@gitroll/tacitt-cli 0.3.0 → 0.4.1

package/dist/{src-CPbdnGrk.mjs → src-DIuh0LHk.mjs}

@@ -1,6 +1,6 @@
-import { Bn as validatePlan, Cn as sessionNonce, Dn as entityDictionaryVersion, En as cleanupImplementationVersion, Fn as frameRecords, Gn as detectStatic, H as codePointLength, Hn as defaultLimits, Ht as ApplicationError, In as retainedMainTextNodes, Jn as jsonSpans, Jt as reviewFamilies, Ln as validateProfile, Nn as nativeText, On as nativeParserVersion, Pn as transformRecords, Qt as sourceSnapshotId, Sn as createReplacementKey, Tn as parseNativeRecord, Un as recordPointerLimits, V as bDigest, Wn as resolveLimits, Wt as safeCode, Xn as createEntityMatcher, Xt as sourceKey, Yn as agentContextLocation, an as withMandatoryCustomTerms, c as textDigest, cn as mainReviewRole, dn as renderNative, fn as createSessionPreparation, gn as createDetectionSummary, in as nativeSourceIdentitySchema, ir as isProcessingCode, j as bDuplicateShift, jn as nativeField, k as bBindingCap, kn as redactionImplementationVersion, ln as reviewRoles, nr as ProcessingError, o as reviewDigest, on as processNativeRecord, pn as bindInspection, qt as familySelected, rr as fail$1, sn as projectNativeReviewInput, tr as defaultDetectionLimits, un as createSentenceContext, vn as walkNativeFields, wn as projectNativeRecord, x as createBAnalysisUnits, zn as buildPlan } from "./locate-U3-nkird.mjs";
+import { Bn as validatePlan, Cn as sessionNonce, Dn as entityDictionaryVersion, En as cleanupImplementationVersion, Fn as frameRecords, Gn as detectStatic, H as codePointLength, Hn as defaultLimits, Ht as ApplicationError, In as retainedMainTextNodes, Jn as jsonSpans, Jt as reviewFamilies, Ln as validateProfile, Mn as nativeItems, Nn as nativeText, On as nativeParserVersion, Pn as transformRecords, Qt as sourceSnapshotId, Sn as createReplacementKey, Tn as parseNativeRecord, Un as recordPointerLimits, V as bDigest, Wn as resolveLimits, Wt as safeCode, Xn as createEntityMatcher, Xt as sourceKey, Yn as agentContextLocation, an as withMandatoryCustomTerms, c as textDigest, cn as mainReviewRole, dn as renderNative, fn as createSessionPreparation, gn as createDetectionSummary, in as nativeSourceIdentitySchema, ir as isProcessingCode, j as bDuplicateShift, jn as nativeField, k as bBindingCap, kn as redactionImplementationVersion, ln as reviewRoles, nr as ProcessingError, o as reviewDigest, on as processNativeRecord, pn as bindInspection, qt as familySelected, rr as fail$1, sn as projectNativeReviewInput, tr as defaultDetectionLimits, un as createSentenceContext, vn as walkNativeFields, wn as projectNativeRecord, x as createBAnalysisUnits, zn as buildPlan } from "./locate-U3-nkird.mjs";
 import { t as createZstdFrameCheck } from "./frame-waS5FnN5.mjs";
-import { Bn as bWordBounded, F as withSourceEvidence, I as agentSetupKey, In as bContainment, Ln as bExceptionRanges, Nt as metadataProcessingVersion, P as sourceIdentityEvidence, gr as resolveSourceSelection, ii as approvedTreatmentSchema, it as defaultAgentSetupInclusion, li as staticCatalogRef, ni as sourceChangePolicy, rt as classifyAgentSetup } from "./src-B4R5XMEP.mjs";
+import { An as bContainment, Dt as metadataProcessingVersion, F as withSourceEvidence, I as agentSetupKey, Mr as agentSourceSchema, P as sourceIdentityEvidence, Pn as bWordBounded, ai as sourceChangePolicy, fi as staticCatalogRef, it as defaultAgentSetupInclusion, jn as bExceptionRanges, jr as agentSourcePathSegment, rt as classifyAgentSetup, si as approvedTreatmentSchema, ur as resolveSourceSelection } from "./src-DSDRF7i6.mjs";
 import { constants } from "node:fs";
 import { link, lstat, mkdir, open, readFile, readdir, realpath, rm, rmdir, stat, unlink } from "node:fs/promises";
 import { execFile, fork, spawn } from "node:child_process";
@@ -16,6 +16,7 @@ import "node:perf_hooks";
 import { availableParallelism, platform, tmpdir, totalmem } from "node:os";
 import { pipeline } from "node:stream/promises";
 import { constants as constants$1, createZstdDecompress } from "node:zlib";
+import { parse } from "@decimalturn/toml-patch";
 //#region packages/file-privacy/src/windows/descriptor.ts
 const system = "S-1-5-18";
 const administrators = "S-1-5-32-544";
@@ -831,9 +832,9 @@ const readMetadata = async (entry, signal, maximumBytes = metadataLimitBytes) =>
 };
 //#endregion
 //#region packages/artifact/src/manifest/fields.ts
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const record = (value) => {
-	if (!isRecord$1(value)) return fail("ARTIFACT_INVALID_MANIFEST");
+const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$1 = (value) => {
+	if (!isRecord$2(value)) return fail("ARTIFACT_INVALID_MANIFEST");
 	return value;
 };
 const string = (value) => {
@@ -860,7 +861,7 @@ const keys = (value, expected) => {
 //#endregion
 //#region packages/artifact/src/manifest/parse.ts
 const parseCounts = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"workspaces",
 		"sessions",
@@ -1086,7 +1087,7 @@ const nativeId = (value) => {
 };
 const nullableId = (value) => value === null ? null : nativeId(value);
 const parsePosition = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, ["kind", "value"]);
 	const kind = item["kind"];
 	if (kind === "unknown" && item["value"] === null) return {
@@ -1115,7 +1116,7 @@ const parsePosition = (value) => {
 	return fail("ARTIFACT_INVALID_MANIFEST");
 };
 const parseFork = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, ["parentSessionId", "position"]);
 	return {
 		parentSessionId: nativeId(item["parentSessionId"]),
@@ -1124,7 +1125,7 @@ const parseFork = (value) => {
 };
 /** Relationships are explicit native metadata; names never determine roles. */
 const parseNativeIdentity = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"role",
 		"sessionId",
@@ -1143,7 +1144,7 @@ const parseNativeIdentity = (value) => {
 	};
 };
 const parseNativeRelation = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	const kind = item["kind"];
 	if (kind === "call" || kind === "result") {
 		keys(item, ["kind", "callId"]);
@@ -1428,7 +1429,7 @@ function parseWorkspaceConfiguration(input, expectedDigest) {
 /** The talent-platform `challengeIdSchema`; an identifier outside it would fail the upload. */
 const challengeIdPattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const markerLimitBytes = 4096;
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const isAbsent = (error) => error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 /** One fixed line; never the path, the file content or the native error message. */
 function ignored(code) {
@@ -1481,7 +1482,7 @@ async function readChallengeId(workspacePath, signal) {
 	} catch {
 		return ignored("CHALLENGE_MARKER_INVALID");
 	}
-	if (!isRecord(marker)) return ignored("CHALLENGE_MARKER_INVALID");
+	if (!isRecord$1(marker)) return ignored("CHALLENGE_MARKER_INVALID");
 	const challengeId = marker["challengeId"];
 	return marker["version"] === 1 && typeof challengeId === "string" && challengeIdPattern.test(challengeId) ? challengeId : ignored("CHALLENGE_MARKER_INVALID");
 }
@@ -1490,7 +1491,7 @@ async function readChallengeId(workspacePath, signal) {
 const uuid$3 = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/;
 const digest$6 = /^[a-f0-9]{64}$/;
 function parseConfiguredWork(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"id",
 		"metadataPath",
@@ -1506,7 +1507,7 @@ function parseConfiguredWork(value) {
 	};
 }
 function parseConfiguredSourceWorkspace(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"id",
 		"metadataPath",
@@ -1526,7 +1527,7 @@ function parseConfiguredSourceWorkspace(value) {
 	};
 }
 function parseConfiguredWorkMetadata(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"version",
 		"id",
@@ -1545,7 +1546,7 @@ function parseConfiguredWorkMetadata(value) {
 }
 /** Physical hashes are never synthesized from a logical Work identity. */
 function validateConfiguredSourceMetadata(value, expected) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"version",
 		"title",
@@ -1576,7 +1577,7 @@ function digestString(value) {
 	return result;
 }
 function parseConfiguredEntry(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"entryPath",
 		"kind",
@@ -1597,7 +1598,7 @@ function parseConfiguredEntry(value) {
 	};
 }
 function parseConfiguredPart(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"id",
 		"sourceId",
@@ -1609,7 +1610,7 @@ function parseConfiguredPart(value) {
 		"retainedRecordCount",
 		"equivalence"
 	]);
-	const source = record(item["source"]);
+	const source = record$1(item["source"]);
 	keys(source, [
 		"representation",
 		"byteLength",
@@ -1634,7 +1635,7 @@ function parseConfiguredPart(value) {
 	};
 }
