentId: opts.agentId,
-      businessSlug: String(opts.businessSlug || "").trim() || void 0,
-      audioEnabled: parseBooleanOption({
-        value: opts.audioEnabled,
-        fallback: true,
-        optionName: "--audio-enabled",
-        step: "channel.whatsapp.setup"
-      }),
-      dryRun: false
-    });
-    format({
-      ...data,
-      legacy_wrapper: legacy,
-      generated_verify_token: generatedVerifyToken && !opts.verifyToken ? generatedVerifyToken : null
-    }, { json: opts.json ?? false });
-  }));
-  addCommonOptions(
-    whatsapp.command("connect").description("[Deprecated wrapper] Use canonical onboarding session flow")
-  ).requiredOption("--phone-number-id <id>", "Meta WhatsApp phone number id").requiredOption("--access-token <token>", "Meta access token").option("--agent-id <id>", "Agent to bind to the WhatsApp channel").option("--verify-token <token>", "Webhook verify token").option("--app-secret <secret>", "Meta app secret for signature verification").option("--business-slug <slug>", "Business identifier for operator-level targeting").option("--audio-enabled <bool>", "Enable inbound WhatsApp audio fallback auto-reply (true/false)", "true").action(async (opts) => withCommandErrorHandling(async () => {
-    const legacy = emitLegacyCommandNotice({
-      command: "connect",
-      canonical: "foh channel whatsapp onboard --access-token <token> --phone-number-id <id>",
-      jsonMode: Boolean(opts.json)
-    });
-    const data = await runWhatsAppOnboardingSession({
-      orgId: opts.org,
-      apiUrl: opts.apiUrl,
-      accessToken: String(opts.accessToken || "").trim(),
-      wabaId: void 0,
-      phoneNumberId: String(opts.phoneNumberId || "").trim() || void 0,
-      verifyToken: String(opts.verifyToken || "").trim() || void 0,
-      appSecret: String(opts.appSecret || "").trim() || void 0,
-      agentId: opts.agentId,
-      businessSlug: String(opts.businessSlug || "").trim() || void 0,
-      audioEnabled: parseBooleanOption({
-        value: opts.audioEnabled,
-        fallback: true,
-        optionName: "--audio-enabled",
-        step: "channel.whatsapp.connect"
-      }),
-      dryRun: false
-    });
-    format({
-      ...data,
-      legacy_wrapper: legacy
-    }, { json: opts.json ?? false });
-  }));
+}
+
+// src/commands/channel-whatsapp.ts
+function registerWhatsAppChannelCommands(whatsapp, addCommonOptions) {
+  registerWhatsAppOnboardingCommands(whatsapp, addCommonOptions);
   addCommonOptions(
     whatsapp.command("status").description("Get WhatsApp channel status")
   ).action(async (opts) => withCommandErrorHandling(async () => {
@@ -16438,11 +16324,11 @@ function registerVoice(program3) {
     }
     const outputPath = String(opts.out || `foh-voice-preview-${provider}-${voiceId}.mp3`).trim();
     const audio = Buffer.from(await res.arrayBuffer());
-    const { mkdirSync: mkdirSync10, writeFileSync: writeFileSync15 } = await import("fs");
-    const { dirname: dirname13, resolve: resolve15 } = await import("path");
-    const absolutePath = resolve15(outputPath);
-    mkdirSync10(dirname13(absolutePath), { recursive: true });
-    writeFileSync15(absolutePath, audio);
+    const { mkdirSync: mkdirSync11, writeFileSync: writeFileSync16 } = await import("fs");
+    const { dirname: dirname13, resolve: resolve16 } = await import("path");
+    const absolutePath = resolve16(outputPath);
+    mkdirSync11(dirname13(absolutePath), { recursive: true });
+    writeFileSync16(absolutePath, audio);
     format({
       status: "ok",
       provider,
@@ -30933,7 +30819,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve15) => setTimeout(resolve15, pollInterval));
+        await new Promise((resolve16) => setTimeout(resolve16, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -30950,7 +30836,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -31028,7 +30914,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve15(parseResult.data);
+            resolve16(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -31289,12 +31175,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve15, reject) => {
+    return new Promise((resolve16, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve15, interval);
+      const timeoutId = setTimeout(resolve16, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -32394,7 +32280,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve15) => setTimeout(resolve15, pollInterval));
+      await new Promise((resolve16) => setTimeout(resolve16, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -33043,19 +32929,19 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve15) => {
+    return new Promise((resolve16) => {
       const json3 = serializeMessage(message);
       if (this._stdout.write(json3)) {
-        resolve15();
+        resolve16();
       } else {
-        this._stdout.once("drain", resolve15);
+        this._stdout.once("drain", resolve16);
       }
     });
   }
 };
 
 // src/lib/cli-version.ts
-var injectedVersion = true ? String("0.1.86").trim() : "";
+var injectedVersion = true ? String("0.1.88").trim() : "";
 var envVersion = String(process.env.FOH_CLI_VERSION || process.env.npm_package_version || "").trim();
 var CLI_VERSION = injectedVersion || envVersion || "0.0.0-dev";
 
@@ -33242,7 +33128,7 @@ async function runFohCli(params) {
     effectiveArgv.push("--json");
   }
   const command = `foh ${effectiveArgv.join(" ")}`;
-  return await new Promise((resolve15) => {
+  return await new Promise((resolve16) => {
     const child = (0, import_node_child_process.spawn)(process.execPath, [cliEntry, ...effectiveArgv], {
       stdio: ["ignore", "pipe", "pipe"],
       env: {
@@ -33267,7 +33153,7 @@ async function runFohCli(params) {
     });
     child.once("error", (error2) => {
       clearTimeout(timeoutHandle);
-      resolve15({
+      resolve16({
         ok: false,
         command,
         argv: effectiveArgv,
@@ -33283,7 +33169,7 @@ async function runFohCli(params) {
       const stderrText = finalizeBoundedText(stderrBuffer);
       const exitCode = Number.isFinite(code ?? NaN) ? Number(code) : 1;
       const stdoutJson = tryParseJson(stdoutText);
-      resolve15({
+      resolve16({
         ok: !timedOut && exitCode === 0,
         command,
         argv: effectiveArgv,
@@ -34877,8 +34763,190 @@ function writeSetupRunReport(reportPayload, reportOut) {
 }
 
 // src/commands/setup.ts
+var OBJECTIVE_SETUP_INDUSTRIES = ["real_estate", "restaurant", "general"];
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function csv(value, fallback) {
+  return String(value || fallback).split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function objectiveChannels(tools) {
+  const allowed = /* @__PURE__ */ new Set(["widget", "voice", "whatsapp", "instagram", "sms"]);
+  const channels = tools.filter((tool) => allowed.has(tool));
+  return channels.length > 0 ? channels : ["widget"];
+}
+function objectiveOptimizationTarget(industry, objective) {
+  const text = objective.toLowerCase();
+  if (industry === "restaurant" || /book|booking|reservation|table/.test(text)) return "booking_rate";
+  if (/support|resolve|resolution/.test(text)) return "support_resolution";
+  if (/speed|lead|callback|call back/.test(text)) return "speed_to_lead";
+  return "lead_quality";
+}
+function objectiveSetupCommand(opts) {
+  const parts = [
+    "npx --yes @f-o-h/cli@latest setup",
+    `--objective ${JSON.stringify(normalizeString(opts.objective) || "<front-of-house objective>")}`,
+    `--business-name ${JSON.stringify(normalizeString(opts.businessName) || "<business name>")}`,
+    `--industry ${normalizeString(opts.industry) || "<real_estate|restaurant>"}`,
+    `--source-url ${JSON.stringify(normalizeString(opts.sourceUrl) || "<official url>")}`,
+    "--json"
+  ];
+  return parts.join(" ");
+}
+function selectedTemplateSummary(selection) {
+  const candidate = Array.isArray(selection?.candidates) ? selection.candidates[0] : null;
+  const template = candidate?.template;
+  const contract = template?.template_contract ?? {};
+  if (!template) return null;
+  return {
+    template_id: String(template.id || contract.template_id || ""),
+    template_name: String(template.name || contract.name || ""),
+    template_slug: String(contract.slug || ""),
+    industry: String(contract.industry || ""),
+    use_case: String(contract.use_case || ""),
+    match_score: Number.isFinite(Number(candidate.match_score)) ? Number(candidate.match_score) : null,
+    matched_reasons: Array.isArray(candidate.matched_reasons) ? candidate.matched_reasons.map(String) : []
+  };
+}
+async function emitObjectiveSetupBootstrap(opts) {
+  const businessName = normalizeString(opts.businessName);
+  const objective = normalizeString(opts.objective);
+  const industry = normalizeString(opts.industry);
+  const sourceUrl = normalizeString(opts.sourceUrl);
+  const tools = csv(opts.tools, "widget,voice,whatsapp");
+  let credentials = null;
+  try {
+    credentials = loadCredentials(opts.apiUrl);
+    if (!opts.org) opts.org = credentials.orgId;
+  } catch {
+    credentials = null;
+  }
+  if (!credentials && !opts.org) {
+    format({
+      schema_version: "foh_cli_objective_setup_bootstrap.v1",
+      ok: false,
+      status: "blocked",
+      reason_code: "auth_required",
+      summary: "Authenticate before objective setup so template selection and setup planning can use the correct org.",
+      spend_policy: resolveCliSpendPolicy(),
+      next_commands: [
+        "npx --yes @f-o-h/cli@latest auth signup --web --json",
+        "npx --yes @f-o-h/cli@latest auth login --web --json",
+        "npx --yes @f-o-h/cli@latest org list --json",
+        objectiveSetupCommand(opts)
+      ]
+    }, { json: opts.json ?? false });
+    markCommandFailed(1);
+    return;
+  }
+  const missing = [];
+  if (!businessName) missing.push("--business-name");
+  if (!industry) missing.push("--industry");
+  if (!objective) missing.push("--objective");
+  if (!sourceUrl) missing.push("--source-url");
+  if (industry && !OBJECTIVE_SETUP_INDUSTRIES.includes(industry)) missing.push("--industry:supported_value");
+  if (missing.length > 0) {
+    format({
+      schema_version: "foh_cli_objective_setup_bootstrap.v1",
+      ok: false,
+      status: "blocked",
+      reason_code: "objective_setup_required_options_missing",
+      summary: "Objective setup needs an explicit business name, industry, objective, and official source URL.",
+      missing_options: missing,
+      org_id: opts.org ?? null,
+      next_commands: [
+        objectiveSetupCommand(opts),
+        "npx --yes @f-o-h/cli@latest templates list --category general --json",
+        "npx --yes @f-o-h/cli@latest templates list --category buyer --json"
+      ],
+      claim_boundaries: {
+        customer_live_claim_allowed: false,
+        production_claim_allowed: false
+      }
+    }, { json: opts.json ?? false });
+    markCommandFailed(1);
+    return;
+  }
+  const brief = {
+    schema_version: "business_requirement_brief.v1",
+    business_name: businessName,
+    industry,
+    desired_use_cases: [objective],
+    channels: objectiveChannels(tools),
+    knowledge_sources: [{ type: "website", label: `${businessName} official website`, uri: sourceUrl }],
+    required_outcomes: [objective],
+    handoff_rules: ["handoff when approved facts, credentials, or action availability are missing"],
+    constraints: ["do not invent business facts or claim live readiness without accepted evidence"],
+    optimization_target: objectiveOptimizationTarget(industry, objective)
+  };
+  const templateSelection = await apiFetch("/v1/console/templates/select", {
+    method: "POST",
+    body: JSON.stringify(brief),
+    apiUrlOverride: opts.apiUrl
+  });
+  const selectedTemplate = selectedTemplateSummary(templateSelection);
+  if (!selectedTemplate) {
+    format({
+      schema_version: "foh_cli_objective_setup_bootstrap.v1",
+      ok: false,
+      status: "blocked",
+      reason_code: "objective_template_selection_empty",
+      summary: "No supported template matched this objective. Do not continue with a guessed template.",
+      requirement_brief: brief,
+      template_selection: templateSelection,
+      next_commands: [objectiveSetupCommand(opts)]
+    }, { json: opts.json ?? false });
+    markCommandFailed(1);
+    return;
+  }
+  const setupWorkflow = await apiFetch("/v1/console/agency-setup/workflow", {
+    method: "POST",
+    body: JSON.stringify({
+      agency_name: businessName,
+      business_objective: objective,
+      requested_tool_surface: tools,
+      target_exposure_mode: normalizeString(opts.targetMode) || "customer_owned_voice_trial",
+      source_url: sourceUrl,
+      ...normalizeString(opts.location) ? { branch_location: normalizeString(opts.location) } : {}
+    }),
+    orgId: opts.org,
+    apiUrlOverride: opts.apiUrl
+  });
+  format({
+    schema_version: "foh_cli_objective_setup_bootstrap.v1",
+    ok: true,
+    status: "hold",
+    reason_code: "objective_setup_plan_ready",
+    summary: "Objective setup plan is ready. Treat this as dry-run planning until evidence is applied and status explicitly allows live claims.",
+    dry_run: opts.apply === true ? false : true,
+    apply_requested: opts.apply === true,
+    org_id: opts.org ?? null,
+    requirement_brief: brief,
+    selected_template: selectedTemplate,
+    setup_workflow: {
+      decision: setupWorkflow?.decision ?? setupWorkflow?.status ?? null,
+      reason_codes: Array.isArray(setupWorkflow?.reason_codes) ? setupWorkflow.reason_codes : [],
+      evidence_packet: setupWorkflow?.evidence_packet ?? null,
+      operator_status: setupWorkflow?.operator_status ?? null
+    },
+    claim_boundaries: {
+      customer_live_claim_allowed: false,
+      production_claim_allowed: false,
+      fully_autonomous_claim_allowed: false
+    },
+    next_commands: [
+      `npx --yes @f-o-h/cli@latest objective status --business-name ${JSON.stringify(businessName)} --industry ${industry} --business-objective ${JSON.stringify(objective)} --source-url ${JSON.stringify(sourceUrl)} --out test-results/objective-status.latest.json --json`,
+      "npx --yes @f-o-h/cli@latest objective debug --from test-results/objective-status.latest.json --json",
+      `npx --yes @f-o-h/cli@latest templates show --template ${selectedTemplate.template_id} --json`
+    ]
+  }, { json: opts.json ?? false });
+}
 function registerSetup(program3) {
-  program3.command("setup").description("Fully provision a new agency customer in one command").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--agent-template <id>", "Agent template ID (e.g. viewing-request)").option("--agent-name <name>", "Name for the new agent").option("--phone-country <cc>", "Phone number country code", "GB").option("--phone-area-code <code>", "Phone area code preference").option("--phone-mode <mode>", "Phone path: observe, skip, or purchase", "purchase").option("--widget-domains <domains>", "Comma-separated widget domain allowlist").option("--voice-provider <p>", "TTS provider: openai, azure, twilio").option("--voice-id <id>", "Voice ID").option("--skip-compliance", "Skip compliance submission and wait").option("--skip-voice", "Skip voice configuration").option("--skip-tests", "Skip smoke tests").option("--cert-mode <m>", "Simulation cert mode: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive run count for certification loop", "30").option("--cert-max-improvement-rounds <n>", "Max instruction improvement rounds in cert loop (0-5)", "1").option("--resume-from <step>", `Resume from a setup step (${SETUP_STEP_ORDER.join(", ")})`).option("--report-out <path>", "Optional path to write signed setup run report JSON").option("--dry-run", "Print all steps that would run without making any API calls").option("--api-url <url>", "API base URL override").option("--console-url <url>", "Console sign-in URL override").option("--json", "Output as JSON").action(async (opts) => {
+  program3.command("setup").description("Fully provision a customer or plan objective-first setup").option("--objective <text>", "Objective-first setup mode: plain-English front-of-house objective").option("--business-name <name>", "Business trading name for objective-first setup").option("--industry <industry>", "Business industry for objective-first setup: real_estate, restaurant, general").option("--source-url <url>", "Official business source URL for objective-first setup").option("--location <value>", "Location or branch represented by this setup").option("--tools <csv>", "Requested surfaces for objective-first setup", "widget,voice,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode for objective-first setup", "customer_owned_voice_trial").option("--apply", "Explicitly request apply mode for objective setup; default is dry-run planning").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--agent-template <id>", "Agent template ID (e.g. viewing-request)").option("--agent-name <name>", "Name for the new agent").option("--phone-country <cc>", "Phone number country code", "GB").option("--phone-area-code <code>", "Phone area code preference").option("--phone-mode <mode>", "Phone path: observe, skip, or purchase", "purchase").option("--widget-domains <domains>", "Comma-separated widget domain allowlist").option("--voice-provider <p>", "TTS provider: openai, azure, twilio").option("--voice-id <id>", "Voice ID").option("--skip-compliance", "Skip compliance submission and wait").option("--skip-voice", "Skip voice configuration").option("--skip-tests", "Skip smoke tests").option("--cert-mode <m>", "Simulation cert mode: quick, full, stress", "quick").option("--cert-adaptive-runs <n>", "Adaptive run count for certification loop", "30").option("--cert-max-improvement-rounds <n>", "Max instruction improvement rounds in cert loop (0-5)", "1").option("--resume-from <step>", `Resume from a setup step (${SETUP_STEP_ORDER.join(", ")})`).option("--report-out <path>", "Optional path to write signed setup run report JSON").option("--dry-run", "Print all steps that would run without making any API calls").option("--api-url <url>", "API base URL override").option("--console-url <url>", "Console sign-in URL override").option("--json", "Output as JSON").action(async (opts) => {
+    if (opts.objective) {
+      await emitObjectiveSetupBootstrap(opts);
+      return;
+    }
     if (!opts.org) {
       try {
         opts.org = loadCredentials(opts.apiUrl).orgId;
@@ -35453,8 +35521,8 @@ function registerSetup(program3) {
         }
         try {
           const manifest = await agentExport(resolvedAgentId, { apiUrlOverride: opts.apiUrl });
-          const { writeFileSync: writeFileSync15 } = await import("fs");
-          writeFileSync15(
+          const { writeFileSync: writeFileSync16 } = await import("fs");
+          writeFileSync16(
             "tenant.yaml",
             `# tenant.yaml - Front Of House agent manifest
 # Edit this file and run: foh plan tenant.yaml
@@ -35624,8 +35692,8 @@ function registerSim(program3) {
       }
       const cert = response.certificate;
       if (opts.out) {
-        const { writeFileSync: writeFileSync15 } = await import("fs");
-        writeFileSync15(opts.out, JSON.stringify(cert, null, 2) + "\n", "utf-8");
+        const { writeFileSync: writeFileSync16 } = await import("fs");
+        writeFileSync16(opts.out, JSON.stringify(cert, null, 2) + "\n", "utf-8");
         process.stderr.write(`  Certificate written to ${opts.out}
 `);
       }
@@ -35675,8 +35743,8 @@ function registerSim(program3) {
         });
       }
       if (opts.out) {
-        const { writeFileSync: writeFileSync15 } = await import("fs");
-        writeFileSync15(opts.out, JSON.stringify(response.certificate, null, 2) + "\n", "utf-8");
+        const { writeFileSync: writeFileSync16 } = await import("fs");
+        writeFileSync16(opts.out, JSON.stringify(response.certificate, null, 2) + "\n", "utf-8");
         process.stderr.write(`  Final certificate written to ${opts.out}
 `);
       }
@@ -35733,7 +35801,7 @@ function defaultAdaptiveRuns(profile) {
   if (profile === "stress") return 30;
   return 5;
 }
-function csv(raw) {
+function csv2(raw) {
   if (!raw) return void 0;
   const values = String(raw).split(",").map((value) => value.trim()).filter(Boolean);
   return values.length > 0 ? values : void 0;
@@ -35759,8 +35827,8 @@ function registerCertify(program3) {
           body: JSON.stringify({
             mode,
             adaptive_runs: adaptiveRuns,
-            journeys: csv(opts.journeys),
-            scenario_ids: csv(opts.scenarioIds),
+            journeys: csv2(opts.journeys),
+            scenario_ids: csv2(opts.scenarioIds),
             channel: channel(opts.channel)
           }),
           apiUrlOverride: opts.apiUrl
@@ -38109,6 +38177,9 @@ function fail(name, reasonCode, error2, nextCommand) {
 function skipped(name, reasonCode, summary, nextCommand) {
   return { name, category: categoryForCheck(name), status: "skipped", reason_code: reasonCode, summary, next_command: nextCommand };
 }
+function defaultCertificationProfileForMission(mission) {
+  return mission === "publish" ? "release" : "smoke";
+}
 function hasBlockingChecks(checks) {
   return checks.some((check2) => check2.status === "hold" || check2.status === "fail");
 }
@@ -38446,11 +38517,12 @@ function registerProve(program3) {
       if (opts.skipCert) {
         checks.push(skipped("simulation_certification", "operator_skipped", "Skipped by --skip-cert.", `foh certify run --agent ${ctx.agentId} --profile release --json`));
       } else if (!opts.includeCertification) {
+        const certificationProfile = defaultCertificationProfileForMission(mission);
         checks.push(skipped(
           "simulation_certification",
           "certification_explicitly_required",
-          "Runtime proof does not run release certification by default.",
-          `foh certify run --agent ${ctx.agentId} --profile release --json`
+          certificationProfile === "release" ? "Runtime proof does not run release certification by default." : "Runtime proof does not run certification by default; use smoke certification for bounded external-agent verification.",
