@harness-engineering/orchestrator 0.5.0 → 0.7.0

package/dist/index.mjs

@@ -27,7 +27,7 @@ function sortCandidates(issues) {
     return comparePriority(a, b) ?? compareCreatedAt(a, b) ?? a.identifier.localeCompare(b.identifier);
   });
 }
-function isEligible(issue, state, activeStates, terminalStates) {
+function isEligible(issue, state, activeStates, terminalStates, selfAssignee) {
   if (!issue.id || !issue.identifier || !issue.title || !issue.state) {
     return false;
   }
@@ -49,6 +49,9 @@ function isEligible(issue, state, activeStates, terminalStates) {
   if (state.completed.has(issue.id)) {
     return false;
   }
+  if (selfAssignee !== void 0 && issue.assignee != null && issue.assignee !== selfAssignee) {
+    return false;
+  }
   if (normalizedState === "todo" && issue.blockedBy.length > 0) {
     const hasNonTerminalBlocker = issue.blockedBy.some((blocker) => {
       if (blocker.state === null) return true;
@@ -60,9 +63,11 @@ function isEligible(issue, state, activeStates, terminalStates) {
   }
   return true;
 }
-function selectCandidates(issues, state, activeStates, terminalStates) {
+function selectCandidates(issues, state, activeStates, terminalStates, selfAssignee) {
   const sorted = sortCandidates(issues);
-  return sorted.filter((issue) => isEligible(issue, state, activeStates, terminalStates));
+  return sorted.filter(
+    (issue) => isEligible(issue, state, activeStates, terminalStates, selfAssignee)
+  );
 }
 
 // src/core/concurrency.ts
@@ -658,7 +663,8 @@ function handleTick(state, event, config) {
     candidates,
     next,
     config.tracker.activeStates,
-    config.tracker.terminalStates
+    config.tracker.terminalStates,
+    event.selfAssignee
   );
   const escalationConfig = resolveEscalationConfig(config);
   for (const issue of eligible) {
@@ -1144,7 +1150,7 @@ var ClaimManager = class {
     const claimResult = await this.tracker.claimIssue(issueId, this.orchestratorId);
     if (!claimResult.ok) return claimResult;
     if (this.verifyDelayMs > 0) {
-      await new Promise((resolve6) => setTimeout(resolve6, this.verifyDelayMs));
+      await new Promise((resolve8) => setTimeout(resolve8, this.verifyDelayMs));
     }
     const statesResult = await this.tracker.fetchIssueStatesByIds([issueId]);
     if (!statesResult.ok) return statesResult;
@@ -1796,7 +1802,8 @@ function formatFilesList(files) {
 }
 
 // src/workflow/loader.ts
-import * as fs6 from "fs/promises";
+import * as fs7 from "fs/promises";
+import * as path7 from "path";
 import { parse } from "yaml";
 import { Ok as Ok3, Err as Err2 } from "@harness-engineering/types";
 
@@ -1804,7 +1811,8 @@ import { Ok as Ok3, Err as Err2 } from "@harness-engineering/types";
 import { z as z2 } from "zod";
 import {
   Ok as Ok2,
-  Err
+  Err,
+  STANDARD_COGNITIVE_MODES
 } from "@harness-engineering/types";
 
 // src/workflow/schema.ts
@@ -1852,16 +1860,29 @@ var BackendDefSchema = z.discriminatedUnion("type", [
     probeIntervalMs: z.number().int().min(1e3).optional()
   }).strict()
 ]);
+var RoutingValueSchema = z.union([
+  z.string().min(1),
+  z.array(z.string().min(1)).nonempty("fallback chain must contain at least one backend name").readonly()
+]);
 var RoutingConfigSchema = z.object({
-  default: z.string().min(1),
-  "quick-fix": z.string().optional(),
-  "guided-change": z.string().optional(),
-  "full-exploration": z.string().optional(),
-  diagnostic: z.string().optional(),
+  default: RoutingValueSchema,
+  "quick-fix": RoutingValueSchema.optional(),
+  "guided-change": RoutingValueSchema.optional(),
+  "full-exploration": RoutingValueSchema.optional(),
+  diagnostic: RoutingValueSchema.optional(),
   intelligence: z.object({
-    sel: z.string().optional(),
-    pesl: z.string().optional()
-  }).strict().optional()
+    sel: RoutingValueSchema.optional(),
+    pesl: RoutingValueSchema.optional()
+  }).strict().optional(),
+  // --- Spec B Phase 2: isolation block widened to RoutingValueSchema ---
+  isolation: z.object({
+    none: RoutingValueSchema.optional(),
+    container: RoutingValueSchema.optional(),
+    "remote-sandbox": RoutingValueSchema.optional()
+  }).strict().optional(),
+  // --- Spec B Phase 0: new optional maps (resolver wired in Phase 1) ---
+  skills: z.record(z.string().min(1), RoutingValueSchema).optional(),
+  modes: z.record(z.string().min(1), RoutingValueSchema).optional()
 }).strict();
 
 // src/workflow/config.ts
@@ -1870,13 +1891,17 @@ var BackendsMapSchema = z2.record(z2.string(), BackendDefSchema);
 function crossFieldRoutingIssues(backends, routing) {
   const issues = [];
   const names = new Set(Object.keys(backends));
-  const checkRef = (path19, name) => {
-    if (name !== void 0 && !names.has(name)) {
+  const checkRef = (path24, value) => {
+    if (value === void 0) return;
+    const entries = Array.isArray(value) ? value : [value];
+    entries.forEach((name, idx) => {
+      if (names.has(name)) return;
+      const pathWithIdx = Array.isArray(value) ? [...path24, String(idx)] : path24;
       issues.push({
-        path: path19,
-        message: `routing.${path19.join(".")} references unknown backend '${name}'. Defined: [${[...names].join(", ")}].`
+        path: pathWithIdx,
+        message: `routing.${pathWithIdx.join(".")} references unknown backend '${name}'. Defined: [${[...names].join(", ")}].`
       });
-    }
+    });
   };
   checkRef(["default"], routing.default);
   checkRef(["quick-fix"], routing["quick-fix"]);
@@ -1885,9 +1910,44 @@ function crossFieldRoutingIssues(backends, routing) {
   checkRef(["diagnostic"], routing.diagnostic);
   checkRef(["intelligence", "sel"], routing.intelligence?.sel);
   checkRef(["intelligence", "pesl"], routing.intelligence?.pesl);
+  checkRef(["isolation", "none"], routing.isolation?.none);
+  checkRef(["isolation", "container"], routing.isolation?.container);
+  checkRef(["isolation", "remote-sandbox"], routing.isolation?.["remote-sandbox"]);
+  if (routing.skills) {
+    for (const [skill, value] of Object.entries(routing.skills)) {
+      checkRef(["skills", skill], value);
+    }
+  }
+  if (routing.modes) {
+    for (const [mode, value] of Object.entries(routing.modes)) {
+      checkRef(["modes", mode], value);
+    }
+  }
   return issues;
 }
-function validateWorkflowConfig(config) {
+function routingWarnings(routing, knownSkillNames) {
+  const warnings = [];
+  if (knownSkillNames.length > 0 && routing.skills) {
+    const known = new Set(knownSkillNames);
+    for (const name of Object.keys(routing.skills)) {
+      if (known.has(name)) continue;
+      warnings.push(
+        `routing.skills.${name} references a skill that is not present in the local skill catalog. If this is intentional (e.g., a skill installed by a downstream consumer), this warning can be ignored.`
+      );
+    }
+  }
+  if (routing.modes) {
+    const standardModes = new Set(STANDARD_COGNITIVE_MODES);
+    for (const mode of Object.keys(routing.modes)) {
+      if (standardModes.has(mode)) continue;
+      warnings.push(
+        `routing.modes.${mode} is not in STANDARD_COGNITIVE_MODES (${[...STANDARD_COGNITIVE_MODES].join(", ")}). Custom cognitive modes are allowed but uncommon; verify this is not a typo.`
+      );
+    }
+  }
+  return warnings;
+}
+function validateWorkflowConfig(config, options = {}) {
   if (!config || typeof config !== "object")
     return Err(new Error("Config is missing or not an object"));
   const c = config;
@@ -1903,6 +1963,7 @@ function validateWorkflowConfig(config) {
   if (!hasLegacyBackend && !hasModernBackends) {
     return Err(new Error("Config must define agent.backend or agent.backends."));
   }
+  const warnings = [];
   if (hasModernBackends) {
     const backendsParsed = BackendsMapSchema.safeParse(agent.backends);
     if (!backendsParsed.success) {
@@ -1913,9 +1974,10 @@ function validateWorkflowConfig(config) {
       return Err(new Error(`agent.routing: ${routingParsed.error.message}`));
     }
     if (routingParsed.data) {
+      const routingData = routingParsed.data;
       const cross = crossFieldRoutingIssues(
         backendsParsed.data,
-        routingParsed.data
+        routingData
       );
       if (cross.length > 0) {
         return Err(
@@ -1924,9 +1986,10 @@ function validateWorkflowConfig(config) {
           )
         );
       }
+      warnings.push(...routingWarnings(routingData, options.knownSkillNames ?? []));
     }
   }
-  return Ok2(config);
+  return Ok2({ config, warnings });
 }
 function getDefaultConfig() {
   return {
@@ -1979,11 +2042,55 @@ function getDefaultConfig() {
   };
 }
 
+// src/workflow/skill-catalog.ts
+import * as fs6 from "fs";
+import * as path6 from "path";
+import { parse as parseYaml } from "yaml";
+function discoverSkillCatalog(projectRoot) {
+  const skillsRoot = path6.join(projectRoot, "agents", "skills");
+  if (!fs6.existsSync(skillsRoot)) return [];
+  const byName = /* @__PURE__ */ new Map();
+  let hosts;
+  try {
+    hosts = fs6.readdirSync(skillsRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  for (const host of hosts) {
+    if (!host.isDirectory()) continue;
+    const hostDir = path6.join(skillsRoot, host.name);
+    let skills;
+    try {
+      skills = fs6.readdirSync(hostDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const skill of skills) {
+      if (!skill.isDirectory()) continue;
+      const skillYamlPath = path6.join(hostDir, skill.name, "skill.yaml");
+      if (!fs6.existsSync(skillYamlPath)) continue;
+      try {
+        const content = fs6.readFileSync(skillYamlPath, "utf-8");
+        const parsed = parseYaml(content);
+        if (parsed && typeof parsed.name === "string" && parsed.name.length > 0 && !byName.has(parsed.name)) {
+          const entry = typeof parsed.cognitive_mode === "string" && parsed.cognitive_mode.length > 0 ? { name: parsed.name, cognitiveMode: parsed.cognitive_mode } : { name: parsed.name };
+          byName.set(parsed.name, entry);
+        }
+      } catch {
+      }
+    }
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function discoverSkillCatalogNames(projectRoot) {
+  return discoverSkillCatalog(projectRoot).map((e) => e.name);
+}
+
 // src/workflow/loader.ts
 var WorkflowLoader = class {
   async loadWorkflow(filePath) {
     try {
-      const content = await fs6.readFile(filePath, "utf-8");
+      const content = await fs7.readFile(filePath, "utf-8");
       const parts = content.split("---");
       if (parts.length < 3) {
         return Err2(
@@ -1995,13 +2102,16 @@ var WorkflowLoader = class {
       const yamlContent = parts[1].trim();
       const promptTemplate = parts.slice(2).join("---").trim();
       const configData = parse(yamlContent);
-      const configResult = validateWorkflowConfig(configData);
+      const projectRoot = path7.dirname(path7.resolve(filePath));
+      const knownSkillNames = discoverSkillCatalogNames(projectRoot);
+      const configResult = validateWorkflowConfig(configData, { knownSkillNames });
       if (!configResult.ok) {
         return Err2(configResult.error);
       }
       return Ok3({
-        config: configResult.value,
-        promptTemplate
+        config: configResult.value.config,
+        promptTemplate,
+        warnings: configResult.value.warnings
       });
     } catch (error) {
       return Err2(error instanceof Error ? error : new Error(String(error)));
@@ -2010,7 +2120,7 @@ var WorkflowLoader = class {
 };
 
 // src/tracker/adapters/roadmap.ts
-import * as fs7 from "fs/promises";
+import * as fs8 from "fs/promises";
 import { createHash as createHash2 } from "crypto";
 import {
   parseRoadmap,
@@ -2047,7 +2157,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssuesByStates(stateNames) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs7.readFile(this.config.filePath, "utf-8");
+      const content = await fs8.readFile(this.config.filePath, "utf-8");
       const roadmapResult = parseRoadmap(content);
       if (!roadmapResult.ok) return roadmapResult;
       const issues = [];
@@ -2079,7 +2189,7 @@ var RoadmapTrackerAdapter = class {
       if (!terminal) {
         return Err3(new Error("Tracker config has no terminalStates; cannot mark complete"));
       }
-      const content = await fs7.readFile(this.config.filePath, "utf-8");
+      const content = await fs8.readFile(this.config.filePath, "utf-8");
       const roadmapResult = parseRoadmap(content);
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
@@ -2088,7 +2198,7 @@ var RoadmapTrackerAdapter = class {
       const normalizedTerminal = this.config.terminalStates.map((s) => s.toLowerCase());
       if (normalizedTerminal.includes(target.status.toLowerCase())) return Ok4(void 0);
       target.status = terminal;
-      await fs7.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2102,19 +2212,22 @@ var RoadmapTrackerAdapter = class {
   async claimIssue(issueId, orchestratorId) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs7.readFile(this.config.filePath, "utf-8");
+      const content = await fs8.readFile(this.config.filePath, "utf-8");
       const roadmapResult = parseRoadmap(content);
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
+      if (target.assignee != null && target.assignee !== orchestratorId) {
+        return Ok4(void 0);
+      }
       if (target.status === "in-progress" && target.assignee === orchestratorId) {
         return Ok4(void 0);
       }
       target.status = "in-progress";
       target.assignee = orchestratorId;
       target.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await fs7.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2131,7 +2244,7 @@ var RoadmapTrackerAdapter = class {
       if (!activeState) {
         return Err3(new Error("Tracker config has no activeStates; cannot release"));
       }
-      const content = await fs7.readFile(this.config.filePath, "utf-8");
+      const content = await fs8.readFile(this.config.filePath, "utf-8");
       const roadmapResult = parseRoadmap(content);
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
@@ -2143,7 +2256,7 @@ var RoadmapTrackerAdapter = class {
       target.status = activeState;
       target.assignee = null;
       target.updatedAt = null;
-      await fs7.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2165,7 +2278,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssueStatesByIds(issueIds) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs7.readFile(this.config.filePath, "utf-8");
+      const content = await fs8.readFile(this.config.filePath, "utf-8");
       const roadmapResult = parseRoadmap(content);
       if (!roadmapResult.ok) return roadmapResult;
       const issueMap = /* @__PURE__ */ new Map();
@@ -2230,8 +2343,8 @@ var LinearGraphQLStub = class {
 };
 
 // src/workspace/manager.ts
-import * as fs8 from "fs/promises";
-import * as path6 from "path";
+import * as fs9 from "fs/promises";
+import * as path8 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 import { Ok as Ok6, Err as Err4 } from "@harness-engineering/types";
@@ -2262,15 +2375,15 @@ var WorkspaceManager = class {
    */
   resolvePath(identifier) {
     const sanitized = this.sanitizeIdentifier(identifier);
-    return path6.join(this.config.root, sanitized);
+    return path8.join(this.config.root, sanitized);
   }
   /**
    * Discovers the git repository root from the workspace root directory.
    */
   async getRepoRoot() {
     if (this.repoRoot) return this.repoRoot;
-    const root = path6.resolve(this.config.root);
-    await fs8.mkdir(root, { recursive: true });
+    const root = path8.resolve(this.config.root);
+    await fs9.mkdir(root, { recursive: true });
     const stdout = await this.git(["rev-parse", "--show-toplevel"], root);
     this.repoRoot = stdout.trim();
     return this.repoRoot;
@@ -2281,23 +2394,23 @@ var WorkspaceManager = class {
    */
   async ensureWorkspace(identifier) {
     try {
-      const workspacePath = path6.resolve(this.resolvePath(identifier));
+      const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs8.access(path6.join(workspacePath, ".git"));
+        await fs9.access(path8.join(workspacePath, ".git"));
         const repoRoot2 = await this.getRepoRoot();
         try {
           await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
         } catch {
-          await fs8.rm(workspacePath, { recursive: true, force: true });
+          await fs9.rm(workspacePath, { recursive: true, force: true });
         }
       } catch {
         try {
-          await fs8.access(workspacePath);
+          await fs9.access(workspacePath);
           const repoRoot2 = await this.getRepoRoot();
           try {
             await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
           } catch {
-            await fs8.rm(workspacePath, { recursive: true, force: true });
+            await fs9.rm(workspacePath, { recursive: true, force: true });
           }
         } catch {
         }
@@ -2393,7 +2506,7 @@ var WorkspaceManager = class {
   async exists(identifier) {
     try {
       const workspacePath = this.resolvePath(identifier);
-      await fs8.access(workspacePath);
+      await fs9.access(workspacePath);
       return true;
     } catch {
       return false;
@@ -2406,9 +2519,9 @@ var WorkspaceManager = class {
    */
   async findPushedBranch(identifier) {
     try {
-      const workspacePath = path6.resolve(this.resolvePath(identifier));
+      const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs8.access(path6.join(workspacePath, ".git"));
+        await fs9.access(path8.join(workspacePath, ".git"));
       } catch {
         return null;
       }
@@ -2514,12 +2627,12 @@ var WorkspaceManager = class {
    */
   async removeWorkspace(identifier) {
     try {
-      const workspacePath = path6.resolve(this.resolvePath(identifier));
+      const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
         const repoRoot = await this.getRepoRoot();
         await this.git(["worktree", "remove", "--force", workspacePath], repoRoot);
       } catch {
-        await fs8.rm(workspacePath, { recursive: true, force: true });
+        await fs9.rm(workspacePath, { recursive: true, force: true });
       }
       return Ok6(void 0);
     } catch (error) {
@@ -2544,7 +2657,7 @@ var WorkspaceHooks = class {
     if (!command) {
       return Ok7(void 0);
     }
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       const filteredEnv = {};
       for (const [k, v] of Object.entries(process.env)) {
         if (v != null && !k.includes("SECRET") && !k.includes("TOKEN") && !k.includes("PASSWORD")) {
@@ -2557,19 +2670,19 @@ var WorkspaceHooks = class {
       });
       const timeout = setTimeout(() => {
         child.kill();
-        resolve6(Err5(new Error(`Hook ${hookName} timed out after ${this.config.timeoutMs}ms`)));
+        resolve8(Err5(new Error(`Hook ${hookName} timed out after ${this.config.timeoutMs}ms`)));
       }, this.config.timeoutMs);
       child.on("exit", (code) => {
         clearTimeout(timeout);
         if (code === 0) {
-          resolve6(Ok7(void 0));
+          resolve8(Ok7(void 0));
         } else {
-          resolve6(Err5(new Error(`Hook ${hookName} failed with exit code ${code}`)));
+          resolve8(Err5(new Error(`Hook ${hookName} failed with exit code ${code}`)));
         }
       });
       child.on("error", (error) => {
         clearTimeout(timeout);
-        resolve6(Err5(error));
+        resolve8(Err5(error));
       });
     });
   }
@@ -2609,7 +2722,7 @@ var MockBackend = class {
       content: "Thinking...",
       sessionId: session.sessionId
     };
-    await new Promise((resolve6) => setTimeout(resolve6, 100));
+    await new Promise((resolve8) => setTimeout(resolve8, 100));
     yield {
       type: "thought",
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2661,12 +2774,12 @@ var PromptRenderer = class {
 
 // src/orchestrator.ts
 import { EventEmitter } from "events";
-import * as path16 from "path";
+import * as path21 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 import { writeTaint } from "@harness-engineering/core";
 
 // src/intelligence/pipeline-runner.ts
-import * as path7 from "path";
+import * as path9 from "path";
 import { weightedRecommendPersona, refreshProfiles } from "@harness-engineering/intelligence";
 import {
   GitHubIssuesSyncAdapter,
@@ -2788,7 +2901,7 @@ var IntelligencePipelineRunner = class {
   }
   async loadGraphStore() {
     try {
-      const graphDir = path7.join(this.ctx.config.workspace.root, "..", "graph");
+      const graphDir = path9.join(this.ctx.config.workspace.root, "..", "graph");
       const loaded = await this.ctx.graphStore.load(graphDir);
       if (loaded) {
         this.ctx.logger.info("Graph store loaded from disk");
@@ -3066,7 +3179,7 @@ var IntelligencePipelineRunner = class {
 };
 
 // src/completion/handler.ts
-import * as path8 from "path";
+import * as path10 from "path";
 import { GitHubIssuesSyncAdapter as GitHubIssuesSyncAdapter2, loadTrackerSyncConfig as loadTrackerSyncConfig2 } from "@harness-engineering/core";
 var CompletionHandler = class {
   ctx;
@@ -3149,7 +3262,7 @@ var CompletionHandler = class {
         result: outcome.result
       });
       if (this.ctx.graphStore) {
-        const graphDir = path8.join(this.ctx.config.workspace.root, "..", "graph");
+        const graphDir = path10.join(this.ctx.config.workspace.root, "..", "graph");
         await this.ctx.graphStore.save(graphDir);
       }
     } catch (err) {
@@ -3635,11 +3748,11 @@ function detectLegacyFields(agent) {
 }
 function buildCase1Warnings(presentLegacy, suppressLocalGroup) {
   const warnings = [];
-  for (const path19 of presentLegacy) {
-    if (CASE1_ALWAYS_SUPPRESS.has(path19)) continue;
-    if (suppressLocalGroup && CASE1_LOCAL_GROUP.has(path19)) continue;
+  for (const path24 of presentLegacy) {
+    if (CASE1_ALWAYS_SUPPRESS.has(path24)) continue;
+    if (suppressLocalGroup && CASE1_LOCAL_GROUP.has(path24)) continue;
     warnings.push(
-      `Ignoring legacy field '${path19}': 'agent.backends' is set and takes precedence. See ${MIGRATION_GUIDE}.`
+      `Ignoring legacy field '${path24}': 'agent.backends' is set and takes precedence. See ${MIGRATION_GUIDE}.`
     );
   }
   return warnings;
@@ -3667,7 +3780,7 @@ function migrateAgentConfig(agent) {
   }
   const { backends, routing } = synthesizeBackendsAndRouting(agent);
   const warnings = presentLegacy.map(
-    (path19) => `Deprecated config field '${path19}' is in use. Migrate to 'agent.backends' / 'agent.routing'. See ${MIGRATION_GUIDE}.`
+    (path24) => `Deprecated config field '${path24}' is in use. Migrate to 'agent.backends' / 'agent.routing'. See ${MIGRATION_GUIDE}.`
   );
   return {
     config: { ...agent, backends, routing },
@@ -3730,61 +3843,160 @@ function synthesizeLocal(agent) {
 }
 