 function session$1(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"id",
 		"workspaceId",
@@ -1657,7 +1658,7 @@ function session$1(value) {
 	};
 }
 function exclusion$1(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"sessionId",
 		"sourceId",
@@ -1672,7 +1673,7 @@ function exclusion$1(value) {
 	};
 }
 function parseConfiguredManifest(text) {
-	const item = record(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	const item = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
 	keys(item, [
 		"format",
 		"formatVersion",
@@ -1699,11 +1700,11 @@ function parseConfiguredManifest(text) {
 	]);
 	const challengeId = item["challengeId"] === void 0 ? null : string(item["challengeId"]);
 	if (challengeId !== null && !challengeIdPattern.test(challengeId)) fail("ARTIFACT_INVALID_MANIFEST");
-	const producer = record(item["producer"]);
+	const producer = record$1(item["producer"]);
 	keys(producer, ["name", "version"]);
-	const adapters = record(item["adapterVersions"]);
+	const adapters = record$1(item["adapterVersions"]);
 	keys(adapters, ["claude", "codex"]);
-	const setup = record(item["agentSetup"]);
+	const setup = record$1(item["agentSetup"]);
 	keys(setup, ["version", "files"]);
 	const configurationDigest = digestString(item["configurationDigest"]);
 	return {
@@ -1730,7 +1731,7 @@ function parseConfiguredManifest(text) {
 		configurationDigest,
 		configuration: parseWorkspaceConfiguration(item["configuration"], configurationDigest),
 		sourceScope: array(item["sourceScope"], (value) => {
-			const source = record(value);
+			const source = record$1(value);
 			keys(source, ["sessionId", "sourceId"]);
 			return {
 				sessionId: string(source["sessionId"]),
@@ -1742,7 +1743,7 @@ function parseConfiguredManifest(text) {
 		agentSetup: {
 			version: literal(setup["version"], 1),
 			files: array(setup["files"], (value) => {
-				const file = record(value);
+				const file = record$1(value);
 				keys(file, [
 					"id",
 					"category",
@@ -1858,7 +1859,7 @@ const digestPattern = /^[a-f0-9]{64}$/;
 const sessionIdPattern = /^s[0-9]{6}$/;
 const sourceIdPattern = /^src[0-9]{6}$/;
 function description(value) {
-	const item = record(value);
+	const item = record$1(value);
 	const kind = item["kind"];
 	const representation = item["representation"];
 	if (kind !== "data" && kind !== "facts" && kind !== "metadata" && kind !== "agent-setup" || representation !== "json" && representation !== "jsonl" && representation !== "jsonl.zst") return fail("ARTIFACT_INVALID_MANIFEST");
@@ -1874,16 +1875,16 @@ function description(value) {
 	};
 }
 function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summary) {
-	const manifest = record(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	const manifest = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
 	const treatment = manifest["contentTreatment"];
 	const configured = treatment === "configured";
 	const configuredManifest = configured ? parseConfiguredManifest(text) : null;
 	if (configuredManifest) validateConfiguredManifest(configuredManifest);
-	const sourceWorkspaces = configuredManifest?.sourceWorkspaces ?? [record(manifest["workspace"])];
+	const sourceWorkspaces = configuredManifest?.sourceWorkspaces ?? [record$1(manifest["workspace"])];
 	const workspaceIds = new Set(sourceWorkspaces.map((workspace) => string(workspace["id"])));
 	if (literal(manifest["format"], "sess-pilot-workspace-bundle") !== "sess-pilot-workspace-bundle" || manifest["formatVersion"] !== (configured ? 5 : 3) || string(manifest["bundleId"]) !== bundleId || summary.bundleId !== bundleId || treatment !== "original" && treatment !== "legacy-plan" && treatment !== "configured") fail("ARTIFACT_INVALID_MANIFEST");
 	if (!configured) {
-		const workspace = record(manifest["workspace"]);
+		const workspace = record$1(manifest["workspace"]);
 		keys(workspace, [
 			"id",
 			"metadataPath",
@@ -1893,7 +1894,7 @@ function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summa
 		if (workspace["id"] !== "w000001" || pathHash !== null && !digestPattern.test(pathHash) || pathHash !== expectedPathHash || workspace["metadataPath"] !== "workspace/metadata.json") fail("ARTIFACT_INVALID_MANIFEST");
 	} else if ((sourceWorkspaces.length === 1 ? sourceWorkspaces[0]?.["pathHash"] : null) !== expectedPathHash) fail("ARTIFACT_INVALID_MANIFEST");
 	const counts = parseCounts(manifest["counts"]);
-	const sessions = array(manifest["sessions"], record);
+	const sessions = array(manifest["sessions"], record$1);
 	if (counts.workspaces !== sourceWorkspaces.length || sessions.length === 0 || sessions.length !== summary.sessions.length || !countsEqual(counts, summary.counts)) fail("ARTIFACT_INVALID_MANIFEST");
 	const descriptions = /* @__PURE__ */ new Map();
 	for (const item of array(manifest["entries"], description)) {
@@ -1912,10 +1913,10 @@ function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summa
 		for (const workspace of configuredManifest.sourceWorkspaces) requireEntry(workspace.metadataPath, "metadata", "json");
 	} else requireEntry("workspace/metadata.json", "metadata", "json");
 	if (configured) {
-		const setup = record(manifest["agentSetup"]);
+		const setup = record$1(manifest["agentSetup"]);
 		keys(setup, ["version", "files"]);
 		if (setup["version"] !== 1) fail("ARTIFACT_INVALID_MANIFEST");
-		for (const [index, value] of array(setup["files"], record).entries()) {
+		for (const [index, value] of array(setup["files"], record$1).entries()) {
 			keys(value, [
 				"id",
 				"category",
@@ -1952,7 +1953,7 @@ function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summa
 			if (rawSession["metadataPath"] !== metadataPath) fail("ARTIFACT_INVALID_MANIFEST");
 			requireEntry(metadataPath, "metadata", "json");
 		}
-		const sessionParts = array(rawSession["parts"], record);
+		const sessionParts = array(rawSession["parts"], record$1);
 		if (sessionParts.length === 0 || sessionParts.length !== expected.sources.length) fail("ARTIFACT_INVALID_MANIFEST");
 		for (const [partIndex, part] of sessionParts.entries()) {
 			const source = expected.sources[partIndex] ?? fail("ARTIFACT_INVALID_MANIFEST");
@@ -1962,7 +1963,7 @@ function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summa
 			admitted.set(sourceId, id);
 			if (configured) {
 				if (source.native === null || !isDeepStrictEqual(parseNativeIdentity(part["native"]), source.native)) fail("ARTIFACT_INVALID_MANIFEST");
-				const sourceFacts = record(part["source"]);
+				const sourceFacts = record$1(part["source"]);
 				sourceBytes += integer(sourceFacts["byteLength"]);
 				const data = `sessions/${id}/parts/${partId}.jsonl`;
 				const facts = `sessions/${id}/facts/${partId}.jsonl`;
@@ -1977,21 +1978,21 @@ function checkWorkspaceManifest(text, entries, bundleId, expectedPathHash, summa
 				const data = `sessions/${id}/parts/${partId}.${representation}`;
 				if (part["entryPath"] !== data) fail("ARTIFACT_INVALID_MANIFEST");
 				requireEntry(data, "data", representation);
-				sourceBytes += part["source"] === void 0 ? integer(part["byteLength"]) : integer(record(part["source"])["byteLength"]);
+				sourceBytes += part["source"] === void 0 ? integer(part["byteLength"]) : integer(record$1(part["source"])["byteLength"]);
 			}
 			parts++;
 		}
 	}
 	if (parts !== counts.parts || sourceBytes !== counts.sourceBytes || referenced.size !== descriptions.size) fail("ARTIFACT_INVALID_MANIFEST");
 	const scope = /* @__PURE__ */ new Map();
-	for (const item of array(manifest["sourceScope"], record)) {
+	for (const item of array(manifest["sourceScope"], record$1)) {
 		const sourceId = string(item["sourceId"]);
 		const sessionId = string(item["sessionId"]);
 		if (!sourceIdPattern.test(sourceId) || !sessionIdPattern.test(sessionId) || scope.has(sourceId)) fail("ARTIFACT_INVALID_MANIFEST");
 		scope.set(sourceId, sessionId);
 	}
 	const excluded = /* @__PURE__ */ new Set();
-	for (const item of array(manifest["exclusions"], record)) {
+	for (const item of array(manifest["exclusions"], record$1)) {
 		const sourceId = string(item["sourceId"]);
 		if (scope.get(sourceId) !== item["sessionId"] || excluded.has(sourceId)) fail("ARTIFACT_INVALID_MANIFEST");
 		excluded.add(sourceId);
@@ -2065,7 +2066,7 @@ async function checkWrittenWorkspaceBundle(path, identity, expectedManifestText,
 //#endregion
 //#region packages/artifact/src/collection/companion.ts
 function companionManifest(primaryText, primary, entries) {
-	const manifest = record(strictJson(primaryText, manifestLimitBytes, manifestNodeLimit));
+	const manifest = record$1(strictJson(primaryText, manifestLimitBytes, manifestNodeLimit));