+          `foh certify run --agent ${ctx.agentId} --profile ${certificationProfile} --json`
         ));
       } else {
         try {
@@ -38542,6 +38614,808 @@ function registerProve(program3) {
   }));
 }
 
+// src/commands/objective.ts
+var import_node_fs5 = require("node:fs");
+var import_node_path2 = require("node:path");
+var DEFAULT_OBJECTIVE_REPORT_PATH = "test-results/objective-status.latest.json";
+var VALID_OBJECTIVE_INDUSTRIES = ["real_estate", "restaurant", "general"];
+var BUSINESS_REQUIREMENT_BRIEF_SCHEMA_VERSION = "business_requirement_brief.v1";
+function asRecord3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function normalizeString2(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function uniqueStrings(values) {
+  return Array.from(new Set(values.map(normalizeString2).filter(Boolean)));
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function collectStringArrays(value, keys, output = []) {
+  if (!value || typeof value !== "object") return output;
+  if (Array.isArray(value)) {
+    for (const item of value) collectStringArrays(item, keys, output);
+    return output;
+  }
+  for (const [key, child] of Object.entries(value)) {
+    if (keys.has(key) && Array.isArray(child)) {
+      for (const item of child) {
+        if (typeof item === "string") output.push(item);
+      }
+    } else if (child && typeof child === "object") {
+      collectStringArrays(child, keys, output);
+    }
+  }
+  return output;
+}
+function collectArtifactRefs(value, output = []) {
+  if (!value || typeof value !== "object") return output;
+  if (Array.isArray(value)) {
+    for (const item of value) collectArtifactRefs(item, output);
+    return output;
+  }
+  for (const [key, child] of Object.entries(value)) {
+    if (typeof child === "string") {
+      const normalized = child.trim();
+      if (normalized && (key.toLowerCase().includes("artifact") || key.toLowerCase().includes("report") || normalized.includes("test-results/") || normalized.includes("test-results\\"))) {
+        output.push(normalized);
+      }
+    } else if (child && typeof child === "object") {
+      collectArtifactRefs(child, output);
+    }
+  }
+  return output;
+}
+function summarizeSourceReport(value) {
+  const report = asRecord3(value);
+  return {
+    decision: firstString(report, ["decision", "current_decision", "status"]) || null,
+    go_live_allowed: report.go_live_allowed === true || report.customer_live_ready === true || report.production_ready === true,
+    allowed_mode: firstString(report, ["allowed_mode", "highest_allowed_mode", "current_mode"]) || null,
+    blocked_modes: uniqueStrings(collectStringArrays(report, /* @__PURE__ */ new Set(["blocked_modes"]))),
+    reason_codes: uniqueStrings(collectStringArrays(report, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"]))),
+    next_commands: uniqueStrings(collectStringArrays(report, /* @__PURE__ */ new Set(["next_commands"]))),
+    evidence_refs: uniqueStrings(collectArtifactRefs(report))
+  };
+}
+function finiteNumber(value) {
+  const number3 = Number(value);
+  return Number.isFinite(number3) ? number3 : null;
+}
+function normalizeCustomerEvidenceActions(value) {
+  return asArray(value).map(asRecord3).map((action) => ({
+    id: firstString(action, ["id", "action_id"]),
+    title: firstString(action, ["title"]) || null,
+    owner: firstString(action, ["owner"]) || null,
+    blocker_count: finiteNumber(action.blocker_count) ?? (uniqueStrings(asArray(action.reason_codes)).length || null),
+    target_evidence_paths: uniqueStrings([
+      ...asArray(action.target_evidence_paths),
+      firstString(action, ["target_evidence_path"])
+    ]),
+    validator_commands: uniqueStrings([
+      ...asArray(action.validator_commands),
+      ...asArray(action.next_commands)
+    ]),
+    required_evidence: firstString(action, ["required_evidence"]) || null,
+    unlocks: firstString(action, ["unlocks"]) || null
+  })).filter((action) => normalizeString2(action.id));
+}
+function normalizeCustomerEvidenceActionPacket(value) {
+  const packet = asRecord3(value);
+  const actions = normalizeCustomerEvidenceActions(packet.actions);
+  if (actions.length === 0) return void 0;
+  return {
+    packet_role: firstString(packet, ["packet_role"]) || "compressed_customer_operator_action_plan",
+    action_count: finiteNumber(packet.action_count) ?? actions.length,
+    external_hold_count: finiteNumber(packet.external_hold_count),
+    raw_reason_code_count: finiteNumber(packet.raw_reason_code_count),
+    compression_ratio: finiteNumber(packet.compression_ratio),
+    actions,
+    validation_commands: uniqueStrings(asArray(packet.validation_commands)),
+    instructions: uniqueStrings(asArray(packet.instructions))
+  };
+}
+function customerEvidenceActionPacketFromSources(...sources) {
+  for (const source of sources) {
+    const report = asRecord3(source);
+    const requestPackets = asRecord3(report.request_packets);
+    const operatorStatus = asRecord3(report.operator_status);
+    const candidates = [
+      requestPackets.customer_operator_action_packet,
+      report.customer_operator_action_packet,
+      report.customer_evidence_action_packet,
+      operatorStatus.customer_operator_action_packet,
+      operatorStatus.customer_evidence_action_packet,
+      operatorStatus.customer_actions ? {
+        packet_role: "compressed_customer_operator_action_plan",
+        action_count: asArray(operatorStatus.customer_actions).length,
+        actions: operatorStatus.customer_actions,
+        validation_commands: collectStringArrays(operatorStatus, /* @__PURE__ */ new Set(["next_commands"]))
+      } : null,
+      report.customer_actions ? { actions: report.customer_actions } : null
+    ];
+    for (const candidate of candidates) {
+      const normalized = normalizeCustomerEvidenceActionPacket(candidate);
+      if (normalized) return normalized;
+    }
+  }
+  return void 0;
+}
+function normalizeObjectiveArtifactPath(value) {
+  return value.trim() ? (0, import_node_path2.resolve)(value.trim()) : "";
+}
+function resolveObjectiveArtifactPath(value) {
+  return normalizeObjectiveArtifactPath(value);
+}
+function firstNonEmptyObject(value) {
+  const record2 = asRecord3(value);
+  return Object.keys(record2).length > 0 ? record2 : void 0;
+}
+function pickEvidencePacket(value) {
+  const record2 = firstNonEmptyObject(value);
+  if (!record2) return void 0;
+  const payload = firstNonEmptyObject(record2.payload);
+  return payload ?? record2;
+}
+function readEvidencePacketFromPlan(path2) {
+  const plan = asRecord3(readJsonArtifact(path2));
+  const sourceReports = asRecord3(plan.source_reports);
+  return pickEvidencePacket(plan.evidence) ?? pickEvidencePacket(plan.evidence_packet) ?? pickEvidencePacket(sourceReports.customer_live_status && asRecord3(sourceReports.customer_live_status).evidence) ?? pickEvidencePacket(asRecord3(sourceReports.setup_workflow).evidence_packet) ?? {};
+}
+function inferEvidenceFromProofPaths(evidence) {
+  const record2 = asRecord3(evidence);
+  if (!record2 || Object.keys(record2).length === 0) return evidence;
+  return record2.evidence ?? evidence;
+}
+async function resolveEvidenceInput(opts) {
+  if (opts.evidence) {
+    return inferEvidenceFromProofPaths(await parseJsonOption(opts.evidence, "--evidence"));
+  }
+  if (!opts.plan) {
+    throw new FohError({
+      step: "objective.apply",
+      error: "Missing objective evidence input: pass --evidence or --plan.",
+      remediation: "Provide either --evidence <json|@file> or --plan <path-to-plan-json>.",
+      statusCode: 400
+    });
+  }
+  const planPath = resolveObjectiveArtifactPath(opts.plan);
+  return inferEvidenceFromProofPaths(readEvidencePacketFromPlan(planPath));
+}
+function firstString(record2, keys) {
+  for (const key of keys) {
+    const value = normalizeString2(record2[key]);
+    if (value) return value;
+  }
+  return "";
+}
+function firstStringFromUnknown(value, keys) {
+  return firstString(asRecord3(value), keys);
+}
+function truthy(record2, keys) {
+  return keys.some((key) => record2[key] === true);
+}
+function statusFromDecision(value) {
+  const normalized = value.toLowerCase();
+  if (/fail|failed|error/.test(normalized)) return "fail";
+  if (/ready|pass|passed|success|go_live/.test(normalized)) return "pass";
+  return "hold";
+}
+function firstCustomerEvidenceAction(packet) {
+  const actions = asArray(packet?.actions).map(asRecord3).filter((action) => normalizeString2(action.id));
+  return actions[0] ?? null;
+}
+function buildDeveloperReadinessPacket(input) {
+  const businessName = resolveBusinessName(input.opts);
+  const sourceUrl = normalizeString2(input.opts.sourceUrl);
+  const businessObjective = normalizeString2(input.opts.businessObjective);
+  const location = resolveLocation(input.opts);
+  const tools = parseCsvOption(input.opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
+  const setupDecision = firstString(input.setupWorkflow, ["decision", "current_decision", "status"]);
+  const liveDecision = firstString(input.customerLiveStatus, ["decision", "current_decision", "status"]);
+  const explicitGoLive = truthy(input.customerLiveStatus, ["go_live_allowed", "customer_live_ready", "production_ready"]) || truthy(input.setupWorkflow, ["go_live_allowed", "customer_live_ready", "production_ready"]);
+  const firstAction = firstCustomerEvidenceAction(input.customerEvidenceActionPacket);
+  const firstActionValidator = firstAction ? uniqueStrings(asArray(firstAction.validator_commands))[0] ?? null : null;
+  const firstNextCommand = input.nextCommands[0] ?? null;
+  return {
+    schema_version: "developer_objective_readiness_packet.v1",
+    packet_role: "coding_agent_objective_readiness",
+    decision: input.classification.status,
+    reason_code: input.classification.reasonCode,
+    business_context: {
+      business_name: businessName || null,
+      business_objective: businessObjective || null,
+      industry: objectiveIndustryOrNull(input.opts),
+      source_url: sourceUrl || null,
+      location: location || null,
+      target_mode: normalizeString2(input.opts.targetMode) || "customer_owned_voice_trial",
+      tools
+    },
+    input_completeness: {
+      business_name: Boolean(businessName),
+      source_url: Boolean(sourceUrl),
+      business_objective: Boolean(businessObjective),
+      requested_tools: tools.length > 0,
+      target_mode: Boolean(normalizeString2(input.opts.targetMode) || "customer_owned_voice_trial")
+    },
+    readiness_dimensions: {
+      setup_workflow: {
+        status: statusFromDecision(setupDecision),
+        decision: setupDecision || null
+      },
+      customer_live_status: {
+        status: explicitGoLive ? "pass" : statusFromDecision(liveDecision),
+        decision: liveDecision || null
+      },
+      customer_evidence_actions: {
+        status: firstAction ? "hold" : "pass",
+        action_count: finiteNumber(input.customerEvidenceActionPacket?.action_count) ?? asArray(input.customerEvidenceActionPacket?.actions).length,
+        first_action_id: firstAction ? normalizeString2(firstAction.id) : null,
+        first_validator_command: firstActionValidator
+      },
+      agent_operability: {
+        status: firstNextCommand ? "pass" : "fail",
+        first_next_command: firstNextCommand,
+        normal_path_requires_raw_artifacts: false
+      }
+    },
+    next_command: firstNextCommand,
+    claim_boundaries: {
+      developer_setup_loop_ready: Boolean(firstNextCommand),
+      customer_live_claim_allowed: explicitGoLive && input.classification.status === "pass",
+      production_claim_allowed: explicitGoLive && input.classification.status === "pass",
+      do_not_claim: explicitGoLive && input.classification.status === "pass" ? [] : ["customer-live", "production-ready", "fully autonomous customer setup"]
+    },
+    agent_instructions: [
+      "Use this packet before source_reports or raw artifacts.",
+      "Execute next_command first, then rerun objective status.",
+      "Treat customer evidence actions as request work, not proof."
+    ]
+  };
+}
+function resolveObjectiveReportPath(value) {
+  const raw = normalizeString2(value);
+  if (!raw || raw === "latest") return (0, import_node_path2.resolve)(DEFAULT_OBJECTIVE_REPORT_PATH);
+  return (0, import_node_path2.resolve)(raw);
+}
+function writeJsonArtifact2(path2, value) {
+  (0, import_node_fs5.mkdirSync)((0, import_node_path2.dirname)(path2), { recursive: true });
+  (0, import_node_fs5.writeFileSync)(path2, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function readJsonArtifact(path2) {
+  return JSON.parse((0, import_node_fs5.readFileSync)(path2, "utf8"));
+}
+function buildSetupBody(opts) {
+  const tools = parseCsvOption(opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
+  const businessName = resolveBusinessName(opts);
+  const location = resolveLocation(opts);
+  const body = {
+    agency_name: businessName,
+    business_objective: normalizeString2(opts.businessObjective) || null,
+    requested_tool_surface: tools,
+    target_exposure_mode: normalizeString2(opts.targetMode) || "customer_owned_voice_trial"
+  };
+  if (opts.sourceUrl) body.source_url = normalizeString2(opts.sourceUrl);
+  if (location) body.branch_location = location;
+  return body;
+}
+function buildStatusParams(opts) {
+  const params = new URLSearchParams();
+  const businessName = resolveBusinessName(opts);
+  const location = resolveLocation(opts);
+  if (opts.environment) params.set("environment", normalizeString2(opts.environment));
+  if (businessName) params.set("agency_name", businessName);
+  if (opts.sourceUrl) params.set("source_url", normalizeString2(opts.sourceUrl));
+  if (location) params.set("branch_location", location);
+  if (opts.tools) params.set("tools", normalizeString2(opts.tools));
+  if (opts.targetMode) params.set("target_mode", normalizeString2(opts.targetMode));
+  return params;
+}
+function resolveBusinessName(opts) {
+  return normalizeString2(opts.businessName) || normalizeString2(opts.agencyName);
+}
+function resolveLocation(opts) {
+  return normalizeString2(opts.location) || normalizeString2(opts.branchLocation);
+}
+function hasAnyToken(value, tokens) {
+  const normalized = ` ${value.toLowerCase().replace(/[^a-z0-9]+/g, " ")} `;
+  return tokens.some((token) => normalized.includes(` ${token} `));
+}
+function inferObjectiveIndustry(opts) {
+  const explicit = normalizeString2(opts.industry);
+  if (explicit) {
+    if (VALID_OBJECTIVE_INDUSTRIES.includes(explicit)) return explicit;
+    throw new FohError({
+      step: "objective.brief",
+      error: `Unsupported industry: ${explicit}.`,
+      remediation: `Use one of: ${VALID_OBJECTIVE_INDUSTRIES.join(", ")}.`,
+      statusCode: 400,
+      reasonCode: "objective_industry_unsupported"
+    });
+  }
+  const objectiveText = [
+    opts.businessObjective,
+    opts.businessName,
+    opts.agencyName,
+    opts.sourceUrl
+  ].map(normalizeString2).join(" ");
+  const realEstate = hasAnyToken(objectiveText, [
+    "estate",
+    "property",
+    "properties",
+    "viewing",
+    "valuation",
+    "buyer",
+    "seller",
+    "landlord",
+    "tenant",
+    "lettings"
+  ]);
+  const restaurant = hasAnyToken(objectiveText, [
+    "restaurant",
+    "table",
+    "booking",
+    "reservation",
+    "reservations",
+    "diner",
+    "diners",
+    "menu",
+    "allergy",
+    "hospitality"
+  ]);
+  if (realEstate && !restaurant) return "real_estate";
+  if (restaurant && !realEstate) return "restaurant";
+  throw new FohError({
+    step: "objective.brief",
+    error: realEstate && restaurant ? "Objective matches multiple industries." : "Objective is too ambiguous to select a business template.",
+    remediation: "Pass --industry real_estate or --industry restaurant, and keep --business-objective specific to one front-of-house outcome.",
+    statusCode: 400,
+    reasonCode: realEstate && restaurant ? "objective_industry_ambiguous" : "objective_industry_missing",
+    nextCommands: [
+      'foh objective plan --business-name <name> --industry restaurant --business-objective "Book tables from website and voice enquiries" --source-url <official_url> --json',
+      'foh objective plan --business-name <name> --industry real_estate --business-objective "Qualify buyers and book viewings" --source-url <official_url> --json'
+    ]
+  });
+}
+function objectiveIndustryOrNull(opts) {
+  try {
+    return inferObjectiveIndustry(opts);
+  } catch {
+    return null;
+  }
+}
+function channelsFromTools(tools) {
+  const supported = /* @__PURE__ */ new Set(["widget", "voice", "whatsapp", "instagram", "sms"]);
+  const channels = tools.filter((tool) => supported.has(tool));
+  return channels.length > 0 ? channels : ["widget"];
+}
+function inferOptimizationTarget(industry, objective) {
+  const normalized = objective.toLowerCase();
+  if (industry === "restaurant" || /book|booking|reservation|table/.test(normalized)) return "booking_rate";
+  if (/speed|fast|callback|call back|lead/.test(normalized)) return "speed_to_lead";
+  if (/support|help|resolve|resolution/.test(normalized)) return "support_resolution";
+  return "lead_quality";
+}
+function buildRequirementBrief(opts) {
+  const businessName = resolveBusinessName(opts);
+  const businessObjective = normalizeString2(opts.businessObjective);
+  if (!businessObjective) {
+    throw new FohError({
+      step: "objective.brief",
+      error: "Missing business objective.",
+      remediation: "Pass --business-objective with the concrete front-of-house outcome to configure.",
+      statusCode: 400,
+      reasonCode: "objective_business_objective_missing"
+    });
+  }
+  const industry = inferObjectiveIndustry(opts);
+  const tools = parseCsvOption(opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? [];
+  const knowledgeSources = [];
+  const sourceUrl = normalizeString2(opts.sourceUrl);
+  if (sourceUrl) {
+    knowledgeSources.push({
+      type: "website",
+      label: `${businessName} official website`,
+      uri: sourceUrl
+    });
+  }
+  return {
+    schema_version: BUSINESS_REQUIREMENT_BRIEF_SCHEMA_VERSION,
+    business_name: businessName,
+    industry,
+    desired_use_cases: [businessObjective],
+    channels: channelsFromTools(tools),
+    knowledge_sources: knowledgeSources,
+    required_outcomes: [businessObjective],
+    handoff_rules: ["handoff when customer facts, credentials, or booking/action availability are missing"],
+    constraints: ["do not invent business facts or confirm actions without configured evidence/tool results"],
+    optimization_target: inferOptimizationTarget(industry, businessObjective)
+  };
+}
+function selectedTemplateSummary2(templateSelection) {
+  const candidates = asArray(asRecord3(templateSelection).candidates).map(asRecord3);
+  const top = candidates[0];
+  const template = asRecord3(top?.template);
+  if (!template || Object.keys(template).length === 0) return null;
+  const contract = asRecord3(template.template_contract);
+  return {
+    template_id: normalizeString2(template.id) || normalizeString2(contract.template_id) || null,
+    template_name: normalizeString2(template.name) || normalizeString2(contract.name) || null,
+    industry: normalizeString2(contract.industry) || null,
+    use_case: normalizeString2(contract.use_case) || null,
+    match_score: finiteNumber(top.match_score),
+    matched_reasons: uniqueStrings(asArray(top.matched_reasons))
+  };
+}
+function assertTemplateSelected(templateSelection) {
+  if (selectedTemplateSummary2(templateSelection)) return;
+  throw new FohError({
+    step: "objective.template_selection",
+    error: "No supported template matched this business objective.",
+    remediation: "Use a more specific --business-objective or choose a supported --industry before setup. Do not continue with a guessed template.",
+    statusCode: 422,
+    reasonCode: "objective_template_selection_empty",
+    nextCommands: [
+      "foh templates select --brief @business-brief.json --json"
+    ]
+  });
+}
+async function selectTemplateForObjective(opts) {
+  const brief = buildRequirementBrief(opts);
+  const selection = await apiFetch("/v1/console/templates/select", {
+    method: "POST",
+    body: JSON.stringify(brief),
+    apiUrlOverride: opts.apiUrl
+  });
+  assertTemplateSelected(selection);
+  return {
+    brief,
+    selection,
+    selected: selectedTemplateSummary2(selection)
+  };
+}
+function assertBusinessName(opts, step) {
+  if (resolveBusinessName(opts)) return;
+  throw new FohError({
+    step,
+    error: "Missing business name.",
+    remediation: "Pass --business-name <name>. Legacy --agency-name <name> is still accepted.",
+    statusCode: 400
+  });
+}
+function classifyStatus(input) {
+  const setup = asRecord3(input.setupWorkflow);
+  const live = asRecord3(input.customerLiveStatus);
+  const allReasonCodes = uniqueStrings([
+    ...collectStringArrays(setup, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"])),
+    ...collectStringArrays(live, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"]))
+  ]);
+  const setupDecision = firstString(setup, ["decision", "current_decision", "status"]);
+  const liveDecision = firstString(live, ["decision", "current_decision", "status"]);
+  const explicitGoLive = truthy(live, ["go_live_allowed", "customer_live_ready", "production_ready"]) || truthy(setup, ["go_live_allowed", "customer_live_ready", "production_ready"]);
+  const hasBlockingReason = allReasonCodes.some((code) => !/_ok$|passed|ready|no_findings/.test(code));
+  const hasHoldDecision = [setupDecision, liveDecision].some(
+    (decision) => /hold|blocked|fail|failed|no_go|developer_supervised|founder_assisted/.test(decision.toLowerCase())
+  );
+  if (explicitGoLive && !hasBlockingReason && !hasHoldDecision) {
+    return {
+      status: "pass",
+      reasonCode: "objective_ready",
+      summary: "Objective evidence is ready for the requested launch mode."
+    };
+  }
+  return {
+    status: "hold",
+    reasonCode: allReasonCodes[0] || "objective_needs_next_action",
+    summary: "Objective is not yet proven for the requested mode; follow next_commands exactly."