 // src/agent/backend-router.ts
+function toArray(value) {
+  return Array.isArray(value) ? value : [value];
+}
 var BackendRouter = class {
   backends;
   routing;
+  decisionBus;
   constructor(opts) {
     this.backends = opts.backends;
     this.routing = opts.routing;
+    this.decisionBus = opts.decisionBus;
     this.validateReferences();
   }
   /**
-   * Returns the backend name for a given use case.
+   * Resolve a {@link RoutingUseCase} to a {@link RoutingDecision}.
+   *
+   * @param useCase the routing query
+   * @param opts.invocationOverride if set and the named backend exists,
+   *   beats all other sources (D7 — the `--backend <name>` escape hatch)
+   */
+  resolve(useCase, opts) {
+    const startedAt = performance.now();
+    const path24 = [];
+    const tryChain = (source, value) => {
+      if (value === void 0) return void 0;
+      for (const name of toArray(value)) {
+        const step = { source, candidate: name, outcome: "considered" };
+        path24.push(step);
+        if (this.backends[name]) {
+          step.outcome = "chosen";
+          return name;
+        }
+        step.outcome = "unknown-backend";
+      }
+      return void 0;
+    };
+    const decide = (backendName) => {
+      const def = this.backends[backendName];
+      if (!def) {
+        throw new Error(
+          `BackendRouter.resolve: internal invariant violated \u2014 backend '${backendName}' missing.`
+        );
+      }
+      return {
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        useCase,
+        resolutionPath: path24,
+        backendName,
+        backendType: def.type,
+        durationMs: performance.now() - startedAt
+      };
+    };
+    const emitAndReturn = (decision) => {
+      this.decisionBus?.emit(decision);
+      return decision;
+    };
+    const fromInvocation = tryChain(
+      "invocation",
+      opts?.invocationOverride !== void 0 ? opts.invocationOverride : void 0
+    );
+    if (fromInvocation) return emitAndReturn(decide(fromInvocation));
+    if (useCase.kind === "skill") {
+      const fromSkill = tryChain("skill", this.routing.skills?.[useCase.skillName]);
+      if (fromSkill) return emitAndReturn(decide(fromSkill));
+    }
+    const mode = useCase.kind === "skill" ? useCase.cognitiveMode : useCase.kind === "mode" ? useCase.cognitiveMode : void 0;
+    if (mode !== void 0) {
+      const fromMode = tryChain("mode", this.routing.modes?.[mode]);
+      if (fromMode) return emitAndReturn(decide(fromMode));
+    }
+    const fromExisting = this.resolveExistingUseCase(useCase);
+    if (fromExisting !== void 0) {
+      const chained = tryChain("tier", fromExisting);
+      if (chained) return emitAndReturn(decide(chained));
+    }
+    const fromDefault = tryChain("default", this.routing.default);
+    if (fromDefault) return emitAndReturn(decide(fromDefault));
+    const knownList = Object.keys(this.backends).join(", ") || "(none)";
+    throw new Error(
+      `BackendRouter.resolve: routing.default produced no available backend for useCase=${JSON.stringify(useCase)}. Resolution path: ${JSON.stringify(path24)}. Known backends: [${knownList}].`
+    );
+  }
+  /**
+   * Returns the {@link BackendDef} reference for the resolved name.
+   * Identity-equal to the entry in `backends` (no copy) so callers
+   * relying on reference equality (SC21) continue to work.
+   */
+  resolveDefinition(useCase, opts) {
+    const decision = this.resolve(useCase, opts);
+    const def = this.backends[decision.backendName];
+    if (!def) {
+      throw new Error(
+        `BackendRouter.resolveDefinition: routing target '${decision.backendName}' is not in backends (useCase=${JSON.stringify(useCase)}).`
+      );
+    }
+    return def;
+  }
+  /**
+   * Spec B Phase 4 (closes P1-IMP-2): a single resolve() + def lookup
+   * for callers that need both. Replaces the previous pattern of
+   * `resolveDefinition(useCase) + resolve(useCase)` which produced two
+   * RoutingDecision emissions per dispatch — doubling routing-decision
+   * log volume now that Phase 4 emits.
    *
-   * - `tier`: per-tier override, falling back to `routing.default`.
-   * - `intelligence`: per-layer override under `routing.intelligence`,
-   *   falling back to `routing.default`.
-   * - `maintenance` / `chat`: always `routing.default`.
+   * Identity-equal `BackendDef` (no copy) so callers relying on
+   * reference equality (SC21) continue to work.
+   */
+  resolveDecisionAndDef(useCase, opts) {
+    const decision = this.resolve(useCase, opts);
+    const def = this.backends[decision.backendName];
+    if (!def) {
+      throw new Error(
+        `BackendRouter.resolveDecisionAndDef: routing target '${decision.backendName}' is not in backends (useCase=${JSON.stringify(useCase)}).`
+      );
+    }
+    return { decision, def };
+  }
+  /**
+   * The pre-Spec-B resolution helper: returns the configured
+   * {@link RoutingValue} for tier/intelligence/isolation/maintenance/chat
+   * use cases (or `undefined` for skill/mode use cases, which are owned
+   * by the per-skill / per-mode steps in {@link resolve}). Returning
+   * `undefined` lets the caller fall through to `routing.default`.
    */
-  resolve(useCase) {
+  resolveExistingUseCase(useCase) {
     switch (useCase.kind) {
       case "tier": {
-        const named = this.routing[useCase.tier];
-        return named ?? this.routing.default;
+        const tierMap = this.routing;
+        return tierMap[useCase.tier];
       }
       case "intelligence": {
         const intel = this.routing.intelligence;
-        return intel?.[useCase.layer] ?? this.routing.default;
+        return intel?.[useCase.layer];
       }
       case "isolation": {
         const iso = this.routing.isolation;
-        return iso?.[useCase.tier] ?? this.routing.default;
+        return iso?.[useCase.tier];
       }
       case "maintenance":
       case "chat":
-        return this.routing.default;
+        return void 0;
+      case "skill":
+      case "mode":
+        return void 0;
     }
   }
-  /**
-   * Returns the BackendDef reference for the resolved name. Returns the
-   * exact reference held in `backends` (no copy) so identity comparisons
-   * succeed (SC21).
-   */
-  resolveDefinition(useCase) {
-    const name = this.resolve(useCase);
-    const def = this.backends[name];
-    if (!def) {
-      throw new Error(
-        `BackendRouter.resolveDefinition: routing target '${name}' is not in backends (useCase=${JSON.stringify(useCase)}).`
-      );
-    }
-    return def;
-  }
   validateReferences() {
     const known = new Set(Object.keys(this.backends));
     const missing = [];
-    const check = (path19, name) => {
-      if (name !== void 0 && !known.has(name)) missing.push({ path: path19, name });
+    const check = (label, value) => {
+      if (value === void 0) return;
+      for (const name of toArray(value)) {
+        if (!known.has(name)) missing.push({ path: label, name });
+      }
     };
     check("default", this.routing.default);
     check("quick-fix", this.routing["quick-fix"]);
@@ -3796,8 +4008,14 @@ var BackendRouter = class {
     check("isolation.none", this.routing.isolation?.none);
     check("isolation.container", this.routing.isolation?.container);
     check("isolation.remote-sandbox", this.routing.isolation?.["remote-sandbox"]);
+    for (const [skill, value] of Object.entries(this.routing.skills ?? {})) {
+      check(`skills.${skill}`, value);
+    }
+    for (const [mode, value] of Object.entries(this.routing.modes ?? {})) {
+      check(`modes.${mode}`, value);
+    }
     if (missing.length > 0) {
-      const detail = missing.map(({ path: path19, name }) => `routing.${path19} -> '${name}'`).join("; ");
+      const detail = missing.map(({ path: path24, name }) => `routing.${path24} -> '${name}'`).join("; ");
       const known_ = [...known].join(", ") || "(none)";
       throw new Error(
         `BackendRouter: routing references unknown backend(s): ${detail}. Defined backends: [${known_}].`
@@ -3814,11 +4032,11 @@ import {
   Ok as Ok10,
   Err as Err7
 } from "@harness-engineering/types";
-function resolveExitCode(code, command, resolve6) {
+function resolveExitCode(code, command, resolve8) {
   if (code === 0) {
-    resolve6(Ok10(void 0));
+    resolve8(Ok10(void 0));
   } else {
-    resolve6(
+    resolve8(
       Err7({
         category: "agent_not_found",
         message: `Claude command '${command}' not found or failed`
@@ -3826,8 +4044,8 @@ function resolveExitCode(code, command, resolve6) {
     );
   }
 }
-function resolveSpawnError(command, resolve6) {
-  resolve6(Err7({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
+function resolveSpawnError(command, resolve8) {
+  resolve8(Err7({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
 }
 var JUST_PAST_GRACE_MS = 5 * 6e4;
 var PRIMARY_LIMIT_RE = /You[\u2019']ve hit your limit.*resets\s+(\d{1,2}(?::\d{2})?\s*(?:am|pm))\s*\(([^)]+)\)/i;
@@ -4140,10 +4358,10 @@ var ClaudeBackend = class {
       errRl.close();
     }
     if (exitCode === null) {
-      await new Promise((resolve6) => {
+      await new Promise((resolve8) => {
         child.on("exit", (code) => {
           exitCode = code;
-          resolve6(null);
+          resolve8(null);
         });
       });
     }
@@ -4165,10 +4383,10 @@ var ClaudeBackend = class {
     return Ok10(void 0);
   }
   async healthCheck() {
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       const child = spawn2(this.command, ["--version"]);
-      child.on("exit", (code) => resolveExitCode(code, this.command, resolve6));
-      child.on("error", () => resolveSpawnError(this.command, resolve6));
+      child.on("exit", (code) => resolveExitCode(code, this.command, resolve8));
+      child.on("error", () => resolveSpawnError(this.command, resolve8));
     });
   }
 };
@@ -4791,7 +5009,7 @@ var PiBackend = class {
       } else {
         resolvedModelName = this.config.model;
       }
-      const piSdk = await import("@mariozechner/pi-coding-agent");
+      const piSdk = await import("@earendil-works/pi-coding-agent");
       const model = buildLocalModel({
         model: resolvedModelName,
         endpoint: this.config.endpoint,
@@ -4946,7 +5164,7 @@ var PiBackend = class {
   }
   async healthCheck() {
     try {
-      await import("@mariozechner/pi-coding-agent");
+      await import("@earendil-works/pi-coding-agent");
       return Ok15(void 0);
     } catch (err) {
       return Err12({
@@ -5100,14 +5318,14 @@ var SshBackend = class {
   async healthCheck() {
     const args = [...this.buildSshArgs()];
     args[args.length - 1] = "true";
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       let child;
       try {
         child = this.spawnImpl(this.config.sshBinary, args, {
           stdio: ["ignore", "ignore", "pipe"]
         });
       } catch (err) {
-        resolve6(
+        resolve8(
           Err13({
             category: "agent_not_found",
             message: err instanceof Error ? err.message : "failed to spawn ssh"
@@ -5128,9 +5346,9 @@ var SshBackend = class {
       child.on("close", (code) => {
         clearTimeout(timer);
         if (code === 0) {
-          resolve6(Ok16(void 0));
+          resolve8(Ok16(void 0));
         } else {
-          resolve6(
+          resolve8(
             Err13({
               category: "agent_not_found",
               message: `ssh health check failed (exit=${code ?? "null"}): ${stderr.slice(0, 500)}`
@@ -5140,7 +5358,7 @@ var SshBackend = class {
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve6(Err13({ category: "agent_not_found", message: err.message }));
+        resolve8(Err13({ category: "agent_not_found", message: err.message }));
       });
     });
   }
@@ -5188,13 +5406,13 @@ async function* readLines(stream) {
   if (buffer.length > 0) yield buffer;
 }
 function waitForExit(child) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve8) => {
     if (child.exitCode !== null) {
-      resolve6(child.exitCode);
+      resolve8(child.exitCode);
       return;
     }
-    child.once("close", (code) => resolve6(code));
-    child.once("error", () => resolve6(null));
+    child.once("close", (code) => resolve8(code));
+    child.once("error", () => resolve8(null));
   });
 }
 
@@ -5384,14 +5602,14 @@ var OciServerlessBackend = class extends ServerlessBackend {
     return out;
   }
   runOneShot(binary, args) {
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       let child;
       try {
         child = this.spawnImpl(binary, args, {
           stdio: ["ignore", "pipe", "pipe"]
         });
       } catch (err) {
-        resolve6(
+        resolve8(
           Err14({
             category: "agent_not_found",
             message: err instanceof Error ? err.message : "failed to spawn runtime"
@@ -5416,9 +5634,9 @@ var OciServerlessBackend = class extends ServerlessBackend {
       child.on("close", (code) => {
         clearTimeout(timer);
         if (code === 0) {
-          resolve6(Ok17(stdout));
+          resolve8(Ok17(stdout));
         } else {
-          resolve6(
+          resolve8(
             Err14({
               category: "response_error",
               message: `runtime '${binary} ${args.join(" ")}' exited ${code ?? "null"}: ${stderr.slice(0, 500)}`
@@ -5428,7 +5646,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve6(Err14({ category: "agent_not_found", message: err.message }));
+        resolve8(Err14({ category: "agent_not_found", message: err.message }));
       });
     });
   }
@@ -5488,13 +5706,13 @@ async function* readLines2(stream) {
   if (buffer.length > 0) yield buffer;
 }
 function waitForExit2(child) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve8) => {
     if (child.exitCode !== null) {
-      resolve6(child.exitCode);
+      resolve8(child.exitCode);
       return;
     }
-    child.once("close", (code) => resolve6(code));
-    child.once("error", () => resolve6(null));
+    child.once("close", (code) => resolve8(code));
+    child.once("error", () => resolve8(null));
   });
 }
 
@@ -5694,13 +5912,13 @@ var ContainerBackend = class {
 import { execFile as execFile3, spawn as spawn5 } from "child_process";
 import { Ok as Ok18, Err as Err16 } from "@harness-engineering/types";
 function dockerExec(args) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     execFile3("docker", args, (error, stdout) => {
       if (error) {
         reject(error);
         return;
       }
-      resolve6(stdout.trim());
+      resolve8(stdout.trim());
     });
   });
 }
@@ -5759,11 +5977,11 @@ var DockerRuntime = class {
     } finally {
       rl.close();
     }
-    const exitCode = await new Promise((resolve6) => {
+    const exitCode = await new Promise((resolve8) => {
       if (child.exitCode !== null) {
-        resolve6(child.exitCode);
+        resolve8(child.exitCode);
       } else {
-        child.on("exit", (code) => resolve6(code ?? 1));
+        child.on("exit", (code) => resolve8(code ?? 1));
       }
     });
     return exitCode;
@@ -5822,13 +6040,13 @@ var EnvSecretBackend = class {
 import { execFile as execFile4 } from "child_process";
 import { Ok as Ok20, Err as Err18 } from "@harness-engineering/types";
 function opExec(args) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     execFile4("op", args, (error, stdout) => {
       if (error) {
         reject(error);
         return;
       }
-      resolve6(stdout.trim());
+      resolve8(stdout.trim());
     });
   });
 }
@@ -5871,13 +6089,13 @@ var OnePasswordSecretBackend = class {
 import { execFile as execFile5 } from "child_process";
 import { Ok as Ok21, Err as Err19 } from "@harness-engineering/types";
 function vaultExec(args, env) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     execFile5("vault", args, { env: { ...process.env, ...env } }, (error, stdout) => {
       if (error) {
         reject(error);
         return;
       }
-      resolve6(stdout.trim());
+      resolve8(stdout.trim());
     });
   });
 }
@@ -5952,7 +6170,11 @@ var OrchestratorBackendFactory = class {
   opts;
   constructor(opts) {
     this.opts = opts;
-    this.router = new BackendRouter({ backends: opts.backends, routing: opts.routing });
+    this.router = new BackendRouter({
+      backends: opts.backends,
+      routing: opts.routing,
+      ...opts.decisionBus !== void 0 ? { decisionBus: opts.decisionBus } : {}
+    });
   }
   /**
    * Resolve `useCase` to a backend name, materialize a fresh
@@ -5971,12 +6193,21 @@ var OrchestratorBackendFactory = class {
    * is `undefined` for pure-modern configs. Threading the routed name
    * through dispatch eliminates that gap.
    */
-  resolveName(useCase) {
-    return this.router.resolve(useCase);
+  resolveName(useCase, opts) {
+    return this.router.resolve(useCase, opts).backendName;
   }
-  forUseCase(useCase) {
-    const def = this.router.resolveDefinition(useCase);
-    const name = this.router.resolve(useCase);
+  /**
+   * Spec B Phase 1: expose the underlying router for callers that need
+   * it directly (e.g., {@link buildIntelligencePipeline} for the
+   * I1 SEL/PESL comparison fix). Read-only access; consumers must not
+   * mutate router state.
+   */
+  getRouter() {
+    return this.router;
+  }
+  forUseCase(useCase, opts) {
+    const { def, decision } = this.router.resolveDecisionAndDef(useCase, opts);
+    const name = decision.backendName;
     let backend;
     const createOpts = this.opts.cacheMetrics ? { cacheMetrics: this.opts.cacheMetrics } : {};
     if ((def.type === "local" || def.type === "pi") && this.opts.getResolverModelFor) {
@@ -6149,15 +6380,14 @@ function buildClaudeCliProvider(def, args, layerModel) {
 
 // src/agent/intelligence-factory.ts
 function buildIntelligencePipeline(deps) {
-  const { config } = deps;
+  const { config, router } = deps;
   const intel = config.intelligence;
   if (!intel?.enabled) return null;
   const selProvider = buildAnalysisProviderForLayer("sel", deps);
   if (!selProvider) return null;
-  const routing = config.agent.routing;
-  const peslName = routing?.intelligence?.pesl;
-  const selName = routing?.intelligence?.sel ?? routing?.default;
-  const peslProvider = peslName !== void 0 && peslName !== selName ? buildAnalysisProviderForLayer("pesl", deps) : null;
+  const peslName = router.resolve({ kind: "intelligence", layer: "pesl" }).backendName;
+  const selName = router.resolve({ kind: "intelligence", layer: "sel" }).backendName;
+  const peslProvider = peslName !== selName ? buildAnalysisProviderForLayer("pesl", deps) : null;
   const peslModel = intel.models?.pesl ?? config.agent.model;
   const graphStore = new GraphStore();
   const pipeline = new IntelligencePipeline(selProvider, graphStore, {
@@ -6174,7 +6404,7 @@ function buildAnalysisProviderForLayer(layer, deps) {
     const layerModel = layer === "sel" ? intel.models?.sel : intel.models?.pesl;
     return buildExplicitProvider(intel.provider, layerModel ?? config.agent.model, config);
   }
-  const routed = resolveRoutedBackend(layer, config, logger);
+  const routed = resolveRoutedBackend(layer, deps);
   if (!routed) return null;
   const { name, def } = routed;
   const resolver = localResolvers.get(name);
@@ -6199,20 +6429,26 @@ function buildAnalysisProviderForLayer(layer, deps) {
     logger
   });
 }
-function resolveRoutedBackend(layer, config, logger) {
-  const routing = config.agent.routing;
+function resolveRoutedBackend(layer, deps) {
+  const { config, router, logger } = deps;
   const backends = config.agent.backends;
-  if (!routing || !backends) return null;
-  const layerName = routing.intelligence?.[layer];
-  const name = layerName ?? routing.default;
-  const def = backends[name];
-  if (!def) {
+  if (!backends || !router) return null;
+  try {
+    const decision = router.resolve({ kind: "intelligence", layer });
+    const def = backends[decision.backendName];
+    if (!def) {
+      logger.warn(
+        `Intelligence pipeline: routed backend '${decision.backendName}' for layer '${layer}' is not in agent.backends.`
+      );
+      return null;
+    }
+    return { name: decision.backendName, def };
+  } catch (err) {
     logger.warn(
-      `Intelligence pipeline: routed backend '${name}' for layer '${layer}' is not in agent.backends.`
+      `Intelligence pipeline: router could not resolve intelligence.${layer}; intelligence disabled. error=${String(err)}`
     );
     return null;
   }
-  return { name, def };
 }
 function buildExplicitProvider(provider, selModel, config) {
   if (provider.kind === "anthropic") {
@@ -6247,9 +6483,104 @@ function buildExplicitProvider(provider, selModel, config) {
   });
 }
 