 	if (manifest["formatVersion"] !== 5 || manifest["companionVersion"] !== 3 || manifest["contentTreatment"] !== "configured") return fail("ARTIFACT_INVALID_MANIFEST");
 	return JSON.stringify({
 		format: "sess-pilot-workspace-companion",
@@ -2080,7 +2081,7 @@ function companionManifest(primaryText, primary, entries) {
 	});
 }
 function checkCompanionManifest(text, entries, primaryText, primary) {
-	const value = record(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	const value = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
 	keys(value, [
 		"format",
 		"formatVersion",
@@ -2092,12 +2093,12 @@ function checkCompanionManifest(text, entries, primaryText, primary) {
 	literal(value["format"], "sess-pilot-workspace-companion");
 	literal(value["formatVersion"], 1);
 	literal(value["companionVersion"], 3);
-	const descriptions = array(value["entries"], record);
-	const expected = record(strictJson(companionManifest(primaryText, primary, descriptions), manifestLimitBytes, manifestNodeLimit));
+	const descriptions = array(value["entries"], record$1);
+	const expected = record$1(strictJson(companionManifest(primaryText, primary, descriptions), manifestLimitBytes, manifestNodeLimit));
 	if (!isDeepStrictEqual(value, expected)) fail("ARTIFACT_INVALID_MANIFEST");
 	const paths = /* @__PURE__ */ new Set();
-	const primaryManifest = record(strictJson(primaryText, manifestLimitBytes, manifestNodeLimit));
-	const parts = array(primaryManifest["sessions"], record).flatMap((session) => array(session["parts"], record));
+	const primaryManifest = record$1(strictJson(primaryText, manifestLimitBytes, manifestNodeLimit));
+	const parts = array(primaryManifest["sessions"], record$1).flatMap((session) => array(session["parts"], record$1));
 	for (const part of parts) {
 		const path = string(part["factsPath"]);
 		if (paths.has(path)) fail("ARTIFACT_INVALID_MANIFEST");
@@ -2221,7 +2222,7 @@ const roles = [
 ];
 const parseRole = (value) => roles.find((role) => role === value) ?? fail("ARTIFACT_INVALID_MANIFEST");
 const parseBody = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"bodyId",
 		"fieldId",
@@ -2271,7 +2272,7 @@ function sampleLocations(bodies, fields, locations) {
 	return synthetic;
 }
 const measured$1 = (value, parse) => {
-	const item = record(value);
+	const item = record$1(value);
 	const state = item["state"];
 	keys(item, [
 		"state",
@@ -2295,8 +2296,8 @@ const measured$1 = (value, parse) => {
 	};
 	return fail("ARTIFACT_INVALID_MANIFEST");
 };
-const patch$1 = (value) => {
-	const item = record(value);
+const patch$2 = (value) => {
+	const item = record$1(value);
 	keys(item, [
 		"grammarVersion",
 		"basis",
@@ -2315,7 +2316,7 @@ const patch$1 = (value) => {
 	};
 };
 const parseFacts = (value) => {
-	const item = record(value);
+	const item = record$1(value);
 	const optional = [
 		"decodedUtf8Bytes",
 		"logicalLines",
@@ -2338,7 +2339,7 @@ const parseFacts = (value) => {
 		extractorVersion: literal(item["extractorVersion"], "native-retention-v1"),
 		...Object.hasOwn(item, "decodedUtf8Bytes") ? { decodedUtf8Bytes: measured$1(item["decodedUtf8Bytes"], integer) } : {},
 		...Object.hasOwn(item, "logicalLines") ? { logicalLines: measured$1(item["logicalLines"], integer) } : {},
-		...Object.hasOwn(item, "patchDelta") ? { patchDelta: measured$1(item["patchDelta"], patch$1) } : {}
+		...Object.hasOwn(item, "patchDelta") ? { patchDelta: measured$1(item["patchDelta"], patch$2) } : {}
 	};
 };
 /** IDs address original nodes, never mutable output positions. */
@@ -2643,7 +2644,7 @@ async function verifyConfiguredPart(part, entries, descriptions, signal) {
 //#region packages/artifact/src/read/configured/workspace.ts
 /** Public primary facts are parsed independently; no source file is opened. */
 function workspaceSummary(text) {
-	const manifest = record(parseConfiguredManifest(text));
+	const manifest = record$1(parseConfiguredManifest(text));
 	if (manifest["contentTreatment"] !== "configured" || manifest["formatVersion"] !== 5 || manifest["companionVersion"] !== 3) return fail("ARTIFACT_INVALID_MANIFEST");
 	return {
 		format: "sess-pilot-workspace-summary",
@@ -2651,7 +2652,7 @@ function workspaceSummary(text) {
 		bundleId: string(manifest["bundleId"]),
 		counts: parseCounts(manifest["counts"]),
 		sessions: array(manifest["sessions"], (value) => {
-			const session = record(value);
+			const session = record$1(value);
 			const harness = session["harness"];
 			if (harness !== "claude" && harness !== "codex") return fail("ARTIFACT_INVALID_MANIFEST");
 			return {
@@ -2681,7 +2682,7 @@ async function readPrimaryMetadata(primaryEntries, primaryText, signal, only) {
 		if (description.representation !== "jsonl" && (!only || only.has(description.entryPath))) {
 			const text = await readMetadata(entry, signal);
 			if (createHash("sha256").update(text).digest("hex") !== description.sha256) fail("ARTIFACT_INVALID_ARCHIVE");
-			const metadata = record(strictJson(text, metadataLimitBytes));
+			const metadata = record$1(strictJson(text, metadataLimitBytes));
 			if (description.entryPath === manifest.work.metadataPath) {
 				if (parseConfiguredWorkMetadata(metadata).id !== manifest.work.id) fail("ARTIFACT_INVALID_MANIFEST");
 			}
@@ -2690,7 +2691,7 @@ async function readPrimaryMetadata(primaryEntries, primaryText, signal, only) {
 			if (description.entryPath.startsWith("sessions/")) {
 				keys(metadata, ["version", "session"]);
 				if (metadata["version"] !== 3) fail("ARTIFACT_INVALID_MANIFEST");
-				const session = record(metadata["session"]);
+				const session = record$1(metadata["session"]);
 				keys(session, [
 					"id",
 					"harness",
@@ -2715,11 +2716,11 @@ async function readPrimaryMetadata(primaryEntries, primaryText, signal, only) {
 async function readConfiguredWorkspacePair(primaryEntries, primaryText, companionEntries, companionText, primary, signal, only) {
 	const { summary } = await readPrimaryMetadata(primaryEntries, primaryText, signal, only);
 	checkCompanionManifest(companionText, companionEntries, primaryText, primary);
-	const manifest = record(strictJson(primaryText, manifestLimitBytes, manifestNodeLimit));
-	const companion = record(strictJson(companionText, manifestLimitBytes, manifestNodeLimit));
+	const manifest = record$1(strictJson(primaryText, manifestLimitBytes, manifestNodeLimit));
+	const companion = record$1(strictJson(companionText, manifestLimitBytes, manifestNodeLimit));
 	const descriptions = new Map([...array(manifest["entries"], parseConfiguredEntry), ...array(companion["entries"], parseConfiguredEntry)].map((entry) => [entry.entryPath, entry]));
 	const entries = new Map([...primaryEntries, ...[...companionEntries].filter(([path]) => path !== "manifest.json")]);
-	for (const session of array(manifest["sessions"], record)) for (const part of array(session["parts"], parseConfiguredPart)) if (!only || only.has(part.dataPath)) await verifyConfiguredPart(part, entries, descriptions, signal);
+	for (const session of array(manifest["sessions"], record$1)) for (const part of array(session["parts"], parseConfiguredPart)) if (!only || only.has(part.dataPath)) await verifyConfiguredPart(part, entries, descriptions, signal);
 	return summary;
 }
 //#endregion
@@ -3226,21 +3227,23 @@ async function inspectInput(input, part, adapter, signal, overrides, complete =
 	const inspector = adapter.source(part);
 	const limits = resolveLimits(overrides);
 	let records = 0;
+	let identityRecords = 0;
 	let readingRecords = true;
 	const cleanup = createCleanup();
 	try {
 		for await (const text of frameRecords(input.chunks, "jsonl", limits.maxRecordBytes, signal)) {
 			const root = parseNativeRecord(text, limits, signal);
 			inspector.inspect(root);
-			observe?.(root);
 			const native = inspector.current();
+			observe?.(root, native);
 			if (!complete && native.role !== "unknown" && native.sessionId !== null) {
 				const identity = inspector.finish();
 				checkNativeEvidence(part, identity);
 				return identity;
 			}
 			records += 1;
-			if (!complete && records >= 256) break;
+			if (adapter.identityRecord?.(root) !== false) identityRecords += 1;
+			if (!complete && identityRecords >= 256) break;
 		}
 		readingRecords = false;
 		if (complete) await (input.finish ?? fail("ARTIFACT_PROCESSING_FAILED"))();
@@ -3271,20 +3274,24 @@ async function inspectCompleteCapturedSourceIdentity(part, captured, adapter, si
 	return inspectInput(await openCapturedConfiguredSource(part, captured, signal), part, adapter, signal, overrides, true, observe);
 }
 /**
-* First launch named by the frozen capture, the same first-known value admission observes;
-* undefined when no record names one or the adapter has no launch port.