+  };
+}
+function buildObjectiveReport(input) {
+  const setup = asRecord3(input.setupWorkflow);
+  const live = asRecord3(input.customerLiveStatus);
+  const classification = classifyStatus(input);
+  const reasonCodes = uniqueStrings([
+    classification.reasonCode,
+    ...collectStringArrays(setup, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"])),
+    ...collectStringArrays(live, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"]))
+  ]);
+  const debugSource = normalizeString2(input.opts.out) || "latest";
+  const nextCommands = dedupeCommands([
+    ...collectStringArrays(setup, /* @__PURE__ */ new Set(["next_commands"])),
+    ...collectStringArrays(live, /* @__PURE__ */ new Set(["next_commands"])),
+    `foh objective debug --from ${debugSource} --json`
+  ]);
+  const allowedMode = firstString(live, ["allowed_mode", "highest_allowed_mode", "current_mode"]) || firstString(setup, ["allowed_mode", "highest_allowed_mode", "current_mode"]) || null;
+  const blockedModes = uniqueStrings([
+    ...collectStringArrays(setup, /* @__PURE__ */ new Set(["blocked_modes"])),
+    ...collectStringArrays(live, /* @__PURE__ */ new Set(["blocked_modes"]))
+  ]);
+  const evidenceRefs = uniqueStrings([
+    ...collectArtifactRefs(setup),
+    ...collectArtifactRefs(live)
+  ]);
+  const customerEvidenceActionPacket = customerEvidenceActionPacketFromSources(live, setup);
+  const developerReadinessPacket = buildDeveloperReadinessPacket({
+    opts: input.opts,
+    setupWorkflow: setup,
+    customerLiveStatus: live,
+    classification,
+    nextCommands,
+    customerEvidenceActionPacket
+  });
+  return cliEnvelope({
+    schemaVersion: "agent_workbench_report.v1",
+    status: classification.status,
+    reasonCode: classification.reasonCode,
+    summary: classification.summary,
+    ids: {
+      org_id: input.opts.org ?? null
+    },
+    artifacts: {
+      evidence_refs: evidenceRefs
+    },
+    nextCommands,
+    spendClass: "free",
+    safeToRetry: true,
+    extra: {
+      objective: {
+        business_objective: normalizeString2(input.opts.businessObjective) || null,
+        business_name: resolveBusinessName(input.opts) || null,
+        agency_name: normalizeString2(input.opts.agencyName) || resolveBusinessName(input.opts) || null,
+        industry: objectiveIndustryOrNull(input.opts),
+        source_url: normalizeString2(input.opts.sourceUrl) || null,
+        location: resolveLocation(input.opts) || null,
+        branch_location: normalizeString2(input.opts.branchLocation) || resolveLocation(input.opts) || null,
+        target_mode: normalizeString2(input.opts.targetMode) || "customer_owned_voice_trial",
+        tools: parseCsvOption(input.opts.tools ?? "widget,voice,email,callback,calendar,crm,webhook,whatsapp") ?? []
+      },
+      requirement_brief: firstNonEmptyObject(input.requirementBrief) ?? null,
+      selected_template: firstNonEmptyObject(input.selectedTemplate) ?? null,
+      template_selection: firstNonEmptyObject(input.templateSelection) ?? null,
+      allowed_mode: allowedMode,
+      blocked_modes: blockedModes,
+      reason_codes: reasonCodes,
+      next_action: nextCommands[0] ?? null,
+      developer_readiness_packet: developerReadinessPacket,
+      customer_evidence_action_packet: customerEvidenceActionPacket ?? null,
+      source_report_summaries: {
+        setup_workflow: summarizeSourceReport(setup),
+        customer_live_status: summarizeSourceReport(live)
+      },
+      artifact_policy: {
+        normal_path_fields: ["status", "reason_code", "reason_codes", "next_action", "next_commands", "developer_readiness_packet", "customer_evidence_action_packet", "source_report_summaries", "agent_guidance"],
+        diagnostic_fields: ["source_reports", "artifacts.evidence_refs"],
+        raw_artifact_reads_required: false,
+        mutable_latest_json_policy: "diagnostic_only",
+        immutable_evidence_refs_required: true
+      },
+      source_reports: {
+        setup_workflow: setup,
+        customer_live_status: live
+      },
+      agent_guidance: {
+        normal_user_path: "Use objective commands first; inspect source_reports only when debug asks for it.",
+        do_not_infer_from_raw_artifacts: true
+      }
+    }
+  });
+}
+function withObjectiveArtifactPath(report, artifactPath) {
+  return {
+    ...report,
+    artifacts: {
+      ...asRecord3(report.artifacts),
+      objective_report: artifactPath
+    },
+    artifact_path: artifactPath
+  };
+}
+function stripDiagnosticField(target, fieldPath) {
+  const parts = fieldPath.split(".").map((part) => part.trim()).filter(Boolean);
+  if (parts.length === 0) return;
+  let current = target;
+  for (let index = 0; index < parts.length - 1; index += 1) {
+    const next = asRecord3(current?.[parts[index]]);
+    if (Object.keys(next).length === 0) return;
+    current = next;
+  }
+  if (!current) return;
+  delete current[parts[parts.length - 1]];
+}
+function buildObjectiveNormalPathOutput(report) {
+  const output = JSON.parse(JSON.stringify(report));
+  const artifactPolicy = asRecord3(output.artifact_policy);
+  const diagnosticFields = uniqueStrings(asArray(artifactPolicy.diagnostic_fields).map((value) => normalizeString2(value)));
+  for (const fieldPath of diagnosticFields) stripDiagnosticField(output, fieldPath);
+  return output;
+}
+function classifyReasonCode(reasonCode) {
+  const normalized = reasonCode.toLowerCase();
+  if (/credential|token|auth|login|permission|scope|key|secret/.test(normalized)) return "credentials";
+  if (/source|official|fact|approval|conflict|provenance|unknown|intake/.test(normalized)) return "source_facts";
+  if (/customer.*evidence|evidence|signoff|ownership|customer_owned|live.*validation/.test(normalized)) return "customer_evidence";
+  if (/voice|stt|tts|turn|audio|latency|tool|webhook|calendar|crm|email|callback|whatsapp/.test(normalized)) return "voice_or_tool_quality";
+  if (/deploy|production|backup|rollback|runtime|env|release|drift/.test(normalized)) return "deploy_or_runtime";
+  if (/docs|api|route|command|registry|schema|contract/.test(normalized)) return "docs_api_mismatch";
+  if (/proof|simulation|cert|widget|artifact|gate|readiness/.test(normalized)) return "runtime_proof";
+  return "uncategorized";
+}
+function buildDebugReport(sourcePath, objectiveReport) {
+  const report = asRecord3(objectiveReport);
+  const reasonCodes = uniqueStrings([
+    firstString(report, ["reason_code"]),
+    ...collectStringArrays(report, /* @__PURE__ */ new Set(["reason_codes", "blocker_reason_codes"]))
+  ]);
+  const nextCommands = dedupeCommands([
+    ...collectStringArrays(report, /* @__PURE__ */ new Set(["next_commands"])),
+    "foh objective status --business-name <name> --source-url <official_url> --out test-results/objective-status.latest.json --json"
+  ]);
+  const categories = uniqueStrings(reasonCodes.map(classifyReasonCode));
+  const status = firstString(report, ["status"]);
+  const isReady = report.ok === true || status === "pass" || status === "success";
+  const dominantCategory = categories.find((category) => category !== "uncategorized") ?? categories[0] ?? "uncategorized";
+  const sourceReports = asRecord3(report.source_reports);
+  const customerEvidenceActionPacket = firstNonEmptyObject(report.customer_evidence_action_packet);
+  const developerReadinessPacket = firstNonEmptyObject(report.developer_readiness_packet);
+  if (isReady && reasonCodes.length <= 1 && reasonCodes[0] === "objective_ready") {
+    return cliEnvelope({
+      schemaVersion: "agent_workbench_debug.v1",
+      status: "pass",
+      reasonCode: "objective_debug_no_blockers",
+      summary: "Objective report is ready; no repair packet is required.",
+      artifacts: { objective_report: sourcePath },
+      nextCommands,
+      spendClass: "free",
+      safeToRetry: true,
+      extra: {
+        blocker_categories: [],
+        dominant_category: null,
+        repair_packet: null
+      }
+    });
+  }
+  return cliEnvelope({
+    schemaVersion: "agent_workbench_debug.v1",
+    status: "hold",
+    reasonCode: "objective_debug_repair_packet_ready",
+    summary: `Objective is held by ${dominantCategory}; execute the first repair command before rerunning status.`,
+    artifacts: { objective_report: sourcePath },
+    nextCommands,
+    spendClass: "free",
+    safeToRetry: true,
+    extra: {
+      blocker_categories: categories,
+      dominant_category: dominantCategory,
+      repair_packet: {
+        category: dominantCategory,
+        reason_codes: reasonCodes,
+        first_repair_command: nextCommands[0] ?? null,
+        developer_readiness_packet: developerReadinessPacket ?? null,
+        customer_evidence_action_packet: customerEvidenceActionPacket ?? null,
+        setup_decision: firstStringFromUnknown(sourceReports.setup_workflow, ["decision", "current_decision", "status"]) || null,
+        customer_live_decision: firstStringFromUnknown(sourceReports.customer_live_status, ["decision", "current_decision", "status"]) || null,
+        principle: "Do not infer readiness from raw artifacts; repair the named blocker and rerun objective status."
+      }
+    }
+  });
+}
+function registerObjective(program3) {
+  const objective = program3.command("objective").description("Agent-native objective workflow: plan, apply, prove, status, debug");
+  objective.command("plan").description("Generate an objective setup/workflow plan").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--industry <industry>", "Business industry: real_estate, restaurant, general").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective plan JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    assertBusinessName(opts, "objective.plan");
+    const templateSelection = await selectTemplateForObjective(opts);
+    const report = await apiFetch("/v1/console/agency-setup/workflow", {
+      method: "POST",
+      body: JSON.stringify(buildSetupBody(opts)),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const outPath = opts.out ? resolveObjectiveReportPath(opts.out) : null;
+    const objectiveSetup = {
+      ...asRecord3(report),
+      requirement_brief: templateSelection.brief,
+      template_selection: templateSelection.selection,
+      selected_template: templateSelection.selected
+    };
+    const output = outPath ? { ...objectiveSetup, artifact_path: outPath } : objectiveSetup;
+    if (outPath) writeJsonArtifact2(outPath, output);
+    format(output, { json: opts.json ?? false });
+  }));
+  objective.command("apply").description("Apply objective evidence to release launch packet gating").option("--evidence <json|@file>", "Redacted evidence payload JSON, or @/path/to/file.json").option("--plan <path>", "Optional objective plan file to derive evidence payload from").option("--dry-run", "Validate evidence payload without persisting it").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective apply result JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const evidence = await resolveEvidenceInput(opts);
+    const body = {
+      ...evidence && typeof evidence === "object" && !Array.isArray(evidence) ? evidence : { evidence }
+    };
+    if (!opts.dryRun) body.apply = true;
+    const report = await apiFetch("/v1/console/release-launch-packet/evidence-dry-run", {
+      method: "POST",
+      body: JSON.stringify(body),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const outPath = opts.out ? resolveObjectiveReportPath(opts.out) : null;
+    const output = outPath ? { ...asRecord3(report), artifact_path: outPath } : report;
+    if (outPath) writeJsonArtifact2(outPath, output);
+    format(output, { json: opts.json ?? false });
+  }));
+  objective.command("prove").description("Run objective proof status against customer-live gate").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--industry <industry>", "Business industry: real_estate, restaurant, general").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--environment <value>", "Environment filter").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective proof JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    assertBusinessName(opts, "objective.prove");
+    const status = await apiFetch(withQuery("/v1/console/customer-live-status", buildStatusParams(opts)), {
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const outPath = opts.out ? resolveObjectiveReportPath(opts.out) : null;
+    const output = outPath ? { ...asRecord3(status), artifact_path: outPath } : status;
+    if (outPath) writeJsonArtifact2(outPath, output);
+    format(output, { json: opts.json ?? false });
+  }));
+  objective.command("status").description("Compose setup and launch evidence into one agent workbench status envelope").option("--business-name <name>", "Business trading name").option("--agency-name <name>", "Legacy alias for --business-name").option("--industry <industry>", "Business industry: real_estate, restaurant, general").option("--business-objective <text>", "Natural-language business objective").option("--source-url <url>", "Official source URL").option("--location <value>", "Location or branch this setup represents").option("--branch-location <value>", "Legacy alias for --location").option("--tools <csv>", "Requested tool surfaces", "widget,voice,email,callback,calendar,crm,webhook,whatsapp").option("--target-mode <mode>", "Target launch/exposure mode", "customer_owned_voice_trial").option("--environment <value>", "Environment filter").option("--org <id>", "Org ID (default: stored org from foh org use)").option("--api-url <url>", "API base URL override").option("--out <path>", "Write objective report JSON to this file path").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    assertBusinessName(opts, "objective.status");
+    const templateSelection = await selectTemplateForObjective(opts);
+    const setupWorkflow = await apiFetch("/v1/console/agency-setup/workflow", {
+      method: "POST",
+      body: JSON.stringify(buildSetupBody(opts)),
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const customerLiveStatus = await apiFetch(withQuery("/v1/console/customer-live-status", buildStatusParams(opts)), {
+      orgId: opts.org,
+      apiUrlOverride: opts.apiUrl
+    });
+    const report = buildObjectiveReport({
+      opts,
+      setupWorkflow,
+      customerLiveStatus,
+      requirementBrief: templateSelection.brief,
+      templateSelection: templateSelection.selection,
+      selectedTemplate: templateSelection.selected
+    });
+    const artifactPath = resolveObjectiveReportPath(opts.out);
+    const fullOutput = withObjectiveArtifactPath(report, artifactPath);
+    writeJsonArtifact2(artifactPath, fullOutput);
+    format(buildObjectiveNormalPathOutput(fullOutput), { json: opts.json ?? false });
+  }));
+  objective.command("debug").description("Explain the next debugging action for an objective report").option("--from <source>", "Report source alias or path", "latest").option("--json", "Output as JSON").action(async (opts) => withCommandErrorHandling(async () => {
+    const sourcePath = resolveObjectiveReportPath(opts.from);
+    if (!(0, import_node_fs5.existsSync)(sourcePath)) {
+      format(cliEnvelope({
+        schemaVersion: "agent_workbench_debug.v1",
+        status: "fail",
+        reasonCode: "objective_report_not_found",
+        summary: `Objective report not found at ${sourcePath}.`,
+        artifacts: { objective_report: sourcePath },
+        nextCommands: [
+          `foh objective status --business-name <name> --source-url <official_url> --out ${DEFAULT_OBJECTIVE_REPORT_PATH} --json`
+        ],
+        spendClass: "free",
+        safeToRetry: true
+      }), { json: opts.json ?? false });
+      return;
+    }
+    let objectiveReport;
+    try {
+      objectiveReport = readJsonArtifact(sourcePath);
+    } catch {
+      format(cliEnvelope({
+        schemaVersion: "agent_workbench_debug.v1",
+        status: "fail",
+        reasonCode: "objective_report_invalid",
+        summary: `Objective report at ${sourcePath} is not valid JSON.`,
+        artifacts: { objective_report: sourcePath },
+        nextCommands: [
+          `foh objective status --business-name <name> --source-url <official_url> --out ${DEFAULT_OBJECTIVE_REPORT_PATH} --json`
+        ],
+        spendClass: "free",
+        safeToRetry: true
+      }), { json: opts.json ?? false });
+      return;
+    }
+    format(buildDebugReport(sourcePath, objectiveReport), { json: opts.json ?? false });
+  }));
+}
+
 // src/commands/interactive.ts
 var import_readline2 = require("readline");
 var import_child_process2 = require("child_process");
@@ -38651,6 +39525,66 @@ var COMMAND_SURFACE_DEFINITIONS = [
     shellSlash: "/status",
     includeInSuggestions: true
   },
+  {
+    id: "objective_status",
+    commandPath: ["objective", "status"],
+    invokeArgs: ["objective", "status", "--help"],
+    label: "objective status",
+    descriptionFallback: "Compose setup and launch evidence into one agent workbench status envelope.",
+    requiresAuth: true,
+    requiresOrg: true,
+    mutatesState: "read",
+    examples: ['foh objective status --business-name "Acme" --source-url https://example.com --out test-results/objective-status.latest.json --json'],
+    homeContexts: ["authenticated_with_org"],
+    homeAliases: ["objective", "status objective"],
+    shellSlash: "/objective",
+    includeInSuggestions: true
+  },
+  {
+    id: "objective_plan",
+    commandPath: ["objective", "plan"],
+    invokeArgs: ["objective", "plan", "--help"],
+    label: "objective plan",
+    descriptionFallback: "Generate an objective setup/workflow plan.",
+    requiresAuth: true,
+    requiresOrg: true,
+    mutatesState: "read",
+    examples: ['foh objective plan --business-name "Acme" --business-objective "Qualify leads" --source-url https://example.com --out test-results/objective-plan.latest.json --json'],
+    homeContexts: ["authenticated_with_org"],
+    homeAliases: ["objective plan"],
+    shellSlash: "/objective-plan",
+    includeInSuggestions: true
+  },
+  {
+    id: "objective_apply",
+    commandPath: ["objective", "apply"],
+    invokeArgs: ["objective", "apply", "--help"],
+    label: "objective apply",
+    descriptionFallback: "Apply objective evidence packets against customer-live launch packet gates.",
+    requiresAuth: true,
+    requiresOrg: true,
+    mutatesState: "write",
+    examples: ["foh objective apply --evidence @test-results/evidence.json --org <org-id> --out test-results/objective-apply.latest.json --json"],
+    homeContexts: ["authenticated_with_org"],
+    homeAliases: ["objective apply"],
+    shellSlash: "/objective-apply",
+    includeInSuggestions: true
+  },
+  {
+    id: "objective_prove",
+    commandPath: ["objective", "prove"],
+    invokeArgs: ["objective", "prove", "--help"],
+    label: "objective prove",
+    descriptionFallback: "Check one objective against customer-live proof gates.",
+    requiresAuth: true,
+    requiresOrg: true,
+    mutatesState: "read",
+    examples: ['foh objective prove --business-name "Acme" --source-url https://example.com --environment staging --json'],
+    homeContexts: ["authenticated_with_org"],
+    homeAliases: ["objective prove"],
+    shellSlash: "/objective-prove",
+    includeInSuggestions: true
+  },
   {
     id: "templates_list",
     commandPath: ["templates", "list"],
@@ -38735,9 +39669,9 @@ var COMMAND_SURFACE_DEFINITIONS = [
     includeInSuggestions: false
   },
   {
-    id: "whatsapp_start",
-    commandPath: ["channel", "whatsapp", "start"],
-    label: "whatsapp start",
+    id: "whatsapp_onboard",
+    commandPath: ["channel", "whatsapp", "onboard"],
+    label: "whatsapp onboard",
     descriptionFallback: "WhatsApp readiness path",
     mutatesState: "write",
     shellSlash: "/whatsapp",
@@ -38791,6 +39725,7 @@ var HOME_QUICK_ACTION_ORDER = {
   unauthenticated: ["auth_login", "interactive_shell", "full_help", "auth_login_help"],
   authenticated_no_org: ["org_list", "interactive_shell", "org_use_help", "auth_whoami", "full_help"],
   authenticated_with_org: [
+    "objective_status",
     "tenant_status",
     "interactive_shell",
     "templates_list",
@@ -39133,7 +40068,7 @@ async function runSelf(args, apiUrlOverride) {
   if (apiUrlOverride && !spawnArgs.includes("--api-url")) {
     spawnArgs.push("--api-url", apiUrlOverride);
   }
-  return await new Promise((resolve15, reject) => {
+  return await new Promise((resolve16, reject) => {
     const child = (0, import_child_process2.spawn)(process.execPath, [process.argv[1], ...spawnArgs], {
       stdio: "inherit",
       env: {
@@ -39143,7 +40078,7 @@ async function runSelf(args, apiUrlOverride) {
       }
     });
     child.once("error", reject);
-    child.once("close", (code) => resolve15(typeof code === "number" ? code : 1));
+    child.once("close", (code) => resolve16(typeof code === "number" ? code : 1));
   });
 }
 function resolveInteractiveState(apiUrlOverride) {
@@ -39330,10 +40265,10 @@ async function confirmMutationIfNeeded(rl, args) {
   const commandEntry = getCommandGraphEntryForArgs(args);
   const label = commandEntry ? `foh ${commandEntry.args.join(" ")}` : `foh ${args.join(" ")}`;
   const warning = mutationState === "high_risk" ? "high-risk" : "write";
-  const approved = await new Promise((resolve15) => {
+  const approved = await new Promise((resolve16) => {
     rl.question(`Confirm ${warning} command ${label}? [y/N]: `, (answer) => {
       const normalized = answer.trim().toLowerCase();