+// src/routing/decision-bus.ts
+var RoutingDecisionBus = class {
+  ringBuffer = [];
+  listeners = /* @__PURE__ */ new Set();
+  capacity;
+  logger;
+  constructor(opts) {
+    this.capacity = opts?.capacity ?? 500;
+    this.logger = opts?.logger;
+  }
+  emit(decision) {
+    this.ringBuffer.push(decision);
+    if (this.ringBuffer.length > this.capacity) {
+      this.ringBuffer.shift();
+    }
+    if (this.logger) {
+      this.logger.info("routing-decision", {
+        useCase: decision.useCase,
+        backendName: decision.backendName,
+        resolutionPathLength: decision.resolutionPath.length,
+        durationMs: decision.durationMs
+      });
+    }
+    for (const listener of this.listeners) {
+      try {
+        listener(decision);
+      } catch (err) {
+        if (this.logger) {
+          this.logger.warn("RoutingDecisionBus subscriber threw", {
+            error: String(err)
+          });
+        }
+      }
+    }
+  }
+  recent(filter) {
+    let out = this.ringBuffer.slice();
+    if (filter?.skillName !== void 0) {
+      out = out.filter(
+        (d) => d.useCase.kind === "skill" && d.useCase.skillName === filter.skillName
+      );
+    }
+    if (filter?.mode !== void 0) {
+      const m = filter.mode;
+      out = out.filter(
+        (d) => d.useCase.kind === "mode" && d.useCase.cognitiveMode === m || d.useCase.kind === "skill" && d.useCase.cognitiveMode === m
+      );
+    }
+    if (filter?.backendName !== void 0) {
+      out = out.filter((d) => d.backendName === filter.backendName);
+    }
+    if (filter?.limit !== void 0) {
+      out = out.slice(-filter.limit).reverse();
+    } else {
+      out = out.reverse();
+    }
+    return out;
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  /**
+   * Spec B Phase 5 (review-S2 fix): release all subscriber references so
+   * teardown can complete without anchoring closures. Called from
+   * `Orchestrator.stop()` before nulling the bus reference. The bus
+   * remains usable after clear — `subscribe()` works as normal.
+   */
+  clearListeners() {
+    this.listeners.clear();
+  }
+};
+
+// src/agent/triage-skill-mapping.ts
+function resolveSkillForTriage(triageSkill, catalog) {
+  const expected = `harness-${triageSkill}`;
+  const match = catalog.find((e) => e.name === expected);
+  if (!match) return void 0;
+  return match.cognitiveMode !== void 0 ? { name: match.name, cognitiveMode: match.cognitiveMode } : { name: match.name };
+}
+
+// src/agent/use-case-builder.ts
+function buildRoutingUseCase(issue, backendParam, catalog) {
+  if (backendParam === "local") return { kind: "tier", tier: "quick-fix" };
+  const decision = triageIssue(issue, {});
+  const resolved = resolveSkillForTriage(decision.skill, catalog);
+  if (resolved) {
+    return resolved.cognitiveMode !== void 0 ? { kind: "skill", skillName: resolved.name, cognitiveMode: resolved.cognitiveMode } : { kind: "skill", skillName: resolved.name };
+  }
+  const tier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
+  return { kind: "tier", tier };
+}
+
 // src/server/http.ts
 import * as http from "http";
-import * as path14 from "path";
+import * as path17 from "path";
 import { assertPortUsable } from "@harness-engineering/core";
 
 // src/server/websocket.ts
@@ -6312,7 +6643,7 @@ import { z as z3 } from "zod";
 // src/server/utils.ts
 var DEFAULT_MAX_BYTES = 1048576;
 function readBody(req, maxBytes = DEFAULT_MAX_BYTES) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     let body = "";
     let bytes = 0;
     req.on("data", (chunk) => {
@@ -6324,7 +6655,7 @@ function readBody(req, maxBytes = DEFAULT_MAX_BYTES) {
       }
       body += String(chunk);
     });
-    req.on("end", () => resolve6(body));
+    req.on("end", () => resolve8(body));
     req.on("error", reject);
   });
 }
@@ -6445,8 +6776,8 @@ function handleV1InteractionsResolveRoute(req, res, queue) {
 
 // src/server/routes/plans.ts
 import { z as z5 } from "zod";
-import * as fs9 from "fs/promises";
-import * as path9 from "path";
+import * as fs10 from "fs/promises";
+import * as path11 from "path";
 var PlanWriteSchema = z5.object({
   filename: z5.string().min(1),
   content: z5.string().min(1)
@@ -6466,7 +6797,7 @@ function handlePlansRoute(req, res, plansDir) {
           return;
         }
         const parsed = result.data;
-        const basename3 = path9.basename(parsed.filename);
+        const basename3 = path11.basename(parsed.filename);
         if (basename3 !== parsed.filename || !basename3.endsWith(".md")) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(
@@ -6474,9 +6805,9 @@ function handlePlansRoute(req, res, plansDir) {
           );
           return;
         }
-        await fs9.mkdir(plansDir, { recursive: true });
-        const filePath = path9.join(plansDir, basename3);
-        await fs9.writeFile(filePath, parsed.content, "utf-8");
+        await fs10.mkdir(plansDir, { recursive: true });
+        const filePath = path11.join(plansDir, basename3);
+        await fs10.writeFile(filePath, parsed.content, "utf-8");
         res.writeHead(201, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: true, filename: basename3 }));
       } catch {
@@ -6851,8 +7182,8 @@ function handleAnalyzeRoute(req, res, pipeline) {
 }
 
 // src/server/routes/roadmap-actions.ts
-import * as fs10 from "fs/promises";
-import * as path10 from "path";
+import * as fs11 from "fs/promises";
+import * as path12 from "path";
 import {
   parseRoadmap as parseRoadmap2,
   serializeRoadmap as serializeRoadmap2,
@@ -6888,7 +7219,7 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         sendJSON2(res, 503, { error: "Roadmap path not configured" });
         return;
       }
-      const projectRoot = path10.dirname(path10.dirname(roadmapPath));
+      const projectRoot = path12.dirname(path12.dirname(roadmapPath));
       const mode = loadProjectRoadmapMode(projectRoot);
       if (mode === "file-less") {
         const trackerCfg = loadTrackerClientConfigFromProject(projectRoot);
@@ -6941,7 +7272,7 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         sendJSON2(res, 400, { error: "Title must not contain newlines or markdown headings" });
         return;
       }
-      const content = await fs10.readFile(roadmapPath, "utf-8");
+      const content = await fs11.readFile(roadmapPath, "utf-8");
       const roadmapResult = parseRoadmap2(content);
       if (!roadmapResult.ok) {
         sendJSON2(res, 500, { error: "Failed to parse roadmap file" });
@@ -6972,8 +7303,8 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
       roadmap.frontmatter.lastManualEdit = (/* @__PURE__ */ new Date()).toISOString();
       const tmpPath = roadmapPath + ".tmp";
       const serialized = serializeRoadmap2(roadmap);
-      await fs10.writeFile(tmpPath, serialized, "utf-8");
-      await fs10.rename(tmpPath, roadmapPath);
+      await fs11.writeFile(tmpPath, serialized, "utf-8");
+      await fs11.rename(tmpPath, roadmapPath);
       sendJSON2(res, 201, { ok: true, featureName: parsed.title });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to append to roadmap";
@@ -7460,88 +7791,779 @@ function handleV1TelemetryRoute(req, res, deps) {
   return false;
 }
 
-// src/server/routes/sessions.ts
-import * as fs11 from "fs/promises";
-import * as path11 from "path";
+// src/server/routes/v1/proposals.ts
 import { z as z13 } from "zod";
-var SessionCreateSchema = z13.object({
-  sessionId: z13.string().min(1)
-}).passthrough();
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isSafeId(id) {
-  return UUID_RE2.test(id) || path11.basename(id) === id && !id.includes("..");
-}
-function jsonResponse(res, status, data) {
-  res.writeHead(status, { "Content-Type": "application/json" });
-  res.end(JSON.stringify(data));
+import {
+  getProposal as getProposal3,
+  listProposals,
+  updateProposal as updateProposal3,
+  ProposalNotFoundError as ProposalNotFoundError3
+} from "@harness-engineering/core";
+import {
+  EditProposalInputSchema
+} from "@harness-engineering/types";
+
+// src/proposals/gate.ts
+import { parse as parseYaml2 } from "yaml";
+import {
+  getProposal,
+  updateProposal,
+  ProposalNotFoundError
+} from "@harness-engineering/core";
+var GateRunError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GateRunError";
+  }
+};
+var SKILL_NAME_RE = /^[a-z][a-z0-9-]*$/;
+function checkSkillYaml(yaml) {
+  const findings = [];
+  let doc;
+  try {
+    doc = parseYaml2(yaml);
+  } catch (err) {
+    findings.push({
+      severity: "error",
+      title: "skill.yaml does not parse",
+      detail: err instanceof Error ? err.message : String(err)
+    });
+    return findings;
+  }
+  if (!doc || typeof doc !== "object") {
+    findings.push({
+      severity: "error",
+      title: "skill.yaml top-level is not a mapping",
+      detail: "Expected a YAML document with keys at the root (name, version, description, \u2026)."
+    });
+    return findings;
+  }
+  const obj = doc;
+  if (typeof obj["name"] !== "string") {
+    findings.push({
+      severity: "error",
+      title: "skill.yaml missing `name`",
+      detail: "Every skill must declare its kebab-case name."
+    });
+  }
+  if (typeof obj["version"] !== "string") {
+    findings.push({
+      severity: "error",
+      title: "skill.yaml missing `version`",
+      detail: "Every skill must declare a semver version string."
+    });
+  }
+  if (typeof obj["description"] !== "string") {
+    findings.push({
+      severity: "warning",
+      title: "skill.yaml missing `description`",
+      detail: "Description is strongly recommended for discoverability."
+    });
+  }
+  return findings;
 }
-function extractSessionId(url) {
-  const segments = new URL(url, "http://localhost").pathname.split(path11.posix.sep);
-  const id = segments.pop();
-  return id && id !== "sessions" ? id : null;
+function checkSkillMd(md) {
+  const findings = [];
+  if (md.trim().length < 40) {
+    findings.push({
+      severity: "error",
+      title: "SKILL.md is too short",
+      detail: "A skill needs a meaningful description (at least 40 non-whitespace characters)."
+    });
+  }
+  if (!/^#\s+\S/m.test(md)) {
+    findings.push({
+      severity: "warning",
+      title: "SKILL.md has no top-level heading",
+      detail: "Convention: open SKILL.md with `# <Skill Name>`."
+    });
+  }
+  return findings;
 }
-async function handleList(res, sessionsDir) {
-  try {
-    const entries = await fs11.readdir(sessionsDir, { withFileTypes: true });
-    const sessions = [];
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      try {
-        const content = await fs11.readFile(
-          path11.join(sessionsDir, entry.name, "session.json"),
-          "utf-8"
-        );
-        sessions.push(JSON.parse(content));
-      } catch {
-      }
+function checkName(name) {
+  if (SKILL_NAME_RE.test(name)) return [];
+  return [
+    {
+      severity: "error",
+      title: "skill name violates the kebab-case rule",
+      detail: `"${name}" must match /^[a-z][a-z0-9-]*$/. Use only lowercase letters, digits, and hyphens; start with a letter.`
     }
-    sessions.sort(
-      (a, b) => new Date(b.lastActiveAt).getTime() - new Date(a.lastActiveAt).getTime()
+  ];
+}
+function checkDiff(diff) {
+  const findings = [];
+  if (!diff.includes("---") || !diff.includes("+++")) {
+    findings.push({
+      severity: "error",
+      title: "Refinement diff is not in unified-diff format",
+      detail: "Diffs must include both `---` and `+++` headers."
+    });
+  }
+  if (!/^@@\s/m.test(diff)) {
+    findings.push({
+      severity: "warning",
+      title: "Refinement diff has no hunk marker",
+      detail: "A unified diff typically contains at least one `@@` line."
+    });
+  }
+  return findings;
+}
+function deriveFindings(proposal) {
+  const findings = [];
+  findings.push(...checkName(proposal.content.name));
+  if (proposal.kind === "new-skill") {
+    findings.push(...checkSkillYaml(proposal.content.skillYaml ?? ""));
+    findings.push(...checkSkillMd(proposal.content.skillMd ?? ""));
+  } else if (proposal.kind === "refinement") {
+    findings.push(...checkDiff(proposal.content.diff ?? ""));
+  }
+  return findings;
+}
+async function runGate(projectPath, proposalId) {
+  const proposal = await getProposal(projectPath, proposalId);
+  if (!proposal) throw new ProposalNotFoundError(proposalId);
+  if (proposal.status === "approved" || proposal.status === "rejected") {
+    throw new GateRunError(
+      `proposal ${proposalId} is already ${proposal.status}; cannot re-run the gate`
     );
-    jsonResponse(res, 200, sessions);
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      jsonResponse(res, 200, []);
-      return;
-    }
-    jsonResponse(res, 500, { error: "Failed to list sessions" });
   }
+  const findings = deriveFindings(proposal);
+  const runAt = (/* @__PURE__ */ new Date()).toISOString();
+  const hasError = findings.some((f) => f.severity === "error");
+  const nextStatus = hasError ? "gate-failed" : "gate-running";
+  const updated = await updateProposal(projectPath, proposalId, {
+    status: nextStatus,
+    gate: { lastRunAt: runAt, findings }
+  });
+  return {
+    proposalId: updated.id,
+    status: updated.status,
+    findings,
+    runAt
+  };
 }
-async function handleGet(res, id, sessionsDir) {
-  if (!isSafeId(id)) {
-    jsonResponse(res, 400, { error: "Invalid sessionId" });
-    return;
+
+// src/proposals/promote.ts
+import * as fs12 from "fs";
+import * as path13 from "path";
+import { parse as parseYaml3, stringify as stringifyYaml } from "yaml";
+import {
+  getProposal as getProposal2,
+  updateProposal as updateProposal2,
+  ProposalNotFoundError as ProposalNotFoundError2
+} from "@harness-engineering/core";
+var GateNotReadyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GateNotReadyError";
   }
-  try {
-    const content = await fs11.readFile(path11.join(sessionsDir, id, "session.json"), "utf-8");
-    jsonResponse(res, 200, JSON.parse(content));
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      jsonResponse(res, 404, { error: "Session not found" });
-      return;
-    }
-    jsonResponse(res, 500, { error: "Failed to read session" });
+};
+var PromotionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PromotionError";
   }
+};
+var GATE_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
+function skillDir(projectPath, name) {
+  return path13.join(projectPath, "agents", "skills", "claude-code", name);
 }
-async function handleCreate(req, res, sessionsDir) {
+function readIfExists(p) {
   try {
-    const body = await readBody(req);
-    const result = SessionCreateSchema.safeParse(JSON.parse(body));
-    if (!result.success) {
-      jsonResponse(res, 400, { error: "Missing sessionId" });
-      return;
-    }
-    const session = result.data;
-    if (!isSafeId(session.sessionId)) {
-      jsonResponse(res, 400, { error: "Invalid sessionId" });
-      return;
-    }
-    const sessionDir = path11.join(sessionsDir, session.sessionId);
-    await fs11.mkdir(sessionDir, { recursive: true });
-    await fs11.writeFile(path11.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
-    jsonResponse(res, 200, { ok: true });
+    return fs12.readFileSync(p, "utf-8");
   } catch {
-    jsonResponse(res, 500, { error: "Failed to save session" });
+    return null;
+  }
+}
+function injectProvenanceIntoYaml(yamlText, proposalId) {
+  let doc;
+  try {
+    doc = parseYaml3(yamlText);
+  } catch (err) {
+    throw new PromotionError(
+      `skill.yaml does not parse: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!doc || typeof doc !== "object") {
+    throw new PromotionError("skill.yaml top-level is not a mapping");
+  }
+  const obj = doc;
+  obj["provenance"] = "agent-proposed";
+  obj["originatingProposalId"] = proposalId;
+  return stringifyYaml(obj);
+}
+function assertGateReady(proposal) {
+  if (proposal.status !== "gate-running") {
+    throw new GateNotReadyError(
+      `proposal ${proposal.id} is in status "${proposal.status}"; the gate must pass before promotion`
+    );
+  }
+  const findings = proposal.gate?.findings ?? [];
+  if (findings.some((f) => f.severity === "error")) {
+    throw new GateNotReadyError(
+      `proposal ${proposal.id} has unresolved gate errors; re-run the gate after edits`
+    );
+  }
+  if (!proposal.gate?.lastRunAt) {
+    throw new GateNotReadyError(`proposal ${proposal.id} has no gate run on record`);
+  }
+  const ageMs = Date.now() - Date.parse(proposal.gate.lastRunAt);
+  if (!Number.isFinite(ageMs) || ageMs > GATE_FRESHNESS_MS) {
+    throw new GateNotReadyError(
+      `proposal ${proposal.id} gate run is older than 24h; re-run before approving`
+    );
+  }
+}
+async function promoteNewSkill(projectPath, proposal) {
+  const target = skillDir(projectPath, proposal.content.name);
+  if (fs12.existsSync(target)) {
+    throw new PromotionError(
+      `a catalog skill already exists at ${target}; use a refinement proposal to update it`
+    );
+  }
+  fs12.mkdirSync(target, { recursive: true });
+  const yamlOut = injectProvenanceIntoYaml(proposal.content.skillYaml ?? "", proposal.id);
+  fs12.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
+  fs12.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
+  return { skillPath: target };
+}
+async function promoteRefinement(projectPath, proposal) {
+  if (!proposal.targetSkill) {
+    throw new PromotionError("refinement proposal is missing targetSkill");
+  }
+  const target = skillDir(projectPath, proposal.targetSkill);
+  if (!fs12.existsSync(target)) {
+    throw new PromotionError(
+      `target skill ${proposal.targetSkill} does not exist at ${target}; cannot refine`
+    );
+  }
+  const yamlPath = path13.join(target, "skill.yaml");
+  const before = readIfExists(yamlPath) ?? "";
+  const after = injectProvenanceIntoYaml(before, proposal.id);
+  if (after === before) {
+    throw new PromotionError(
+      "no metadata changes detected; check that the reviewer applied the proposed diff before approving"
+    );
+  }
+  fs12.writeFileSync(yamlPath, after);
+  return { skillPath: target };
+}
+async function promote(projectPath, proposalId, decidedBy) {
+  const proposal = await getProposal2(projectPath, proposalId);
+  if (!proposal) throw new ProposalNotFoundError2(proposalId);
+  assertGateReady(proposal);
+  const out = proposal.kind === "new-skill" ? await promoteNewSkill(projectPath, proposal) : await promoteRefinement(projectPath, proposal);
+  await updateProposal2(projectPath, proposalId, {
+    status: "approved",
+    decision: {
+      decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      decidedBy,
+      action: "approved"
+    }
+  });
+  return {
+    proposalId,
+    skillPath: out.skillPath,
+    provenance: "agent-proposed"
+  };
+}
+
+// src/proposals/events.ts
+function emit3(bus, topic, data) {
+  bus.emit(topic, data);
+}
+function emitProposalCreated(bus, proposal) {
+  const data = {
+    id: proposal.id,
+    kind: proposal.kind,
+    name: proposal.content.name,
+    proposedBy: proposal.proposedBy,
+    justification: proposal.source.justification
+  };
+  if (proposal.targetSkill) data.targetSkill = proposal.targetSkill;
+  emit3(bus, "proposal.created", data);
+}
+function emitProposalApproved(bus, proposal) {
+  const data = {
+    id: proposal.id,
+    kind: proposal.kind,
+    name: proposal.content.name,
+    decidedBy: proposal.decision?.decidedBy ?? "(unknown)"
+  };
+  if (proposal.targetSkill) data.targetSkill = proposal.targetSkill;
+  emit3(bus, "proposal.approved", data);
+}
+function emitProposalRejected(bus, proposal) {
+  const data = {
+    id: proposal.id,
+    kind: proposal.kind,
+    name: proposal.content.name,
+    decidedBy: proposal.decision?.decidedBy ?? "(unknown)",
+    reason: proposal.decision?.reason ?? "(no reason given)"
+  };
+  emit3(bus, "proposal.rejected", data);
+}
+
+// src/server/routes/v1/proposals.ts
+var LIST_RE = /^\/api\/v1\/proposals(?:\?.*)?$/;
+var SINGLE_RE = /^\/api\/v1\/proposals\/([^/?]+)(?:\?.*)?$/;
+var RUN_GATE_RE = /^\/api\/v1\/proposals\/([^/?]+)\/run-gate(?:\?.*)?$/;
+var APPROVE_RE = /^\/api\/v1\/proposals\/([^/?]+)\/approve(?:\?.*)?$/;
+var REJECT_RE = /^\/api\/v1\/proposals\/([^/?]+)\/reject(?:\?.*)?$/;
+var ProposalStatusValues = [
+  "open",
+  "gate-running",
+  "gate-failed",
+  "approved",
+  "rejected"
+];
+var RejectBody = z13.object({
+  reason: z13.string().min(1).max(280)
+});
+function sendJSON8(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function getDecidedBy(req, deps) {
+  if (deps.decidedByResolver) return deps.decidedByResolver(req);
+  const token = req._authToken;
+  return token?.id ?? "unknown";
+}
+function parseStatusFromQuery(url) {
+  const queryIdx = url.indexOf("?");
+  if (queryIdx === -1) return void 0;
+  const params = new URLSearchParams(url.slice(queryIdx + 1));
+  const raw = params.get("status");
+  if (!raw) return void 0;
+  if (raw === "all") return "all";
+  if (ProposalStatusValues.includes(raw)) return raw;
+  return void 0;
+}
+async function handleList(req, res, deps) {
+  const url = req.url ?? "";
+  const status = parseStatusFromQuery(url);
+  const proposals = await listProposals(deps.projectPath, status ? { status } : {});
+  sendJSON8(res, 200, proposals);
+}
+async function handleGet(res, deps, id) {
+  const proposal = await getProposal3(deps.projectPath, id);
+  if (!proposal) {
+    sendJSON8(res, 404, { error: "Proposal not found" });
+    return;
+  }
+  sendJSON8(res, 200, proposal);
+}
+async function handleRunGate(res, deps, id) {
+  try {
+    const result = await runGate(deps.projectPath, id);
+    sendJSON8(res, 200, result);
+  } catch (err) {
+    if (err instanceof ProposalNotFoundError3) {
+      sendJSON8(res, 404, { error: err.message });
+      return;
+    }
+    if (err instanceof GateRunError) {
+      sendJSON8(res, 409, { error: err.message });
+      return;
+    }
+    sendJSON8(res, 500, {
+      error: "gate run failed",
+      detail: err instanceof Error ? err.message : "unknown"
+    });
+  }
+}
+async function handleApprove(req, res, deps, id) {
+  const decidedBy = getDecidedBy(req, deps);
+  try {
+    const result = await promote(deps.projectPath, id, decidedBy);
+    const proposal = await getProposal3(deps.projectPath, id);
+    if (proposal) emitProposalApproved(deps.bus, proposal);
+    sendJSON8(res, 200, { promotion: result, proposal });
+  } catch (err) {
+    if (err instanceof ProposalNotFoundError3) {
+      sendJSON8(res, 404, { error: err.message });
+      return;
+    }
+    if (err instanceof GateNotReadyError) {
+      sendJSON8(res, 409, { error: err.message });
+      return;
+    }
+    if (err instanceof PromotionError) {
+      sendJSON8(res, 422, { error: err.message });
+      return;
+    }
+    sendJSON8(res, 500, {
+      error: "approve failed",
+      detail: err instanceof Error ? err.message : "unknown"
+    });
+  }
+}
+async function handleReject(req, res, deps, id) {
+  let raw;
+  try {
+    raw = await readBody(req);
+  } catch (err) {
+    sendJSON8(res, 413, { error: err instanceof Error ? err.message : "Body too large" });
+    return;
+  }
+  let json;
+  try {
+    json = raw.length > 0 ? JSON.parse(raw) : {};
+  } catch {
+    sendJSON8(res, 400, { error: "Invalid JSON body" });
+    return;
+  }
+  const parsed = RejectBody.safeParse(json);
+  if (!parsed.success) {
+    sendJSON8(res, 400, { error: "Invalid body", issues: parsed.error.issues });
+    return;
+  }
+  const proposal = await getProposal3(deps.projectPath, id);
+  if (!proposal) {
+    sendJSON8(res, 404, { error: "Proposal not found" });
+    return;
+  }
+  if (proposal.status === "approved" || proposal.status === "rejected") {
+    sendJSON8(res, 409, {
+      error: `proposal already ${proposal.status}; cannot reject`
+    });
+    return;
+  }
+  const decidedBy = getDecidedBy(req, deps);
+  const updated = await updateProposal3(deps.projectPath, id, {
+    status: "rejected",
+    decision: {
+      decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      decidedBy,
+      action: "rejected",
+      reason: parsed.data.reason
+    }
+  });
+  emitProposalRejected(deps.bus, updated);
+  sendJSON8(res, 200, updated);
+}
+async function handleEdit(req, res, deps, id) {
+  let raw;
+  try {
+    raw = await readBody(req);
+  } catch (err) {
+    sendJSON8(res, 413, { error: err instanceof Error ? err.message : "Body too large" });
+    return;
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    sendJSON8(res, 400, { error: "Invalid JSON body" });
+    return;
+  }
+  const parsed = EditProposalInputSchema.safeParse(json);
+  if (!parsed.success) {
+    sendJSON8(res, 400, { error: "Invalid body", issues: parsed.error.issues });
+    return;
+  }
+  const existing = await getProposal3(deps.projectPath, id);
+  if (!existing) {
+    sendJSON8(res, 404, { error: "Proposal not found" });
+    return;
+  }
+  if (existing.status === "approved" || existing.status === "rejected") {
+    sendJSON8(res, 409, {
+      error: `proposal already ${existing.status}; cannot edit`
+    });
+    return;
+  }
+  const mergedContent = {
+    ...existing.content,
+    ...parsed.data.content,
+    name: parsed.data.content.name ?? existing.content.name,
+    description: parsed.data.content.description ?? existing.content.description
+  };
+  try {
+    const updated = await updateProposal3(deps.projectPath, id, {
+      content: mergedContent,
+      status: "open",
+      gate: void 0
+    });
+    sendJSON8(res, 200, updated);
+  } catch (err) {
+    sendJSON8(res, 422, {
+      error: "edit failed",
+      detail: err instanceof Error ? err.message : "unknown"
+    });
+  }
+}
+function handleV1ProposalsRoute(req, res, deps) {
+  const url = req.url ?? "";
+  const method = req.method ?? "GET";
+  if (method === "GET" && LIST_RE.test(url)) {
+    void handleList(req, res, deps);
+    return true;
+  }
+  const runGateMatch = method === "POST" ? RUN_GATE_RE.exec(url) : null;
+  if (runGateMatch) {
+    void handleRunGate(res, deps, runGateMatch[1]);
+    return true;
+  }
+  const approveMatch = method === "POST" ? APPROVE_RE.exec(url) : null;
+  if (approveMatch) {
+    void handleApprove(req, res, deps, approveMatch[1]);
+    return true;
+  }
+  const rejectMatch = method === "POST" ? REJECT_RE.exec(url) : null;
+  if (rejectMatch) {
+    void handleReject(req, res, deps, rejectMatch[1]);
+    return true;
+  }
+  if (method === "PATCH") {
+    const m = SINGLE_RE.exec(url);
+    if (m) {
+      void handleEdit(req, res, deps, m[1]);
+      return true;
+    }
+  }
+  if (method === "GET") {
+    const m = SINGLE_RE.exec(url);
+    if (m) {
+      void handleGet(res, deps, m[1]);
+      return true;
+    }
+  }
+  return false;
+}
+
+// src/server/routes/v1/routing.ts
+import { z as z14 } from "zod";
+var CONFIG_RE = /^\/api\/v1\/routing\/config(?:\?.*)?$/;
+var DECISIONS_RE = /^\/api\/v1\/routing\/decisions(?:\?.*)?$/;
+var TRACE_RE = /^\/api\/v1\/routing\/trace(?:\?.*)?$/;
+function sendJSON9(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function unavailable(res) {
+  sendJSON9(res, 503, { error: "BackendRouter not available" });
+  return true;
+}
+function resolveChain(value, backends) {
+  return toArray(value).map((c) => ({ candidate: c, exists: c in backends }));
+}
+function buildResolvedChains(routing, backends) {
+  const out = {};
+  out["default"] = resolveChain(routing.default, backends);
+  for (const tier of ["quick-fix", "guided-change", "full-exploration", "diagnostic"]) {
+    const v = routing[tier];
+    if (v !== void 0) out[`tier:${tier}`] = resolveChain(v, backends);
+  }
+  if (routing.intelligence) {
+    for (const [layer, v] of Object.entries(routing.intelligence)) {
+      if (v !== void 0) out[`intelligence:${layer}`] = resolveChain(v, backends);
+    }
+  }
+  if (routing.isolation) {
+    for (const [tier, v] of Object.entries(routing.isolation)) {
+      if (v !== void 0) out[`isolation:${tier}`] = resolveChain(v, backends);
+    }
+  }
+  if (routing.skills) {
+    for (const [name, v] of Object.entries(routing.skills)) {
+      if (v !== void 0) out[`skill:${name}`] = resolveChain(v, backends);
+    }
+  }
+  if (routing.modes) {
+    for (const [mode, v] of Object.entries(routing.modes)) {
+      if (v !== void 0) out[`mode:${mode}`] = resolveChain(v, backends);
+    }
+  }
+  return out;
+}
+function handleConfig(res, deps) {
+  if (!deps.router || !deps.routing || !deps.backends) return unavailable(res);
+  sendJSON9(res, 200, {
+    routing: deps.routing,
+    resolvedChains: buildResolvedChains(deps.routing, deps.backends),
+    backends: Object.keys(deps.backends)
+  });
+  return true;
+}
+function parseDecisionsQuery(url) {
+  const qIdx = url.indexOf("?");
+  if (qIdx === -1) return {};
+  const p = new URLSearchParams(url.slice(qIdx + 1));
+  const filter = {};
+  const skill = p.get("skill");
+  const mode = p.get("mode");
+  const backend = p.get("backend");
+  const limit = p.get("limit");
+  if (skill) filter.skillName = skill;
+  if (mode) filter.mode = mode;
+  if (backend) filter.backendName = backend;
+  if (limit) {
+    const n = Number(limit);
+    if (Number.isFinite(n) && n > 0) filter.limit = Math.floor(n);
+  }
+  return filter;
+}
+function handleDecisions(req, res, deps) {
+  if (!deps.bus) return unavailable(res);
+  const filter = parseDecisionsQuery(req.url ?? "");
+  sendJSON9(res, 200, { decisions: deps.bus.recent(filter) });
+  return true;
+}
+var UseCaseSchema = z14.discriminatedUnion("kind", [
+  z14.object({
+    kind: z14.literal("tier"),
+    tier: z14.enum(["quick-fix", "guided-change", "full-exploration", "diagnostic"])
+  }),
+  z14.object({ kind: z14.literal("intelligence"), layer: z14.enum(["sel", "pesl"]) }),
+  z14.object({ kind: z14.literal("isolation"), tier: z14.string() }),
+  z14.object({ kind: z14.literal("maintenance") }),
+  z14.object({ kind: z14.literal("chat") }),
+  z14.object({
+    kind: z14.literal("skill"),
+    skillName: z14.string().min(1),
+    cognitiveMode: z14.string().optional()
+  }),
+  z14.object({ kind: z14.literal("mode"), cognitiveMode: z14.string().min(1) })
+]);
+var TraceBodySchema = z14.object({
+  useCase: UseCaseSchema,
+  invocationOverride: z14.string().min(1).optional()
+});
+async function handleTrace(req, res, deps) {
+  if (!deps.routing || !deps.backends) {
+    unavailable(res);
+    return true;
+  }
+  let raw;
+  try {
+    raw = await readBody(req);
+  } catch {
+    sendJSON9(res, 400, { error: "body read failed" });
+    return true;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    sendJSON9(res, 400, { error: "invalid JSON body" });
+    return true;
+  }
+  const r = TraceBodySchema.safeParse(parsed);
+  if (!r.success) {
+    sendJSON9(res, 400, { error: r.error.message });
+    return true;
+  }
+  const opts = r.data.invocationOverride !== void 0 ? { invocationOverride: r.data.invocationOverride } : void 0;
+  try {
+    const dryRunRouter = new BackendRouter({
+      backends: deps.backends,
+      routing: deps.routing
+    });
+    const { decision, def } = dryRunRouter.resolveDecisionAndDef(
+      r.data.useCase,
+      opts
+    );
+    sendJSON9(res, 200, { decision, def: { type: def.type } });
+  } catch (err) {
+    sendJSON9(res, 500, { error: String(err) });
+  }
+  return true;
+}
+function handleV1RoutingRoute(req, res, deps) {
+  const url = req.url ?? "";
+  const method = req.method ?? "GET";
+  if (method === "GET" && CONFIG_RE.test(url)) return handleConfig(res, deps);
+  if (method === "GET" && DECISIONS_RE.test(url)) return handleDecisions(req, res, deps);
+  if (method === "POST" && TRACE_RE.test(url)) {
+    void handleTrace(req, res, deps);
+    return true;
+  }
+  return false;
+}
+
+// src/server/routes/sessions.ts
+import * as fs13 from "fs/promises";
+import * as path14 from "path";
+import { z as z15 } from "zod";
+var SessionCreateSchema = z15.object({
+  sessionId: z15.string().min(1)
+}).passthrough();
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isSafeId(id) {
+  return UUID_RE2.test(id) || path14.basename(id) === id && !id.includes("..");
+}
+function jsonResponse(res, status, data) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(data));
+}
+function extractSessionId(url) {
+  const segments = new URL(url, "http://localhost").pathname.split(path14.posix.sep);
+  const id = segments.pop();
+  return id && id !== "sessions" ? id : null;
+}
+async function handleList2(res, sessionsDir) {
+  try {
+    const entries = await fs13.readdir(sessionsDir, { withFileTypes: true });
+    const sessions = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      try {
+        const content = await fs13.readFile(
+          path14.join(sessionsDir, entry.name, "session.json"),
+          "utf-8"
+        );
+        sessions.push(JSON.parse(content));
+      } catch {
+      }
+    }
+    sessions.sort(
+      (a, b) => new Date(b.lastActiveAt).getTime() - new Date(a.lastActiveAt).getTime()
+    );
+    jsonResponse(res, 200, sessions);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      jsonResponse(res, 200, []);
+      return;
+    }
+    jsonResponse(res, 500, { error: "Failed to list sessions" });
+  }
+}
+async function handleGet2(res, id, sessionsDir) {
+  if (!isSafeId(id)) {
+    jsonResponse(res, 400, { error: "Invalid sessionId" });
+    return;
+  }
+  try {
+    const content = await fs13.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
+    jsonResponse(res, 200, JSON.parse(content));
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      jsonResponse(res, 404, { error: "Session not found" });
+      return;
+    }
+    jsonResponse(res, 500, { error: "Failed to read session" });
+  }
+}
+async function handleCreate(req, res, sessionsDir) {
+  try {
+    const body = await readBody(req);
+    const result = SessionCreateSchema.safeParse(JSON.parse(body));
+    if (!result.success) {
+      jsonResponse(res, 400, { error: "Missing sessionId" });
+      return;
+    }
+    const session = result.data;
+    if (!isSafeId(session.sessionId)) {
+      jsonResponse(res, 400, { error: "Invalid sessionId" });
+      return;
+    }
+    const sessionDir = path14.join(sessionsDir, session.sessionId);
+    await fs13.mkdir(sessionDir, { recursive: true });
+    await fs13.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
+    jsonResponse(res, 200, { ok: true });
+  } catch {
+    jsonResponse(res, 500, { error: "Failed to save session" });
   }
 }
 async function handleUpdate(req, res, url, sessionsDir) {
@@ -7552,10 +8574,10 @@ async function handleUpdate(req, res, url, sessionsDir) {
       return;
     }
     const body = await readBody(req);
-    const updates = z13.record(z13.unknown()).parse(JSON.parse(body));
-    const sessionFilePath = path11.join(sessionsDir, id, "session.json");
-    const current = JSON.parse(await fs11.readFile(sessionFilePath, "utf-8"));
-    await fs11.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
+    const updates = z15.record(z15.unknown()).parse(JSON.parse(body));
+    const sessionFilePath = path14.join(sessionsDir, id, "session.json");
+    const current = JSON.parse(await fs13.readFile(sessionFilePath, "utf-8"));
+    await fs13.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to update session" });
@@ -7568,7 +8590,7 @@ async function handleDelete(res, url, sessionsDir) {
       jsonResponse(res, 400, { error: "Missing or invalid sessionId" });
       return;
     }
-    await fs11.rm(path11.join(sessionsDir, id), { recursive: true, force: true });
+    await fs13.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to delete session" });
@@ -7581,8 +8603,8 @@ function handleSessionsRoute(req, res, sessionsDir) {
   switch (method) {
     case "GET": {
       const id = extractSessionId(url);
-      if (id) void handleGet(res, id, sessionsDir);
-      else void handleList(res, sessionsDir);
+      if (id) void handleGet2(res, id, sessionsDir);
+      else void handleList2(res, sessionsDir);
       return true;
     }
     case "POST":
@@ -7672,20 +8694,20 @@ function handleStreamsRoute(req, res, recorder) {
 }
 