+* Launch on the first identity-bearing record that names a launch, matching admission. Later per-record launch
+* metadata cannot redefine session admission; absent launch retains legacy behavior.
 */
 async function capturedLaunch(part, captured, adapter, signal, overrides) {
 	const launch = adapter.launch;
 	if (!launch) return void 0;
+	const inspector = adapter.source(part);
 	const limits = resolveLimits(overrides);
 	const input = await openCapturedConfiguredSource(part, captured, signal);
 	let records = 0;
 	const cleanup = createCleanup();
 	try {
 		for await (const text of frameRecords(input.chunks, "jsonl", limits.maxRecordBytes, signal)) {
-			const value = launch(parseNativeRecord(text, limits, signal));
-			if (value !== void 0) return value;
+			const root = parseNativeRecord(text, limits, signal);
+			inspector.inspect(root);
+			const identity = inspector.current();
+			const value = launch(root);
+			if (identity.sessionId !== null && adapter.identityRecord?.(root) !== false && value !== void 0) return value;
 			records += 1;
 		}
 		return;
@@ -3973,11 +3980,11 @@ function configuredSelection(selection, treatment) {
 	if (modes !== void 0 && !object(modes)) return fail("ARTIFACT_INVALID_APPROVAL");
 	const guardians = new Set(selection.diagnostics.filter((diagnostic) => diagnostic.code === "guardian-excluded").map((diagnostic) => diagnostic.nodeId));
 	if (cleanup.ref.id === "native-evidence") {
-		if (selection.omitRecord && guardians.has(void 0)) return selection;
+		if (selection.omitRecord && (guardians.has(void 0) || selection.diagnostics.some((item) => item.code === "unsupported-native-shape"))) return selection;
 		return {
 			diagnostics: selection.diagnostics,
 			edits: selection.edits.map((edit) => {
-				if (guardians.has(edit.nodeId)) return edit;
+				if (guardians.has(edit.nodeId) || edit.alwaysApply && edit.role === "derived") return edit;
 				const { replacement: _replacement, retainAs: _retainAs, replacementOrigin, replacementSourceRanges: _replacementSourceRanges, replacementTargetRanges: _replacementTargetRanges, ...original } = edit;
 				return {
 					...original,
@@ -4729,6 +4736,277 @@ function createInspectionProcessor(processing) {
 	} };
 }
 //#endregion
+//#region packages/artifact/src/agent-sources/model.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function record(value) {
+	return isRecord(value) ? value : {};
+}
+function publicName(value) {
+	return typeof value === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,199}$/.test(value);
+}
+function repository(value) {
+	if (typeof value !== "string") return false;
+	const segments = value.split("/");
+	return segments.length === 2 && segments.every((part) => part.length <= 100 && agentSourcePathSegment(part));
+}
+function repoPath(value) {
+	return value.length <= 500 && value.split("/").every(agentSourcePathSegment);
+}
+//#endregion
+//#region packages/artifact/src/agent-sources/mcp.ts
+/** Only direct npx invocation has npm provenance; never preserve its arguments. */
+function npmPackage(value) {
+	const entry = record(value);
+	if (entry["command"] !== "npx" || entry["url"] !== void 0 || entry["type"] !== void 0 && entry["type"] !== "stdio") return void 0;
+	const args = entry["args"];
+	if (!Array.isArray(args) || !args.every((arg) => typeof arg === "string")) return void 0;
+	if (args.some((arg) => /registry|userconfig/i.test(arg)) || Object.keys(record(entry["env"])).some((key) => /registry|userconfig/i.test(key))) return void 0;
+	let position = 0;
+	while (args[position] === "-y" || args[position] === "--yes" || args[position] === "--no") position++;
+	const candidate = args[position];
+	if (candidate === void 0) return void 0;
+	const name = /^((?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)(?:@[a-zA-Z0-9][a-zA-Z0-9._~^*-]*)?$/.exec(candidate)?.[1];
+	return name !== void 0 && name.length <= 214 ? name : void 0;
+}
+function mcpCandidates(value, names) {
+	const output = [];
+	for (const [name, entry] of Object.entries(record(value)).slice(0, 500)) {
+		if (!publicName(name) || !names.has(name)) continue;
+		const packageName = npmPackage(entry);
+		if (packageName) output.push({
+			kind: "mcp",
+			name,
+			source: {
+				type: "npm",
+				package: packageName
+			}
+		});
+	}
+	return output;
+}
+//#endregion
+//#region packages/artifact/src/agent-sources/read.ts
+/** Optional enrichment treats missing, malformed and unreadable config as omissions. */
+async function readText(path) {
+	try {
+		const file = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+		try {
+			const info = await file.stat();
+			if (!info.isFile() || info.size > 1048576) return void 0;
+			const buffer = Buffer.alloc(1048577);
+			const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+			return bytesRead <= 1048576 ? buffer.subarray(0, bytesRead).toString("utf8") : void 0;
+		} finally {
+			await file.close();
+		}
+	} catch {
+		return;
+	}
+}
+async function readJson(path) {
+	const text = await readText(path);
+	if (text === void 0) return void 0;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region packages/artifact/src/agent-sources/plugins.ts
+async function skillsAt(root) {
+	try {
+		const entries = await readdir(join(root, "skills"), { withFileTypes: true });
+		const result = [];
+		for (const entry of entries.slice(0, 500)) {
+			if (!entry.isDirectory() || !repoPath(entry.name)) continue;
+			const path = `skills/${entry.name}/SKILL.md`;
+			const text = await readText(join(root, path));
+			const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text ?? "")?.[1];
+			const name = /^name:\s*["']?([a-zA-Z0-9][a-zA-Z0-9_.:-]*)["']?\s*$/m.exec(frontmatter ?? "")?.[1];
+			if (name && publicName(name)) result.push({
+				name,
+				path
+			});
+		}
+		return result;
+	} catch {
+		return [];
+	}
+}
+async function pluginCandidates(home, workspacePath, skills, mcps) {
+	const base = join(home, ".claude", "plugins");
+	const installed = record(record(await readJson(join(base, "installed_plugins.json")))["plugins"]);
+	const marketplaces = record(await readJson(join(base, "known_marketplaces.json")));
+	const personalAndProject = new Set((await Promise.all([skillsAt(join(home, ".claude")), skillsAt(join(workspacePath, ".claude"))])).flat().map((skill) => skill.name));
+	const definitions = /* @__PURE__ */ new Map();
+	const bareCandidates = /* @__PURE__ */ new Set();
+	const output = [];
+	for (const [key, entries] of Object.entries(installed).slice(0, 128)) {
+		const [plugin, marketplace, extra] = key.split("@");
+		if (!plugin || !marketplace || extra !== void 0 || !publicName(plugin)) continue;
+		const market = record(marketplaces[marketplace]);
+		const marketSource = record(market["source"]);
+		const location = market["installLocation"];
+		const catalog = typeof location === "string" ? record(await readJson(join(location, ".claude-plugin", "marketplace.json")))["plugins"] : void 0;
+		const catalogEntry = Array.isArray(catalog) ? catalog.find((item) => record(item)["name"] === plugin) : void 0;
+		const descriptor = record(catalogEntry);
+		const source = record(descriptor["source"]);
+		const relativeSource = descriptor["source"];
+		const prefix = typeof relativeSource === "string" && relativeSource.startsWith("./") && repoPath(relativeSource.slice(2)) ? relativeSource.slice(2) : void 0;
+		const repo = source["source"] === "github" ? source["repo"] : catalogEntry !== void 0 && (relativeSource === void 0 || prefix !== void 0) && (marketSource["source"] === void 0 || marketSource["source"] === "github") ? marketSource["repo"] : void 0;
+		if (!Array.isArray(entries)) continue;
+		const rank = (value) => {
+			const entry = record(value);
+			const scope = entry["scope"];