-      resolve15(normalized === "y" || normalized === "yes");
+      resolve16(normalized === "y" || normalized === "yes");
     });
   });
   if (approved) return { approved: true };
@@ -39501,7 +40436,7 @@ function registerInteractive(program3) {
     rl.on("SIGINT", () => {
       rl.close();
     });
-    await new Promise((resolve15) => {
+    await new Promise((resolve16) => {
       rl.on("close", () => {
         process.stdout.write("\n");
         memory.history = rl.history.slice(0, 500);
@@ -39509,7 +40444,7 @@ function registerInteractive(program3) {
         flushInteractiveSessionArtifact(sessionArtifact);
         flushInteractiveSessionReport(sessionArtifact);
         saveInteractiveShellMemory(memory);
-        resolve15();
+        resolve16();
       });
     });
   });
@@ -39841,7 +40776,7 @@ async function runSelf2(args, apiUrlOverride) {
   if (apiUrlOverride && !spawnArgs.includes("--api-url")) {
     spawnArgs.push("--api-url", apiUrlOverride);
   }
-  return await new Promise((resolve15, reject) => {
+  return await new Promise((resolve16, reject) => {
     const child = (0, import_child_process3.spawn)(process.execPath, [process.argv[1], ...spawnArgs], {
       stdio: "inherit",
       env: {
@@ -39851,7 +40786,7 @@ async function runSelf2(args, apiUrlOverride) {
       }
     });
     child.once("error", reject);
-    child.once("close", (code) => resolve15(typeof code === "number" ? code : 1));
+    child.once("close", (code) => resolve16(typeof code === "number" ? code : 1));
   });
 }
 function shouldUseInteractiveHome(argv) {
@@ -40200,17 +41135,17 @@ function detectUpdateAvailability(currentVersion, cwd = process.cwd()) {
 async function applyRepoUpdate(repoRoot) {
   const scriptPath = (0, import_path10.join)(repoRoot, "scripts", "Install-FohCli.ps1");
   if (process.platform === "win32") {
-    return await new Promise((resolve15, reject) => {
+    return await new Promise((resolve16, reject) => {
       const child = (0, import_child_process4.spawn)(
         "powershell",
         ["-ExecutionPolicy", "Bypass", "-File", scriptPath],
         { stdio: "inherit" }
       );
       child.once("error", reject);
-      child.once("close", (code) => resolve15(typeof code === "number" ? code : 1));
+      child.once("close", (code) => resolve16(typeof code === "number" ? code : 1));
     });
   }
-  return await new Promise((resolve15, reject) => {
+  return await new Promise((resolve16, reject) => {
     const child = (0, import_child_process4.spawn)(
       "corepack",
       ["pnpm", "cli:install:global"],
@@ -40220,7 +41155,7 @@ async function applyRepoUpdate(repoRoot) {
       }
     );
     child.once("error", reject);
-    child.once("close", (code) => resolve15(typeof code === "number" ? code : 1));
+    child.once("close", (code) => resolve16(typeof code === "number" ? code : 1));
   });
 }
 function shouldShowUpdateNotice(argv = process.argv) {
@@ -40692,9 +41627,9 @@ function readCommandRecords(runDir) {
 }
 
 // src/lib/external-agent-executor.ts
-var import_fs20 = require("fs");
+var import_fs19 = require("fs");
 var import_os3 = require("os");
-var import_path19 = require("path");
+var import_path18 = require("path");
 var import_child_process6 = require("child_process");
 
 // src/lib/external-agent-executor-env.ts
@@ -40865,824 +41800,303 @@ function copyExternalAgentCommandCaptureArtifacts(input) {
 }
 
 // src/lib/external-agent-executor-classification.ts
-var import_fs18 = require("fs");
-var import_path17 = require("path");
-
-// src/lib/external-agent-run-summary.ts
 var import_fs17 = require("fs");
 var import_path16 = require("path");
-var REQUIRED_RUN_FIELDS = [
-  "schema_version",
-  "run_id",
-  "status",
-  "model_provider",
-  "model_name",
-  "prompt_version",
-  "started_at",
-  "manual_intervention_count",
-  "environment",
-  "public_entrypoints",
-  "commands_run",
-  "docs_pages_used",
-  "artifacts"
-];
-var VALID_STATUSES = /* @__PURE__ */ new Set(["pass", "hold", "fail"]);
-var DOC_URL_RE = /https:\/\/frontofhouse\.okii\.uk\/[^\s"'`)<>,;\\\]}]*/g;
-function quoteShellArg(value) {
-  const text = String(value);
-  if (/^[A-Za-z0-9_./:=@-]+$/.test(text)) return text;
-  return `"${text.replace(/(["$`])/g, "\\$1")}"`;
+function proofArtifactPasses(runDir) {
+  const proofPath = (0, import_path16.join)(runDir, "proof.json");
+  if (!(0, import_fs17.existsSync)(proofPath)) return false;
+  try {
+    const parsed = JSON.parse((0, import_fs17.readFileSync)(proofPath, "utf8"));
+    return parsed.ok === true || parsed.status === "pass" || parsed.status === "passed";
+  } catch {
+    return false;
+  }
 }
-function externalAgentSummaryCommand(root) {
-  const summaryPath = (0, import_path16.join)(root, "latest-summary.json");
-  const reportPath = (0, import_path16.join)(root, "summary.report.json");
+function readIfExists(path2) {
+  return (0, import_fs17.existsSync)(path2) ? (0, import_fs17.readFileSync)(path2, "utf8") : "";
+}
+function relativeArtifactName(path2) {
+  return (0, import_path16.basename)(path2);
+}
+function externalAgentSummaryTemplateCommand() {
   return [
     "foh",
     "eval",
     "external-agent",
     "summary",
     "--root",
-    quoteShellArg(root),
+    "<batch_dir>",
     "--out",
-    quoteShellArg(summaryPath),
+    "<batch_dir>/latest-summary.json",
     "--report",
-    quoteShellArg(reportPath),
+    "<batch_dir>/summary.report.json",
     "--json"
   ].join(" ");
 }
-function readJson(filePath) {
-  return JSON.parse((0, import_fs17.readFileSync)(filePath, "utf8").replace(/^\uFEFF/, ""));
-}
-function readNdjson(filePath) {
-  if (!(0, import_fs17.existsSync)(filePath)) return [];
-  return (0, import_fs17.readFileSync)(filePath, "utf8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => {
-    try {
-      const parsed = JSON.parse(line);
-      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-    } catch {
-      return null;
-    }
-  }).filter((record2) => Boolean(record2));
-}
-function asObject(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function toArray2(value) {
-  return Array.isArray(value) ? value : [];
-}
-function increment(map3, key, amount = 1) {
-  const normalized = String(key || "unknown");
-  map3.set(normalized, (map3.get(normalized) || 0) + amount);
-}
-function ranked(map3) {
-  return Array.from(map3.entries()).map(([key, count]) => ({ key, count })).sort((a, b) => b.count - a.count || a.key.localeCompare(b.key));
-}
-function collectDocUrls(text) {
-  return Array.from(new Set((String(text || "").match(DOC_URL_RE) || []).map((url2) => url2.replace(/[.?!:]+$/g, "")).filter((url2) => url2.startsWith("https://frontofhouse.okii.uk/")))).sort();
-}
-function findRunCandidates(root) {
-  if (!(0, import_fs17.existsSync)(root)) return [];
-  const candidates = [];
-  const seenRunDirs = /* @__PURE__ */ new Set();
-  const captureDirs = [];
-  const stack = [root];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    if (!current) continue;
-    for (const entry of (0, import_fs17.readdirSync)(current, { withFileTypes: true })) {
-      const absolute = (0, import_path16.join)(current, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(absolute);
-      } else if (entry.isFile() && entry.name === "run.json") {
-        candidates.push({ path: absolute, synthetic: false });
-        seenRunDirs.add((0, import_path16.dirname)(absolute));
-      } else if (entry.isFile() && entry.name === "commands.ndjson") {
-        captureDirs.push(current);
-      }
-    }
+function classifyExternalAgentRun(input) {
+  if (input.timedOut) return { status: "hold", reasonCode: `${input.run.command}_runner_timeout` };
+  if (!input.artifactSafetyOk) return { status: "fail", reasonCode: "external_agent_artifact_safety_blocked" };
+  const completedCommands = readCommandRecords(input.run.run_dir).filter((record2) => record2.phase === "completed");
+  const observedVersions = completedCommands.map((record2) => String(record2.cli_version || "").trim()).filter((version2) => /^\d+\.\d+\.\d+$/.test(version2));
+  if (observedVersions.some((version2) => version2 !== CLI_VERSION)) {
+    return { status: "hold", reasonCode: "external_agent_cli_version_drift" };
   }
-  for (const captureDir of captureDirs) {
-    if (seenRunDirs.has(captureDir)) continue;
-    candidates.push({ path: (0, import_path16.join)(captureDir, "run.json"), synthetic: true });
+  const commandReasonCodes2 = completedCommands.flatMap((record2) => [
+    String(record2.reason_code || ""),
+    ...Array.isArray(record2.check_reason_codes) ? record2.check_reason_codes.map((code) => String(code || "")) : []
+  ]).filter(Boolean);
+  const hasCommandReason = (pattern) => commandReasonCodes2.some((reason) => pattern.test(reason));
+  if (hasCommandReason(new RegExp(PAID_RESOURCE_BLOCKED_REASON_CODE, "i"))) {
+    return { status: "hold", reasonCode: PAID_RESOURCE_BLOCKED_REASON_CODE };
   }
-  return candidates.sort((a, b) => a.path.localeCompare(b.path));
-}
-function validateExternalAgentRun(value) {
-  const findings = [];
-  const run = asObject(value);
-  if (!run) return [{ id: "run_not_object", detail: "run artifact must be an object" }];
-  for (const field of REQUIRED_RUN_FIELDS) {
-    if (!(field in run)) findings.push({ id: "required_field_missing", field });
+  if (hasCommandReason(/provider_capacity_blocked/i)) {
+    return { status: "hold", reasonCode: "provider_capacity_blocked" };
   }
-  if (run.schema_version !== "external_agent_run.v1") {
-    findings.push({ id: "schema_version_invalid", expected: "external_agent_run.v1", actual: run.schema_version ?? null });
+  if (hasCommandReason(/byon_voice_number_not_configured/i)) {
+    return { status: "hold", reasonCode: "byon_voice_number_not_configured" };
   }
-  if (!VALID_STATUSES.has(String(run.status || ""))) {
-    findings.push({ id: "status_invalid", expected: Array.from(VALID_STATUSES), actual: run.status ?? null });
+  if (hasCommandReason(/contact_phone_provisioning_failed/i)) {
+    return { status: "hold", reasonCode: "voice_contact_phone_provisioning_failed" };
   }
-  if ((run.status === "hold" || run.status === "fail") && !String(run.failure_reason_code || "").trim()) {
-    findings.push({ id: "failure_reason_code_missing" });
+  if (hasCommandReason(/voice_contact_expected_no_spend_hold/i)) {
+    return { status: "hold", reasonCode: "voice_contact_expected_no_spend_hold" };
   }
-  if (!Number.isInteger(run.manual_intervention_count) || Number(run.manual_intervention_count) < 0) {
-    findings.push({ id: "manual_intervention_count_invalid" });
+  if (hasCommandReason(/contact_phone_missing/i)) {
+    return { status: "hold", reasonCode: "voice_contact_phone_missing" };
   }
-  if (!Array.isArray(run.commands_run)) findings.push({ id: "commands_run_invalid" });
-  if (!Array.isArray(run.docs_pages_used)) findings.push({ id: "docs_pages_used_invalid" });
-  if (!asObject(run.environment)) findings.push({ id: "environment_invalid" });
-  if (!asObject(run.artifacts)) findings.push({ id: "artifacts_invalid" });
-  if (toArray2(run.public_entrypoints).length === 0) findings.push({ id: "public_entrypoints_missing" });
-  return findings;
-}
-function runSortTime(run) {
-  const raw = String(run.ended_at || run.started_at || "");
-  const time3 = Date.parse(raw);
-  return Number.isFinite(time3) ? time3 : 0;
-}
-function latestCommandTime(commands) {
-  const times = commands.map((command) => String(command.completed_at || command.started_at || command.recorded_at || "")).map((raw) => ({ raw, time: Date.parse(raw) })).filter((entry) => Number.isFinite(entry.time)).sort((a, b) => b.time - a.time);
-  return times[0]?.raw ?? null;
-}
-function firstCommandTime(commands) {
-  const times = commands.map((command) => String(command.started_at || command.recorded_at || command.completed_at || "")).map((raw) => ({ raw, time: Date.parse(raw) })).filter((entry) => Number.isFinite(entry.time)).sort((a, b) => a.time - b.time);
-  return times[0]?.raw ?? null;
-}
-function commandReasonCodes(commands) {
-  const codes = /* @__PURE__ */ new Set();
-  for (const command of commands) {
-    if (command.reason_code) codes.add(String(command.reason_code));
-    for (const reasonCode of toArray2(command.check_reason_codes)) {
-      if (reasonCode) codes.add(String(reasonCode));
-    }
+  if (hasCommandReason(/sim(?:ulation)?[_-]?cert(?:ify|ification)?.*failed|simulation_certification_failed/i)) {
+    return { status: "hold", reasonCode: "simulation_certification_failed" };
   }
-  return Array.from(codes);
-}
-function syntheticStatusFromCommands(commands) {
-  const commandReasons = commandReasonCodes(commands);
-  const failed = commands.find((command) => {
-    const status = String(command.status || "").toLowerCase();
-    return status === "fail" || typeof command.exit_code === "number" && command.exit_code !== 0 && status !== "hold";
-  });
-  if (failed) {
-    return {
-      status: "fail",
-      reasonCode: String(failed.reason_code || commandReasons[0] || "external_agent_command_failed")
-    };
+  if (hasCommandReason(/proof_held/i)) {
+    return { status: "hold", reasonCode: "external_agent_proof_held" };
   }
-  const held = commands.find((command) => String(command.status || "").toLowerCase() === "hold");
-  if (held) {
-    return {
-      status: "hold",
-      reasonCode: String(held.reason_code || commandReasons[0] || "external_agent_command_held")
-    };
+  if (hasCommandReason(/agent_limit_reached/i)) {
+    return { status: "hold", reasonCode: "eval_org_agent_limit_reached" };
   }
-  if (commands.length === 0) {
-    return { status: "hold", reasonCode: "external_agent_capture_empty" };
+  const agentMetadata = readExternalAgentMetadata(input.run.run_dir);
+  const metadataBlockerCodes = agentMetadata.blocker_reason_codes;
+  const hasMetadataBlocker = (pattern) => metadataBlockerCodes.some((reason) => pattern.test(reason));
+  if (hasMetadataBlocker(/^customer_owned_requirement_unverified:/i)) {
+    return { status: "hold", reasonCode: "customer_owned_requirements_unverified_expected_hold" };
   }
-  return { status: "pass", reasonCode: null };
+  if (hasMetadataBlocker(/^api_health:/i) && metadataBlockerCodes.some((reason) => /^customer_owned_requirement_unverified:/i.test(reason))) {
+    return { status: "hold", reasonCode: "customer_owned_requirements_unverified_expected_hold" };
+  }
+  const firstCommandReasonCode = commandReasonCodes2.find((reason) => reason.trim().length > 0) ?? null;
+  if (firstCommandReasonCode) {
+    return { status: "hold", reasonCode: firstCommandReasonCode };
+  }
+  const lastMessage = readIfExists(input.run.outputs.last_message);
+  const stderr = readIfExists(input.run.outputs.stderr);
+  const combined = `${lastMessage}
+${stderr}`;
+  if (/need[^.\n]*(?:private|source)[^.\n]*repo|cannot[^.\n]*without[^.\n]*(?:private|source)[^.\n]*repo|clone[^.\n]*(?:private|source)[^.\n]*repo/i.test(combined)) {
+    return { status: "fail", reasonCode: "private_repo_assumption_detected" };
+  }
+  if (/(?:blocked|rejected|declined) by policy|EXEC_POLICY_BLOCKED|command execution was rejected|shell commands were rejected/i.test(combined)) {
+    return { status: "hold", reasonCode: "codex_exec_policy_blocked" };
+  }
+  if (/bwrap:.*(?:RTM_NEWADDR|Operation not permitted|setting up uid map: Permission denied)|bubblewrap.*(?:RTM_NEWADDR|Operation not permitted|setting up uid map: Permission denied)|Failed RTM_NEWADDR|ENV_SANDBOX_EXEC_BLOCKED|permission profiles requiring direct runtime enforcement are incompatible with --use-legacy-landlock|legacy[_ -]?landlock.*incompatible/i.test(combined)) {
+    return { status: "hold", reasonCode: "codex_sandbox_exec_blocked" };
+  }
+  if (/ENV_NETWORK_DNS_BLOCK|Could not resolve host|npm ping.*timeout|NO_EXECUTABLE_INSTALL/i.test(combined)) {
+    return { status: "hold", reasonCode: "codex_network_dns_blocked" };
+  }
+  if (new RegExp(PAID_RESOURCE_BLOCKED_REASON_CODE, "i").test(combined)) {
+    return { status: "hold", reasonCode: PAID_RESOURCE_BLOCKED_REASON_CODE };
+  }
+  if (/provider_capacity_blocked/i.test(combined)) {
+    return { status: "hold", reasonCode: "provider_capacity_blocked" };
+  }
+  if (/byon_voice_number_not_configured/i.test(combined)) {
+    return { status: "hold", reasonCode: "byon_voice_number_not_configured" };
+  }
+  if (/contact_phone_provisioning_failed/i.test(combined)) {
+    return { status: "hold", reasonCode: "voice_contact_phone_provisioning_failed" };
+  }
+  if (/voice_contact_expected_no_spend_hold/i.test(combined)) {
+    return { status: "hold", reasonCode: "voice_contact_expected_no_spend_hold" };
+  }
+  if (/contact_phone_missing/i.test(combined)) {
+    return { status: "hold", reasonCode: "voice_contact_phone_missing" };
+  }
+  if (/simulation_certification_failed/i.test(combined)) {
+    return { status: "hold", reasonCode: "simulation_certification_failed" };
+  }
+  if (/proof_held/i.test(combined)) {
+    return { status: "hold", reasonCode: "external_agent_proof_held" };
+  }
+  if (/agent_limit_reached/i.test(combined)) {
+    return { status: "hold", reasonCode: "eval_org_agent_limit_reached" };
+  }
+  if (/browser|approve|approval|login|auth|sign in/i.test(combined) && !proofArtifactPasses(input.run.run_dir)) {
+    return { status: "hold", reasonCode: "auth_browser_approval_required" };
+  }
+  if (input.exitCode !== 0) return { status: "hold", reasonCode: `${input.run.command}_runner_nonzero_exit` };
+  if (proofArtifactPasses(input.run.run_dir)) return { status: "pass", reasonCode: null };
+  return { status: "hold", reasonCode: "external_agent_proof_artifact_missing" };
 }
-function synthesizeRunFromCapture(runPath) {
-  const runDir = (0, import_path16.dirname)(runPath);
-  const commands = collapseCommandRecords(readNdjson((0, import_path16.join)(runDir, "commands.ndjson")));
-  const metadata = asObject((0, import_fs17.existsSync)((0, import_path16.join)(runDir, "external-agent-metadata.json")) ? readJson((0, import_path16.join)(runDir, "external-agent-metadata.json")) : {});
-  const blockerCodes = toArray2(metadata?.blocker_reason_codes).map(String).filter(Boolean);
-  const commandClassification = syntheticStatusFromCommands(commands);
-  const status = commandClassification.status === "fail" ? "fail" : blockerCodes.length > 0 ? "hold" : commandClassification.status;
-  const reasonCode = commandClassification.status === "fail" ? commandClassification.reasonCode : blockerCodes[0] || commandClassification.reasonCode;
-  const firstCommand = commands[0] || {};
-  const startedAt = firstCommandTime(commands) || (/* @__PURE__ */ new Date(0)).toISOString();
-  const endedAt = latestCommandTime(commands) || startedAt;
-  const docs = toArray2(metadata?.docs_pages_used).map(String).filter(Boolean);
-  const runId = (0, import_path16.dirname)(runPath).split(/[\\/]/).filter(Boolean).slice(-3).join("-") || "capture-only-run";
+function buildExecutedExternalAgentRunArtifact(input) {
+  const commands = readCommandRecords(input.run.run_dir);
+  const agentMetadata = readExternalAgentMetadata(input.run.run_dir);
   return {
     schema_version: "external_agent_run.v1",
-    run_id: runId,
-    status,
-    failure_reason_code: status === "pass" ? null : reasonCode || "external_agent_capture_unfinalized",
-    model_provider: "unknown",
-    model_name: "unknown",
-    prompt_version: String(firstCommand.prompt_version || "unknown"),
-    started_at: startedAt,
-    ended_at: endedAt,
+    run_id: input.run.run_id,
+    status: input.status,
+    failure_reason_code: input.reasonCode,
+    model_provider: input.run.model_provider,
+    model_name: input.run.model_name,
+    runner_model: input.run.runner_model,
+    agent_shell: `${input.run.command}-exec`,
+    workspace_type: "clean-no-repo-programmatic",
+    prompt_version: input.run.prompt_version,
+    prompt_path: "prompt.txt",
+    started_at: input.startedAt,
+    ended_at: input.endedAt,
     manual_intervention_count: 0,
+    manual_interventions: [],
     environment: {
-      foh_cli_version: firstCommand.cli_version || null,
-      capture_only: true
+      os: process.platform,
+      node_version: process.version,
+      npm_version: null,
+      foh_cli_version: CLI_VERSION,
+      runner_exit_code: input.exitCode,
+      runner_timed_out: input.timedOut,
+      duration_ms: input.durationMs
     },
     public_entrypoints: [
       "https://frontofhouse.okii.uk",
+      "https://frontofhouse.okii.uk/llms.txt",
+      "https://frontofhouse.okii.uk/openapi.yaml",
       "npx --yes @f-o-h/cli@latest"
     ],
-    commands_run: commands.map((command) => String(command.command || "")).filter(Boolean),
-    docs_pages_used: docs,
+    commands_run: commands.map((command) => command.command),
+    docs_pages_used: agentMetadata.docs_pages_used,
+    eval_state: {
+      lifecycle_strategy: "reuse_existing_eval_state",
+      org_reuse_expected: true,
+      agent_reuse_expected: true,
+      widget_reuse_expected: true,
+      fresh_org_expected: false,
+      ephemeral_org_expected: false,
+      fresh_agent_expected: false,
+      phone_purchase_expected: false,
+      paid_resource_creation_expected: false,
+      spend_policy_expected: NO_SPEND_POLICY,
+      cleanup_expected: false,
+      cleanup_strategy: "no_cleanup_for_reused_eval_state",
+      paid_resource_strategy: "blocked_unless_explicit_byon_or_operator_approved",
+      rationale: "Mass external-agent evals benchmark public docs/CLI/API clarity; reuse avoids paid phone and Twilio inventory churn."