 // src/server/routes/auth.ts
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 import {
   TokenScopeSchema,
   BridgeKindSchema,
   AuthTokenPublicSchema
 } from "@harness-engineering/types";
-var CreateBodySchema = z14.object({
-  name: z14.string().min(1).max(100),
-  scopes: z14.array(TokenScopeSchema).min(1),
+var CreateBodySchema = z16.object({
+  name: z16.string().min(1).max(100),
+  scopes: z16.array(TokenScopeSchema).min(1),
   bridgeKind: BridgeKindSchema.optional(),
-  tenantId: z14.string().optional(),
-  expiresAt: z14.string().datetime().optional()
+  tenantId: z16.string().optional(),
+  expiresAt: z16.string().datetime().optional()
 });
-function sendJSON8(res, status, body) {
+function sendJSON10(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -7695,19 +8717,19 @@ async function handlePost(req, res, store) {
     raw = await readBody(req);
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to read body";
-    sendJSON8(res, 413, { error: msg });
+    sendJSON10(res, 413, { error: msg });
     return;
   }
   let json;
   try {
     json = JSON.parse(raw);
   } catch {
-    sendJSON8(res, 400, { error: "Invalid JSON body" });
+    sendJSON10(res, 400, { error: "Invalid JSON body" });
     return;
   }
   const parsed = CreateBodySchema.safeParse(json);
   if (!parsed.success) {
-    sendJSON8(res, 422, { error: "Invalid body", issues: parsed.error.issues });
+    sendJSON10(res, 422, { error: "Invalid body", issues: parsed.error.issues });
     return;
   }
   try {
@@ -7720,37 +8742,37 @@ async function handlePost(req, res, store) {
     if (parsed.data.expiresAt !== void 0) input.expiresAt = parsed.data.expiresAt;
     const result = await store.create(input);
     const publicRecord = AuthTokenPublicSchema.parse(result.record);
-    sendJSON8(res, 200, {
+    sendJSON10(res, 200, {
       ...publicRecord,
       token: result.token
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : "Failed to create token";
     if (msg.includes("already exists")) {
-      sendJSON8(res, 409, { error: msg });
+      sendJSON10(res, 409, { error: msg });
       return;
     }
-    sendJSON8(res, 500, { error: "Internal error creating token" });
+    sendJSON10(res, 500, { error: "Internal error creating token" });
   }
 }
-async function handleList2(res, store) {
+async function handleList3(res, store) {
   try {
     const list = await store.list();
-    sendJSON8(res, 200, list);
+    sendJSON10(res, 200, list);
   } catch {
-    sendJSON8(res, 500, { error: "Internal error listing tokens" });
+    sendJSON10(res, 500, { error: "Internal error listing tokens" });
   }
 }
 async function handleDelete2(res, store, id) {
   try {
     const ok = await store.revoke(id);
     if (!ok) {
-      sendJSON8(res, 404, { error: "Token not found" });
+      sendJSON10(res, 404, { error: "Token not found" });
       return;
     }
-    sendJSON8(res, 200, { deleted: true });
+    sendJSON10(res, 200, { deleted: true });
   } catch {
-    sendJSON8(res, 500, { error: "Internal error revoking token" });
+    sendJSON10(res, 500, { error: "Internal error revoking token" });
   }
 }
 var DELETE_PATH_RE2 = /^\/api\/v1\/auth\/tokens\/([^/?]+)(?:\?.*)?$/;
@@ -7764,7 +8786,7 @@ function handleAuthRoute(req, res, store) {
     return true;
   }
   if (method === "GET" && pathname === "/api/v1/auth/tokens") {
-    void handleList2(res, store);
+    void handleList3(res, store);
     return true;
   }
   if (method === "DELETE") {
@@ -7775,12 +8797,12 @@ function handleAuthRoute(req, res, store) {
       return true;
     }
   }
-  sendJSON8(res, 405, { error: "Method not allowed" });
+  sendJSON10(res, 405, { error: "Method not allowed" });
   return true;
 }
 
 // src/server/routes/local-model.ts
-function sendJSON9(res, status, body) {
+function sendJSON11(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
@@ -7788,36 +8810,36 @@ function handleLocalModelRoute(req, res, getStatus) {
   const { method, url } = req;
   if (url !== "/api/v1/local-model/status") return false;
   if (method !== "GET") {
-    sendJSON9(res, 405, { error: "Method not allowed" });
+    sendJSON11(res, 405, { error: "Method not allowed" });
     return true;
   }
   if (!getStatus) {
-    sendJSON9(res, 503, { error: "Local backend not configured" });
+    sendJSON11(res, 503, { error: "Local backend not configured" });
     return true;
   }
   const status = getStatus();
   if (!status) {
-    sendJSON9(res, 503, { error: "Local backend not configured" });
+    sendJSON11(res, 503, { error: "Local backend not configured" });
     return true;
   }
-  sendJSON9(res, 200, status);
+  sendJSON11(res, 200, status);
   return true;
 }
 function handleLocalModelsRoute(req, res, getStatuses) {
   const { method, url } = req;
   if (url !== "/api/v1/local-models/status") return false;
   if (method !== "GET") {
-    sendJSON9(res, 405, { error: "Method not allowed" });
+    sendJSON11(res, 405, { error: "Method not allowed" });
     return true;
   }
   const statuses = getStatuses ? getStatuses() : [];
-  sendJSON9(res, 200, statuses);
+  sendJSON11(res, 200, statuses);
   return true;
 }
 
 // src/server/static.ts
-import * as fs12 from "fs";
-import * as path12 from "path";
+import * as fs14 from "fs";
+import * as path15 from "path";
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript; charset=utf-8",
@@ -7837,29 +8859,29 @@ var MIME_TYPES = {
 function handleStaticFile(req, res, dashboardDir) {
   const { method, url } = req;
   if (method !== "GET") return false;
-  const apiPrefix = path12.posix.join(path12.posix.sep, "api", path12.posix.sep);
-  const wsPath = path12.posix.join(path12.posix.sep, "ws");
+  const apiPrefix = path15.posix.join(path15.posix.sep, "api", path15.posix.sep);
+  const wsPath = path15.posix.join(path15.posix.sep, "ws");
   if (url?.startsWith(apiPrefix) || url === wsPath) return false;
   const urlPath = new URL(url ?? "/", "http://localhost").pathname;
-  const requestedPath = path12.join(dashboardDir, urlPath === "/" ? "index.html" : urlPath);
-  const resolved = path12.resolve(requestedPath);
-  if (!resolved.startsWith(path12.resolve(dashboardDir))) {
-    return serveFile(path12.join(dashboardDir, "index.html"), res);
+  const requestedPath = path15.join(dashboardDir, urlPath === "/" ? "index.html" : urlPath);
+  const resolved = path15.resolve(requestedPath);
+  if (!resolved.startsWith(path15.resolve(dashboardDir))) {
+    return serveFile(path15.join(dashboardDir, "index.html"), res);
   }
-  if (fs12.existsSync(resolved) && fs12.statSync(resolved).isFile()) {
+  if (fs14.existsSync(resolved) && fs14.statSync(resolved).isFile()) {
     return serveFile(resolved, res);
   }
-  const indexPath = path12.join(dashboardDir, "index.html");
-  if (fs12.existsSync(indexPath)) {
+  const indexPath = path15.join(dashboardDir, "index.html");
+  if (fs14.existsSync(indexPath)) {
     return serveFile(indexPath, res);
   }
   return false;
 }
 function serveFile(filePath, res) {
-  const ext = path12.extname(filePath).toLowerCase();
+  const ext = path15.extname(filePath).toLowerCase();
   const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
   try {
-    const content = fs12.readFileSync(filePath);
+    const content = fs14.readFileSync(filePath);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
     return true;
@@ -7869,8 +8891,8 @@ function serveFile(filePath, res) {
 }
 