+			if (scope === "local" || scope === "project") {
+				const projectPath = entry["projectPath"];
+				if (typeof projectPath !== "string" || resolve(projectPath) !== resolve(workspacePath)) return -1;
+				return scope === "local" ? 3 : 2;
+			}
+			return scope === void 0 || scope === "user" ? 1 : -1;
+		};
+		const selected = entries.slice(0, 8).filter((entry) => rank(entry) >= 0).sort((left, right) => rank(right) - rank(left)).slice(0, 1);
+		for (const raw of selected) {
+			const entry = record(raw);
+			const root = entry["installPath"];
+			if (typeof root !== "string") continue;
+			const pluginMcp = record(await readJson(join(root, ".mcp.json")));
+			const servers = record(pluginMcp["mcpServers"] ?? pluginMcp);
+			output.push(...mcpCandidates(servers, mcps));
+			for (const [server, configuration] of Object.entries(servers).slice(0, 500)) {
+				const alias = `plugin_${plugin}_${server}`;
+				if (mcps.has(alias)) output.push(...mcpCandidates({ [alias]: configuration }, mcps));
+			}
+			const directSource = record(entry["source"]);
+			const candidateRepo = directSource["source"] === "github" ? directSource["repo"] : entry["source"] === void 0 ? repo : void 0;
+			const installedSkills = await skillsAt(root);
+			for (const skill of installedSkills) {
+				const owners = definitions.get(skill.name) ?? /* @__PURE__ */ new Set();
+				owners.add(key);
+				definitions.set(skill.name, owners);
+			}
+			if (!repository(candidateRepo)) continue;
+			const commit = entry["gitCommitSha"];
+			for (const skill of installedSkills) for (const name of [`${plugin}:${skill.name}`, skill.name]) {
+				if (!skills.has(name)) continue;
+				const path = directSource["source"] === "github" || source["source"] === "github" ? skill.path : prefix ? `${prefix}/${skill.path}` : void 0;
+				const candidate = {
+					kind: "skill",
+					name,
+					source: {
+						type: "github",
+						repo: candidateRepo,
+						...path === void 0 ? {} : { path },
+						...typeof commit === "string" && /^[a-fA-F0-9]{40}$/.test(commit) ? { commit } : {}
+					}
+				};
+				output.push(candidate);
+				if (name === skill.name) bareCandidates.add(candidate);
+			}
+		}
+	}
+	return output.filter((item) => !bareCandidates.has(item) || definitions.get(item.name)?.size === 1 && !personalAndProject.has(item.name)).slice(0, 500);
+}
+//#endregion
+//#region packages/artifact/src/agent-sources/index.ts
+/** Collection-time candidates stay local until anonymous upload-time admission. */
+async function collectAgentSourceCandidates(options) {
+	const skills = new Set(options.skills.slice(0, 500));
+	const mcps = new Set(options.mcps.slice(0, 500));
+	if (skills.size === 0 && mcps.size === 0) return [];
+	const output = [];
+	if (options.harness !== "codex") {
+		const user = record(await readJson(join(options.userHome, ".claude.json")));
+		const project = record(await readJson(join(options.workspacePath, ".mcp.json")));
+		const local = record(record(user["projects"])[options.workspacePath]);
+		const servers = {
+			...record(user["mcpServers"]),
+			...record(project["mcpServers"]),
+			...record(local["mcpServers"])
+		};
+		const plugins = await pluginCandidates(options.userHome, options.workspacePath, skills, mcps);
+		output.push(...plugins.filter((item) => item.kind !== "mcp" || !(item.name in servers)));
+		output.push(...mcpCandidates(servers, mcps));
+	}
+	const toml = options.harness === "claude" ? void 0 : await readText(join(options.userHome, ".codex", "config.toml"));
+	if (toml !== void 0) try {
+		output.push(...mcpCandidates(record(parse(toml))["mcp_servers"], mcps));
+	} catch {}
+	const customRegistry = (await Promise.all([readText(join(options.workspacePath, ".npmrc")), readText(join(options.userHome, ".npmrc"))])).some((text) => text?.split(/\r?\n/u).some((line) => /^\s*(?:@[^:=\s]+:)?registry\s*=/iu.test(line)));
+	const privateTerms = [basename(options.userHome), ...options.customTerms ?? []].map((term) => term.normalize("NFC").toLowerCase()).filter(Boolean);
+	const admitted = output.filter((item) => !(customRegistry && item.source.type === "npm") && ![item.name, ...item.source.type === "github" ? [item.source.repo, item.source.path ?? ""] : [item.source.package]].some((value) => privateTerms.some((term) => value.normalize("NFC").toLowerCase().includes(term))));
+	return [...new Map(admitted.map((item) => [`${item.kind}:${item.name}`, item])).values()].slice(0, 500);
+}
+//#endregion
+//#region packages/artifact/src/configured/session/agent-sources.ts
+/** Recognized call positions only: arbitrary prose and tool results never establish usage. */
+function createAgentSourceCollector(harness) {
+	const skills = /* @__PURE__ */ new Set();
+	const mcps = /* @__PURE__ */ new Set();
+	const add = (set, name) => {
+		if (name && set.size < 500 && /^[A-Za-z0-9_][A-Za-z0-9_.:-]{0,199}$/u.test(name)) set.add(name);
+	};
+	const mcp = (name) => {
+		if (!name?.startsWith("mcp__")) return;
+		const server = name.slice(5).split("__")[0];
+		if (server && /^[A-Za-z0-9_-]+$/u.test(server)) add(mcps, server);
+	};
+	return {
+		add(root) {
+			const type = nativeText(nativeField(root, "type"));
+			if (harness === "claude" && type === "assistant") {
+				const message = nativeField(root, "message");
+				const role = nativeText(nativeField(message, "role"));
+				if (role !== void 0 && role !== "assistant") return;
+				for (const item of nativeItems(nativeField(message, "content"))) {
+					if (nativeText(nativeField(item, "type")) !== "tool_use") continue;
+					const name = nativeText(nativeField(item, "name"));
+					if (name === "Skill") add(skills, nativeText(nativeField(nativeField(item, "input"), "skill")));
+					else mcp(name);
+				}
+			}
+			if (harness === "codex") {
+				const payload = nativeField(root, "payload");
+				const payloadType = nativeText(nativeField(payload, "type"));
+				if (type === "response_item" && payloadType === "function_call") {
+					mcp(nativeText(nativeField(payload, "name")));
+					mcp(nativeText(nativeField(payload, "namespace")));
+				}
+				if (type === "event_msg" && payloadType === "mcp_tool_call_begin") add(mcps, nativeText(nativeField(nativeField(payload, "invocation"), "server")));
+			}
+		},
+		names: () => ({
+			skills: [...skills],
+			mcps: [...mcps]
+		})
+	};
+}
+async function collectSessionAgentSources(request, names) {
+	const userHome = request.processing.environment.userHome;
+	if (!userHome || !request.workspace.path || names.skills.length === 0 && names.mcps.length === 0) return [];
+	try {
+		const candidates = await collectAgentSourceCandidates({
+			userHome,
+			harness: request.session.harness,
+			customTerms: request.processing.customTerms?.terms ?? [],
+			workspacePath: request.workspace.path,
+			...names
+		});
+		const items = [];
+		for (const candidate of candidates) {
+			const parsed = agentSourceSchema.safeParse(candidate);
+			if (parsed.success) items.push(parsed.data);
+		}
+		return items.slice(0, 500);
+	} catch {
+		console.error("AGENT_SOURCES_COLLECTION_UNAVAILABLE");
+		return [];
+	}
+}
+//#endregion
 //#region packages/artifact/src/configured/masks/text.ts
 /** Generated title input is local metadata, not an asserted location inside a captured native row. */
 function titleMasks(input, output) {
@@ -4928,8 +5206,12 @@ async function prepareConfiguredSession(request) {
 		const metadata = metadataRoot(request, owner.limits);
 		const gitIdentity = await prepareGit(request, owner.signal, owner.preparation);
 		const agentSetup = request.collectAgentSetup ? createAgentSetupCollector(request) : void 0;
+		const agentSources = request.collectAgentSetup ? createAgentSourceCollector(request.session.harness) : void 0;
 		let images = 0;