+    },
     artifacts: {
-      command_log: "commands.ndjson",
-      agent_metadata: (0, import_fs17.existsSync)((0, import_path16.join)(runDir, "external-agent-metadata.json")) ? "external-agent-metadata.json" : null,
-      capture_only: true
+      terminal_transcript: relativeArtifactName(input.run.outputs.jsonl),
+      command_log: (0, import_fs17.existsSync)((0, import_path16.join)(input.run.run_dir, "commands.ndjson")) ? "commands.ndjson" : null,
+      proof_bundle: (0, import_fs17.existsSync)((0, import_path16.join)(input.run.run_dir, "proof.json")) ? "proof.json" : null,
+      replay_packet: (0, import_fs17.existsSync)((0, import_path16.join)(input.run.run_dir, "replay.json")) ? "replay.json" : null,
+      knowledge_packet: (0, import_fs17.existsSync)((0, import_path16.join)(input.run.run_dir, "knowledge.json")) ? "knowledge.json" : null,
+      improvement_packet: input.status === "pass" ? null : "improvement-packet.json",
+      agent_metadata: agentMetadata.path,
+      notes: (0, import_fs17.existsSync)((0, import_path16.join)(input.run.run_dir, "notes.md")) ? "notes.md" : null,
+      runner_last_message: relativeArtifactName(input.run.outputs.last_message),
+      runner_stderr: relativeArtifactName(input.run.outputs.stderr),
+      codex_last_message: input.run.command === "codex" ? relativeArtifactName(input.run.outputs.last_message) : null,
+      codex_stderr: input.run.command === "codex" ? relativeArtifactName(input.run.outputs.stderr) : null,
+      artifact_safety: relativeArtifactName(input.run.outputs.artifact_safety)
     },
-    summary: "Synthetic run record created from external-agent capture artifacts because run.json was missing."
+    summary: input.status === "pass" ? `Controlled ${input.run.command} external-agent run produced passing proof evidence.` : `Controlled ${input.run.command} external-agent run ended as ${input.status} with reason ${input.reasonCode}.`,
+    next_commands: input.status === "pass" ? [externalAgentSummaryTemplateCommand()] : [
+      "foh eval external-agent scan-artifacts --run-dir <run_dir> --private-repo-root <private_repo_root> --write-redacted --json",
+      "foh bug improve --from external-agent-run --file <run_dir>/run.json --out <run_dir>/improvement-packet.json --json",
+      externalAgentSummaryTemplateCommand()
+    ]
   };
 }
-function cohortIdForRunPath(root, runPath) {
-  const normalized = (0, import_path16.relative)(root, (0, import_path16.dirname)(runPath)).replaceAll("\\", "/");
-  const parts = normalized.split("/").filter(Boolean);
-  if (parts.length === 0) return ".";
-  if (/^\d{4}-\d{2}-\d{2}$/.test(parts[0]) && parts[1]) return `${parts[0]}/${parts[1]}`;
-  return parts[0];
+
+// src/lib/external-agent-runner-execution.ts
+var import_child_process5 = require("child_process");
+var import_fs18 = require("fs");
+var import_path17 = require("path");
+function buildCommandInvocation(command, args) {
+  if (command.toLowerCase().endsWith(".cmd")) {
+    const binDir = (0, import_path17.dirname)(command);
+    const codexEntrypoint = (0, import_path17.join)(binDir, "node_modules", "@openai", "codex", "bin", "codex.js");
+    if ((0, import_fs18.existsSync)(codexEntrypoint)) return { command: process.execPath, args: [codexEntrypoint, ...args] };
+    const geminiEntrypoint = (0, import_path17.join)(binDir, "node_modules", "@google", "gemini-cli", "bundle", "gemini.js");
+    if ((0, import_fs18.existsSync)(geminiEntrypoint)) return { command: process.execPath, args: ["--no-warnings=DEP0040", geminiEntrypoint, ...args] };
+  }
+  return { command, args };
 }
-function readRunRecords(root, cwd) {
-  const records = [];
-  const invalid_runs = [];
-  for (const candidate of findRunCandidates(root)) {
-    const file2 = candidate.path;
-    try {
-      const parsed = candidate.synthetic ? synthesizeRunFromCapture(file2) : readJson(file2);
-      const findings = validateExternalAgentRun(parsed);
-      if (findings.length > 0) {
-        invalid_runs.push({ path: (0, import_path16.relative)(cwd, file2).replaceAll("\\", "/"), findings });
-        continue;
+function spawnExternalAgentRunner(input) {
+  return new Promise((resolveRun) => {
+    const started = Date.now();
+    const commandInvocation = buildCommandInvocation(input.command, input.args);
+    const child = (0, import_child_process5.spawn)(commandInvocation.command, commandInvocation.args, {
+      cwd: input.cwd,
+      env: input.env,
+      shell: false,
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true
+    });
+    const stdout = (0, import_fs18.createWriteStream)(input.stdoutPath, { flags: "w" });
+    const stderr = (0, import_fs18.createWriteStream)(input.stderrPath, { flags: "w" });
+    child.stdout.pipe(stdout);
+    child.stderr.pipe(stderr);
+    child.stdin.end(input.prompt);
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      if (child.pid && process.platform === "win32") {
+        (0, import_child_process5.spawnSync)("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
+      } else {
+        child.kill("SIGKILL");
       }
-      const run = parsed;
-      records.push({
-        path: file2,
-        run,
-        cohort_id: cohortIdForRunPath(root, file2),
-        sort_time: runSortTime(run)
+    }, input.timeoutMs);
+    child.on("close", (exitCode) => {
+      clearTimeout(timer);
+      stdout.end();
+      stderr.end();
+      resolveRun({
+        exitCode,
+        timedOut,
+        durationMs: Date.now() - started
       });
-    } catch (error2) {
-      invalid_runs.push({
-        path: (0, import_path16.relative)(cwd, file2).replaceAll("\\", "/"),
-        findings: [{ id: "json_parse_failed", detail: error2 instanceof Error ? error2.message : String(error2) }]
+    });
+    child.on("error", () => {
+      clearTimeout(timer);
+      stdout.end();
+      stderr.end();
+      resolveRun({
+        exitCode: null,
+        timedOut,
+        durationMs: Date.now() - started
       });
-    }
-  }
-  return { records, invalid_runs };
-}
-function latestCohortId(records) {
-  return records.slice().sort((a, b) => b.sort_time - a.sort_time || b.path.localeCompare(a.path))[0]?.cohort_id ?? null;
-}
-function ownerSubsystemFor(reasonCode) {
-  const reason = String(reasonCode || "").toLowerCase();
-  if (reason.includes("simulation") || reason.includes("certification") || reason.includes("scenario")) return "dojo_certification";
-  if (reason.includes("contact_phone") || reason.includes("voice_contact") || reason.includes("provider_capacity") || reason.includes("byon")) return "voice_contact";
-  if (reason.includes("exec_policy") || reason.includes("policy_blocked") || reason.includes("sandbox") || reason.includes("runner") || reason.includes("codex")) return "infra_runner";
-  if (reason.includes("api") || reason.includes("http_4") || reason.includes("http_5") || reason.includes("404") || reason.includes("500") || reason.includes("roundtrip")) return "api_contract";
-  if (reason.includes("cli") || reason.includes("command") || reason.includes("flag")) return "cli";
-  if (reason.includes("docs") || reason.includes("unclear") || reason.includes("not_found")) return "docs";
-  if (reason.includes("auth") || reason.includes("org") || reason.includes("config")) return "infra_runner";
-  if (reason.includes("runtime") || reason.includes("widget") || reason.includes("proof")) return "runtime";
-  return "product_ux";
-}
-function recommendedFixFor(reasonCode) {
-  const owner = ownerSubsystemFor(reasonCode);
-  if (owner === "api_contract") return "fix_api";
-  if (owner === "cli") return "fix_cli";
-  if (owner === "docs") return "fix_docs";
-  if (owner === "runtime") return "fix_runtime";
-  if (owner === "dojo_certification") return "add_test";
-  return "fix_config";
+    });
+  });
 }
-function collapseCommandRecords(records) {
-  const order = [];
-  const byId = /* @__PURE__ */ new Map();
-  for (const record2 of records) {
-    const id = String(record2.command_id || `${record2.recorded_at || ""}:${record2.command || ""}`);
-    if (!byId.has(id)) order.push(id);
-    const previous = byId.get(id);
-    byId.set(id, record2.phase === "completed" ? record2 : previous || record2);
+
+// src/lib/external-agent-executor.ts
+var GEMINI_HEADLESS_PROBE_TIMEOUT_MS = 15e3;
+var DEFAULT_FOH_API_URL2 = "https://api.frontofhouse.okii.uk";
+var ExternalAgentExecutorError = class extends Error {
+  reasonCode;
+  constructor(reasonCode, message) {
+    super(message);
+    this.name = "ExternalAgentExecutorError";
+    this.reasonCode = reasonCode;
   }
-  return order.map((id) => byId.get(id)).filter((record2) => Boolean(record2));
+};
+function readExternalAgentEvalAuthEnv(env = process.env) {
+  return {
+    token: String(env.FOH_EXTERNAL_AGENT_EVAL_TOKEN || "").trim(),
+    orgId: String(env.FOH_EXTERNAL_AGENT_EVAL_ORG_ID || "").trim(),
+    apiUrl: String(env.FOH_EXTERNAL_AGENT_EVAL_API_URL || env.FOH_API_URL || DEFAULT_FOH_API_URL2).trim() || DEFAULT_FOH_API_URL2,
+    expiresAt: String(env.FOH_EXTERNAL_AGENT_EVAL_TOKEN_EXPIRES_AT || "").trim()
+  };
 }
-function readCommandOutputJson(runDir, command) {
-  const artifact = typeof command.output_artifact === "string" && command.output_artifact.trim() ? command.output_artifact.trim() : "";
-  if (!artifact || artifact.includes("..") || artifact.includes("/") || artifact.includes("\\")) return null;
-  const artifactPath = (0, import_path16.join)(runDir, artifact);
-  if (!(0, import_fs17.existsSync)(artifactPath)) return null;
-  try {
-    const text = (0, import_fs17.readFileSync)(artifactPath, "utf8");
-    const firstObject = text.indexOf("{");
-    const lastObject = text.lastIndexOf("}");
-    if (firstObject < 0 || lastObject <= firstObject) return null;
-    return JSON.parse(text.slice(firstObject, lastObject + 1));
-  } catch {
-    return null;
-  }
-}
-function commandTimingBreakdown(command, output) {
-  const schemaVersion = String(output?.schema_version || "");
-  if (schemaVersion === "foh_cli_proof_report.v1") {
-    const timing = asObject(output?.timing) || {};
-    const cacheSources = /* @__PURE__ */ new Map();
-    let cacheWaitMs = 0;
-    let cacheHitCount = 0;
-    let cacheMissCount = 0;
-    for (const check2 of toArray2(output?.checks)) {
-      const detail = asObject(check2)?.detail;
-      const proofCache = asObject(asObject(detail)?.proof_cache);
-      if (!proofCache) continue;
-      if (proofCache["hit"] === true) cacheHitCount += 1;
-      if (proofCache["miss"] === true) cacheMissCount += 1;
-      cacheWaitMs += Number(proofCache["waited_ms"] || 0);
-      increment(cacheSources, proofCache["source"] || "unknown");
-    }
-    return {
-      kind: "proof",
-      command: command.command || "",
-      total_ms: Number(timing.total_ms || command.duration_ms || 0),
-      total_check_duration_ms: Number(timing.total_check_duration_ms || 0),
-      slow_checks: toArray2(timing.slow_checks).slice(0, 5),
-      cache_wait_ms: cacheWaitMs,
-      cache_hit_count: cacheHitCount,
-      cache_miss_count: cacheMissCount,
-      cache_sources: ranked(cacheSources)
-    };
-  }
-  if (schemaVersion === "foh_certification_run.v1") {
-    const timing = asObject(output?.timing) || {};
-    const certificate = asObject(output?.certificate) || {};
-    return {
-      kind: "certification",
-      command: command.command || "",
-      total_ms: Number(timing.total_ms || command.duration_ms || 0),
-      api_ms: Number(timing.api_ms || 0),
-      status: output?.status || null,
-      reason_code: output?.reason_code || null,
-      scenario_summary: certificate.scenario_summary || null
-    };
-  }
-  return null;
-}
-function analyzeRunArtifacts(runPath, run, cwd) {
-  const runDir = (0, import_path16.dirname)(runPath);
-  const commands = collapseCommandRecords(readNdjson((0, import_path16.join)(runDir, "commands.ndjson")));
-  const reasonCounts = /* @__PURE__ */ new Map();
-  const slowSteps = [];
-  const timingBreakdowns = [];
-  let completed = 0;
-  let withDuration = 0;
-  let totalDuration = 0;
-  for (const command of commands) {
-    const output = readCommandOutputJson(runDir, command);
-    const breakdown = commandTimingBreakdown(command, output);
-    if (breakdown) timingBreakdowns.push({
-      run_id: run.run_id,
-      run_path: (0, import_path16.relative)(cwd, runPath).replaceAll("\\", "/"),
-      ...breakdown
-    });
-    if (command.phase === "completed" || command.completed_at) completed += 1;
-    if (typeof command.duration_ms === "number") {
-      withDuration += 1;
-      totalDuration += command.duration_ms;
-      slowSteps.push({
-        run_id: run.run_id,
-        run_path: (0, import_path16.relative)(cwd, runPath).replaceAll("\\", "/"),
-        command: command.command || "",
-        duration_ms: command.duration_ms,
-        status: command.status || null,
-        reason_code: command.reason_code || null,
-        check_reason_codes: Array.isArray(command.check_reason_codes) ? command.check_reason_codes : []
-      });
-    }
-    if (command.reason_code) increment(reasonCounts, command.reason_code);
-    for (const reasonCode of toArray2(command.check_reason_codes)) {
-      if (reasonCode) increment(reasonCounts, reasonCode);
-    }
-  }
-  const codexEvents = readNdjson((0, import_path16.join)(runDir, "codex-exec.jsonl"));
-  const codexDocs = /* @__PURE__ */ new Set();
-  let codexCommandExecutions = 0;
-  let codexFailedExitCodes = 0;
-  for (const event of codexEvents) {
-    const item = asObject(event.item) || event;
-    if (item.type === "command_execution" && item.status === "completed") {
-      codexCommandExecutions += 1;
-      if (typeof item.exit_code === "number" && item.exit_code !== 0) codexFailedExitCodes += 1;
-    }
-    for (const url2 of collectDocUrls(JSON.stringify(event))) codexDocs.add(url2);
-  }
-  const docs = /* @__PURE__ */ new Set([
-    ...toArray2(run.docs_pages_used).map(String),
-    ...Array.from(codexDocs)
-  ]);
-  return {
-    command_log_present: (0, import_fs17.existsSync)((0, import_path16.join)(runDir, "commands.ndjson")),
-    command_count: commands.length,
-    completed_command_count: completed,
-    missing_completion_count: Math.max(0, commands.length - completed),
-    commands_with_duration_count: withDuration,
-    total_command_duration_ms: totalDuration,
-    command_reason_codes: ranked(reasonCounts),
-    slow_steps: slowSteps.sort((a, b) => Number(b.duration_ms) - Number(a.duration_ms)).slice(0, 10),
-    timing_breakdowns: timingBreakdowns,
-    docs_pages_observed: Array.from(docs).sort(),
-    codex_command_execution_completed_count: codexCommandExecutions,
-    codex_failed_exit_code_count: codexFailedExitCodes
-  };
-}
-function summarizeExternalAgentRuns(options) {
-  const cwd = (0, import_path16.resolve)(options.cwd || process.cwd());
-  const root = (0, import_path16.resolve)(cwd, options.root);
-  const loaded = readRunRecords(root, cwd);
-  const selectedCohortId = options.cohortId || (options.currentBaselineOnly ? latestCohortId(loaded.records) : null);
-  const records = selectedCohortId ? loaded.records.filter((record2) => record2.cohort_id === selectedCohortId) : loaded.records;
-  const statusCounts = /* @__PURE__ */ new Map();
-  const modelCounts = /* @__PURE__ */ new Map();
-  const failureCounts = /* @__PURE__ */ new Map();
-  const commandReasonCounts = /* @__PURE__ */ new Map();
-  const docsCounts = /* @__PURE__ */ new Map();
-  const slowSteps = [];
-  const timingBreakdowns = [];
-  let manualInterventions = 0;
-  let commandCount = 0;
-  let completedCommandCount = 0;
-  let missingCompletionCount = 0;
-  let commandsWithDurationCount = 0;
-  let totalCommandDurationMs = 0;
-  let commandLogRunCount = 0;
-  let codexCommandExecutions = 0;
-  let codexFailedExitCodes = 0;
-  for (const record2 of records) {
-    const run = record2.run;
-    increment(statusCounts, run.status);
-    increment(modelCounts, `${run.model_provider}/${run.model_name}`);
-    manualInterventions += Number(run.manual_intervention_count || 0);
-    if (run.status !== "pass") increment(failureCounts, run.failure_reason_code || "unknown");
-    const artifactSummary = analyzeRunArtifacts(record2.path, run, cwd);
-    if (artifactSummary.command_log_present) commandLogRunCount += 1;
-    commandCount += Number(artifactSummary.command_count || 0);
-    completedCommandCount += Number(artifactSummary.completed_command_count || 0);
-    missingCompletionCount += Number(artifactSummary.missing_completion_count || 0);
-    commandsWithDurationCount += Number(artifactSummary.commands_with_duration_count || 0);
-    totalCommandDurationMs += Number(artifactSummary.total_command_duration_ms || 0);
-    codexCommandExecutions += Number(artifactSummary.codex_command_execution_completed_count || 0);
-    codexFailedExitCodes += Number(artifactSummary.codex_failed_exit_code_count || 0);
-    for (const row of toArray2(artifactSummary.slow_steps)) slowSteps.push(row);
-    for (const row of toArray2(artifactSummary.timing_breakdowns)) timingBreakdowns.push(row);
-    for (const row of toArray2(artifactSummary.command_reason_codes)) {
-      const entry = asObject(row);
-      if (entry) increment(commandReasonCounts, entry.key, Number(entry.count || 1));
-    }
-    for (const page of toArray2(artifactSummary.docs_pages_observed)) increment(docsCounts, page);
-  }
-  const topFailures = ranked(failureCounts);
-  const commandReasonCodes2 = ranked(commandReasonCounts);
-  const recommendedFixes = topFailures.map((failure) => ({
-    reason_code: failure.key,
-    count: failure.count,
-    recommended_fix: recommendedFixFor(failure.key),
-    owner_subsystem: ownerSubsystemFor(failure.key)
-  }));
-  const nextRecommendedFix = recommendedFixes[0] || null;
-  return {
-    schema_version: "external_agent_run_summary.v1",
-    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
-    root: (0, import_path16.relative)(cwd, root).replaceAll("\\", "/") || ".",
-    cohort_id: selectedCohortId,
-    current_baseline_only: Boolean(selectedCohortId),
-    run_count: records.length,
-    invalid_run_count: selectedCohortId ? 0 : loaded.invalid_runs.length,
-    status_counts: Object.fromEntries(statusCounts),
-    model_counts: ranked(modelCounts),
-    manual_intervention_count: manualInterventions,
-    top_failure_reason_codes: topFailures,
-    docs_pages_observed: ranked(docsCounts),
-    command_telemetry: {
-      run_count_with_command_log: commandLogRunCount,
-      command_count: commandCount,
-      completed_command_count: completedCommandCount,
-      missing_completion_count: missingCompletionCount,
-      commands_with_duration_count: commandsWithDurationCount,
-      total_command_duration_ms: totalCommandDurationMs,
-      command_reason_codes: commandReasonCodes2,
-      slow_steps: slowSteps.sort((a, b) => Number(b.duration_ms || 0) - Number(a.duration_ms || 0) || String(a.command || "").localeCompare(String(b.command || ""))).slice(0, 20),
-      timing_breakdowns: timingBreakdowns.sort((a, b) => Number(b.total_ms || 0) - Number(a.total_ms || 0) || String(a.command || "").localeCompare(String(b.command || ""))).slice(0, 20)
-    },
-    codex_telemetry: {
-      command_execution_completed_count: codexCommandExecutions,
-      failed_exit_code_count: codexFailedExitCodes
-    },
-    recommended_fixes: recommendedFixes,
-    next_recommended_fix: nextRecommendedFix,
-    fix_selection_policy: {
-      mode: "coherent_failure_cluster_first",
-      rule: "Fix the highest-impact owner subsystem locally with focused proof, then rerun the same prompt once externally.",
-      run_failure_weight: 3,
-      command_reason_weight: 1
-    },