 // src/server/plan-watcher.ts
-import * as fs13 from "fs";
-import * as path13 from "path";
+import * as fs15 from "fs";
+import * as path16 from "path";
 var PlanWatcher = class {
   plansDir;
   queue;
@@ -7884,11 +8906,11 @@ var PlanWatcher = class {
    * Creates the directory if it does not exist.
    */
   start() {
-    fs13.mkdirSync(this.plansDir, { recursive: true });
-    this.watcher = fs13.watch(this.plansDir, (eventType, filename) => {
+    fs15.mkdirSync(this.plansDir, { recursive: true });
+    this.watcher = fs15.watch(this.plansDir, (eventType, filename) => {
       if (eventType === "rename" && filename && filename.endsWith(".md")) {
-        const filePath = path13.join(this.plansDir, filename);
-        if (fs13.existsSync(filePath)) {
+        const filePath = path16.join(this.plansDir, filename);
+        if (fs15.existsSync(filePath)) {
           void this.handleNewPlan(filename);
         }
       }
@@ -7921,7 +8943,7 @@ var PlanWatcher = class {
 // src/auth/tokens.ts
 import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
 import { readFile as readFile8, writeFile as writeFile8, mkdir as mkdir7, rename as rename2 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 import bcrypt from "bcryptjs";
 import {
   AuthTokenSchema,
@@ -7941,8 +8963,8 @@ function parseToken(raw) {
   return { id: raw.slice(0, dot), secret: raw.slice(dot + 1) };
 }
 var TokenStore = class {
-  constructor(path19) {
-    this.path = path19;
+  constructor(path24) {
+    this.path = path24;
   }
   path;
   cache = null;
@@ -7963,7 +8985,7 @@ var TokenStore = class {
     return this.cache;
   }
   async persist(records) {
-    await mkdir7(dirname4(this.path), { recursive: true });
+    await mkdir7(dirname5(this.path), { recursive: true });
     const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}`;
     await writeFile8(tmp, JSON.stringify(records, null, 2), "utf8");
     await rename2(tmp, this.path);
@@ -8046,11 +9068,11 @@ var TokenStore = class {
 
 // src/auth/audit.ts
 import { appendFile, mkdir as mkdir8 } from "fs/promises";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 import { AuthAuditEntrySchema } from "@harness-engineering/types";
 var AuditLogger = class {
-  constructor(path19, opts = {}) {
-    this.path = path19;
+  constructor(path24, opts = {}) {
+    this.path = path24;
     this.opts = opts;
   }
   path;
@@ -8077,7 +9099,7 @@ var AuditLogger = class {
   async writeLine(line) {
     try {
       if (this.opts.createDir !== false && !this.dirEnsured) {
-        await mkdir8(dirname5(this.path), { recursive: true });
+        await mkdir8(dirname6(this.path), { recursive: true });
         this.dirEnsured = true;
       }
       await appendFile(this.path, line, "utf8");
@@ -8134,20 +9156,79 @@ var V1_BRIDGE_ROUTES = [
     scope: "subscribe-webhook",
     description: "Webhook delivery queue depth + DLQ stats."
   },
+  // Hermes Phase 4 — skill proposal review queue.
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/proposals(?:\?.*)?$/,
+    scope: "read-status",
+    description: "List skill proposals (open + decided)."
+  },
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/proposals\/[^/]+(?:\?.*)?$/,
+    scope: "read-status",
+    description: "Get a single skill proposal."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/proposals\/[^/]+\/run-gate(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Run the soundness-review gate against a proposal."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/proposals\/[^/]+\/approve(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Approve a proposal \u2014 promotes the skill into the catalog."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/proposals\/[^/]+\/reject(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Reject a proposal with a one-line reason."
+  },
+  {
+    method: "PATCH",
+    pattern: /^\/api\/v1\/proposals\/[^/]+(?:\?.*)?$/,
+    scope: "manage-proposals",
+    description: "Edit proposal content (resets gate to not-run)."
+  },
   // ── Phase 5 bridge primitives ──
   {
     method: "GET",
     pattern: /^\/api\/v1\/telemetry\/cache\/stats(?:\?.*)?$/,
     scope: "read-telemetry",
     description: "Prompt-cache hit/miss snapshot (rolling window)."
+  },
+  // ── Spec B Phase 5 routing observability ──
+  // D-OP-1: all three reuse `read-telemetry` — matches the cacheMetrics
+  // precedent (read-only observability). A dedicated `read-routing`
+  // scope was rejected to avoid a TokenScopeSchema + ADR cascade.
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/routing\/config(?:\?.*)?$/,
+    scope: "read-telemetry",
+    description: "Current routing config + resolved fallback chains + known backends."
+  },
+  {
+    method: "GET",
+    pattern: /^\/api\/v1\/routing\/decisions(?:\?.*)?$/,
+    scope: "read-telemetry",
+    description: "Recent routing decisions (newest-first), filterable by skill/mode/backend."
+  },
+  {
+    method: "POST",
+    pattern: /^\/api\/v1\/routing\/trace(?:\?.*)?$/,
+    scope: "read-telemetry",
+    description: "Dry-run a routing decision without side effects (no bus emit, no dispatch)."
   }
 ];
 function isV1Bridge(method, url) {
   return V1_BRIDGE_ROUTES.some((r) => r.method === method && r.pattern.test(url));
 }
-function requiredBridgeScope(method, path19) {
+function requiredBridgeScope(method, path24) {
   for (const r of V1_BRIDGE_ROUTES) {
-    if (r.method === method && r.pattern.test(path19)) return r.scope;
+    if (r.method === method && r.pattern.test(path24)) return r.scope;
   }
   return null;
 }
@@ -8157,24 +9238,24 @@ function hasScope(held, required) {
   if (held.includes("admin")) return true;
   return held.includes(required);
 }
-function requiredScopeForRoute(method, path19) {
-  const bridgeScope = requiredBridgeScope(method, path19);
+function requiredScopeForRoute(method, path24) {
+  const bridgeScope = requiredBridgeScope(method, path24);
   if (bridgeScope) return bridgeScope;
-  if (path19 === "/api/v1/auth/token" && method === "POST") return "admin";
-  if (path19 === "/api/v1/auth/tokens" && method === "GET") return "admin";
-  if (/^\/api\/v1\/auth\/tokens\/[^/]+$/.test(path19) && method === "DELETE") return "admin";
-  if ((path19 === "/api/state" || path19 === "/api/v1/state") && method === "GET") return "read-status";
-  if (path19.startsWith("/api/interactions")) return "resolve-interaction";
-  if (path19.startsWith("/api/plans")) return "read-status";
-  if (path19.startsWith("/api/analyze") || path19.startsWith("/api/analyses")) return "read-status";
-  if (path19.startsWith("/api/roadmap-actions")) return "modify-roadmap";
-  if (path19.startsWith("/api/dispatch-actions")) return "trigger-job";
-  if (path19.startsWith("/api/local-model") || path19.startsWith("/api/local-models"))
+  if (path24 === "/api/v1/auth/token" && method === "POST") return "admin";
+  if (path24 === "/api/v1/auth/tokens" && method === "GET") return "admin";
+  if (/^\/api\/v1\/auth\/tokens\/[^/]+$/.test(path24) && method === "DELETE") return "admin";
+  if ((path24 === "/api/state" || path24 === "/api/v1/state") && method === "GET") return "read-status";
+  if (path24.startsWith("/api/interactions")) return "resolve-interaction";
+  if (path24.startsWith("/api/plans")) return "read-status";
+  if (path24.startsWith("/api/analyze") || path24.startsWith("/api/analyses")) return "read-status";
+  if (path24.startsWith("/api/roadmap-actions")) return "modify-roadmap";
+  if (path24.startsWith("/api/dispatch-actions")) return "trigger-job";
+  if (path24.startsWith("/api/local-model") || path24.startsWith("/api/local-models"))
     return "read-status";
-  if (path19.startsWith("/api/maintenance")) return "trigger-job";
-  if (path19.startsWith("/api/streams")) return "read-status";
-  if (path19.startsWith("/api/sessions")) return "read-status";
-  if (path19.startsWith("/api/chat-proxy")) return "trigger-job";
+  if (path24.startsWith("/api/maintenance")) return "trigger-job";
+  if (path24.startsWith("/api/streams")) return "read-status";
+  if (path24.startsWith("/api/sessions")) return "read-status";
+  if (path24.startsWith("/api/chat-proxy")) return "trigger-job";
   return null;
 }
 
@@ -8228,11 +9309,25 @@ var OrchestratorServer = class {
   roadmapPath;
   dispatchAdHoc;
   sessionsDir;
+  /**
+   * Project root used by file-backed routes (Phase 4 proposals at
+   * `.harness/proposals/`). Defaults to process.cwd().
+   */
+  projectPath;
   maintenanceDeps = null;
   getLocalModelStatus = null;
   getLocalModelStatuses = null;
   webhooks;
   cacheMetrics;
+  // Spec B Phase 5 — routing observability accessor closures + the WS
+  // broadcaster unsubscribe handle (D-OP-4 dual safety net: server.stop()
+  // calls it explicitly; clearListeners in Orchestrator.stop() is the
+  // belt-and-suspenders second line).
+  getBackendRouterFn = null;
+  getRoutingDecisionBusFn = null;
+  getRoutingConfigFn = null;
+  getBackendsFn = null;
+  routingDecisionUnsubscribe = null;
   recorder = null;
   planWatcher = null;
   tokenStore;
@@ -8245,8 +9340,8 @@ var OrchestratorServer = class {
     this.orchestrator = orchestrator;
     this.port = port;
     this.initDependencies(deps);
-    const tokensPath = process.env["HARNESS_TOKENS_PATH"] ?? path14.resolve(".harness", "tokens.json");
-    const auditPath = process.env["HARNESS_AUDIT_PATH"] ?? path14.resolve(".harness", "audit.log");
+    const tokensPath = process.env["HARNESS_TOKENS_PATH"] ?? path17.resolve(".harness", "tokens.json");
+    const auditPath = process.env["HARNESS_AUDIT_PATH"] ?? path17.resolve(".harness", "audit.log");
     this.tokenStore = new TokenStore(tokensPath);
     this.auditLogger = new AuditLogger(auditPath);
     this.httpServer = http.createServer(this.handleRequest.bind(this));
@@ -8259,19 +9354,24 @@ var OrchestratorServer = class {
   }
   initDependencies(deps) {
     this.interactionQueue = deps?.interactionQueue;
-    this.plansDir = deps?.plansDir ?? path14.resolve("docs", "plans");
-    this.dashboardDir = deps?.dashboardDir ?? path14.resolve("packages", "dashboard", "dist", "client");
+    this.plansDir = deps?.plansDir ?? path17.resolve("docs", "plans");
+    this.dashboardDir = deps?.dashboardDir ?? path17.resolve("packages", "dashboard", "dist", "client");
     this.claudeCommand = deps?.claudeCommand ?? "claude";
     this.pipeline = deps?.pipeline ?? null;
     this.analysisArchive = deps?.analysisArchive;
     this.roadmapPath = deps?.roadmapPath ?? null;
     this.dispatchAdHoc = deps?.dispatchAdHoc ?? null;
-    this.sessionsDir = deps?.sessionsDir ?? path14.resolve(".harness", "sessions");
+    this.sessionsDir = deps?.sessionsDir ?? path17.resolve(".harness", "sessions");
+    this.projectPath = deps?.projectPath ?? process.cwd();
     this.maintenanceDeps = deps?.maintenanceDeps ?? null;
     this.getLocalModelStatus = deps?.getLocalModelStatus ?? null;
     this.getLocalModelStatuses = deps?.getLocalModelStatuses ?? null;
     this.webhooks = deps?.webhooks;
     this.cacheMetrics = deps?.cacheMetrics;
+    this.getBackendRouterFn = deps?.getBackendRouter ?? null;
+    this.getRoutingDecisionBusFn = deps?.getRoutingDecisionBus ?? null;
+    this.getRoutingConfigFn = deps?.getRoutingConfig ?? null;
+    this.getBackendsFn = deps?.getBackends ?? null;
   }
   wireEvents() {
     this.stateChangeListener = (snapshot) => {
@@ -8282,6 +9382,12 @@ var OrchestratorServer = class {
     };
     this.orchestrator.on("state_change", this.stateChangeListener);
     this.orchestrator.on("agent_event", this.agentEventListener);
+    const bus = this.getRoutingDecisionBusFn?.() ?? null;
+    if (bus) {
+      this.routingDecisionUnsubscribe = bus.subscribe((decision) => {
+        this.broadcaster.broadcast("routing:decision", decision);
+      });
+    }
   }
   /**
    * Broadcast a new interaction to all WebSocket clients.
@@ -8437,6 +9543,23 @@ var OrchestratorServer = class {
       (req, res) => handleV1TelemetryRoute(req, res, {
         ...this.cacheMetrics ? { cacheMetrics: this.cacheMetrics } : {}
       }),
+      // Spec B Phase 5 — routing observability. Returns 503 when the
+      // backendFactory is null (legacy single-backend configs).
+      (req, res) => handleV1RoutingRoute(req, res, {
+        router: this.getBackendRouterFn?.() ?? null,
+        bus: this.getRoutingDecisionBusFn?.() ?? null,
+        routing: this.getRoutingConfigFn?.() ?? null,
+        backends: this.getBackendsFn?.() ?? null
+      }),
+      // Hermes Phase 4 — skill proposal review queue. Read scopes
+      // (`read-status`) and write scopes (`manage-proposals`) are enforced
+      // upstream by V1_BRIDGE_ROUTES; this dispatcher only handles
+      // business logic. `projectPath` defaults to process.cwd() — that is
+      // where `.harness/proposals/` lives in every deployment we ship.
+      (req, res) => handleV1ProposalsRoute(req, res, {
+        projectPath: this.projectPath,
+        bus: this.orchestrator
+      }),
       // Chat proxy route (spawns Claude Code CLI — no API key required)
       (req, res) => handleChatProxyRoute(req, res, this.claudeCommand)
     ];
@@ -8524,17 +9647,21 @@ var OrchestratorServer = class {
       this.planWatcher = new PlanWatcher(this.plansDir, this.interactionQueue);
       this.planWatcher.start();
     }
-    return new Promise((resolve6) => {
+    return new Promise((resolve8) => {
       const host = getBindHost();
       this.httpServer.listen(this.port, host, () => {
         console.log(`Orchestrator API listening on ${host}:${this.port}`);
-        resolve6();
+        resolve8();
       });
     });
   }
   stop() {
     this.orchestrator.removeListener("state_change", this.stateChangeListener);
     this.orchestrator.removeListener("agent_event", this.agentEventListener);
+    if (this.routingDecisionUnsubscribe) {
+      this.routingDecisionUnsubscribe();
+      this.routingDecisionUnsubscribe = null;
+    }
     if (this.planWatcher) {
       this.planWatcher.stop();
       this.planWatcher = null;
@@ -8547,7 +9674,7 @@ var OrchestratorServer = class {
 // src/gateway/webhooks/store.ts
 import { randomBytes as randomBytes4 } from "crypto";
 import { readFile as readFile9, writeFile as writeFile9, mkdir as mkdir9, rename as rename3, chmod } from "fs/promises";
-import { dirname as dirname6 } from "path";
+import { dirname as dirname7 } from "path";
 import { WebhookSubscriptionSchema } from "@harness-engineering/types";
 
 // src/gateway/webhooks/signer.ts
@@ -8578,8 +9705,8 @@ function genSecret2() {
   return randomBytes4(32).toString("base64url");
 }
 var WebhookStore = class {
-  constructor(path19) {
-    this.path = path19;
+  constructor(path24) {
+    this.path = path24;
   }
   path;
   cache = null;
@@ -8602,7 +9729,7 @@ var WebhookStore = class {
   async persist(records) {
     const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes4(4).toString("hex")}`;
     try {
-      await mkdir9(dirname6(this.path), { recursive: true });
+      await mkdir9(dirname7(this.path), { recursive: true });
       await writeFile9(tmp, JSON.stringify(records, null, 2), { encoding: "utf8", mode: 384 });
       await rename3(tmp, this.path);
       await chmod(this.path, 384);
@@ -8970,7 +10097,12 @@ var WEBHOOK_TOPICS = [
   "maintenance:completed",
   "maintenance:error",
   "webhook.subscription.created",
-  "webhook.subscription.deleted"
+  "webhook.subscription.deleted",
+  // Hermes Phase 4 — skill proposal lifecycle. Subscriptions can use the
+  // `proposal.*` glob pattern to receive all three.
+  "proposal.created",
+  "proposal.approved",
+  "proposal.rejected"
 ];
 function newEventId2() {
   return `evt_${randomBytes6(8).toString("hex")}`;
@@ -9395,6 +10527,33 @@ var ENVELOPE_DERIVERS = {
       summary: data.message ?? "If you see this, your notification sink is working.",
       severity: "info"
     };
+  },
+  // Hermes Phase 4 — skill proposal lifecycle events.
+  "proposal.created": (event) => {
+    const data = asObj(event.data);
+    const label = data.kind === "refinement" ? `refinement of ${data.targetSkill ?? "(unknown skill)"}` : data.name ?? "(new skill)";
+    return {
+      title: `New skill proposal: ${label}`,
+      summary: truncate(data.justification ?? "No justification provided.", 240),
+      severity: "info"
+    };
+  },
+  "proposal.approved": (event) => {
+    const data = asObj(event.data);
+    const label = data.name ?? data.targetSkill ?? "(unknown skill)";
+    return {
+      title: `Skill proposal approved: ${label}`,
+      summary: `Approved by ${data.decidedBy ?? "(unknown reviewer)"}.`,
+      severity: "success"
+    };
+  },
+  "proposal.rejected": (event) => {
+    const data = asObj(event.data);
+    return {
+      title: "Skill proposal rejected",
+      summary: truncate(data.reason ?? "No reason provided.", 240),
+      severity: "warning"
+    };
   }
 };
 function truncate(s, max) {
@@ -9439,7 +10598,11 @@ var NOTIFICATION_TOPICS = [
   "interaction.resolved",
   "maintenance:started",
   "maintenance:completed",
-  "maintenance:error"
+  "maintenance:error",
+  // Hermes Phase 4 — skill proposal lifecycle.
+  "proposal.created",
+  "proposal.approved",
+  "proposal.rejected"
 ];
 function newEventId4() {
   return `evt_${randomBytes8(8).toString("hex")}`;
@@ -9535,8 +10698,8 @@ var StructuredLogger = class {
 };
 
 // src/workspace/config-scanner.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { join as join13, relative } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join15, relative } from "path";
 import {
   scanForInjection,
   SecurityScanner,
@@ -9560,10 +10723,10 @@ function adjustFindingSeverity(findings) {
   });
 }
 async function scanSingleFile(filePath, targetDir, scanner) {
-  if (!existsSync4(filePath)) return null;
+  if (!existsSync6(filePath)) return null;
   let content;
   try {
-    content = readFileSync4(filePath, "utf8");
+    content = readFileSync6(filePath, "utf8");
   } catch {
     return null;
   }
@@ -9582,7 +10745,7 @@ async function scanWorkspaceConfig(workspacePath) {
   const scanner = new SecurityScanner(parseSecurityConfig({}));
   const results = [];
   for (const configFile of CONFIG_FILES) {
-    const result = await scanSingleFile(join13(workspacePath, configFile), workspacePath, scanner);
+    const result = await scanSingleFile(join15(workspacePath, configFile), workspacePath, scanner);
     if (result) results.push(result);
   }
   return { exitCode: computeScanExitCode(results), results };
@@ -9768,6 +10931,19 @@ var BUILT_IN_TASKS = [
     schedule: "*/15 * * * *",
     branch: null,
     checkCommand: ["harness", "sync-main", "--json"]
+  },
+  // Hermes Phase 4 — one-shot backfill that stamps `provenance: user-authored`
+  // on every existing catalog skill. Schedule is Feb 31 (a date that never
+  // exists) so the cron loop never fires it automatically; operators trigger
+  // it once via the dashboard "Run now" button or `harness backfill-skill-
+  // provenance` after upgrading to Phase 4.
+  {
+    id: "proposal-provenance-backfill",
+    type: "housekeeping",
+    description: "Backfill provenance: user-authored on every existing skill (one-shot, idempotent)",
+    schedule: "0 0 31 2 *",
+    branch: null,
+    checkCommand: ["backfill-skill-provenance"]
   }
 ];
 