-		const snapshots = await prepareSources(request, owner, metadata, agentSetup?.add, (count) => {
+		const snapshots = await prepareSources(request, owner, metadata, (root) => {
+			agentSetup?.add(root);
+			agentSources?.add(root);
+		}, (count) => {
 			images += count;
 		});
 		owner.seal();
@@ -4996,6 +5278,7 @@ async function prepareConfiguredSession(request) {
 						...processedMetadata.masks === void 0 ? {} : { metadataMasks: processedMetadata.masks },
 						sources: Object.freeze(sources),
 						agentSetup: Object.freeze(setup),
+						...agentSources ? { agentSources: await collectSessionAgentSources(request, agentSources.names()) } : {},
 						images
 					});
 					await owner.close();
@@ -5019,10 +5302,10 @@ async function prepareConfiguredSession(request) {
 //#region packages/artifact/src/collection/producer/session-metadata.ts
 /** Validate the session-only shape already projected before configured processing. */
 function sessionMetadata(metadata) {
-	const root = record(strictJson(metadata, metadataLimitBytes));
+	const root = record$1(strictJson(metadata, metadataLimitBytes));
 	keys(root, ["version", "session"]);
 	literal(root["version"], 3);
-	const session = record(root["session"]);
+	const session = record$1(root["session"]);
 	const compact = JSON.stringify({
 		version: 3,
 		session
@@ -5629,7 +5912,7 @@ function boundedHash(value) {
 	return result;
 }
 function parseIdentityMap(value) {
-	const input = record(value);
+	const input = record$1(value);
 	keys(input, [
 		"format",
 		"formatVersion",
@@ -5638,7 +5921,7 @@ function parseIdentityMap(value) {
 	]);
 	const bundleId = string(input["bundleId"]);
 	validBundleId(bundleId);
-	const workspace = record(input["workspace"]);
+	const workspace = record$1(input["workspace"]);
 	keys(workspace, [
 		"path",
 		"pathHash",
@@ -5652,7 +5935,7 @@ function parseIdentityMap(value) {
 	if (!Array.isArray(rawRemotes)) return fail("ARTIFACT_INVALID_MANIFEST");
 	if (rawRemotes.length > maximumRemotes) fail("ARTIFACT_METADATA_LIMIT");
 	const remotes = rawRemotes.map((entry) => {
-		const remote = record(entry);
+		const remote = record$1(entry);
 		keys(remote, ["url", "hash"]);
 		return {
 			url: boundedLocator(remote["url"]),
@@ -6359,7 +6642,7 @@ const pointer$3 = (value) => {
 	return text;
 };
 const range$2 = (value) => {
-	const v = record(value);
+	const v = record$1(value);
 	keys(v, ["start", "end"]);
 	const start = integer(v["start"]), end = integer(v["end"]);
 	if (end <= start) fail("ARTIFACT_INVALID_MANIFEST");
@@ -6385,7 +6668,7 @@ function rowRanges(value, fields) {
 	});
 }
 function mask(value) {
-	const v = record(value);
+	const v = record$1(value);
 	keys(v, [
 		"inputRange",
 		"outputRange",
@@ -6394,9 +6677,9 @@ function mask(value) {
 		"node",
 		"ruleId"
 	]);
-	const node = record(v["node"]);
+	const node = record$1(v["node"]);
 	keys(node, ["id", "version"]);
-	const output = record(v["outputRange"]);
+	const output = record$1(v["outputRange"]);
 	keys(output, ["start", "end"]);
 	const start = integer(output["start"]), end = integer(output["end"]);
 	const replacement = string(v["replacement"]);
@@ -6417,7 +6700,7 @@ function mask(value) {
 	};
 }
 function field(value) {
-	const v = record(value);
+	const v = record$1(value);
 	keys(v, [
 		"pointer",
 		"cleanedPointer",
@@ -6460,7 +6743,7 @@ function field(value) {
 	return result;
 }
 function parsePrivateReviewRow(text) {
-	const v = record(strictJson(text, 67108864));
+	const v = record$1(strictJson(text, 67108864));
 	keys(v, [
 		"entryPath",
 		"recordIndex",
@@ -6486,7 +6769,7 @@ function parsePrivateReviewRow(text) {
 	};
 }
 function parsePrivateReviewManifest(text, entries, primary) {
-	const v = record(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	const v = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
 	keys(v, [
 		"format",
 		"version",
@@ -6496,11 +6779,11 @@ function parsePrivateReviewManifest(text, entries, primary) {
 		"entries",
 		"rows"
 	]);
-	const bound = record(v["primary"]);
+	const bound = record$1(v["primary"]);
 	keys(bound, ["sha256", "archiveBytes"]);
 	if (v["bundleId"] !== primary.manifest.bundleId || v["workId"] !== primary.manifest.work.id || bound["sha256"] !== primary.sha256 || bound["archiveBytes"] !== primary.archiveBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
 	const descriptions = array(v["entries"], (value) => {
-		const e = record(value);
+		const e = record$1(value);
 		keys(e, [
 			"entryPath",
 			"kind",
@@ -7727,7 +8010,7 @@ function createMaskContexts() {
 		/** Resolves a stored context of the next row read; a reference must name an earlier one. */
 		read(row, inputSha256, value) {
 			enter(row);
-			const data = record(value);
+			const data = record$1(value);
 			const start = integer(data["start"]);
 			if (!Object.hasOwn(data, "text")) {
 				keys(data, ["start", "end"]);
@@ -7755,7 +8038,7 @@ const hash$3 = (value) => {
 	return text;
 };
 const range$1 = (value) => {
-	const data = record(value);
+	const data = record$1(value);
 	keys(data, ["start", "end"]);
 	const start = integer(data["start"]);
 	const end = integer(data["end"]);
@@ -7772,7 +8055,7 @@ const pointer$2 = (value) => {
 };
 /** Parses one row in ledger order; `contexts` resolves context references (ADR 0084). */
 function parsePrivateMaskRow(text, contexts) {
-	const row = record(strictJson(text, 33554432));
+	const row = record$1(strictJson(text, 33554432));
 	keys(row, [
 		"entryPath",
 		"recordIndex",
@@ -7781,7 +8064,7 @@ function parsePrivateMaskRow(text, contexts) {
 		"archiveSessionId",
 		"mask"
 	]);
-	const item = record(row["mask"]);
+	const item = record$1(row["mask"]);
 	keys(item, [
 		"inputRange",
 		"outputRange",
@@ -7798,7 +8081,7 @@ function parsePrivateMaskRow(text, contexts) {
 		"outputSha256",
 		"context"
 	]);
-	const node = record(item["node"]);
+	const node = record$1(item["node"]);
 	keys(node, ["id", "version"]);
 	const entryPath = string(row["entryPath"]);
 	const recordIndex = integer(row["recordIndex"]);
@@ -7843,7 +8126,7 @@ function parsePrivateMaskRow(text, contexts) {
 	};
 }
 function parsePrivateMaskManifest(text, entries, primary) {
-	const data = record(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	const data = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
 	keys(data, [
 		"format",
 		"version",
@@ -7854,11 +8137,11 @@ function parsePrivateMaskManifest(text, entries, primary) {
 		"entries",
 		"rows"
 	]);
-	const binding = record(data["primary"]);
+	const binding = record$1(data["primary"]);
 	keys(binding, ["sha256", "archiveBytes"]);
 	if (data["bundleId"] !== primary.manifest.bundleId || data["workId"] !== primary.manifest.work.id || binding["sha256"] !== primary.sha256 || binding["archiveBytes"] !== primary.archiveBytes) return fail("ARTIFACT_PROCESSING_MISMATCH");
 	const descriptions = array(data["entries"], (value) => {
-		const entry = record(value);
+		const entry = record$1(value);
 		keys(entry, [
 			"entryPath",
 			"kind",
@@ -7925,7 +8208,7 @@ function maskHash(value) {
 	return text;
 }
 function maskRange(value) {
-	const data = record(value);
+	const data = record$1(value);
 	keys(data, ["start", "end"]);
 	const result = {
 		start: integer(data["start"]),
@@ -7940,7 +8223,7 @@ function pointer$1(value) {
 	return text;
 }
 function semantic(value, scope, contexts) {
-	const data = record(value);
+	const data = record$1(value);
 	keys(data, [
 		"pointer",
 		"inputSha256",
@@ -7967,7 +8250,7 @@ function semantic(value, scope, contexts) {
 }
 /** Parses one row in ledger order; `contexts` resolves static context references (ADR 0084). */
 function parseFinalMaskRow(text, contexts) {
-	const data = record(strictJson(text, 33554432));