-    next_commands: nextRecommendedFix ? [`foh bug improve --from external-agent-run --file <run_dir>/run.json --json`] : [],
-    invalid_runs: selectedCohortId ? [] : loaded.invalid_runs,
-    run_paths: records.map((record2) => (0, import_path16.relative)(cwd, record2.path).replaceAll("\\", "/")).sort()
-  };
-}
-function runExternalAgentRunSummary(options) {
-  const summary = summarizeExternalAgentRuns(options);
-  const invalidRuns = toArray2(summary.invalid_runs);
-  const status = invalidRuns.length > 0 ? "failed" : "passed";
-  const report = {
-    report_schema_version: "script_report.v1",
-    script: "foh eval external-agent summary",
-    checked_at: (/* @__PURE__ */ new Date()).toISOString(),
-    status,
-    errors: invalidRuns.map((entry) => {
-      const object3 = asObject(entry);
-      return `${object3?.path || "unknown"}: ${JSON.stringify(object3?.findings || [])}`;
-    }),
-    warnings: Number(summary.run_count || 0) === 0 ? ["no external-agent run artifacts found"] : [],
-    report: summary
-  };
-  if (options.out) {
-    (0, import_fs17.mkdirSync)((0, import_path16.dirname)((0, import_path16.resolve)(options.cwd || process.cwd(), options.out)), { recursive: true });
-    (0, import_fs17.writeFileSync)((0, import_path16.resolve)(options.cwd || process.cwd(), options.out), `${JSON.stringify(summary, null, 2)}
-`, "utf8");
-  }
-  if (options.report) {
-    (0, import_fs17.mkdirSync)((0, import_path16.dirname)((0, import_path16.resolve)(options.cwd || process.cwd(), options.report)), { recursive: true });
-    (0, import_fs17.writeFileSync)((0, import_path16.resolve)(options.cwd || process.cwd(), options.report), `${JSON.stringify(report, null, 2)}
-`, "utf8");
-  }
-  return { summary, report };
-}
-
-// src/lib/external-agent-executor-classification.ts
-function proofArtifactPasses(runDir) {
-  const proofPath = (0, import_path17.join)(runDir, "proof.json");
-  if (!(0, import_fs18.existsSync)(proofPath)) return false;
-  try {
-    const parsed = JSON.parse((0, import_fs18.readFileSync)(proofPath, "utf8"));
-    return parsed.ok === true || parsed.status === "pass" || parsed.status === "passed";
-  } catch {
-    return false;
-  }
-}
-function readIfExists(path2) {
-  return (0, import_fs18.existsSync)(path2) ? (0, import_fs18.readFileSync)(path2, "utf8") : "";
-}
-function relativeArtifactName(path2) {
-  return (0, import_path17.basename)(path2);
-}
-function classifyExternalAgentRun(input) {
-  if (input.timedOut) return { status: "hold", reasonCode: `${input.run.command}_runner_timeout` };
-  if (!input.artifactSafetyOk) return { status: "fail", reasonCode: "external_agent_artifact_safety_blocked" };
-  const completedCommands = readCommandRecords(input.run.run_dir).filter((record2) => record2.phase === "completed");
-  const observedVersions = completedCommands.map((record2) => String(record2.cli_version || "").trim()).filter((version2) => /^\d+\.\d+\.\d+$/.test(version2));
-  if (observedVersions.some((version2) => version2 !== CLI_VERSION)) {
-    return { status: "hold", reasonCode: "external_agent_cli_version_drift" };
-  }
-  const commandReasonCodes2 = completedCommands.flatMap((record2) => [
-    String(record2.reason_code || ""),
-    ...Array.isArray(record2.check_reason_codes) ? record2.check_reason_codes.map((code) => String(code || "")) : []
-  ]).filter(Boolean);
-  const hasCommandReason = (pattern) => commandReasonCodes2.some((reason) => pattern.test(reason));
-  if (hasCommandReason(new RegExp(PAID_RESOURCE_BLOCKED_REASON_CODE, "i"))) {
-    return { status: "hold", reasonCode: PAID_RESOURCE_BLOCKED_REASON_CODE };
-  }
-  if (hasCommandReason(/provider_capacity_blocked/i)) {
-    return { status: "hold", reasonCode: "provider_capacity_blocked" };
-  }
-  if (hasCommandReason(/byon_voice_number_not_configured/i)) {
-    return { status: "hold", reasonCode: "byon_voice_number_not_configured" };
-  }
-  if (hasCommandReason(/contact_phone_provisioning_failed/i)) {
-    return { status: "hold", reasonCode: "voice_contact_phone_provisioning_failed" };
-  }
-  if (hasCommandReason(/voice_contact_expected_no_spend_hold/i)) {
-    return { status: "hold", reasonCode: "voice_contact_expected_no_spend_hold" };
-  }
-  if (hasCommandReason(/contact_phone_missing/i)) {
-    return { status: "hold", reasonCode: "voice_contact_phone_missing" };
-  }
-  if (hasCommandReason(/sim(?:ulation)?[_-]?cert(?:ify|ification)?.*failed|simulation_certification_failed/i)) {
-    return { status: "hold", reasonCode: "simulation_certification_failed" };
-  }
-  if (hasCommandReason(/proof_held/i)) {
-    return { status: "hold", reasonCode: "external_agent_proof_held" };
-  }
-  if (hasCommandReason(/agent_limit_reached/i)) {
-    return { status: "hold", reasonCode: "eval_org_agent_limit_reached" };
-  }
-  const agentMetadata = readExternalAgentMetadata(input.run.run_dir);
-  const metadataBlockerCodes = agentMetadata.blocker_reason_codes;
-  const hasMetadataBlocker = (pattern) => metadataBlockerCodes.some((reason) => pattern.test(reason));
-  if (hasMetadataBlocker(/^customer_owned_requirement_unverified:/i)) {
-    return { status: "hold", reasonCode: "customer_owned_requirements_unverified_expected_hold" };
-  }
-  if (hasMetadataBlocker(/^api_health:/i) && metadataBlockerCodes.some((reason) => /^customer_owned_requirement_unverified:/i.test(reason))) {
-    return { status: "hold", reasonCode: "customer_owned_requirements_unverified_expected_hold" };
-  }
-  const firstCommandReasonCode = commandReasonCodes2.find((reason) => reason.trim().length > 0) ?? null;
-  if (firstCommandReasonCode) {
-    return { status: "hold", reasonCode: firstCommandReasonCode };
-  }
-  const lastMessage = readIfExists(input.run.outputs.last_message);
-  const stderr = readIfExists(input.run.outputs.stderr);
-  const combined = `${lastMessage}
-${stderr}`;
-  if (/need[^.\n]*(?:private|source)[^.\n]*repo|cannot[^.\n]*without[^.\n]*(?:private|source)[^.\n]*repo|clone[^.\n]*(?:private|source)[^.\n]*repo/i.test(combined)) {
-    return { status: "fail", reasonCode: "private_repo_assumption_detected" };
-  }
-  if (/(?:blocked|rejected|declined) by policy|EXEC_POLICY_BLOCKED|command execution was rejected|shell commands were rejected/i.test(combined)) {
-    return { status: "hold", reasonCode: "codex_exec_policy_blocked" };
-  }
-  if (/bwrap:.*(?:RTM_NEWADDR|Operation not permitted|setting up uid map: Permission denied)|bubblewrap.*(?:RTM_NEWADDR|Operation not permitted|setting up uid map: Permission denied)|Failed RTM_NEWADDR|ENV_SANDBOX_EXEC_BLOCKED|permission profiles requiring direct runtime enforcement are incompatible with --use-legacy-landlock|legacy[_ -]?landlock.*incompatible/i.test(combined)) {
-    return { status: "hold", reasonCode: "codex_sandbox_exec_blocked" };
-  }
-  if (/ENV_NETWORK_DNS_BLOCK|Could not resolve host|npm ping.*timeout|NO_EXECUTABLE_INSTALL/i.test(combined)) {
-    return { status: "hold", reasonCode: "codex_network_dns_blocked" };
-  }
-  if (new RegExp(PAID_RESOURCE_BLOCKED_REASON_CODE, "i").test(combined)) {
-    return { status: "hold", reasonCode: PAID_RESOURCE_BLOCKED_REASON_CODE };
-  }
-  if (/provider_capacity_blocked/i.test(combined)) {
-    return { status: "hold", reasonCode: "provider_capacity_blocked" };
-  }
-  if (/byon_voice_number_not_configured/i.test(combined)) {
-    return { status: "hold", reasonCode: "byon_voice_number_not_configured" };
-  }
-  if (/contact_phone_provisioning_failed/i.test(combined)) {
-    return { status: "hold", reasonCode: "voice_contact_phone_provisioning_failed" };
-  }
-  if (/voice_contact_expected_no_spend_hold/i.test(combined)) {
-    return { status: "hold", reasonCode: "voice_contact_expected_no_spend_hold" };
-  }
-  if (/contact_phone_missing/i.test(combined)) {
-    return { status: "hold", reasonCode: "voice_contact_phone_missing" };
-  }
-  if (/simulation_certification_failed/i.test(combined)) {
-    return { status: "hold", reasonCode: "simulation_certification_failed" };
-  }
-  if (/proof_held/i.test(combined)) {
-    return { status: "hold", reasonCode: "external_agent_proof_held" };
-  }
-  if (/agent_limit_reached/i.test(combined)) {
-    return { status: "hold", reasonCode: "eval_org_agent_limit_reached" };
-  }
-  if (/browser|approve|approval|login|auth|sign in/i.test(combined) && !proofArtifactPasses(input.run.run_dir)) {
-    return { status: "hold", reasonCode: "auth_browser_approval_required" };
-  }
-  if (input.exitCode !== 0) return { status: "hold", reasonCode: `${input.run.command}_runner_nonzero_exit` };
-  if (proofArtifactPasses(input.run.run_dir)) return { status: "pass", reasonCode: null };
-  return { status: "hold", reasonCode: "external_agent_proof_artifact_missing" };
-}
-function buildExecutedExternalAgentRunArtifact(input) {
-  const commands = readCommandRecords(input.run.run_dir);
-  const agentMetadata = readExternalAgentMetadata(input.run.run_dir);
-  return {
-    schema_version: "external_agent_run.v1",
-    run_id: input.run.run_id,
-    status: input.status,
-    failure_reason_code: input.reasonCode,
-    model_provider: input.run.model_provider,
-    model_name: input.run.model_name,
-    runner_model: input.run.runner_model,
-    agent_shell: `${input.run.command}-exec`,
-    workspace_type: "clean-no-repo-programmatic",
-    prompt_version: input.run.prompt_version,
-    prompt_path: "prompt.txt",
-    started_at: input.startedAt,
-    ended_at: input.endedAt,
-    manual_intervention_count: 0,
-    manual_interventions: [],
-    environment: {
-      os: process.platform,
-      node_version: process.version,
-      npm_version: null,
-      foh_cli_version: CLI_VERSION,
-      runner_exit_code: input.exitCode,
-      runner_timed_out: input.timedOut,
-      duration_ms: input.durationMs
-    },
-    public_entrypoints: [
-      "https://frontofhouse.okii.uk",
-      "https://frontofhouse.okii.uk/llms.txt",
-      "https://frontofhouse.okii.uk/openapi.yaml",
-      "npx --yes @f-o-h/cli@latest"
-    ],
-    commands_run: commands.map((command) => command.command),
-    docs_pages_used: agentMetadata.docs_pages_used,
-    eval_state: {
-      lifecycle_strategy: "reuse_existing_eval_state",
-      org_reuse_expected: true,
-      agent_reuse_expected: true,
-      widget_reuse_expected: true,
-      fresh_org_expected: false,
-      ephemeral_org_expected: false,
-      fresh_agent_expected: false,
-      phone_purchase_expected: false,
-      paid_resource_creation_expected: false,
-      spend_policy_expected: NO_SPEND_POLICY,
-      cleanup_expected: false,
-      cleanup_strategy: "no_cleanup_for_reused_eval_state",
-      paid_resource_strategy: "blocked_unless_explicit_byon_or_operator_approved",
-      rationale: "Mass external-agent evals benchmark public docs/CLI/API clarity; reuse avoids paid phone and Twilio inventory churn."
-    },
-    artifacts: {
-      terminal_transcript: relativeArtifactName(input.run.outputs.jsonl),
-      command_log: (0, import_fs18.existsSync)((0, import_path17.join)(input.run.run_dir, "commands.ndjson")) ? "commands.ndjson" : null,
-      proof_bundle: (0, import_fs18.existsSync)((0, import_path17.join)(input.run.run_dir, "proof.json")) ? "proof.json" : null,
-      replay_packet: (0, import_fs18.existsSync)((0, import_path17.join)(input.run.run_dir, "replay.json")) ? "replay.json" : null,
-      knowledge_packet: (0, import_fs18.existsSync)((0, import_path17.join)(input.run.run_dir, "knowledge.json")) ? "knowledge.json" : null,
-      improvement_packet: input.status === "pass" ? null : "improvement-packet.json",
-      agent_metadata: agentMetadata.path,
-      notes: (0, import_fs18.existsSync)((0, import_path17.join)(input.run.run_dir, "notes.md")) ? "notes.md" : null,
-      runner_last_message: relativeArtifactName(input.run.outputs.last_message),
-      runner_stderr: relativeArtifactName(input.run.outputs.stderr),
-      codex_last_message: input.run.command === "codex" ? relativeArtifactName(input.run.outputs.last_message) : null,
-      codex_stderr: input.run.command === "codex" ? relativeArtifactName(input.run.outputs.stderr) : null,
-      artifact_safety: relativeArtifactName(input.run.outputs.artifact_safety)
-    },
-    summary: input.status === "pass" ? `Controlled ${input.run.command} external-agent run produced passing proof evidence.` : `Controlled ${input.run.command} external-agent run ended as ${input.status} with reason ${input.reasonCode}.`,
-    next_commands: input.status === "pass" ? [externalAgentSummaryCommand((0, import_path17.dirname)(input.run.run_dir))] : [
-      "foh eval external-agent scan-artifacts --run-dir <run_dir> --private-repo-root <private_repo_root> --write-redacted --json",
-      "foh bug improve --from external-agent-run --file <run_dir>/run.json --out <run_dir>/improvement-packet.json --json",
-      externalAgentSummaryCommand((0, import_path17.dirname)(input.run.run_dir))
-    ]
-  };
-}
-
-// src/lib/external-agent-runner-execution.ts
-var import_child_process5 = require("child_process");
-var import_fs19 = require("fs");
-var import_path18 = require("path");
-function buildCommandInvocation(command, args) {
-  if (process.platform === "win32" && command.toLowerCase().endsWith(".cmd")) {
-    const binDir = (0, import_path18.dirname)(command);
-    const codexEntrypoint = (0, import_path18.join)(binDir, "node_modules", "@openai", "codex", "bin", "codex.js");
-    if ((0, import_fs19.existsSync)(codexEntrypoint)) return { command: process.execPath, args: [codexEntrypoint, ...args] };
-    const geminiEntrypoint = (0, import_path18.join)(binDir, "node_modules", "@google", "gemini-cli", "bundle", "gemini.js");
-    if ((0, import_fs19.existsSync)(geminiEntrypoint)) return { command: process.execPath, args: ["--no-warnings=DEP0040", geminiEntrypoint, ...args] };
-  }
-  return { command, args };
-}
-function spawnExternalAgentRunner(input) {
-  return new Promise((resolveRun) => {
-    const started = Date.now();
-    const commandInvocation = buildCommandInvocation(input.command, input.args);
-    const child = (0, import_child_process5.spawn)(commandInvocation.command, commandInvocation.args, {
-      cwd: input.cwd,
-      env: input.env,
-      shell: false,
-      stdio: ["pipe", "pipe", "pipe"],
-      windowsHide: true
-    });
-    const stdout = (0, import_fs19.createWriteStream)(input.stdoutPath, { flags: "w" });
-    const stderr = (0, import_fs19.createWriteStream)(input.stderrPath, { flags: "w" });
-    child.stdout.pipe(stdout);
-    child.stderr.pipe(stderr);
-    child.stdin.end(input.prompt);
-    let timedOut = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      if (child.pid && process.platform === "win32") {
-        (0, import_child_process5.spawnSync)("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
-      } else {
-        child.kill("SIGKILL");
-      }
-    }, input.timeoutMs);
-    child.on("close", (exitCode) => {
-      clearTimeout(timer);
-      stdout.end();
-      stderr.end();
-      resolveRun({
-        exitCode,
-        timedOut,
-        durationMs: Date.now() - started
-      });
-    });
-    child.on("error", () => {
-      clearTimeout(timer);
-      stdout.end();
-      stderr.end();
-      resolveRun({
-        exitCode: null,
-        timedOut,
-        durationMs: Date.now() - started
-      });
-    });
-  });
-}
-
-// src/lib/external-agent-executor.ts
-var GEMINI_HEADLESS_PROBE_TIMEOUT_MS = 15e3;
-var DEFAULT_FOH_API_URL2 = "https://api.frontofhouse.okii.uk";
-var ExternalAgentExecutorError = class extends Error {
-  reasonCode;
-  constructor(reasonCode, message) {
-    super(message);
-    this.name = "ExternalAgentExecutorError";
-    this.reasonCode = reasonCode;
-  }
-};
-function readExternalAgentEvalAuthEnv(env = process.env) {
-  return {
-    token: String(env.FOH_EXTERNAL_AGENT_EVAL_TOKEN || "").trim(),
-    orgId: String(env.FOH_EXTERNAL_AGENT_EVAL_ORG_ID || "").trim(),
-    apiUrl: String(env.FOH_EXTERNAL_AGENT_EVAL_API_URL || env.FOH_API_URL || DEFAULT_FOH_API_URL2).trim() || DEFAULT_FOH_API_URL2,
-    expiresAt: String(env.FOH_EXTERNAL_AGENT_EVAL_TOKEN_EXPIRES_AT || "").trim()
-  };
-}
-function shouldRunExternalAgentEvalAuthPreflight(env = process.env) {
-  return Boolean(
-    env.FOH_EXTERNAL_AGENT_EVAL_TOKEN || env.FOH_EXTERNAL_AGENT_EVAL_ORG_ID || env.FOH_EXTERNAL_AGENT_EVAL_API_URL || env.FOH_EXTERNAL_AGENT_EVAL_TOKEN_EXPIRES_AT || env.FOH_SERVICE_TOKEN || env.FOH_ORG_ID || env.FOH_API_URL || env.FOH_TOKEN_EXPIRES_AT
-  );
+function shouldRunExternalAgentEvalAuthPreflight(env = process.env) {
+  return Boolean(
+    env.FOH_EXTERNAL_AGENT_EVAL_TOKEN || env.FOH_EXTERNAL_AGENT_EVAL_ORG_ID || env.FOH_EXTERNAL_AGENT_EVAL_API_URL || env.FOH_EXTERNAL_AGENT_EVAL_TOKEN_EXPIRES_AT || env.FOH_SERVICE_TOKEN || env.FOH_ORG_ID || env.FOH_API_URL || env.FOH_TOKEN_EXPIRES_AT
+  );
 }
 async function runExternalAgentEvalAuthPreflight(env = process.env, options = {}) {
   const hasExplicitEvalAuth = Boolean(
@@ -41736,14 +42150,14 @@ async function runExternalAgentEvalAuthPreflight(env = process.env, options = {}
   };
 }
 function normalizeForCompare(path2) {
-  const resolved = (0, import_path19.resolve)(path2);
+  const resolved = (0, import_path18.resolve)(path2);
   return process.platform === "win32" ? resolved.toLowerCase() : resolved;
 }
 function isPathInside(childPath, parentPath) {
   const child = normalizeForCompare(childPath);
   const parent = normalizeForCompare(parentPath);
-  const rel = (0, import_path19.relative)(parent, child);
-  return rel === "" || !!rel && !rel.startsWith("..") && !(0, import_path19.isAbsolute)(rel);
+  const rel = (0, import_path18.relative)(parent, child);
+  return rel === "" || !!rel && !rel.startsWith("..") && !(0, import_path18.isAbsolute)(rel);
 }
 function requireString(value, field) {
   if (typeof value !== "string" || value.trim() === "") {
@@ -41752,10 +42166,10 @@ function requireString(value, field) {
   return value;
 }
 function readBatch(batchPath) {
-  if (!(0, import_fs20.existsSync)(batchPath)) {
+  if (!(0, import_fs19.existsSync)(batchPath)) {
     throw new ExternalAgentExecutorError("external_agent_batch_not_found", `Batch file not found: ${batchPath}`);
   }
-  const parsed = JSON.parse((0, import_fs20.readFileSync)(batchPath, "utf8"));
+  const parsed = JSON.parse((0, import_fs19.readFileSync)(batchPath, "utf8"));
   if (parsed.schema_version !== "external_agent_batch_plan.v1") {
     throw new ExternalAgentExecutorError("invalid_external_agent_batch", "Batch schema_version must be external_agent_batch_plan.v1.");
   }
@@ -41792,8 +42206,8 @@ function resolveCodexProbeCommand() {
   if (process.platform !== "win32") return "codex";
   const appData = process.env.APPDATA;
   if (appData) {
-    const appDataShim = (0, import_path19.join)(appData, "npm", "codex.cmd");
-    if ((0, import_fs20.existsSync)(appDataShim)) return appDataShim;
+    const appDataShim = (0, import_path18.join)(appData, "npm", "codex.cmd");
+    if ((0, import_fs19.existsSync)(appDataShim)) return appDataShim;
   }
   return "codex.cmd";
 }
@@ -41804,8 +42218,8 @@ function resolveGeminiProbeCommand() {
   if (process.platform !== "win32") return "gemini";
   const appData = process.env.APPDATA;
   if (appData) {
-    const appDataShim = (0, import_path19.join)(appData, "npm", "gemini.cmd");
-    if ((0, import_fs20.existsSync)(appDataShim)) return appDataShim;
+    const appDataShim = (0, import_path18.join)(appData, "npm", "gemini.cmd");
+    if ((0, import_fs19.existsSync)(appDataShim)) return appDataShim;
   }
   return "gemini.cmd";
 }
@@ -42076,34 +42490,34 @@ function safeRunId(value) {
   return value.toLowerCase().replace(/[^a-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "") || "run";
 }