@@ -9860,24 +11036,49 @@ var MaintenanceScheduler = class {
     this.resolvedTasks = this.resolveTasks();
   }
   /**
-   * Merge built-in task definitions with config overrides.
-   * Tasks with `enabled: false` are filtered out.
-   * Schedule overrides replace the default cron expression.
+   * Merge built-in task definitions with config overrides, then append
+   * Hermes Phase 2 `customTasks` (also respecting `tasks.<id>.enabled`
+   * overrides). Tasks with `enabled: false` are filtered out. Schedule
+   * overrides replace the default cron expression.
    */
   resolveTasks() {
     const overrides = this.config.tasks ?? {};
-    return BUILT_IN_TASKS.filter((task) => {
-      const override = overrides[task.id];
-      if (override?.enabled === false) return false;
-      return true;
-    }).map((task) => {
+    const customs = this.config.customTasks ?? {};
+    const merged = [];
+    for (const task of BUILT_IN_TASKS) {
       const override = overrides[task.id];
-      if (!override) return { ...task };
-      return {
+      if (override?.enabled === false) continue;
+      merged.push({
         ...task,
-        ...override.schedule !== void 0 && { schedule: override.schedule }
-      };
-    });
+        ...override?.schedule !== void 0 && { schedule: override.schedule }
+      });
+    }
+    for (const [id, def] of Object.entries(customs)) {
+      const override = overrides[id];
+      if (override?.enabled === false) continue;
+      merged.push({
+        id,
+        type: def.type,
+        description: def.description,
+        schedule: override?.schedule ?? def.schedule,
+        branch: def.branch,
+        ...def.checkCommand !== void 0 && { checkCommand: def.checkCommand },
+        ...def.checkScript !== void 0 && { checkScript: def.checkScript },
+        ...def.fixSkill !== void 0 && { fixSkill: def.fixSkill },
+        ...def.inlineSkills !== void 0 && { inlineSkills: def.inlineSkills },
+        ...def.inlineSkillsBudgetTokens !== void 0 && {
+          inlineSkillsBudgetTokens: def.inlineSkillsBudgetTokens
+        },
+        ...def.contextFrom !== void 0 && { contextFrom: def.contextFrom },
+        ...def.contextFromMaxAgeMinutes !== void 0 && {
+          contextFromMaxAgeMinutes: def.contextFromMaxAgeMinutes
+        },
+        ...def.outputRetention !== void 0 && { outputRetention: def.outputRetention },
+        ...def.costCeiling !== void 0 && { costCeiling: def.costCeiling },
+        isCustom: true
+      });
+    }
+    return merged;
   }
   /** Returns the resolved (merged) task list. Useful for testing and dashboard. */
   getResolvedTasks() {
@@ -10058,19 +11259,19 @@ var SingleProcessLeaderElector = class {
 };
 
 // src/maintenance/reporter.ts
-import * as fs14 from "fs";
-import * as path15 from "path";
-import { z as z15 } from "zod";
-var RunResultSchema = z15.object({
-  taskId: z15.string(),
-  startedAt: z15.string(),
-  completedAt: z15.string(),
-  status: z15.enum(["success", "failure", "skipped", "no-issues"]),
-  findings: z15.number(),
-  fixed: z15.number(),
-  prUrl: z15.string().nullable(),
-  prUpdated: z15.boolean(),
-  error: z15.string().optional()
+import * as fs16 from "fs";
+import * as path18 from "path";
+import { z as z17 } from "zod";
+var RunResultSchema = z17.object({
+  taskId: z17.string(),
+  startedAt: z17.string(),
+  completedAt: z17.string(),
+  status: z17.enum(["success", "failure", "skipped", "no-issues"]),
+  findings: z17.number(),
+  fixed: z17.number(),
+  prUrl: z17.string().nullable(),
+  prUpdated: z17.boolean(),
+  error: z17.string().optional()
 });
 var MAX_HISTORY = 500;
 var fallbackLogger = {
@@ -10094,10 +11295,10 @@ var MaintenanceReporter = class {
    */
   async load() {
     try {
-      await fs14.promises.mkdir(this.persistDir, { recursive: true });
-      const filePath = path15.join(this.persistDir, "history.json");
-      const data = await fs14.promises.readFile(filePath, "utf-8");
-      const parsed = z15.array(RunResultSchema).safeParse(JSON.parse(data));
+      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      const filePath = path18.join(this.persistDir, "history.json");
+      const data = await fs16.promises.readFile(filePath, "utf-8");
+      const parsed = z17.array(RunResultSchema).safeParse(JSON.parse(data));
       if (parsed.success) {
         this.history = parsed.data.slice(0, MAX_HISTORY);
       }
@@ -10130,9 +11331,9 @@ var MaintenanceReporter = class {
    */
   async persist() {
     try {
-      await fs14.promises.mkdir(this.persistDir, { recursive: true });
-      const filePath = path15.join(this.persistDir, "history.json");
-      await fs14.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
+      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      const filePath = path18.join(this.persistDir, "history.json");
+      await fs16.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
     } catch (err) {
       this.logger.error("MaintenanceReporter: failed to persist history", { error: String(err) });
     }
@@ -10148,6 +11349,9 @@ var TaskRunner = class {
   cwd;
   prManager;
   baseBranch;
+  checkScriptRunner;
+  contextResolver;
+  outputStore;
   constructor(options) {
     this.config = options.config;
     this.checkRunner = options.checkRunner;
@@ -10156,27 +11360,49 @@ var TaskRunner = class {
     this.cwd = options.cwd;
     this.prManager = options.prManager ?? null;
     this.baseBranch = options.baseBranch ?? "main";
+    this.checkScriptRunner = options.checkScriptRunner ?? null;
+    this.contextResolver = options.contextResolver ?? null;
+    this.outputStore = options.outputStore ?? null;
   }
   /**
    * Run a maintenance task and return the result.
    * Dispatches to the appropriate execution path based on task type.
    * Never throws -- errors are captured in the RunResult.
+   *
+   * @param task - Resolved task definition.
+   * @param origin - Hermes Phase 2 trigger-source tag; defaults to `'cron'`
+   *                 when called from the scheduler path.
    */
-  async run(task) {
+  async run(task, origin = "cron") {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    let result;
+    let captured;
     try {
       switch (task.type) {
-        case "mechanical-ai":
-          return await this.runMechanicalAI(task, startedAt);
+        case "mechanical-ai": {
+          const out = await this.runMechanicalAI(task, startedAt);
+          result = out.result;
+          captured = out.captured;
+          break;
+        }
         case "pure-ai":
-          return await this.runPureAI(task, startedAt);
-        case "report-only":
-          return await this.runReportOnly(task, startedAt);
-        case "housekeeping":
-          return await this.runHousekeeping(task, startedAt);
+          result = await this.runPureAI(task, startedAt);
+          break;
+        case "report-only": {
+          const out = await this.runReportOnly(task, startedAt);
+          result = out.result;
+          captured = out.captured;
+          break;
+        }
+        case "housekeeping": {
+          const out = await this.runHousekeeping(task, startedAt);
+          result = out.result;
+          captured = out.captured;
+          break;
+        }
         default: {
           const _exhaustive = task.type;
-          return this.failureResult(
+          result = this.failureResult(
             task.id,
             startedAt,
             `Unknown task type: ${String(_exhaustive)}`
@@ -10184,69 +11410,174 @@ var TaskRunner = class {
         }
       }
     } catch (err) {
-      return this.failureResult(task.id, startedAt, String(err));
+      result = this.failureResult(task.id, startedAt, String(err));
+    }
+    result.origin = origin;
+    await this.persistOutput(task, result, captured, origin);
+    return result;
+  }
+  async persistOutput(task, result, captured, origin) {
+    if (!this.outputStore) return;
+    const entry = {
+      taskId: result.taskId,
+      startedAt: result.startedAt,
+      completedAt: result.completedAt,
+      status: result.status,
+      findings: result.findings,
+      fixed: result.fixed,
+      prUrl: result.prUrl,
+      prUpdated: result.prUpdated,
+      origin,
+      ...result.error !== void 0 && { error: result.error },
+      ...result.costUsd !== void 0 && { costUsd: result.costUsd },
+      ...captured?.stdout !== void 0 && { stdout: captured.stdout },
+      ...captured?.stderr !== void 0 && { stderr: captured.stderr },
+      ...captured?.structured !== void 0 && { structured: captured.structured },
+      ...captured?.context !== void 0 && { context: captured.context }
+    };
+    try {
+      await this.outputStore.write(task.id, entry, task.outputRetention);
+    } catch {
     }
   }
   /**
-   * Mechanical-AI: run check command, dispatch AI agent only if fixable findings exist.
+   * Run the check step using whichever runner the task asks for. Custom
+   * tasks that declare `checkScript` go through the Hermes Phase 2
+   * `CheckScriptRunner`; built-ins (and customs that use the legacy
+   * `checkCommand` shape) go through the original heuristic runner.
    */
-  async runMechanicalAI(task, startedAt) {
+  async runCheckStep(task) {
+    if (task.checkScript) {
+      if (!this.checkScriptRunner) {
+        throw new Error(
+          `task '${task.id}' declares checkScript but no CheckScriptRunner is configured`
+        );
+      }
+      const r2 = await this.checkScriptRunner.run(task.checkScript, this.cwd);
+      return {
+        passed: r2.passed,
+        findings: r2.findings,
+        stdout: r2.output,
+        stderr: r2.stderr,
+        structured: r2.structured ? r2.structured : null
+      };
+    }
     if (!task.checkCommand || task.checkCommand.length === 0) {
-      return this.failureResult(task.id, startedAt, "mechanical-ai task missing checkCommand");
+      throw new Error(`task '${task.id}' is missing checkCommand`);
     }
+    const r = await this.checkRunner.run(task.checkCommand, this.cwd);
+    return {
+      passed: r.passed,
+      findings: r.findings,
+      stdout: r.output,
+      stderr: "",
+      structured: null
+    };
+  }
+  /**
+   * Hermes Phase 2 — Compose the agent prompt-context block from inlined
+   * skills + upstream task outputs. Returns an empty string when nothing
+   * is configured (or when the resolver is absent), which is the safe
+   * no-op default.
+   */
+  async composePromptContext(task) {
+    if (!this.contextResolver) return "";
+    const skills = await this.contextResolver.resolveInlineSkills(
+      task.inlineSkills,
+      task.inlineSkillsBudgetTokens ?? 8e3
+    );
+    const upstream = await this.contextResolver.resolveContextFrom(task.contextFrom, {
+      maxAgeMinutes: task.contextFromMaxAgeMinutes ?? 1440
+    });
+    return [skills, upstream].filter(Boolean).join("\n");
+  }
+  /**
+   * Mechanical-AI: run check (legacy or Phase 2 script), dispatch AI agent
+   * only if fixable findings exist; persist captured stdout/stderr/context
+   * via the output store on the way out.
+   */
+  async runMechanicalAI(task, startedAt) {
     if (!task.fixSkill) {
-      return this.failureResult(task.id, startedAt, "mechanical-ai task missing fixSkill");
+      return wrap(this.failureResult(task.id, startedAt, "mechanical-ai task missing fixSkill"));
     }
     if (!task.branch) {
-      return this.failureResult(task.id, startedAt, "mechanical-ai task missing branch");
+      return wrap(this.failureResult(task.id, startedAt, "mechanical-ai task missing branch"));
+    }
+    if (!task.checkCommand && !task.checkScript) {
+      return wrap(
+        this.failureResult(
+          task.id,
+          startedAt,
+          "mechanical-ai task missing checkCommand or checkScript"
+        )
+      );
     }
-    const checkResult = await this.checkRunner.run(task.checkCommand, this.cwd);
-    if (checkResult.findings === 0) {
+    let check;
+    try {
+      check = await this.runCheckStep(task);
+    } catch (err) {
+      return wrap(this.failureResult(task.id, startedAt, String(err)));
+    }
+    const promptContext = await this.composePromptContext(task);
+    const baseCaptured = {
+      stdout: check.stdout,
+      stderr: check.stderr,
+      structured: check.structured,
+      ...promptContext ? { context: promptContext } : {}
+    };
+    const wakeAgentExplicitlyFalse = check.structured !== null && typeof check.structured === "object" && check.structured.wakeAgent === false;
+    if (check.findings === 0 || wakeAgentExplicitlyFalse) {
       return {
-        taskId: task.id,
-        startedAt,
-        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        status: "no-issues",
-        findings: 0,
-        fixed: 0,
-        prUrl: null,
-        prUpdated: false
+        result: {
+          taskId: task.id,
+          startedAt,
+          completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          status: "no-issues",
+          findings: check.findings,
+          fixed: 0,
+          prUrl: null,
+          prUpdated: false
+        },
+        captured: baseCaptured
       };
     }
     if (this.prManager) {
       try {
         await this.prManager.ensureBranch(task.branch, this.baseBranch);
       } catch (err) {
-        return this.failureResult(task.id, startedAt, `ensureBranch failed: ${String(err)}`);
+        return wrap(
+          this.failureResult(task.id, startedAt, `ensureBranch failed: ${String(err)}`),
+          baseCaptured
+        );
       }
     }
     const backendName = this.resolveBackend(task.id);
     let agentResult;
     try {
-      agentResult = await this.agentDispatcher.dispatch(
-        task.fixSkill,
-        task.branch,
-        backendName,
-        this.cwd
-      );
+      agentResult = promptContext ? await this.agentDispatcher.dispatch(task.fixSkill, task.branch, backendName, this.cwd, {
+        promptContext
+      }) : await this.agentDispatcher.dispatch(task.fixSkill, task.branch, backendName, this.cwd);
     } catch (err) {
       return {
-        taskId: task.id,
-        startedAt,
-        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        status: "failure",
-        findings: checkResult.findings,
-        fixed: 0,
-        prUrl: null,
-        prUpdated: false,
-        error: `Agent dispatch failed: ${String(err)}`
+        result: {
+          taskId: task.id,
+          startedAt,
+          completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          status: "failure",
+          findings: check.findings,
+          fixed: 0,
+          prUrl: null,
+          prUpdated: false,
+          error: `Agent dispatch failed: ${String(err)}`
+        },
+        captured: baseCaptured
       };
     }
     let prUrl = null;
     let prUpdated = false;
     if (this.prManager && agentResult.producedCommits) {
       try {
-        const summary = `Findings: ${checkResult.findings}, Fixed: ${agentResult.fixed}`;
+        const summary = `Findings: ${check.findings}, Fixed: ${agentResult.fixed}`;
         const prResult = await this.prManager.ensurePR(task, summary);
         prUrl = prResult.prUrl;
         prUpdated = prResult.prUpdated;
@@ -10255,14 +11586,17 @@ var TaskRunner = class {
       }
     }
     return {
-      taskId: task.id,
-      startedAt,
-      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      status: "success",
-      findings: checkResult.findings,
-      fixed: agentResult.fixed,
-      prUrl,
-      prUpdated
+      result: {
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "success",
+        findings: check.findings,
+        fixed: agentResult.fixed,
+        prUrl,
+        prUpdated
+      },
+      captured: baseCaptured
     };
   }
   /**
@@ -10282,15 +11616,13 @@ var TaskRunner = class {
         return this.failureResult(task.id, startedAt, `ensureBranch failed: ${String(err)}`);
       }
     }
+    const promptContext = await this.composePromptContext(task);
     const backendName = this.resolveBackend(task.id);
     let agentResult;
     try {
-      agentResult = await this.agentDispatcher.dispatch(
-        task.fixSkill,
-        task.branch,
-        backendName,
-        this.cwd
-      );
+      agentResult = promptContext ? await this.agentDispatcher.dispatch(task.fixSkill, task.branch, backendName, this.cwd, {
+        promptContext
+      }) : await this.agentDispatcher.dispatch(task.fixSkill, task.branch, backendName, this.cwd);
     } catch (err) {
       return this.failureResult(task.id, startedAt, `Agent dispatch failed: ${String(err)}`);
     }
@@ -10318,7 +11650,7 @@ var TaskRunner = class {
     };
   }
   /**
-   * Report-only: run check command, record metrics, no AI dispatch.
+   * Report-only: run check (legacy or Phase 2 script), record metrics, no AI dispatch.
    *
    * Honors the JSON status contract emitted by Phase 4/5 CLIs (`harness pulse run`
    * and `harness compound scan-candidates` in `--non-interactive` mode):
@@ -10328,13 +11660,24 @@ var TaskRunner = class {
    * Legacy report-only tasks emit free-form output and fall through to 'success'.
    */
   async runReportOnly(task, startedAt) {
-    if (!task.checkCommand || task.checkCommand.length === 0) {
-      return this.failureResult(task.id, startedAt, "report-only task missing checkCommand");
+    if (!task.checkCommand && !task.checkScript) {
+      return wrap(
+        this.failureResult(
+          task.id,
+          startedAt,
+          "report-only task missing checkCommand or checkScript"
+        )
+      );
     }
-    const checkResult = await this.checkRunner.run(task.checkCommand, this.cwd);
-    const parsed = parseStatusLine(checkResult.output);
+    let check;
+    try {
+      check = await this.runCheckStep(task);
+    } catch (err) {
+      return wrap(this.failureResult(task.id, startedAt, String(err)));
+    }
+    const parsed = parseStatusLine(check.stdout);
     const status = parsed?.status ?? "success";
-    const findings = parsed === null ? checkResult.findings : typeof parsed.candidatesFound === "number" ? parsed.candidatesFound : 0;
+    const findings = parsed === null ? check.findings : typeof parsed.candidatesFound === "number" ? parsed.candidatesFound : 0;
     const result = {
       taskId: task.id,
       startedAt,
@@ -10348,7 +11691,10 @@ var TaskRunner = class {
     if (parsed?.error) {
       result.error = parsed.error;
     }
-    return result;
+    return {
+      result,
+      captured: { stdout: check.stdout, stderr: check.stderr, structured: check.structured }
+    };
   }
   /**
    * Housekeeping: run command directly, no AI, no PR.
@@ -10359,17 +11705,39 @@ var TaskRunner = class {
    *   - sync-main contract: updated/no-op/skipped/error → mapped onto the run-result status
    * Legacy housekeeping commands that emit no JSON keep the prior behavior:
    *   status: 'success', findings: 0.
+   *
+   * Hermes Phase 2: a `checkScript` may replace `checkCommand` for housekeeping
+   * tasks; the runner falls through to the same JSON-status parsing path.
    */
   async runHousekeeping(task, startedAt) {
-    if (!task.checkCommand || task.checkCommand.length === 0) {
-      return this.failureResult(task.id, startedAt, "housekeeping task missing checkCommand");
+    if (!task.checkCommand && !task.checkScript) {
+      return wrap(
+        this.failureResult(
+          task.id,
+          startedAt,
+          "housekeeping task missing checkCommand or checkScript"
+        )
+      );
     }
     let stdout;
-    try {
-      const out = await this.commandExecutor.exec(task.checkCommand, this.cwd);
-      stdout = out.stdout ?? "";
-    } catch (err) {
-      return this.failureResult(task.id, startedAt, String(err));
+    let stderr = "";
+    let structured = null;
+    if (task.checkScript) {
+      try {
+        const r = await this.runCheckStep(task);
+        stdout = r.stdout;
+        stderr = r.stderr;
+        structured = r.structured;
+      } catch (err) {
+        return wrap(this.failureResult(task.id, startedAt, String(err)));
+      }
+    } else {
+      try {
+        const out = await this.commandExecutor.exec(task.checkCommand, this.cwd);
+        stdout = out.stdout ?? "";
+      } catch (err) {
+        return wrap(this.failureResult(task.id, startedAt, String(err)));
+      }
     }
     const parsed = parseStatusLine(stdout);
     const status = parsed?.status ?? "success";
@@ -10384,7 +11752,7 @@ var TaskRunner = class {
       prUpdated: false
     };
     if (parsed?.error) result.error = parsed.error;
-    return result;
+    return { result, captured: { stdout, stderr, structured } };
   }
   /**
    * Resolve which AI backend name to use for a given task.
@@ -10409,6 +11777,9 @@ var TaskRunner = class {
     };
   }
 };
+function wrap(result, captured) {
+  return captured ? { result, captured } : { result };
+}
 function parseStatusLine(output) {
   const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
   for (let i = lines.length - 1; i >= 0; i--) {
@@ -10446,12 +11817,561 @@ function parseStatusLine(output) {
   return null;
 }
 