+	const data = record$1(strictJson(text, 33554432));
 	keys(data, [
 		"entryPath",
 		"recordIndex",
@@ -7982,7 +8265,7 @@ function parseFinalMaskRow(text, contexts) {
 	const subject = data["subject"];
 	if (subject !== "key" && subject !== "value") return fail("ARTIFACT_INVALID_MANIFEST");
 	const contributors = array(data["contributors"], (value) => {
-		const item = record(value);
+		const item = record$1(value);
 		keys(item, [
 			"id",
 			"kind",
@@ -8031,7 +8314,7 @@ function parseFinalMaskRow(text, contexts) {
 //#endregion
 //#region packages/artifact/src/configured/masks/final/manifest.ts
 function categories(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"identity",
 		"credentials",
@@ -8046,7 +8329,7 @@ function categories(value) {
 	};
 }
 function maskSummary(value) {
-	const data = record(value);
+	const data = record$1(value);
 	keys(data, [
 		"occurrences",
 		"contributors",
@@ -8064,7 +8347,7 @@ function maskSummariesEqual(a, b) {
 	return a.occurrences === b.occurrences && a.contributors === b.contributors && a.categories.identity === b.categories.identity && a.categories.credentials === b.categories.credentials && a.categories.internal === b.categories.internal && a.categories.private === b.categories.private;
 }
 function parseFinalMaskManifest(text, entries, primary) {
-	const data = record(strictJson(text, manifestLimitBytes, manifestNodeLimit));
+	const data = record$1(strictJson(text, manifestLimitBytes, manifestNodeLimit));
 	keys(data, [
 		"format",
 		"version",
@@ -8078,13 +8361,13 @@ function parseFinalMaskManifest(text, entries, primary) {
 		"entries",
 		"summary"
 	]);
-	const binding = record(data["primary"]);
+	const binding = record$1(data["primary"]);
 	keys(binding, ["sha256", "archiveBytes"]);
 	if (data["bundleId"] !== primary.manifest.bundleId || data["workId"] !== primary.manifest.work.id || binding["sha256"] !== primary.sha256 || binding["archiveBytes"] !== primary.archiveBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
 	const expected = new Set(primary.manifest.entries.map((entry) => `${entry.entryPath}.masks.jsonl`));
 	let total = emptyMaskSummary();
 	const descriptions = array(data["entries"], (value) => {
-		const row = record(value);
+		const row = record$1(value);
 		keys(row, [
 			"entryPath",
 			"kind",
@@ -8950,7 +9233,7 @@ async function rewriteConfiguredOutput(request, handle, signal = new AbortContro
 			archiveBytes: primaryResult.archiveBytes
 		};
 		const finalMaskLedger = await masks?.finish(changed, finalPrimary, { rows: request.shards === void 0 });
-		const companionValue = record(strictJson(companion.manifestText, manifestLimitBytes, manifestNodeLimit));
+		const companionValue = record$1(strictJson(companion.manifestText, manifestLimitBytes, manifestNodeLimit));
 		const companionEntries = [];
 		for (const description of array(companionValue["entries"], parseConfiguredEntry)) {
 			const entry = companion.entries.get(description.entryPath) ?? fail("ARTIFACT_INVALID_ARCHIVE");
@@ -10304,7 +10587,7 @@ function validateCollectionIndex(index) {
 const maximumCollectionIndexBytes = 16777216;
 const maximumCollectionNodes = 1e6;
 function source(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"sourceId",
 		"sourceOrdinal",
@@ -10317,7 +10600,7 @@ function source(value) {
 	};
 }
 function session(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"sessionId",
 		"scopeOrdinal",
@@ -10338,7 +10621,7 @@ function session(value) {
 	};
 }
 function parseCollectionWorkspaceSummary(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"format",
 		"formatVersion",
@@ -10355,7 +10638,7 @@ function parseCollectionWorkspaceSummary(value) {
 	};
 }
 function parseCompanionDescriptor(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"path",
 		"archiveBytes",
@@ -10368,7 +10651,7 @@ function parseCompanionDescriptor(value) {
 	};
 }
 function bundle(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"workspaceSlot",
 		"workspaceVersion",
@@ -10403,7 +10686,7 @@ function bundle(value) {
 	};
 }
 function sourceScope(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, ["applicationSessionId", "sourceId"]);
 	return {
 		applicationSessionId: string(item["applicationSessionId"]),
@@ -10411,7 +10694,7 @@ function sourceScope(value) {
 	};
 }
 function exclusion(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"applicationSessionId",
 		"sourceId",
@@ -10426,7 +10709,7 @@ function exclusion(value) {
 	};
 }
 function sessionBinding(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"applicationSessionId",
 		"bundleId",
@@ -10441,7 +10724,7 @@ function sessionBinding(value) {
 	};
 }
 function sourceBinding(value) {
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"applicationSessionId",
 		"sourceId",
@@ -10467,7 +10750,7 @@ function parseCollectionIndex(text) {
 		if (error instanceof Error && error.message === "ARTIFACT_METADATA_LIMIT") fail("ARTIFACT_INDEX_LIMIT", { cause: error });
 		throw error;
 	}
-	const item = record(value);
+	const item = record$1(value);
 	keys(item, [
 		"format",
 		"formatVersion",
@@ -10563,7 +10846,7 @@ function measured(value, copy) {
 		reasonCode: value.reasonCode
 	};
 }
-function patch(value) {
+function patch$1(value) {
 	return {
 		grammarVersion: value.grammarVersion,
 		basis: value.basis,
@@ -10582,7 +10865,7 @@ function fact(value) {
 		extractorVersion: value.extractorVersion,
 		...value.decodedUtf8Bytes === void 0 ? {} : { decodedUtf8Bytes: measured(value.decodedUtf8Bytes, (number) => number) },
 		...value.logicalLines === void 0 ? {} : { logicalLines: measured(value.logicalLines, (number) => number) },
-		...value.patchDelta === void 0 ? {} : { patchDelta: measured(value.patchDelta, patch) }
+		...value.patchDelta === void 0 ? {} : { patchDelta: measured(value.patchDelta, patch$1) }
 	};
 }
 function relation(value) {
@@ -10710,7 +10993,7 @@ function pointer(value) {
 	return result;
 }
 function parseInputField(value) {
-	const v = record(value);
+	const v = record$1(value);
 	keys(v, [
 		"fieldId",
 		"sourceFieldId",
@@ -10732,13 +11015,13 @@ function parseInputField(value) {
 	if (scalarKind !== void 0 && scalarKind !== "literal" && scalarKind !== "structure" && scalarKind !== "container") return fail("ARTIFACT_INVALID_MANIFEST");
 	const text = string(v["text"]), fieldHash = digest(v["fieldHash"]);
 	if (!text.length || hash$1(text) !== fieldHash) fail("ARTIFACT_PROCESSING_MISMATCH");
-	const c = v["cleanedRange"] === void 0 ? void 0 : record(v["cleanedRange"]);
+	const c = v["cleanedRange"] === void 0 ? void 0 : record$1(v["cleanedRange"]);
 	if (c) keys(c, ["start", "end"]);
 	const cleanedRange = c ? {
 		start: integer(c["start"]),
 		end: integer(c["end"])
 	} : void 0;
-	const r = v["originalRange"] === void 0 ? void 0 : record(v["originalRange"]);
+	const r = v["originalRange"] === void 0 ? void 0 : record$1(v["originalRange"]);
 	if (r) keys(r, ["start", "end"]);
 	const range = r ? {
 		start: integer(r["start"]),
@@ -11108,6 +11391,7 @@ async function runConfiguredSessionJob(job, processing, signal, onSourceProgress
 			parts,
 			entries,
 			agentSetup: completed.agentSetup,
+			...completed.agentSources === void 0 ? {} : { agentSources: completed.agentSources },
 			images: completed.images
 		};
 	} catch (error) {
@@ -12748,10 +13032,11 @@ async function admitConfiguredSources(approval, processing, signal, hooks, isola
 				const adapter = processing.adapters[session.harness];
 				const launch = adapter.launch;
 				let launchKnown = false;
-				const observe = launch && ((root) => {
-					if (launchKnown) return;
+				const observe = launch && ((root, identity) => {
+					if (launchKnown || identity.sessionId === null || adapter.identityRecord?.(root) === false) return;