 function resolveWorkspaceRoot(input) {
-  if (input.workspaceRoot) return (0, import_path19.resolve)(input.workspaceRoot);
-  const batchStem = (0, import_path19.basename)((0, import_path19.resolve)(input.batchPath)).replace(/[^a-zA-Z0-9_.-]+/g, "-");
-  const repoStem = (0, import_path19.basename)((0, import_path19.resolve)(input.privateRepoRoot)).replace(/[^a-zA-Z0-9_.-]+/g, "-");
-  return (0, import_path19.resolve)((0, import_os3.tmpdir)(), "foh-external-agent-workspaces", repoStem, batchStem);
+  if (input.workspaceRoot) return (0, import_path18.resolve)(input.workspaceRoot);
+  const batchStem = (0, import_path18.basename)((0, import_path18.resolve)(input.batchPath)).replace(/[^a-zA-Z0-9_.-]+/g, "-");
+  const repoStem = (0, import_path18.basename)((0, import_path18.resolve)(input.privateRepoRoot)).replace(/[^a-zA-Z0-9_.-]+/g, "-");
+  return (0, import_path18.resolve)((0, import_os3.tmpdir)(), "foh-external-agent-workspaces", repoStem, batchStem);
 }
 function findNearestGitRoot(startPath) {
-  let current = (0, import_path19.resolve)(startPath);
+  let current = (0, import_path18.resolve)(startPath);
   while (true) {
-    if ((0, import_fs20.existsSync)((0, import_path19.join)(current, ".git"))) return current;
-    const parent = (0, import_path19.dirname)(current);
+    if ((0, import_fs19.existsSync)((0, import_path18.join)(current, ".git"))) return current;
+    const parent = (0, import_path18.dirname)(current);
     if (parent === current) return null;
     current = parent;
   }
 }
 function resolvePrivateRepoRoot(input) {
   if (input.explicitPrivateRepoRoot) {
-    return { root: (0, import_path19.resolve)(input.explicitPrivateRepoRoot), explicit: true };
+    return { root: (0, import_path18.resolve)(input.explicitPrivateRepoRoot), explicit: true };
   }
-  const cwd = (0, import_path19.resolve)(input.cwd || process.cwd());
+  const cwd = (0, import_path18.resolve)(input.cwd || process.cwd());
   const gitRoot = findNearestGitRoot(cwd);
   if (gitRoot) return { root: gitRoot, explicit: false };
   return {
-    root: (0, import_path19.join)(cwd, ".foh-no-private-repo-root-sentinel"),
+    root: (0, import_path18.join)(cwd, ".foh-no-private-repo-root-sentinel"),
     explicit: false
   };
 }
 function promptVersionFromPath(promptPath) {
-  const raw = (0, import_fs20.readFileSync)(promptPath, "utf8");
+  const raw = (0, import_fs19.readFileSync)(promptPath, "utf8");
   if (raw.includes("arbitrary-agency setup context") || raw.includes("Mission: prove whether an arbitrary estate agency") || raw.includes("ops reporting agency-setup-preview") || raw.includes("ops reporting agency-setup-workflow")) return "arbitrary-agency-setup-release.v1";
   if (raw.includes("Do not assume access to the private source repository")) return "blank-setup.v1";
   return "unknown";
@@ -42113,7 +42527,7 @@ function createExternalAgentExecutorPlan(options) {
   if (runner !== "codex" && runner !== "gemini") {
     throw new ExternalAgentExecutorError("unsupported_external_agent_runner", `Unsupported runner: ${runner}`);
   }
-  const batchPath = (0, import_path19.resolve)(options.batchPath);
+  const batchPath = (0, import_path18.resolve)(options.batchPath);
   const batch = readBatch(batchPath);
   const runnerProbe = validateRunner(options, runner);
   const codexSandboxBackend = normalizeCodexSandboxBackend(options.codexSandboxBackend);
@@ -42132,17 +42546,17 @@ function createExternalAgentExecutorPlan(options) {
       `Workspace root must be outside the private repository. workspace=${workspaceRoot} repo=${privateRepoRoot}`
     );
   }
-  (0, import_fs20.mkdirSync)(workspaceRoot, { recursive: true });
-  const batchDir = (0, import_path19.resolve)(String(batch.batch_dir || (0, import_path19.resolve)(batchPath, "..")));
+  (0, import_fs19.mkdirSync)(workspaceRoot, { recursive: true });
+  const batchDir = (0, import_path18.resolve)(String(batch.batch_dir || (0, import_path18.resolve)(batchPath, "..")));
   const timeoutMinutes = Number.isFinite(options.timeoutMinutes) && Number(options.timeoutMinutes) > 0 ? Number(options.timeoutMinutes) : 30;
   const runs = batch.runs.map((run) => {
     const runId = safeRunId(requireString(run.run_id, "runs[].run_id"));
-    const runDir = (0, import_path19.resolve)(requireString(run.run_dir, `runs[${runId}].run_dir`));
-    const promptPath = (0, import_path19.resolve)(requireString(run.prompt_path, `runs[${runId}].prompt_path`));
-    const workspaceDir = (0, import_path19.join)(workspaceRoot, runId);
-    (0, import_fs20.mkdirSync)(workspaceDir, { recursive: true });
-    (0, import_fs20.writeFileSync)(
-      (0, import_path19.join)(workspaceDir, "README.md"),
+    const runDir = (0, import_path18.resolve)(requireString(run.run_dir, `runs[${runId}].run_dir`));
+    const promptPath = (0, import_path18.resolve)(requireString(run.prompt_path, `runs[${runId}].prompt_path`));
+    const workspaceDir = (0, import_path18.join)(workspaceRoot, runId);
+    (0, import_fs19.mkdirSync)(workspaceDir, { recursive: true });
+    (0, import_fs19.writeFileSync)(
+      (0, import_path18.join)(workspaceDir, "README.md"),
       [
         "# FOH External-Agent Workspace",
         "",
@@ -42153,18 +42567,19 @@ function createExternalAgentExecutorPlan(options) {
       ].join("\n"),
       "utf8"
     );
+    const explicitPromptVersion = typeof run.prompt_version === "string" && run.prompt_version.trim() ? run.prompt_version.trim() : typeof batch.prompt_version === "string" && batch.prompt_version.trim() ? batch.prompt_version.trim() : promptVersionFromPath(promptPath);
     const env = buildCodexExecutorEnv({
       sourceEnv: options.env,
       runDir,
-      promptVersion: promptVersionFromPath(promptPath)
+      promptVersion: explicitPromptVersion
     });
     const promptVersion = String(env[EXTERNAL_AGENT_PROMPT_VERSION_ENV] || "unknown");
     const outputStem = runner === "gemini" ? "gemini" : "codex";
-    const jsonlPath = (0, import_path19.join)(runDir, `${outputStem}-exec.jsonl`);
-    const lastMessagePath = (0, import_path19.join)(runDir, `${outputStem}-last-message.md`);
-    const stderrPath = (0, import_path19.join)(runDir, `${outputStem}-stderr.txt`);
-    const runPath = (0, import_path19.join)(runDir, "run.json");
-    const artifactSafetyPath = (0, import_path19.join)(runDir, "artifact-safety.json");
+    const jsonlPath = (0, import_path18.join)(runDir, `${outputStem}-exec.jsonl`);
+    const lastMessagePath = (0, import_path18.join)(runDir, `${outputStem}-last-message.md`);
+    const stderrPath = (0, import_path18.join)(runDir, `${outputStem}-stderr.txt`);
+    const runPath = (0, import_path18.join)(runDir, "run.json");
+    const artifactSafetyPath = (0, import_path18.join)(runDir, "artifact-safety.json");
     const args = runner === "gemini" ? [
       ...runnerProbe.globalArgs,
       ...runnerProbe.execArgs
@@ -42255,9 +42670,9 @@ function createExternalAgentExecutorPlan(options) {
   };
 }
 function writeExternalAgentExecutorPlan(plan) {
-  const path2 = (0, import_path19.join)(plan.batch_dir, "executor-plan.json");
-  (0, import_fs20.mkdirSync)(plan.batch_dir, { recursive: true });
-  (0, import_fs20.writeFileSync)(path2, `${JSON.stringify(plan, null, 2)}
+  const path2 = (0, import_path18.join)(plan.batch_dir, "executor-plan.json");
+  (0, import_fs19.mkdirSync)(plan.batch_dir, { recursive: true });
+  (0, import_fs19.writeFileSync)(path2, `${JSON.stringify(plan, null, 2)}
 `, "utf8");
   return path2;
 }
@@ -42272,7 +42687,7 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
   if (authPreflight && !authPreflight.ok) {
     const endedAt2 = (/* @__PURE__ */ new Date()).toISOString();
     const blockedResults = plan.runs.map((run) => {
-      (0, import_fs20.mkdirSync)(run.run_dir, { recursive: true });
+      (0, import_fs19.mkdirSync)(run.run_dir, { recursive: true });
       const runArtifact = buildExecutedExternalAgentRunArtifact({
         run,
         startedAt,
@@ -42283,7 +42698,7 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
         timedOut: false,
         durationMs: 0
       });
-      (0, import_fs20.writeFileSync)(run.outputs.run, `${JSON.stringify(runArtifact, null, 2)}
+      (0, import_fs19.writeFileSync)(run.outputs.run, `${JSON.stringify(runArtifact, null, 2)}
 `, "utf8");
       return {
         run_id: run.run_id,
@@ -42310,8 +42725,8 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
   }
   for (const run of plan.runs) {
     const runStartedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const commandCaptureDir = (0, import_path19.join)(run.workspace_dir, ".foh-capture");
-    (0, import_fs20.mkdirSync)(commandCaptureDir, { recursive: true });
+    const commandCaptureDir = (0, import_path18.join)(run.workspace_dir, ".foh-capture");
+    (0, import_fs19.mkdirSync)(commandCaptureDir, { recursive: true });
     const env = buildCodexExecutorEnv({
       sourceEnv: options.env,
       runDir: commandCaptureDir,
@@ -42322,7 +42737,7 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
       args: run.args,
       cwd: run.workspace_dir,
       env,
-      prompt: (0, import_fs20.readFileSync)(run.prompt_path, "utf8"),
+      prompt: (0, import_fs19.readFileSync)(run.prompt_path, "utf8"),
       stdoutPath: run.outputs.jsonl,
       stderrPath: run.outputs.stderr,
       timeoutMs: plan.timeout_minutes * 60 * 1e3
@@ -42335,7 +42750,7 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
       privateRepoRoot,
       writeRedacted: true
     });
-    (0, import_fs20.writeFileSync)(run.outputs.artifact_safety, `${JSON.stringify(artifactSafety, null, 2)}
+    (0, import_fs19.writeFileSync)(run.outputs.artifact_safety, `${JSON.stringify(artifactSafety, null, 2)}
 `, "utf8");
     const runEndedAt = (/* @__PURE__ */ new Date()).toISOString();
     const classification = classifyExternalAgentRun({
@@ -42354,7 +42769,7 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
       timedOut: spawned.timedOut,
       durationMs: spawned.durationMs
     });
-    (0, import_fs20.writeFileSync)(run.outputs.run, `${JSON.stringify(runArtifact, null, 2)}
+    (0, import_fs19.writeFileSync)(run.outputs.run, `${JSON.stringify(runArtifact, null, 2)}
 `, "utf8");
     results.push({
       run_id: run.run_id,
@@ -42384,11 +42799,546 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
   };
 }
 
+// src/lib/external-agent-run-summary.ts
+var import_fs20 = require("fs");
+var import_path19 = require("path");
+var REQUIRED_RUN_FIELDS = [
+  "schema_version",
+  "run_id",
+  "status",
+  "model_provider",
+  "model_name",
+  "prompt_version",
+  "started_at",
+  "manual_intervention_count",
+  "environment",
+  "public_entrypoints",
+  "commands_run",
+  "docs_pages_used",
+  "artifacts"
+];
+var VALID_STATUSES = /* @__PURE__ */ new Set(["pass", "hold", "fail"]);
+var DOC_URL_RE = /https:\/\/frontofhouse\.okii\.uk\/[^\s"'`)<>,;\\\]}]*/g;
+function quoteShellArg(value) {
+  const text = String(value);
+  if (/^[A-Za-z0-9_./:=@-]+$/.test(text)) return text;
+  return `"${text.replace(/(["$`])/g, "\\$1")}"`;
+}
+function externalAgentSummaryCommand(root) {
+  const summaryPath = (0, import_path19.join)(root, "latest-summary.json");
+  const reportPath = (0, import_path19.join)(root, "summary.report.json");
+  return [
+    "foh",
+    "eval",
+    "external-agent",
+    "summary",
+    "--root",
+    quoteShellArg(root),
+    "--out",
+    quoteShellArg(summaryPath),
+    "--report",
+    quoteShellArg(reportPath),
+    "--json"
+  ].join(" ");
+}
+function readJson(filePath) {
+  return JSON.parse((0, import_fs20.readFileSync)(filePath, "utf8").replace(/^\uFEFF/, ""));
+}
+function readNdjson(filePath) {
+  if (!(0, import_fs20.existsSync)(filePath)) return [];
+  return (0, import_fs20.readFileSync)(filePath, "utf8").split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => {
+    try {
+      const parsed = JSON.parse(line);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
+  }).filter((record2) => Boolean(record2));
+}
+function asObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function toArray2(value) {
+  return Array.isArray(value) ? value : [];
+}
+function increment(map3, key, amount = 1) {
+  const normalized = String(key || "unknown");
+  map3.set(normalized, (map3.get(normalized) || 0) + amount);
+}
+function ranked(map3) {
+  return Array.from(map3.entries()).map(([key, count]) => ({ key, count })).sort((a, b) => b.count - a.count || a.key.localeCompare(b.key));
+}
+function collectDocUrls(text) {
+  return Array.from(new Set((String(text || "").match(DOC_URL_RE) || []).map((url2) => url2.replace(/[.?!:]+$/g, "")).filter((url2) => url2.startsWith("https://frontofhouse.okii.uk/")))).sort();
+}
+function findRunCandidates(root) {
+  if (!(0, import_fs20.existsSync)(root)) return [];
+  const candidates = [];
+  const seenRunDirs = /* @__PURE__ */ new Set();
+  const captureDirs = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (!current) continue;
+    for (const entry of (0, import_fs20.readdirSync)(current, { withFileTypes: true })) {
+      const absolute = (0, import_path19.join)(current, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(absolute);
+      } else if (entry.isFile() && entry.name === "run.json") {
+        candidates.push({ path: absolute, synthetic: false });
+        seenRunDirs.add((0, import_path19.dirname)(absolute));
+      } else if (entry.isFile() && entry.name === "commands.ndjson") {
+        captureDirs.push(current);
+      }
+    }
+  }
+  for (const captureDir of captureDirs) {
+    if (seenRunDirs.has(captureDir)) continue;
+    candidates.push({ path: (0, import_path19.join)(captureDir, "run.json"), synthetic: true });
+  }
+  return candidates.sort((a, b) => a.path.localeCompare(b.path));
+}
+function validateExternalAgentRun(value) {
+  const findings = [];
+  const run = asObject(value);
+  if (!run) return [{ id: "run_not_object", detail: "run artifact must be an object" }];
+  for (const field of REQUIRED_RUN_FIELDS) {
+    if (!(field in run)) findings.push({ id: "required_field_missing", field });
+  }
+  if (run.schema_version !== "external_agent_run.v1") {
+    findings.push({ id: "schema_version_invalid", expected: "external_agent_run.v1", actual: run.schema_version ?? null });
+  }
+  if (!VALID_STATUSES.has(String(run.status || ""))) {
+    findings.push({ id: "status_invalid", expected: Array.from(VALID_STATUSES), actual: run.status ?? null });
+  }
+  if ((run.status === "hold" || run.status === "fail") && !String(run.failure_reason_code || "").trim()) {
+    findings.push({ id: "failure_reason_code_missing" });
+  }
+  if (!Number.isInteger(run.manual_intervention_count) || Number(run.manual_intervention_count) < 0) {
+    findings.push({ id: "manual_intervention_count_invalid" });
+  }
+  if (!Array.isArray(run.commands_run)) findings.push({ id: "commands_run_invalid" });
+  if (!Array.isArray(run.docs_pages_used)) findings.push({ id: "docs_pages_used_invalid" });
+  if (!asObject(run.environment)) findings.push({ id: "environment_invalid" });
+  if (!asObject(run.artifacts)) findings.push({ id: "artifacts_invalid" });
+  if (toArray2(run.public_entrypoints).length === 0) findings.push({ id: "public_entrypoints_missing" });
+  return findings;
+}
+function runSortTime(run) {
+  const raw = String(run.ended_at || run.started_at || "");
+  const time3 = Date.parse(raw);
+  return Number.isFinite(time3) ? time3 : 0;
+}
+function latestCommandTime(commands) {
+  const times = commands.map((command) => String(command.completed_at || command.started_at || command.recorded_at || "")).map((raw) => ({ raw, time: Date.parse(raw) })).filter((entry) => Number.isFinite(entry.time)).sort((a, b) => b.time - a.time);
+  return times[0]?.raw ?? null;
+}
+function firstCommandTime(commands) {
+  const times = commands.map((command) => String(command.started_at || command.recorded_at || command.completed_at || "")).map((raw) => ({ raw, time: Date.parse(raw) })).filter((entry) => Number.isFinite(entry.time)).sort((a, b) => a.time - b.time);
+  return times[0]?.raw ?? null;
+}
+function commandReasonCodes(commands) {
+  const codes = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    if (command.reason_code) codes.add(String(command.reason_code));
+    for (const reasonCode of toArray2(command.check_reason_codes)) {
+      if (reasonCode) codes.add(String(reasonCode));
+    }
+  }
+  return Array.from(codes);
+}
+function syntheticStatusFromCommands(commands) {
+  const commandReasons = commandReasonCodes(commands);
+  const failed = commands.find((command) => {
+    const status = String(command.status || "").toLowerCase();
+    return status === "fail" || typeof command.exit_code === "number" && command.exit_code !== 0 && status !== "hold";
+  });
+  if (failed) {
+    return {
+      status: "fail",
+      reasonCode: String(failed.reason_code || commandReasons[0] || "external_agent_command_failed")
+    };
+  }
+  const held = commands.find((command) => String(command.status || "").toLowerCase() === "hold");
+  if (held) {
+    return {
+      status: "hold",
+      reasonCode: String(held.reason_code || commandReasons[0] || "external_agent_command_held")
+    };
+  }
+  if (commands.length === 0) {
+    return { status: "hold", reasonCode: "external_agent_capture_empty" };
+  }
+  return { status: "pass", reasonCode: null };
+}
+function synthesizeRunFromCapture(runPath) {
+  const runDir = (0, import_path19.dirname)(runPath);
+  const commands = collapseCommandRecords(readNdjson((0, import_path19.join)(runDir, "commands.ndjson")));
+  const metadata = asObject((0, import_fs20.existsSync)((0, import_path19.join)(runDir, "external-agent-metadata.json")) ? readJson((0, import_path19.join)(runDir, "external-agent-metadata.json")) : {});
+  const blockerCodes = toArray2(metadata?.blocker_reason_codes).map(String).filter(Boolean);
+  const commandClassification = syntheticStatusFromCommands(commands);
+  const status = commandClassification.status === "fail" ? "fail" : blockerCodes.length > 0 ? "hold" : commandClassification.status;
+  const reasonCode = commandClassification.status === "fail" ? commandClassification.reasonCode : blockerCodes[0] || commandClassification.reasonCode;
+  const firstCommand = commands[0] || {};
+  const startedAt = firstCommandTime(commands) || (/* @__PURE__ */ new Date(0)).toISOString();
+  const endedAt = latestCommandTime(commands) || startedAt;
+  const docs = toArray2(metadata?.docs_pages_used).map(String).filter(Boolean);
+  const runId = (0, import_path19.dirname)(runPath).split(/[\\/]/).filter(Boolean).slice(-3).join("-") || "capture-only-run";
+  return {
+    schema_version: "external_agent_run.v1",
+    run_id: runId,
+    status,
+    failure_reason_code: status === "pass" ? null : reasonCode || "external_agent_capture_unfinalized",
+    model_provider: "unknown",
+    model_name: "unknown",
+    prompt_version: String(firstCommand.prompt_version || "unknown"),
+    started_at: startedAt,
+    ended_at: endedAt,
+    manual_intervention_count: 0,
+    environment: {
+      foh_cli_version: firstCommand.cli_version || null,
+      capture_only: true
+    },
+    public_entrypoints: [
+      "https://frontofhouse.okii.uk",
+      "npx --yes @f-o-h/cli@latest"
+    ],
+    commands_run: commands.map((command) => String(command.command || "")).filter(Boolean),
+    docs_pages_used: docs,
+    artifacts: {
+      command_log: "commands.ndjson",
+      agent_metadata: (0, import_fs20.existsSync)((0, import_path19.join)(runDir, "external-agent-metadata.json")) ? "external-agent-metadata.json" : null,
+      capture_only: true
+    },
+    summary: "Synthetic run record created from external-agent capture artifacts because run.json was missing."