-// src/orchestrator.ts
-function useCaseForBackendParam(issue, backendParam) {
-  if (backendParam === "local") return { kind: "tier", tier: "quick-fix" };
-  const tier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
-  return { kind: "tier", tier };
+// src/maintenance/check-script-runner.ts
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify3 } from "util";
+import * as path19 from "path";
+var execFileAsync = promisify3(execFile6);
+var CheckScriptRunner = class {
+  constructor(cwd) {
+    this.cwd = cwd;
+  }
+  cwd;
+  async run(spec, cwd) {
+    const projectRoot = cwd ?? this.cwd;
+    const captured = await captureScript(spec, projectRoot);
+    const parseJson = spec.parseStdoutJson !== false;
+    const structured = parseJson ? parseStatusEnvelope(captured.stdout) : null;
+    if (structured) {
+      return mapStructured(structured, captured.stdout, captured.stderr);
+    }
+    return heuristicResult(captured.stdout, captured.stderr, captured.exitedAbnormally);
+  }
+};
+async function captureScript(spec, projectRoot) {
+  const resolved = path19.isAbsolute(spec.path) ? spec.path : path19.resolve(projectRoot, spec.path);
+  const args = spec.args ?? [];
+  const timeoutMs = spec.timeoutMs ?? 12e4;
+  try {
+    const result = await execFileAsync(resolved, args, { cwd: projectRoot, timeout: timeoutMs });
+    return {
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? ""),
+      exitedAbnormally: false
+    };
+  } catch (err) {
+    const e = err;
+    return {
+      stdout: String(e.stdout ?? ""),
+      stderr: String(e.stderr ?? ""),
+      exitedAbnormally: true
+    };
+  }
+}
+function parseStatusEnvelope(stdout) {
+  const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const env = classifyLine2(lines[i]);
+    if (env) return env;
+  }
+  return null;
+}
+var ENVELOPE_STATUSES = /* @__PURE__ */ new Set(["ok", "findings", "skip", "error"]);
+function classifyLine2(line) {
+  const obj = tryParseJsonObject(line);
+  if (!obj) return null;
+  const s = obj.status;
+  if (typeof s !== "string" || !ENVELOPE_STATUSES.has(s)) return null;
+  return buildEnvelope(s, obj);
+}
+function tryParseJsonObject(line) {
+  if (!line || !line.startsWith("{") || !line.endsWith("}")) return null;
+  try {
+    return JSON.parse(line);
+  } catch {
+    return null;
+  }
+}
+function buildEnvelope(status, obj) {
+  const env = { status };
+  if (typeof obj.findings === "number") env.findings = obj.findings;
+  if (typeof obj.wakeAgent === "boolean") env.wakeAgent = obj.wakeAgent;
+  if (typeof obj.message === "string") env.message = obj.message;
+  if (obj.outputs && typeof obj.outputs === "object") {
+    env.outputs = obj.outputs;
+  }
+  return env;
+}
+function mapStructured(env, stdout, stderr) {
+  const findings = env.findings ?? (env.status === "findings" ? 1 : 0);
+  switch (env.status) {
+    case "ok":
+      return { passed: true, findings: 0, output: stdout, stderr, structured: env };
+    case "findings": {
+      const wake = env.wakeAgent ?? findings > 0;
+      return { passed: !wake, findings, output: stdout, stderr, structured: env };
+    }
+    case "skip":
+      return { passed: true, findings: 0, output: stdout, stderr, structured: env };
+    case "error":
+      return {
+        passed: false,
+        findings: Math.max(findings, 1),
+        output: stdout,
+        stderr,
+        structured: env
+      };
+    default:
+      return { passed: true, findings: 0, output: stdout, stderr, structured: env };
+  }
+}
+function heuristicResult(stdout, stderr, exitedAbnormally) {
+  const combined = [stdout, stderr].filter(Boolean).join("\n");
+  const findingsMatch = combined.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
+  const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : exitedAbnormally ? 1 : 0;
+  return {
+    passed: findings === 0 && !exitedAbnormally,
+    findings,
+    output: stdout,
+    stderr,
+    structured: null
+  };
+}
+
+// src/maintenance/output-store.ts
+import * as fs17 from "fs";
+import * as path20 from "path";
+var DEFAULT_RETENTION = {
+  runs: 50,
+  maxAgeDays: 30
+};
+var fallbackLogger2 = {
+  info: () => {
+  },
+  warn: (m, c) => console.warn(m, c),
+  error: (m, c) => console.error(m, c)
+};
+var TaskOutputStore = class {
+  rootDir;
+  retentionDefaults;
+  logger;
+  constructor(options) {
+    this.rootDir = options.rootDir;
+    this.retentionDefaults = options.retentionDefaults ?? DEFAULT_RETENTION;
+    this.logger = options.logger ?? fallbackLogger2;
+  }
+  /**
+   * Reject task IDs that don't match the validator's kebab-case pattern —
+   * defends `dirFor()` against caller-supplied path-traversal segments
+   * (`'../foo'`) when the store is invoked from CLI surfaces that don't
+   * round-trip through `validateCustomTasks`.
+   */
+  ensureSafeTaskId(taskId) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(taskId)) {
+      throw new Error(
+        `TaskOutputStore: invalid task id '${taskId}' (must match ^[a-z0-9][a-z0-9-]*$)`
+      );
+    }
+  }
+  /**
+   * Persist a single run entry. Retention is applied after the write so
+   * the latest record is durable even if pruning fails.
+   */
+  async write(taskId, entry, retention) {
+    this.ensureSafeTaskId(taskId);
+    const dir = this.dirFor(taskId);
+    await fs17.promises.mkdir(dir, { recursive: true });
+    const fileName = `${sanitizeIso(entry.completedAt || (/* @__PURE__ */ new Date()).toISOString())}.json`;
+    const filePath = path20.join(dir, fileName);
+    const tmpPath = `${filePath}.tmp`;
+    const payload = JSON.stringify(entry, null, 2);
+    await fs17.promises.writeFile(tmpPath, payload, "utf-8");
+    await fs17.promises.rename(tmpPath, filePath);
+    try {
+      await this.applyRetention(taskId, retention);
+    } catch (err) {
+      this.logger.warn("TaskOutputStore retention failed", { taskId, error: String(err) });
+    }
+  }
+  /**
+   * Return the most recent persisted entry for the task, or null if none.
+   */
+  async latest(taskId) {
+    const entries = await this.list(taskId, 1, 0);
+    return entries[0] ?? null;
+  }
+  /**
+   * List entries newest-first with offset+limit pagination.
+   */
+  async list(taskId, limit, offset) {
+    this.ensureSafeTaskId(taskId);
+    const dir = this.dirFor(taskId);
+    const fileNames = await listJsonFilesDescending(dir);
+    const slice = fileNames.slice(offset, offset + limit);
+    const out = [];
+    for (const name of slice) {
+      const entry = await this.readEntry(path20.join(dir, name));
+      if (entry) out.push(entry);
+    }
+    return out;
+  }
+  /**
+   * Lookup a specific run by its file name (without the `.json` suffix) or
+   * by its raw completion timestamp.
+   */
+  async get(taskId, runId) {
+    this.ensureSafeTaskId(taskId);
+    if (/[\\/]|\.\./.test(runId)) {
+      throw new Error(`TaskOutputStore: runId '${runId}' must not contain path separators or '..'`);
+    }
+    const dir = this.dirFor(taskId);
+    const fileName = runId.endsWith(".json") ? runId : `${sanitizeIso(runId)}.json`;
+    return this.readEntry(path20.join(dir, fileName));
+  }
+  /**
+   * The on-disk root for a given task. Exposed for tooling that needs to walk
+   * outputs from outside the store API.
+   */
+  dirFor(taskId) {
+    return path20.join(this.rootDir, taskId, "outputs");
+  }
+  async readEntry(filePath) {
+    try {
+      const buf = await fs17.promises.readFile(filePath, "utf-8");
+      const parsed = JSON.parse(buf);
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async applyRetention(taskId, retention) {
+    const runs = retention?.runs ?? this.retentionDefaults.runs;
+    const maxAgeDays = retention?.maxAgeDays ?? this.retentionDefaults.maxAgeDays;
+    const dir = this.dirFor(taskId);
+    const fileNames = await listJsonFilesDescending(dir);
+    const overflow = fileNames.slice(runs);
+    const cutoffMs = Date.now() - maxAgeDays * 24 * 60 * 60 * 1e3;
+    const aged = [];
+    for (const name of fileNames) {
+      const ts = parseIsoFromFileName(name);
+      if (ts !== null && ts < cutoffMs) aged.push(name);
+    }
+    const toRemove = /* @__PURE__ */ new Set([...overflow, ...aged]);
+    for (const name of toRemove) {
+      try {
+        await fs17.promises.unlink(path20.join(dir, name));
+      } catch {
+      }
+    }
+  }
+};
+async function listJsonFilesDescending(dir) {
+  let names;
+  try {
+    names = await fs17.promises.readdir(dir);
+  } catch {
+    return [];
+  }
+  return names.filter((n) => n.endsWith(".json")).sort().reverse();
+}
+function sanitizeIso(iso) {
+  return iso.replace(/:/g, "-");
+}
+function parseIsoFromFileName(fileName) {
+  const stem = fileName.replace(/\.json$/, "");
+  const restored = stem.replace(/T(\d{2})-(\d{2})-(\d{2})/, "T$1:$2:$3");
+  const ms = Date.parse(restored);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+// src/maintenance/context-resolver.ts
+var ContextResolver = class {
+  outputStore;
+  skillReader;
+  logger;
+  perUpstreamMaxChars;
+  constructor(options) {
+    this.outputStore = options.outputStore;
+    this.skillReader = options.skillReader ?? null;
+    this.logger = options.logger ?? fallbackLogger3;
+    this.perUpstreamMaxChars = options.perUpstreamMaxChars ?? 2e3;
+  }
+  async resolveContextFrom(upstreamTaskIds, options = {}) {
+    if (!upstreamTaskIds || upstreamTaskIds.length === 0) return "";
+    const maxAgeMs = (options.maxAgeMinutes ?? 1440) * 60 * 1e3;
+    const now = Date.now();
+    const sections = [];
+    for (const id of upstreamTaskIds) {
+      const entry = await this.outputStore.latest(id);
+      sections.push(this.formatUpstream(id, entry, now, maxAgeMs));
+    }
+    return `## Upstream context
+
+${sections.join("\n\n")}
+`;
+  }
+  async resolveInlineSkills(skillNames, budgetTokens = 8e3) {
+    if (!skillNames || skillNames.length === 0) return "";
+    if (!this.skillReader) return "";
+    const charBudget = budgetTokens * 4;
+    let used = 0;
+    const sections = [];
+    let truncatedAt = -1;
+    for (let i = 0; i < skillNames.length; i++) {
+      const name = skillNames[i];
+      const body = await this.skillReader.read(name);
+      if (body === null) {
+        this.logger.warn("inlineSkills: skill not found in registry", { name });
+        continue;
+      }
+      const block = `### ${name}
+
+${body}`;
+      if (used + block.length > charBudget) {
+        truncatedAt = i;
+        break;
+      }
+      used += block.length;
+      sections.push(block);
+    }
+    if (truncatedAt >= 0) {
+      this.logger.warn(
+        `inlineSkillsBudgetTokens (${budgetTokens}) exhausted after ${sections.length} of ${skillNames.length} skills; truncated.`
+      );
+    }
+    if (sections.length === 0) return "";
+    return `## Reference skills
+
+${sections.join("\n\n")}
+`;
+  }
+  formatUpstream(id, entry, now, maxAgeMs) {
+    if (!entry) {
+      return `### ${id}
+
+_[no prior run]_`;
+    }
+    const completedMs = Date.parse(entry.completedAt);
+    if (Number.isFinite(completedMs) && now - completedMs > maxAgeMs) {
+      return `### ${id} (last run ${entry.completedAt}, stale)
+
+_[stale: omitted]_`;
+    }
+    const head = `### ${id} (last run ${entry.completedAt}, status=${entry.status}, findings=${entry.findings})`;
+    const body = (entry.stdout ?? "").trim();
+    const truncated = body.length > this.perUpstreamMaxChars ? `${body.slice(0, this.perUpstreamMaxChars)}
+
+_[truncated]_` : body;
+    return `${head}
+
+${truncated || "_[no stdout captured]_"}`;
+  }
+};
+var fallbackLogger3 = {
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+
+// src/maintenance/custom-task-validator.ts
+import { Ok as Ok23, Err as Err20 } from "@harness-engineering/types";
+var ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+var REQUIRED_FIELDS_BY_TYPE = {
+  "mechanical-ai": ["branch", "fixSkill"],
+  "pure-ai": ["branch", "fixSkill"],
+  "report-only": [],
+  housekeeping: []
+};
+function validateCustomTasks(customTasks, builtIns, deps = {}) {
+  const errors = [];
+  if (!customTasks) return Ok23(void 0);
+  const builtInIds = new Set(builtIns.map((t) => t.id));
+  const customIds = Object.keys(customTasks);
+  const allIds = /* @__PURE__ */ new Set([...builtInIds, ...customIds]);
+  for (const id of customIds) {
+    const task = customTasks[id];
+    if (!task) continue;
+    validateOne(id, task, builtInIds, allIds, deps, errors);
+  }
+  detectCycles(customTasks, builtIns, errors);
+  return errors.length === 0 ? Ok23(void 0) : Err20(errors);
+}
+function validateOne(id, task, builtInIds, allIds, deps, errors) {
+  const prefix = `customTasks.${id}`;
+  if (!ID_PATTERN.test(id)) {
+    errors.push({
+      path: prefix,
+      message: `task ID '${id}' must match ^[a-z0-9][a-z0-9-]*$`
+    });
+  }
+  if (builtInIds.has(id)) {
+    errors.push({
+      path: prefix,
+      message: `task ID '${id}' collides with a built-in task; choose a different name`
+    });
+  }
+  if (!task.description || task.description.trim().length === 0) {
+    errors.push({ path: `${prefix}.description`, message: "description is required" });
+  }
+  if (!task.schedule || task.schedule.trim().length === 0) {
+    errors.push({ path: `${prefix}.schedule`, message: "schedule (cron expression) is required" });
+  }
+  validateCheckShape(prefix, task, errors);
+  validateRequiredByType(prefix, task, errors);
+  validateContextFrom(prefix, id, task, allIds, errors);
+  validateInlineSkills(prefix, task, deps, errors);
+  validateScriptPath(prefix, task, deps, errors);
+}
+function validateCheckShape(prefix, task, errors) {
+  const hasCommand = Array.isArray(task.checkCommand) && task.checkCommand.length > 0;
+  const hasScript = task.checkScript !== void 0;
+  if (hasCommand && hasScript) {
+    errors.push({
+      path: prefix,
+      message: "a task may declare checkCommand OR checkScript, not both"
+    });
+  }
+  const needsCheck = task.type === "mechanical-ai" || task.type === "report-only" || task.type === "housekeeping";
+  if (needsCheck && !hasCommand && !hasScript) {
+    errors.push({
+      path: prefix,
+      message: `${task.type} task must declare either checkCommand or checkScript`
+    });
+  }
+  if (hasScript) {
+    const path24 = task.checkScript?.path;
+    if (!path24 || path24.trim().length === 0) {
+      errors.push({ path: `${prefix}.checkScript.path`, message: "checkScript.path is required" });
+    }
+    if (task.checkScript?.timeoutMs !== void 0 && task.checkScript.timeoutMs <= 0) {
+      errors.push({
+        path: `${prefix}.checkScript.timeoutMs`,
+        message: "timeoutMs must be a positive integer"
+      });
+    }
+  }
+}
+function validateRequiredByType(prefix, task, errors) {
+  const required = REQUIRED_FIELDS_BY_TYPE[task.type];
+  if (!required) {
+    errors.push({ path: `${prefix}.type`, message: `unknown task type '${String(task.type)}'` });
+    return;
+  }
+  for (const field of required) {
+    const value = task[field];
+    if (value === void 0 || value === null || typeof value === "string" && value.length === 0) {
+      errors.push({
+        path: `${prefix}.${String(field)}`,
+        message: `${task.type} task requires ${String(field)}`
+      });
+    }
+  }
+  if ((task.type === "mechanical-ai" || task.type === "pure-ai") && task.branch === null) {
+    errors.push({
+      path: `${prefix}.branch`,
+      message: `${task.type} task requires a non-null branch`
+    });
+  }
+}
+function validateContextFrom(prefix, selfId, task, allIds, errors) {
+  if (task.contextFromMaxAgeMinutes !== void 0 && task.contextFromMaxAgeMinutes <= 0) {
+    errors.push({
+      path: `${prefix}.contextFromMaxAgeMinutes`,
+      message: "contextFromMaxAgeMinutes must be a positive integer"
+    });
+  }
+  if (!task.contextFrom) return;
+  for (let i = 0; i < task.contextFrom.length; i++) {
+    const upstreamId = task.contextFrom[i];
+    if (!upstreamId) continue;
+    if (upstreamId === selfId) {
+      errors.push({
+        path: `${prefix}.contextFrom[${i}]`,
+        message: `task '${selfId}' cannot reference itself in contextFrom`
+      });
+    }
+    if (!allIds.has(upstreamId)) {
+      errors.push({
+        path: `${prefix}.contextFrom[${i}]`,
+        message: `references unknown task '${upstreamId}'`
+      });
+    }
+  }
+}
+function validateInlineSkills(prefix, task, deps, errors) {
+  if (!task.inlineSkills) return;
+  if (!deps.skillExists) return;
+  for (let i = 0; i < task.inlineSkills.length; i++) {
+    const name = task.inlineSkills[i];
+    if (!name) continue;
+    if (!deps.skillExists(name)) {
+      errors.push({
+        path: `${prefix}.inlineSkills[${i}]`,
+        message: `skill '${name}' not found in the registry`
+      });
+    }
+  }
+  if (task.inlineSkillsBudgetTokens !== void 0 && task.inlineSkillsBudgetTokens <= 0) {
+    errors.push({
+      path: `${prefix}.inlineSkillsBudgetTokens`,
+      message: "inlineSkillsBudgetTokens must be a positive integer"
+    });
+  }
+}
+function validateScriptPath(prefix, task, deps, errors) {
+  if (!task.checkScript?.path) return;
+  if (!deps.scriptExists) return;
+  if (!deps.scriptExists(task.checkScript.path)) {
+    errors.push({
+      path: `${prefix}.checkScript.path`,
+      message: `executable not found: ${task.checkScript.path}`
+    });
+  }
+}
+function detectCycles(customTasks, builtIns, errors) {
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const t of builtIns) adjacency.set(t.id, []);
+  for (const [id, task] of Object.entries(customTasks)) {
+    adjacency.set(id, (task.contextFrom ?? []).slice());
+  }
+  const color = /* @__PURE__ */ new Map();
+  for (const id of adjacency.keys()) color.set(id, "white");
+  const reported = /* @__PURE__ */ new Set();
+  for (const id of Object.keys(customTasks)) {
+    if (color.get(id) === "white") visitFromRoot(id, adjacency, color, errors, reported);
+  }
+}
+function visitFromRoot(start, adjacency, color, errors, reported) {
+  const stack = [{ id: start, nextIdx: 0, path: [start] }];
+  color.set(start, "grey");
+  while (stack.length) {
+    const top = stack[stack.length - 1];
+    const neighbors = adjacency.get(top.id) ?? [];
+    if (top.nextIdx >= neighbors.length) {
+      color.set(top.id, "black");
+      stack.pop();
+      continue;
+    }
+    const next = neighbors[top.nextIdx++];
+    if (!next || !adjacency.has(next)) continue;
+    handleEdge(top, next, color, stack, errors, reported);
+  }
+}
+function handleEdge(top, next, color, stack, errors, reported) {
+  const nextColor = color.get(next);
+  if (nextColor === "grey") {
+    reportCycle(top.path, next, errors, reported);
+  } else if (nextColor === "white") {
+    color.set(next, "grey");
+    stack.push({ id: next, nextIdx: 0, path: [...top.path, next] });
+  }
+}
+function reportCycle(path24, next, errors, reported) {
+  const cycleStart = path24.indexOf(next);
+  const cyclePath = cycleStart >= 0 ? [...path24.slice(cycleStart), next] : [...path24, next];
+  const key = cyclePath.join("\u2192");
+  if (reported.has(key)) return;
+  reported.add(key);
+  errors.push({
+    path: `customTasks.${cyclePath[0]}.contextFrom`,
+    message: `contextFrom cycle detected: ${cyclePath.join(" \u2192 ")}`
+  });
 }
+
+// src/orchestrator.ts
 var Orchestrator = class extends EventEmitter {
   state;
   config;
@@ -10476,6 +12396,14 @@ var Orchestrator = class extends EventEmitter {
    * construction time. Eliminating this fallback is autopilot Phase 4+.
    */
   backendFactory;
+  /**
+   * Spec B Phase 4 (D8): per-orchestrator in-process bus for
+   * `RoutingDecision` events. Constructed alongside backendFactory when
+   * agent.backends synthesis succeeds; null when legacy single-backend
+   * config bypassed backends. Phase 5+ consumers (HTTP, WS, dashboard)
+   * subscribe via `getRoutingDecisionBus()`.
+   */
+  routingDecisionBus;
   /**
    * Test-only: when overrides.backend is provided, dispatch uses this
    * instance directly (bypassing the factory). Mirrors Phase 1
@@ -10498,6 +12426,15 @@ var Orchestrator = class extends EventEmitter {
    * so this map is the single source of truth post-migration.
    */
   localResolvers = /* @__PURE__ */ new Map();
+  /**
+   * Spec B Phase 3: skill catalog (name + cognitiveMode) read once at
+   * construction from `projectRoot/agents/skills/`. Consulted by
+   * `buildRoutingUseCase` at dispatch start to construct
+   * `{ kind: 'skill', skillName, cognitiveMode }` RoutingUseCases.
+   * Empty when the orchestrator runs outside a harness project root
+   * (then dispatch falls through to per-tier, preserving F11/N2).
+   */
+  skillCatalog;
   /**
    * Per-resolver `onStatusChange` unsubscribe callbacks. Spec 2 Phase 5
    * (SC39): each local/pi resolver gets its own listener emitting a
@@ -10546,7 +12483,7 @@ var Orchestrator = class extends EventEmitter {
   completionHandler;
   /** Project root directory, derived from workspace root. */
   get projectRoot() {
-    return path16.resolve(this.config.workspace.root, "..", "..");
+    return path21.resolve(this.config.workspace.root, "..", "..");
   }
   enrichedSpecsByIssue = /* @__PURE__ */ new Map();
   /** Tracks recently-failed intelligence analysis to avoid re-requesting every tick */
@@ -10590,6 +12527,13 @@ var Orchestrator = class extends EventEmitter {
         `migrateAgentConfig failed; continuing with legacy fields. Error: ${err instanceof Error ? err.message : String(err)}`
       );
     }
+    const skillCatalogRoot = path21.resolve(this.config.workspace.root, "..", "..");
+    this.skillCatalog = discoverSkillCatalog(skillCatalogRoot);
+    if (this.skillCatalog.length === 0) {
+      this.logger.warn(
+        `Spec B Phase 3: skill catalog discovery returned 0 entries; per-skill / per-mode routing will fall through to per-tier. Looked under ${path21.join(skillCatalogRoot, "agents/skills")}.`
+      );
+    }
     this.tracker = overrides?.tracker || this.createTracker();
     this.workspace = new WorkspaceManager(config.workspace, {
       emitEvent: (event) => {
@@ -10601,10 +12545,10 @@ var Orchestrator = class extends EventEmitter {
     this.renderer = new PromptRenderer();
     this.overrideBackend = overrides?.backend ?? null;
     this.interactionQueue = new InteractionQueue(
-      path16.join(config.workspace.root, "..", "interactions"),
+      path21.join(config.workspace.root, "..", "interactions"),
       this
     );
-    this.analysisArchive = new AnalysisArchive(path16.join(config.workspace.root, "..", "analyses"));
+    this.analysisArchive = new AnalysisArchive(path21.join(config.workspace.root, "..", "analyses"));
     const backendsMap = this.config.agent.backends ?? {};
     for (const [name, def] of Object.entries(backendsMap)) {
       if (def.type === "local" || def.type === "pi") {
@@ -10625,6 +12569,10 @@ var Orchestrator = class extends EventEmitter {
       const routing = this.config.agent.routing ?? {
         default: firstBackendName ?? "primary"
       };
+      this.routingDecisionBus = new RoutingDecisionBus({
+        capacity: 500,
+        logger: this.logger
+      });
       this.backendFactory = new OrchestratorBackendFactory({
         backends: this.config.agent.backends,
         routing,
@@ -10632,6 +12580,7 @@ var Orchestrator = class extends EventEmitter {
         ...this.config.agent.container !== void 0 ? { container: this.config.agent.container } : {},
         ...this.config.agent.secrets !== void 0 ? { secrets: this.config.agent.secrets } : {},
         cacheMetrics: this.cacheMetrics,
+        decisionBus: this.routingDecisionBus,
         getResolverModelFor: (name) => {
           const resolver = this.localResolvers.get(name);
           return resolver ? () => resolver.resolveModel() : void 0;
@@ -10639,6 +12588,7 @@ var Orchestrator = class extends EventEmitter {
       });
     } else {
       this.backendFactory = null;
+      this.routingDecisionBus = null;
     }
     this.pipeline = null;
     this.orchestratorIdPromise = resolveOrchestratorId(config.orchestratorId);
@@ -10648,7 +12598,7 @@ var Orchestrator = class extends EventEmitter {
       ...overrides?.execFileFn ? { execFileFn: overrides.execFileFn } : {}
     });
     this.recorder = new StreamRecorder(
-      path16.resolve(config.workspace.root, "..", "streams"),
+      path21.resolve(config.workspace.root, "..", "streams"),
       this.logger
     );
     const self = this;
@@ -10679,10 +12629,10 @@ var Orchestrator = class extends EventEmitter {
     this.completionHandler = new CompletionHandler(ctx, this.postLifecycleComment.bind(this));
     if (config.server?.port) {
       const webhookStore = new WebhookStore(
-        path16.join(this.projectRoot, ".harness", "webhooks.json")
+        path21.join(this.projectRoot, ".harness", "webhooks.json")
       );
       this.webhookQueue = new WebhookQueue(
-        path16.join(this.projectRoot, ".harness", "webhook-queue.sqlite")
+        path21.join(this.projectRoot, ".harness", "webhook-queue.sqlite")
       );
       const webhookDelivery = new WebhookDelivery({
         queue: this.webhookQueue,
@@ -10720,7 +12670,16 @@ var Orchestrator = class extends EventEmitter {
           queue: this.webhookQueue
         },
         cacheMetrics: this.cacheMetrics,
-        plansDir: path16.resolve(config.workspace.root, "..", "docs", "plans"),
+        // Spec B Phase 5: routing observability accessors. Closures so the
+        // server re-reads on every request — stop() / start() do not
+        // require server reconstruction. Returns null if no backendFactory
+        // (legacy single-backend configs), and the route handler renders
+        // 503 in that case.
+        getBackendRouter: () => this.getBackendRouter(),
+        getRoutingDecisionBus: () => this.getRoutingDecisionBus(),
+        getRoutingConfig: () => this.getRoutingConfig(),
+        getBackends: () => this.getBackends(),
+        plansDir: path21.resolve(config.workspace.root, "..", "docs", "plans"),
         pipeline: this.pipeline,
         analysisArchive: this.analysisArchive,
         roadmapPath: config.tracker.filePath ?? null,
@@ -10776,13 +12735,13 @@ var Orchestrator = class extends EventEmitter {
     const logger = this.logger;
     const checkRunner = {
       run: async (command, cwd) => {
-        const { execFile: execFile6 } = await import("child_process");
-        const { promisify: promisify4 } = await import("util");
-        const execFileAsync = promisify4(execFile6);
+        const { execFile: execFile7 } = await import("child_process");
+        const { promisify: promisify5 } = await import("util");
+        const execFileAsync2 = promisify5(execFile7);
         const [cmd, ...args] = command;
         if (!cmd) return { passed: true, findings: 0, output: "" };
         try {
-          const { stdout } = await execFileAsync(cmd, args, { cwd, timeout: 12e4 });
+          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
           const findingsMatch = stdout.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
           const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 0;
           return { passed: findings === 0, findings, output: stdout };
@@ -10811,13 +12770,13 @@ var Orchestrator = class extends EventEmitter {
     };
     const commandExecutor = {
       exec: async (command, cwd) => {
-        const { execFile: execFile6 } = await import("child_process");
-        const { promisify: promisify4 } = await import("util");
-        const execFileAsync = promisify4(execFile6);
+        const { execFile: execFile7 } = await import("child_process");
+        const { promisify: promisify5 } = await import("util");
+        const execFileAsync2 = promisify5(execFile7);
         const [cmd, ...args] = command;
         if (!cmd) return { stdout: "" };
         try {
-          const { stdout } = await execFileAsync(cmd, args, { cwd, timeout: 12e4 });
+          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
           return { stdout: String(stdout) };
         } catch (err) {
           logger.warn("Maintenance command execution failed", {
@@ -10829,12 +12788,31 @@ var Orchestrator = class extends EventEmitter {
         }
       }
     };
+    const outputStore = new TaskOutputStore({
+      rootDir: path21.join(this.projectRoot, ".harness", "maintenance"),
+      logger: this.logger
+    });
+    const checkScriptRunner = new CheckScriptRunner(this.projectRoot);
+    const skillReader = {
+      // The orchestrator does not own the skill registry; CLI-side skill
+      // resolution wires this in via direct injection. Default: skill not
+      // resolvable from the orchestrator boundary.
+      read: async () => null
+    };
+    const contextResolver = new ContextResolver({
+      outputStore,
+      skillReader,
+      logger: this.logger
+    });
     return new TaskRunner({
       config: maintenanceConfig,
       checkRunner,
       agentDispatcher,
       commandExecutor,
-      cwd: this.projectRoot
+      cwd: this.projectRoot,
+      checkScriptRunner,
+      contextResolver,
+      outputStore
     });
   }
   /**
@@ -10842,8 +12820,17 @@ var Orchestrator = class extends EventEmitter {
    * Extracted from start() to keep function length under threshold.
    */
   async initMaintenance(maintenanceConfig) {
+    const validation = validateCustomTasks(
+      maintenanceConfig.customTasks,
+      BUILT_IN_TASKS
+    );
+    if (!validation.ok) {
+      const messages = validation.error.map((e) => `  - ${e.path}: ${e.message}`).join("\n");
+      throw new Error(`Invalid maintenance.customTasks configuration:
+${messages}`);
+    }
     this.maintenanceReporter = new MaintenanceReporter({
-      persistDir: path16.join(this.projectRoot, ".harness", "maintenance"),
+      persistDir: path21.join(this.projectRoot, ".harness", "maintenance"),
       logger: this.logger
     });
     await this.maintenanceReporter.load();
@@ -10894,10 +12881,17 @@ var Orchestrator = class extends EventEmitter {
     }
   }
   createIntelligencePipeline() {
+    if (!this.backendFactory) {
+      this.logger.warn(
+        "intelligence pipeline disabled: no backendFactory available (legacy config without agent.backends)"
+      );
+      return null;
+    }
     const bundle = buildIntelligencePipeline({
       config: this.config,
       localResolvers: this.localResolvers,
-      logger: this.logger
+      logger: this.logger,
+      router: this.backendFactory.getRouter()
     });
     if (!bundle) return null;
     this.graphStore = bundle.graphStore;
@@ -10948,11 +12942,13 @@ var Orchestrator = class extends EventEmitter {
       simulationResults,
       personaRecommendations
     } = pipelineResult ?? {};
+    const selfAssignee = await this.orchestratorIdPromise;
     const tickEvent = {
       type: "tick",
       candidates,
       runningStates: runningStatesResult.value,
       nowMs,
+      selfAssignee,
       ...concernSignals !== void 0 && { concernSignals },
       ...enrichedSpecs !== void 0 && { enrichedSpecs },
       ...complexityScores !== void 0 && { complexityScores },
@@ -11376,14 +13372,24 @@ var Orchestrator = class extends EventEmitter {
         issue,
         attempt: attempt || 1
       });
-      const useCase = useCaseForBackendParam(issue, backend);
+      const useCase = buildRoutingUseCase(issue, backend, this.skillCatalog);
+      const invocationOverride = process.env.HARNESS_BACKEND_OVERRIDE;
+      const routerOpts = invocationOverride ? { invocationOverride } : void 0;
+      if (invocationOverride) {
+        this.logger.info(
+          `Spec B Phase 3: HARNESS_BACKEND_OVERRIDE='${invocationOverride}' taking effect for ${issue.identifier}`,
+          { issueId: issue.id }
+        );
+      }
       let routedBackendName;
       if (this.overrideBackend !== null) {
         routedBackendName = this.overrideBackend.name;
       } else if (this.backendFactory !== null) {
-        routedBackendName = this.backendFactory.resolveName(useCase);
+        routedBackendName = this.backendFactory.resolveName(useCase, routerOpts);
       } else {
-        routedBackendName = this.config.agent.routing?.default ?? this.config.agent.backend ?? "unknown";
+        const routingDefault = this.config.agent.routing?.default;
+        const routingDefaultScalar = routingDefault !== void 0 ? toArray(routingDefault)[0] : void 0;
+        routedBackendName = routingDefaultScalar ?? this.config.agent.backend ?? "unknown";
       }
       const session = {
         sessionId: `pending-${Date.now()}`,
@@ -11422,7 +13428,7 @@ var Orchestrator = class extends EventEmitter {
       if (this.overrideBackend !== null) {
         agentBackend = this.overrideBackend;
       } else if (this.backendFactory !== null) {
-        agentBackend = this.backendFactory.forUseCase(useCase);
+        agentBackend = this.backendFactory.forUseCase(useCase, routerOpts);
       } else {
         throw new Error(
           `Cannot dispatch ${issue.identifier}: agent.backends not synthesized (migration failed) and no override backend supplied. Migrate to agent.backends/agent.routing per docs/guides/multi-backend-routing.md.`
@@ -11712,6 +13718,8 @@ var Orchestrator = class extends EventEmitter {
       unsub();
     }
     this.localModelStatusUnsubscribes = [];
+    this.routingDecisionBus?.clearListeners();
+    this.routingDecisionBus = null;
     for (const resolver of this.localResolvers.values()) {
       resolver.stop();
     }
@@ -11785,6 +13793,42 @@ var Orchestrator = class extends EventEmitter {
       tickActivity: this.tickActivity
     };
   }
+  /**
+   * Spec B Phase 4 (D8): expose the bus for Phase 5 (HTTP routes) and
+   * Phase 7 (dashboard WS broadcast). Returns null when the legacy
+   * single-backend config bypassed agent.backends synthesis.
+   */
+  getRoutingDecisionBus() {
+    return this.routingDecisionBus;
+  }
+  /**
+   * Spec B Phase 5: live BackendRouter for HTTP routes. The orchestrator
+   * dispatch path uses the factory-owned router directly; observability
+   * routes (config / decisions) reach it through this accessor. Returns
+   * null when the legacy single-backend config bypassed agent.backends
+   * synthesis (no backendFactory built).
+   */
+  getBackendRouter() {
+    return this.backendFactory?.getRouter() ?? null;
+  }
+  /**
+   * Spec B Phase 5: snapshot of the active RoutingConfig for the config
+   * route and the trace route's bus-less router construction. Returns
+   * null when the operator's harness.config.json carries no
+   * `agent.routing` block.
+   */
+  getRoutingConfig() {
+    return this.config.agent.routing ?? null;
+  }
+  /**
+   * Spec B Phase 5: snapshot of `agent.backends` for the config route
+   * (existence annotations) and the trace route (bus-less router
+   * construction). Returns null when no synthesized backends map exists
+   * (legacy single-backend configs).
+   */
+  getBackends() {
+    return this.config.agent.backends ?? null;
+  }
   /** Returns the maintenance scheduler status, or null if maintenance is not enabled. */
   getMaintenanceStatus() {
     return this.maintenanceScheduler?.getStatus() ?? null;
@@ -12020,10 +14064,10 @@ function launchTUI(orchestrator) {
 