 					const value = launch(root);
-					launchKnown = value !== void 0;
+					if (value === void 0) return;
+					launchKnown = true;
 					if (value === "interactive") interactive.add(id);
 					if (value === "automation" && assessedOnly.has(session.id)) automated.add(id);
 				});
@@ -15316,6 +15601,7 @@ async function runConfiguredScanJob(job, processing, signal, onSourceProgress, o
 		requireCurrentCleanup(job.cleanup);
 		const owner = createOwner(request);
 		const buffered = [];
+		const toleratedDrift = /* @__PURE__ */ new Map();
 		const verified = /* @__PURE__ */ new Map();
 		let bufferedUtf16 = 0, mainRecords = 0, emptyEligible = true;
 		try {
@@ -15337,6 +15623,12 @@ async function runConfiguredScanJob(job, processing, signal, onSourceProgress, o
 				const inspector = adapter.source(source.source);
 				const input = await owner.open(source);
 				let ordinal = 0;
+				let identitySeen = false;
+				const tolerate = (shape) => {
+					const counts = toleratedDrift.get(source.id) ?? {};
+					counts[shape] = (counts[shape] ?? 0) + 1;
+					toleratedDrift.set(source.id, counts);
+				};
 				let reading = true;
 				try {
 					for await (const record of roots(input, owner.limits, owner.signal)) {
@@ -15346,7 +15638,15 @@ async function runConfiguredScanJob(job, processing, signal, onSourceProgress, o
 						const original = retain(root);
 						const annotations = adapter.annotations(root, nativeOptions, original);
 						prepareOriginals(root, original, annotations, owner.preparation, owner.limits, owner.signal);
-						if (adapter.mainProseComplete?.(root, original) !== true || adapter.launch?.(root) === "automation") fail("ARTIFACT_PROCESSING_UNSUPPORTED");
+						if (adapter.mainProseComplete?.(root, original, tolerate) !== true) fail("ARTIFACT_PROCESSING_UNSUPPORTED");
+						const native = inspector.current();
+						const launch = adapter.launch?.(root);
+						const identityRecord = native.sessionId !== null && adapter.identityRecord?.(root) !== false && launch !== void 0;
+						if (launch === "automation") {
+							if (!identitySeen && identityRecord) fail("ARTIFACT_PROCESSING_UNSUPPORTED");
+							tolerate("launch");
+						}
+						identitySeen ||= identityRecord;
 						const id = recordId(source.id, capture.facts, ordinal);
 						const projection = projectNativeReviewInput({
 							root,
@@ -15467,8 +15767,18 @@ async function runConfiguredScanJob(job, processing, signal, onSourceProgress, o
 				input: {
 					...metadataRow,
 					file: await fields.finish()
-				}
+				},
+				toleratedDrift: [...toleratedDrift].map(([sourceId, driftCounts]) => ({
+					sourceId,
+					count: Object.values(driftCounts).reduce((sum, count) => sum + count, 0),
+					driftCounts
+				}))
 			};
+			for (const { sourceId, driftCounts } of result.toleratedDrift ?? []) processing.onAnomaly?.({
+				code: "tolerated-harness-drift",
+				sourceId,
+				driftCounts
+			});
 			success = true;
 			return result;
 		} finally {
@@ -15588,6 +15898,17 @@ async function scanPreparedSession(production, sessionId, directory, hooks, canc
 			const capture = captures.find((row) => row.partId === source.source.id);
 			if (capture && JSON.stringify(actual.facts) !== JSON.stringify(capture.facts)) fail("ARTIFACT_SOURCE_CHANGED");
 		}
+		const drift = settled.toleratedDrift ?? [];
+		if (parallel && parallel.size > 1) for (const { sourceId, driftCounts } of drift) production.processing.onAnomaly?.({
+			code: "tolerated-harness-drift",
+			sourceId,
+			driftCounts
+		});
+		hooks.onTiming?.({
+			scope: "preparation",
+			phases: {},
+			volumes: { scanToleratedDrift: drift.reduce((sum, row) => sum + row.count, 0) }
+		});
 		return settled;
 	} catch (error) {
 		const id = error instanceof SessionWorkerError ? error.sourceId : recordSourceId(error);
@@ -15613,7 +15934,7 @@ function hash(value) {
 	return text;
 }
 function range(value) {
-	const v = record(value);
+	const v = record$1(value);
 	keys(v, ["start", "end"]);
 	const start = integer(v["start"]), end = integer(v["end"]);
 	if (end <= start) fail("ARTIFACT_PROCESSING_MISMATCH");
@@ -15634,7 +15955,7 @@ function rowIdentity(v, input) {
 	};
 }
 function parseSessionScanRow(value, input) {
-	const v = record(value);
+	const v = record$1(value);
 	keys(v, [
 		"sourceId",
 		"ordinal",
@@ -15644,7 +15965,7 @@ function parseSessionScanRow(value, input) {
 	const { sourceId, ordinal, id, source } = rowIdentity(v, input);
 	const ids = /* @__PURE__ */ new Set();
 	const fields = array(v["fields"], (item) => {
-		const { sessionId, sourceId: fieldSource, ordinal: fieldOrdinal, recordId: fieldRecord, protectedRanges, ...plain } = record(item);
+		const { sessionId, sourceId: fieldSource, ordinal: fieldOrdinal, recordId: fieldRecord, protectedRanges, ...plain } = record$1(item);
 		const field = parseInputField(plain);
 		if (!source || source.native.role !== "main" || sessionId !== input.sessionId || fieldSource !== sourceId || fieldOrdinal !== ordinal || fieldRecord !== id || field.role === "tool-output" || field.scalarKind !== void 0 || ids.has(field.fieldId) || !field.sourceFieldId.startsWith(`${id}-f`)) fail("ARTIFACT_PROCESSING_MISMATCH");
 		const node = field.sourceFieldId.slice(`${id}-f`.length);
@@ -15671,20 +15992,20 @@ function parseSessionScanRow(value, input) {
 	};
 }
 function scanFile(value) {
-	const file = record(value);
+	const file = record$1(value);
 	keys(file, [
 		"path",
 		"identity",
 		"sha256",
 		"byteLength"
 	]);
-	const identity = record(file["identity"]);
+	const identity = record$1(file["identity"]);
 	keys(identity, ["dev", "ino"]);
 	if (!string(file["path"]) || !string(identity["dev"]) || !string(identity["ino"]) || integer(file["byteLength"]) > maximumPartBytes) fail("ARTIFACT_PROCESSING_MISMATCH");
 	hash(file["sha256"]);
 }
 function validateSessionScanInput(input) {
-	keys(record(input), [
+	keys(record$1(input), [
 		"version",
 		"sessionId",
 		"emptyReviewVerified",
@@ -15701,7 +16022,7 @@ function validateSessionScanInput(input) {
 	integer(input.fieldCount);
 	integer(input.inputUtf16);
 	const sources = /* @__PURE__ */ new Set(), parts = /* @__PURE__ */ new Set();
-	for (const item of array(input.sources, record)) {
+	for (const item of array(input.sources, record$1)) {
 		keys(item, [
 			"sourceId",
 			"sourcePartId",
@@ -15712,7 +16033,7 @@ function validateSessionScanInput(input) {
 		if (!id || !part || sources.has(id) || parts.has(part) || !nativeSourceIdentitySchema.safeParse(item["native"]).success) fail("ARTIFACT_PROCESSING_MISMATCH");
 		sources.add(id);
 		parts.add(part);
-		const facts = record(item["facts"]);
+		const facts = record$1(item["facts"]);
 		keys(facts, [
 			"representation",
 			"byteLength",
@@ -15748,7 +16069,7 @@ async function* scan(handle, input, signal) {
 	const ordinals = /* @__PURE__ */ new Map();
 	for await (const value of frames(handle, input.file, signal)) {
 		if (footer) fail("ARTIFACT_PROCESSING_MISMATCH");
-		if (record(value)["kind"] === "session-scan-footer") {
+		if (record$1(value)["kind"] === "session-scan-footer") {
 			const { file: _file, ...descriptor } = input;
 			if (!isDeepStrictEqual(value, {
 				kind: "session-scan-footer",
@@ -16174,7 +16495,7 @@ function createWorkPieces() {
 			const occurrences = /* @__PURE__ */ new Map();
 			for (const { field, row } of fields) for (const spec of cut(fieldOutline(field), repeated)) {
 				if (taken.has(spec.id)) continue;
-				const text = field.text.slice(spec.utf16Start, spec.utf16End);
+				const text = Buffer.from(field.text.slice(spec.utf16Start, spec.utf16End), "utf16le").toString("utf16le");
 				if (spec.key) {
 					texts.set(spec.key, text);
 					occurrences.set(spec.key, (occurrences.get(spec.key) ?? 0) + 1);