+  };
+}
+function cohortIdForRunPath(root, runPath) {
+  const normalized = (0, import_path19.relative)(root, (0, import_path19.dirname)(runPath)).replaceAll("\\", "/");
+  const parts = normalized.split("/").filter(Boolean);
+  if (parts.length === 0) return ".";
+  if (/^\d{4}-\d{2}-\d{2}$/.test(parts[0]) && parts[1]) return `${parts[0]}/${parts[1]}`;
+  return parts[0];
+}
+function readRunRecords(root, cwd) {
+  const records = [];
+  const invalid_runs = [];
+  for (const candidate of findRunCandidates(root)) {
+    const file2 = candidate.path;
+    try {
+      const parsed = candidate.synthetic ? synthesizeRunFromCapture(file2) : readJson(file2);
+      const findings = validateExternalAgentRun(parsed);
+      if (findings.length > 0) {
+        invalid_runs.push({ path: (0, import_path19.relative)(cwd, file2).replaceAll("\\", "/"), findings });
+        continue;
+      }
+      const run = parsed;
+      records.push({
+        path: file2,
+        run,
+        cohort_id: cohortIdForRunPath(root, file2),
+        sort_time: runSortTime(run)
+      });
+    } catch (error2) {
+      invalid_runs.push({
+        path: (0, import_path19.relative)(cwd, file2).replaceAll("\\", "/"),
+        findings: [{ id: "json_parse_failed", detail: error2 instanceof Error ? error2.message : String(error2) }]
+      });
+    }
+  }
+  return { records, invalid_runs };
+}
+function latestCohortId(records) {
+  return records.slice().sort((a, b) => b.sort_time - a.sort_time || b.path.localeCompare(a.path))[0]?.cohort_id ?? null;
+}
+function ownerSubsystemFor(reasonCode) {
+  const reason = String(reasonCode || "").toLowerCase();
+  if (reason.includes("simulation") || reason.includes("certification") || reason.includes("scenario")) return "dojo_certification";
+  if (reason.includes("contact_phone") || reason.includes("voice_contact") || reason.includes("provider_capacity") || reason.includes("byon")) return "voice_contact";
+  if (reason.includes("exec_policy") || reason.includes("policy_blocked") || reason.includes("sandbox") || reason.includes("runner") || reason.includes("codex")) return "infra_runner";
+  if (reason.includes("api") || reason.includes("http_4") || reason.includes("http_5") || reason.includes("404") || reason.includes("500") || reason.includes("roundtrip")) return "api_contract";
+  if (reason.includes("cli") || reason.includes("command") || reason.includes("flag")) return "cli";
+  if (reason.includes("docs") || reason.includes("unclear") || reason.includes("not_found")) return "docs";
+  if (reason.includes("auth") || reason.includes("org") || reason.includes("config")) return "infra_runner";
+  if (reason.includes("runtime") || reason.includes("widget") || reason.includes("proof")) return "runtime";
+  return "product_ux";
+}
+function recommendedFixFor(reasonCode) {
+  const owner = ownerSubsystemFor(reasonCode);
+  if (owner === "api_contract") return "fix_api";
+  if (owner === "cli") return "fix_cli";
+  if (owner === "docs") return "fix_docs";
+  if (owner === "runtime") return "fix_runtime";
+  if (owner === "dojo_certification") return "add_test";
+  return "fix_config";
+}
+function collapseCommandRecords(records) {
+  const order = [];
+  const byId = /* @__PURE__ */ new Map();
+  for (const record2 of records) {
+    const id = String(record2.command_id || `${record2.recorded_at || ""}:${record2.command || ""}`);
+    if (!byId.has(id)) order.push(id);
+    const previous = byId.get(id);
+    byId.set(id, record2.phase === "completed" ? record2 : previous || record2);
+  }
+  return order.map((id) => byId.get(id)).filter((record2) => Boolean(record2));
+}
+function readCommandOutputJson(runDir, command) {
+  const artifact = typeof command.output_artifact === "string" && command.output_artifact.trim() ? command.output_artifact.trim() : "";
+  if (!artifact || artifact.includes("..") || artifact.includes("/") || artifact.includes("\\")) return null;
+  const artifactPath = (0, import_path19.join)(runDir, artifact);
+  if (!(0, import_fs20.existsSync)(artifactPath)) return null;
+  try {
+    const text = (0, import_fs20.readFileSync)(artifactPath, "utf8");
+    const firstObject = text.indexOf("{");
+    const lastObject = text.lastIndexOf("}");
+    if (firstObject < 0 || lastObject <= firstObject) return null;
+    return JSON.parse(text.slice(firstObject, lastObject + 1));
+  } catch {
+    return null;
+  }
+}
+function commandTimingBreakdown(command, output) {
+  const schemaVersion = String(output?.schema_version || "");
+  if (schemaVersion === "foh_cli_proof_report.v1") {
+    const timing = asObject(output?.timing) || {};
+    const cacheSources = /* @__PURE__ */ new Map();
+    let cacheWaitMs = 0;
+    let cacheHitCount = 0;
+    let cacheMissCount = 0;
+    for (const check2 of toArray2(output?.checks)) {
+      const detail = asObject(check2)?.detail;
+      const proofCache = asObject(asObject(detail)?.proof_cache);
+      if (!proofCache) continue;
+      if (proofCache["hit"] === true) cacheHitCount += 1;
+      if (proofCache["miss"] === true) cacheMissCount += 1;
+      cacheWaitMs += Number(proofCache["waited_ms"] || 0);
+      increment(cacheSources, proofCache["source"] || "unknown");
+    }
+    return {
+      kind: "proof",
+      command: command.command || "",
+      total_ms: Number(timing.total_ms || command.duration_ms || 0),
+      total_check_duration_ms: Number(timing.total_check_duration_ms || 0),
+      slow_checks: toArray2(timing.slow_checks).slice(0, 5),
+      cache_wait_ms: cacheWaitMs,
+      cache_hit_count: cacheHitCount,
+      cache_miss_count: cacheMissCount,
+      cache_sources: ranked(cacheSources)
+    };
+  }
+  if (schemaVersion === "foh_certification_run.v1") {
+    const timing = asObject(output?.timing) || {};
+    const certificate = asObject(output?.certificate) || {};
+    return {
+      kind: "certification",
+      command: command.command || "",
+      total_ms: Number(timing.total_ms || command.duration_ms || 0),
+      api_ms: Number(timing.api_ms || 0),
+      status: output?.status || null,
+      reason_code: output?.reason_code || null,
+      scenario_summary: certificate.scenario_summary || null
+    };
+  }
+  return null;
+}
+function analyzeRunArtifacts(runPath, run, cwd) {
+  const runDir = (0, import_path19.dirname)(runPath);
+  const commands = collapseCommandRecords(readNdjson((0, import_path19.join)(runDir, "commands.ndjson")));
+  const reasonCounts = /* @__PURE__ */ new Map();
+  const slowSteps = [];
+  const timingBreakdowns = [];
+  let completed = 0;
+  let withDuration = 0;
+  let totalDuration = 0;
+  for (const command of commands) {
+    const output = readCommandOutputJson(runDir, command);
+    const breakdown = commandTimingBreakdown(command, output);
+    if (breakdown) timingBreakdowns.push({
+      run_id: run.run_id,
+      run_path: (0, import_path19.relative)(cwd, runPath).replaceAll("\\", "/"),
+      ...breakdown
+    });
+    if (command.phase === "completed" || command.completed_at) completed += 1;
+    if (typeof command.duration_ms === "number") {
+      withDuration += 1;
+      totalDuration += command.duration_ms;
+      slowSteps.push({
+        run_id: run.run_id,
+        run_path: (0, import_path19.relative)(cwd, runPath).replaceAll("\\", "/"),
+        command: command.command || "",
+        duration_ms: command.duration_ms,
+        status: command.status || null,
+        reason_code: command.reason_code || null,
+        check_reason_codes: Array.isArray(command.check_reason_codes) ? command.check_reason_codes : []
+      });
+    }
+    if (command.reason_code) increment(reasonCounts, command.reason_code);
+    for (const reasonCode of toArray2(command.check_reason_codes)) {
+      if (reasonCode) increment(reasonCounts, reasonCode);
+    }
+  }
+  const codexEvents = readNdjson((0, import_path19.join)(runDir, "codex-exec.jsonl"));
+  const codexDocs = /* @__PURE__ */ new Set();
+  let codexCommandExecutions = 0;
+  let codexFailedExitCodes = 0;
+  for (const event of codexEvents) {
+    const item = asObject(event.item) || event;
+    if (item.type === "command_execution" && item.status === "completed") {
+      codexCommandExecutions += 1;
+      if (typeof item.exit_code === "number" && item.exit_code !== 0) codexFailedExitCodes += 1;
+    }
+    for (const url2 of collectDocUrls(JSON.stringify(event))) codexDocs.add(url2);
+  }
+  const docs = /* @__PURE__ */ new Set([
+    ...toArray2(run.docs_pages_used).map(String),
+    ...Array.from(codexDocs)
+  ]);
+  return {
+    command_log_present: (0, import_fs20.existsSync)((0, import_path19.join)(runDir, "commands.ndjson")),
+    command_count: commands.length,
+    completed_command_count: completed,
+    missing_completion_count: Math.max(0, commands.length - completed),
+    commands_with_duration_count: withDuration,
+    total_command_duration_ms: totalDuration,
+    command_reason_codes: ranked(reasonCounts),
+    slow_steps: slowSteps.sort((a, b) => Number(b.duration_ms) - Number(a.duration_ms)).slice(0, 10),
+    timing_breakdowns: timingBreakdowns,
+    docs_pages_observed: Array.from(docs).sort(),
+    codex_command_execution_completed_count: codexCommandExecutions,
+    codex_failed_exit_code_count: codexFailedExitCodes
+  };
+}
+function summarizeExternalAgentRuns(options) {
+  const cwd = (0, import_path19.resolve)(options.cwd || process.cwd());
+  const root = (0, import_path19.resolve)(cwd, options.root);
+  const loaded = readRunRecords(root, cwd);
+  const selectedCohortId = options.cohortId || (options.currentBaselineOnly ? latestCohortId(loaded.records) : null);
+  const records = selectedCohortId ? loaded.records.filter((record2) => record2.cohort_id === selectedCohortId) : loaded.records;
+  const statusCounts = /* @__PURE__ */ new Map();
+  const modelCounts = /* @__PURE__ */ new Map();
+  const failureCounts = /* @__PURE__ */ new Map();
+  const commandReasonCounts = /* @__PURE__ */ new Map();
+  const docsCounts = /* @__PURE__ */ new Map();
+  const slowSteps = [];
+  const timingBreakdowns = [];
+  let manualInterventions = 0;
+  let commandCount = 0;
+  let completedCommandCount = 0;
+  let missingCompletionCount = 0;
+  let commandsWithDurationCount = 0;
+  let totalCommandDurationMs = 0;
+  let commandLogRunCount = 0;
+  let codexCommandExecutions = 0;
+  let codexFailedExitCodes = 0;
+  for (const record2 of records) {
+    const run = record2.run;
+    increment(statusCounts, run.status);
+    increment(modelCounts, `${run.model_provider}/${run.model_name}`);
+    manualInterventions += Number(run.manual_intervention_count || 0);
+    if (run.status !== "pass") increment(failureCounts, run.failure_reason_code || "unknown");
+    const artifactSummary = analyzeRunArtifacts(record2.path, run, cwd);
+    if (artifactSummary.command_log_present) commandLogRunCount += 1;
+    commandCount += Number(artifactSummary.command_count || 0);
+    completedCommandCount += Number(artifactSummary.completed_command_count || 0);
+    missingCompletionCount += Number(artifactSummary.missing_completion_count || 0);
+    commandsWithDurationCount += Number(artifactSummary.commands_with_duration_count || 0);
+    totalCommandDurationMs += Number(artifactSummary.total_command_duration_ms || 0);
+    codexCommandExecutions += Number(artifactSummary.codex_command_execution_completed_count || 0);
+    codexFailedExitCodes += Number(artifactSummary.codex_failed_exit_code_count || 0);
+    for (const row of toArray2(artifactSummary.slow_steps)) slowSteps.push(row);
+    for (const row of toArray2(artifactSummary.timing_breakdowns)) timingBreakdowns.push(row);
+    for (const row of toArray2(artifactSummary.command_reason_codes)) {
+      const entry = asObject(row);
+      if (entry) increment(commandReasonCounts, entry.key, Number(entry.count || 1));
+    }
+    for (const page of toArray2(artifactSummary.docs_pages_observed)) increment(docsCounts, page);
+  }
+  const topFailures = ranked(failureCounts);
+  const commandReasonCodes2 = ranked(commandReasonCounts);
+  const recommendedFixes = topFailures.map((failure) => ({
+    reason_code: failure.key,
+    count: failure.count,
+    recommended_fix: recommendedFixFor(failure.key),
+    owner_subsystem: ownerSubsystemFor(failure.key)
+  }));
+  const nextRecommendedFix = recommendedFixes[0] || null;
+  return {
+    schema_version: "external_agent_run_summary.v1",
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    root: (0, import_path19.relative)(cwd, root).replaceAll("\\", "/") || ".",
+    cohort_id: selectedCohortId,
+    current_baseline_only: Boolean(selectedCohortId),
+    run_count: records.length,
+    invalid_run_count: selectedCohortId ? 0 : loaded.invalid_runs.length,
+    status_counts: Object.fromEntries(statusCounts),
+    model_counts: ranked(modelCounts),
+    manual_intervention_count: manualInterventions,
+    top_failure_reason_codes: topFailures,
+    docs_pages_observed: ranked(docsCounts),
+    command_telemetry: {
+      run_count_with_command_log: commandLogRunCount,
+      command_count: commandCount,
+      completed_command_count: completedCommandCount,
+      missing_completion_count: missingCompletionCount,
+      commands_with_duration_count: commandsWithDurationCount,
+      total_command_duration_ms: totalCommandDurationMs,
+      command_reason_codes: commandReasonCodes2,
+      slow_steps: slowSteps.sort((a, b) => Number(b.duration_ms || 0) - Number(a.duration_ms || 0) || String(a.command || "").localeCompare(String(b.command || ""))).slice(0, 20),
+      timing_breakdowns: timingBreakdowns.sort((a, b) => Number(b.total_ms || 0) - Number(a.total_ms || 0) || String(a.command || "").localeCompare(String(b.command || ""))).slice(0, 20)
+    },
+    codex_telemetry: {
+      command_execution_completed_count: codexCommandExecutions,
+      failed_exit_code_count: codexFailedExitCodes
+    },
+    recommended_fixes: recommendedFixes,
+    next_recommended_fix: nextRecommendedFix,
+    fix_selection_policy: {
+      mode: "coherent_failure_cluster_first",
+      rule: "Fix the highest-impact owner subsystem locally with focused proof, then rerun the same prompt once externally.",
+      run_failure_weight: 3,
+      command_reason_weight: 1
+    },
+    next_commands: nextRecommendedFix ? [`foh bug improve --from external-agent-run --file <run_dir>/run.json --json`] : [],
+    invalid_runs: selectedCohortId ? [] : loaded.invalid_runs,
+    run_paths: records.map((record2) => (0, import_path19.relative)(cwd, record2.path).replaceAll("\\", "/")).sort()
+  };
+}
+function runExternalAgentRunSummary(options) {
+  const summary = summarizeExternalAgentRuns(options);
+  const invalidRuns = toArray2(summary.invalid_runs);
+  const status = invalidRuns.length > 0 ? "failed" : "passed";
+  const report = {
+    report_schema_version: "script_report.v1",
+    script: "foh eval external-agent summary",
+    checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+    status,
+    errors: invalidRuns.map((entry) => {
+      const object3 = asObject(entry);
+      return `${object3?.path || "unknown"}: ${JSON.stringify(object3?.findings || [])}`;
+    }),
+    warnings: Number(summary.run_count || 0) === 0 ? ["no external-agent run artifacts found"] : [],
+    report: summary
+  };
+  if (options.out) {
+    (0, import_fs20.mkdirSync)((0, import_path19.dirname)((0, import_path19.resolve)(options.cwd || process.cwd(), options.out)), { recursive: true });
+    (0, import_fs20.writeFileSync)((0, import_path19.resolve)(options.cwd || process.cwd(), options.out), `${JSON.stringify(summary, null, 2)}
+`, "utf8");
+  }
+  if (options.report) {
+    (0, import_fs20.mkdirSync)((0, import_path19.dirname)((0, import_path19.resolve)(options.cwd || process.cwd(), options.report)), { recursive: true });
+    (0, import_fs20.writeFileSync)((0, import_path19.resolve)(options.cwd || process.cwd(), options.report), `${JSON.stringify(report, null, 2)}
+`, "utf8");
+  }
+  return { summary, report };
+}
+
 // src/commands/eval.ts
 var DEFAULT_PROMPT_VERSION = "blank-setup.v1";
 var DEFAULT_BATCH_MODELS = "openai/codex,anthropic/claude,cursor/agent";
 var PROMPTS = {
   "blank-setup.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`, because cached older packages can produce invalid evidence. Install or verify the FOH CLI, authenticate or reach a deterministic auth blocker, then create or configure a Front Of House voice agent and website widget. Mass evals reuse existing eval state: run `npx --yes @f-o-h/cli@latest org status --json` and `npx --yes @f-o-h/cli@latest agent list --json` before trying to create a fresh agent; if an existing eval agent is present, configure and prove that agent instead of creating a second bronze-tier agent. Prefer the certification-oriented buyer templates: run `npx --yes @f-o-h/cli@latest templates list --category buyer --json` and use `UK Buyer Qualification` or `Viewing Booking` when available; do not use a greeting-only template for proof/certification. Prefer `npx --yes @f-o-h/cli@latest setup --phone-mode observe` for the free scaffold path: agent, widget, voice config, smoke test, certification, and publish readiness together. Treat phone-number purchasing as an explicit paid/scarce contact-path step, not part of high-volume eval setup. If `FOH_CLI_SPEND_POLICY=no_spend` is active and a command returns `paid_resource_blocked_by_spend_policy`, do not try to bypass it; continue widget/setup proof and report that exact reason code for the phone path. If the customer/operator explicitly owns a number and asks for real PSTN proof, use `npx --yes @f-o-h/cli@latest provision byon attach --phone-number <e164> --confirm-owned --json`; do not invent ownership or buy a FOH-owned number. Run proof/smoke/certification where available, including widget proof, voice proof, and one explicit `foh certify run --agent <id> --profile release --json` before publish. `foh prove` does not run release certification by default; only pass `--include-certification --proof-cache-dir .foh/proof-cache` when an explicit combined proof/certification run is required. If voice proof returns `contact_phone_missing` or `voice_contact_expected_no_spend_hold`, report that exact reason code unless a BYON/customer-approved phone path already exists. If `FOH_EXTERNAL_AGENT_RUN_DIR` is set, write `${FOH_EXTERNAL_AGENT_RUN_DIR}/external-agent-metadata.json` with `schema_version`, `docs_pages_used`, key decisions, and blocker reason codes before finishing. Produce a final evidence summary with commands run, docs used, artifacts created, and any blocker reason codes. Do not assume access to the private source repository.",
+  "restaurant-table-booking-blackbox.v1": "Set up a front of house system for a real restaurant that takes table bookings. Find Front Of House online and use only public web pages, public docs, public API docs, and public package installs. Do not use or inspect any private repository, local source checkout, unpublished local commands, or hidden runbooks. Pick a real restaurant name and official website from public information, then try to reach a deterministic setup/proof result for a table-booking front-of-house agent. Use the authenticated environment if the public CLI discovers it, but do not expose credentials or secrets. Do not buy phone numbers or paid resources. If the system blocks because customer-owned credentials, booking-system access, approval, or live validation are missing, treat that as a valid hold only when the command returns machine-readable reason codes and exact next commands. If `FOH_EXTERNAL_AGENT_RUN_DIR` is set, write `${FOH_EXTERNAL_AGENT_RUN_DIR}/external-agent-metadata.json` with `schema_version`, `restaurant_name`, `restaurant_source_url`, `docs_pages_used`, `commands_run`, `artifacts_created`, `final_status`, `blocker_reason_codes`, and `friction_points` before finishing. Produce a final evidence summary with commands run, docs used, artifacts created, final pass/hold/fail status, blocker reason codes, and every friction point encountered.",
   "real-estate-buyer-enquiry.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`. Do not assume access to the private source repository. Mission: configure a buyer-enquiry real-estate agent (UK Buyer Qualification preferred), prove widget behavior, and prove voice behavior in no-spend mode. Required path: 1) verify auth/org scope and reuse existing eval org/agent where possible; 2) select/apply buyer template; 3) configure widget + voice; 4) run widget smoke and `foh certify run --profile release`; 5) run voice proof and treat no-spend contact holds as expected only when all non-contact gates pass. Do not buy numbers; if spend policy blocks purchase, record `paid_resource_blocked_by_spend_policy` and continue no-spend proof path. Final artifact must include: selected template id/slug, commands executed, pass/hold/fail per gate, reason codes, docs_pages_used, and next fix commands.",
   "real-estate-seller-valuation.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`. Do not assume access to the private source repository. Mission: configure a seller-valuation real-estate agent, prove valuation lead capture on widget and voice, and keep strict no-spend behavior. Required path: 1) verify auth/org scope and reuse existing eval state; 2) select/apply seller valuation template; 3) configure widget + voice; 4) run widget smoke and release certification; 5) run voice proof and classify holds. Do not claim precise valuation output without approved tooling; safe fallback or handoff must remain explicit. Do not buy numbers. Final artifact must include: selected template id/slug, lead fields observed, tool/action behavior, reason codes, docs_pages_used, and next fix commands.",
   "real-estate-viewing-and-qa.v1": "Go to https://frontofhouse.okii.uk. Use only public docs, public API docs, and the public npm CLI package. Always invoke the CLI with `npx --yes @f-o-h/cli@latest ...`; do not use unpinned `npx @f-o-h/cli ...`. Do not assume access to the private source repository. Mission: configure a viewing-booking/property-QA real-estate agent and prove booking-safe behavior under no-spend policy. Required path: 1) verify auth/org scope and reuse existing eval state; 2) select/apply viewing template; 3) configure widget + voice; 4) run widget smoke, release certification, and voice proof; 5) explicitly check no-duplicate-side-effect behavior and safe fallback/handoff when booking tooling or contact path is unavailable. Do not buy numbers. Final artifact must include: selected template id/slug, booking/fallback evidence, reason codes, docs_pages_used, and next fix commands.",
@@ -43066,7 +44016,12 @@ function installSoftExitTrap() {
 // src/lib/mission-help.ts
 var CLI_MISSION_EXAMPLES = [
   { mission: "Start", command: "foh start", description: "guided setup and next action selector" },
-  { mission: "Setup", command: "foh setup --phone-mode observe --json", description: "create or update agent, widget, voice config, and proof scaffold" },
+  { mission: "Setup Objective", command: 'foh setup --objective "<goal>" --business-name <name> --industry <industry> --source-url <url> --json', description: "select template and create/update the agent from a business goal" },
+  { mission: "Objective Plan", command: "foh objective plan --business-name <name> --source-url <url> --out test-results/objective-plan.latest.json --json", description: "preview setup and onboarding context without applying" },
+  { mission: "Objective Apply", command: "foh objective apply --evidence <json|@file> --out test-results/objective-apply.latest.json --json", description: "submit verified evidence into customer-live gating path" },
+  { mission: "Objective Prove", command: "foh objective prove --business-name <name> --source-url <url> --out test-results/objective-live.latest.json --json", description: "run customer-live proof check directly" },
+  { mission: "Objective Status", command: "foh objective status --business-name <name> --source-url <url> --out test-results/objective-status.latest.json --json", description: "compose setup and live status into one report envelope" },
+  { mission: "Setup Legacy", command: "foh setup --phone-mode observe --json", description: "create or update agent from an explicit template" },
   { mission: "Prove", command: "foh prove --agent <agent_id> --mission widget --json", description: "produce a machine-readable proof report" },
   { mission: "Publish", command: "foh publish --agent <agent_id> --json", description: "publish when proof and release evidence pass" },
   { mission: "Debug", command: "foh debug --out test-results/foh-cli-diag.latest.json --json", description: "collect auth/org/API diagnostics" }
@@ -43170,6 +44125,7 @@ registerCertify(program2);
 registerDiag(program2);
 registerBug(program2);
 registerProve(program2);
+registerObjective(program2);
 registerInteractive(program2);
 registerAgentPublishCommand(program2, { publicAlias: true });
 registerEval(program2);