 // src/maintenance/sync-main.ts
 import { execFile as nodeExecFile } from "child_process";
-import { promisify as promisify3 } from "util";
+import { promisify as promisify4 } from "util";
 var DEFAULT_TIMEOUT_MS3 = 6e4;
 async function git(execFileFn, args, cwd, timeoutMs) {
-  const exec = promisify3(execFileFn);
+  const exec = promisify4(execFileFn);
   const { stdout, stderr } = await exec("git", args, { cwd, timeout: timeoutMs });
   return { stdout: String(stdout), stderr: String(stderr) };
 }
@@ -12163,8 +14207,8 @@ async function syncMain(repoRoot, opts = {}) {
 }
 
 // src/sessions/search-index.ts
-import * as fs15 from "fs";
-import * as path17 from "path";
+import * as fs18 from "fs";
+import * as path22 from "path";
 import Database2 from "better-sqlite3";
 import { INDEXED_FILE_KINDS } from "@harness-engineering/types";
 var SEARCH_INDEX_FILE = "search-index.sqlite";
@@ -12209,7 +14253,7 @@ function normalizeFts5Query(query) {
   return query.split(/\s+/).filter((tok) => tok.length > 0).map((tok) => `"${tok.replace(/"/g, '""')}"`).join(" ");
 }
 function searchIndexPath(projectPath) {
-  return path17.join(projectPath, ".harness", SEARCH_INDEX_FILE);
+  return path22.join(projectPath, ".harness", SEARCH_INDEX_FILE);
 }
 var FILE_KIND_TO_FILENAME = {
   summary: "summary.md",
@@ -12224,7 +14268,7 @@ var SqliteSearchIndex = class {
   removeSessionStmt;
   totalStmt;
   constructor(dbPath) {
-    fs15.mkdirSync(path17.dirname(dbPath), { recursive: true });
+    fs18.mkdirSync(path22.dirname(dbPath), { recursive: true });
     this.db = new Database2(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("synchronous = NORMAL");
@@ -12329,14 +14373,14 @@ function indexSessionDirectory(idx, args) {
   let docsWritten = 0;
   for (const kind of kinds) {
     const fileName = FILE_KIND_TO_FILENAME[kind];
-    const filePath = path17.join(args.sessionDir, fileName);
-    if (!fs15.existsSync(filePath)) continue;
-    let body = fs15.readFileSync(filePath, "utf8");
+    const filePath = path22.join(args.sessionDir, fileName);
+    if (!fs18.existsSync(filePath)) continue;
+    let body = fs18.readFileSync(filePath, "utf8");
     if (Buffer.byteLength(body, "utf8") > cap) {
       body = body.slice(0, cap) + "\n\n[TRUNCATED]";
     }
-    const stat = fs15.statSync(filePath);
-    const relPath = path17.relative(args.projectPath, filePath).replaceAll("\\", "/");
+    const stat = fs18.statSync(filePath);
+    const relPath = path22.relative(args.projectPath, filePath).replaceAll("\\", "/");
     idx.upsertSessionDoc({
       sessionId: args.sessionId,
       archived: args.archived,
@@ -12351,17 +14395,17 @@ function indexSessionDirectory(idx, args) {
 }
 function reindexFromArchive(projectPath, opts = {}) {
   const start = Date.now();
-  const archiveBase = path17.join(projectPath, ".harness", "archive", "sessions");
+  const archiveBase = path22.join(projectPath, ".harness", "archive", "sessions");
   const idx = openSearchIndex(projectPath);
   try {
     idx.resetArchived();
     let sessionsIndexed = 0;
     let docsWritten = 0;
-    if (fs15.existsSync(archiveBase)) {
-      const entries = fs15.readdirSync(archiveBase, { withFileTypes: true });
+    if (fs18.existsSync(archiveBase)) {
+      const entries = fs18.readdirSync(archiveBase, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const sessionDir = path17.join(archiveBase, entry.name);
+        const sessionDir = path22.join(archiveBase, entry.name);
         const result = indexSessionDirectory(idx, {
           sessionId: entry.name,
           sessionDir,
@@ -12381,12 +14425,12 @@ function reindexFromArchive(projectPath, opts = {}) {
 }
 
 // src/sessions/summarize.ts
-import * as fs16 from "fs";
-import * as path18 from "path";
+import * as fs19 from "fs";
+import * as path23 from "path";
 import {
   SessionSummarySchema
 } from "@harness-engineering/types";
-import { Ok as Ok23, Err as Err20 } from "@harness-engineering/types";
+import { Ok as Ok24, Err as Err21 } from "@harness-engineering/types";
 var LLM_SUMMARY_FILE = "llm-summary.md";
 var SUMMARY_INPUT_FILES = [
   { filename: "summary.md", kind: "summary" },
@@ -12412,10 +14456,10 @@ var USER_PROMPT_PREAMBLE = `Below are the archived files for a single harness-en
 function readInputCorpus(archiveDir) {
   const parts = [];
   for (const { filename, kind } of SUMMARY_INPUT_FILES) {
-    const p = path18.join(archiveDir, filename);
-    if (!fs16.existsSync(p)) continue;
+    const p = path23.join(archiveDir, filename);
+    if (!fs19.existsSync(p)) continue;
     try {
-      const content = fs16.readFileSync(p, "utf8");
+      const content = fs19.readFileSync(p, "utf8");
       if (content.trim().length === 0) continue;
       parts.push(`## FILE: ${kind}
 
@@ -12466,7 +14510,7 @@ function renderLlmSummaryMarkdown(summary, meta) {
   return lines.join("\n");
 }
 function writeStubMarkdown(archiveDir, reason) {
-  const filePath = path18.join(archiveDir, LLM_SUMMARY_FILE);
+  const filePath = path23.join(archiveDir, LLM_SUMMARY_FILE);
   const body = `---
 generatedAt: ${(/* @__PURE__ */ new Date()).toISOString()}
 schemaVersion: 1
@@ -12477,17 +14521,17 @@ status: failed
 
 - reason: ${reason}
 `;
-  fs16.writeFileSync(filePath, body, "utf8");
+  fs19.writeFileSync(filePath, body, "utf8");
   return filePath;
 }
 async function summarizeArchivedSession(ctx) {
   const writeStubOnError = ctx.writeStubOnError ?? true;
-  if (!fs16.existsSync(ctx.archiveDir)) {
-    return Err20(new Error(`archive directory not found: ${ctx.archiveDir}`));
+  if (!fs19.existsSync(ctx.archiveDir)) {
+    return Err21(new Error(`archive directory not found: ${ctx.archiveDir}`));
   }
   const corpus = readInputCorpus(ctx.archiveDir);
   if (corpus.trim().length === 0) {
-    return Err20(new Error(`no summary input files found in ${ctx.archiveDir}`));
+    return Err21(new Error(`no summary input files found in ${ctx.archiveDir}`));
   }
   const inputBudgetTokens = ctx.config?.inputBudgetTokens ?? DEFAULT_INPUT_BUDGET_TOKENS;
   const truncated = truncateForBudget(corpus, inputBudgetTokens);
@@ -12520,7 +14564,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return Err20(
+    return Err21(
       new Error(`session summary failed: ${reason}` + (stubPath ? ` (stub: ${stubPath})` : ""))
     );
   }
@@ -12534,7 +14578,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return Err20(new Error(reason));
+    return Err21(new Error(reason));
   }
   const meta = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -12543,10 +14587,10 @@ async function summarizeArchivedSession(ctx) {
     outputTokens: response.tokenUsage.outputTokens,
     schemaVersion: 1
   };
-  const filePath = path18.join(ctx.archiveDir, LLM_SUMMARY_FILE);
+  const filePath = path23.join(ctx.archiveDir, LLM_SUMMARY_FILE);
   const body = renderLlmSummaryMarkdown(parsed.data, meta);
-  fs16.writeFileSync(filePath, body, "utf8");
-  return Ok23({ summary: parsed.data, meta, filePath });
+  fs19.writeFileSync(filePath, body, "utf8");
+  return Ok24({ summary: parsed.data, meta, filePath });
 }
 function isSummaryEnabled(config) {
   if (!config) return false;
@@ -12622,8 +14666,11 @@ function buildArchiveHooks(opts) {
 }
 export {
   AnalysisArchive,
+  BUILT_IN_TASKS,
   BackendRouter,
   ClaimManager,
+  GateNotReadyError,
+  GateRunError,
   InteractionQueue,
   LinearGraphQLStub,
   MAX_ATTEMPTS,
@@ -12632,6 +14679,7 @@ export {
   Orchestrator,
   OrchestratorBackendFactory,
   PRDetector,
+  PromotionError,
   PromptRenderer,
   RETRY_DELAYS_MS,
   RoadmapTrackerAdapter,
@@ -12640,6 +14688,7 @@ export {
   SlackSink,
   SqliteSearchIndex,
   StreamRecorder,
+  TaskOutputStore,
   TokenStore,
   WebhookQueue,
   WorkflowLoader,
@@ -12653,7 +14702,13 @@ export {
   computeRateLimitDelay,
   createBackend,
   createEmptyState,
+  crossFieldRoutingIssues,
   detectScopeTier,
+  discoverSkillCatalog,
+  discoverSkillCatalogNames,
+  emitProposalApproved,
+  emitProposalCreated,
+  emitProposalRejected,
   extractHighlights,
   extractTitlePrefix,
   getAvailableSlots,
@@ -12667,6 +14722,7 @@ export {
   migrateAgentConfig,
   normalizeFts5Query,
   openSearchIndex,
+  promote,
   reconcile,
   reindexFromArchive,
   renderAnalysisComment,
@@ -12675,6 +14731,8 @@ export {
   resolveEscalationConfig,
   resolveOrchestratorId,
   routeIssue,
+  routingWarnings,
+  runGate,
   savePublishedIndex,
   searchIndexPath,
   selectCandidates,
@@ -12683,6 +14741,7 @@ export {
   syncMain,
   triageIssue,
   truncateForBudget,
+  validateCustomTasks,
   validateWorkflowConfig,
   wireNotificationSinks,
   wrapAsEnvelope